New Zealand PM : GCSB to access some metadata under law

Prime Minister John Key has clarified that the GCSB will be able to access some email metadata - such as viruses - but won't record other details.
The government's spy agency won't be allowed to trawl through New Zealanders' emails, but it will have the power to check for viruses or other security threats in emails to big Kiwi companies.
Prime Minister John Key has given some clarity to what "metadata" the Government Communications Security Bureau will be able to access under new powers in a controversial bill, and is promising his speech at its third reading - which could take place on Wednesday or Thursday - will give further clarity on the metadata issue.
The bill enables government departments and large companies of national significance to seek the GCSB's help with cyber-security protection, which will require a warrant, signed by the prime minister and the commissioner of security warrants.
Mr Key says the cyber-security function is to "protect" information, rather than accessing content.
He says the GCSB will be able to look at some email metadata, but that will not include addresses, the times emails were sent or received, or their content.
"Essentially it flows through a filter, and as it flows through that filter, it doesn't record for anything other than a hundredth of a second," he told media.
"It's looking for the viruses which are coming into the system - it's not looking at content, it's not looking at who sent the email, it's simply looking for the viruses and we don't record ... where the emails came from, who got them, any of that sort of stuff."
It is not clear whether the filter will also pick up keywords.
Mr Key is categorically ruling out "wholesale surveillance" of emails.
In cases where the GCSB wants to access the content of New Zealanders' emails, Mr Key expects the agency to apply for very specific warrants, and seek the New Zealander's consent, unless there are very good reasons not to.
Parliament's intelligence and security committee will be able to see what type of warrants are being signed off and ask questions about those.
The bill's most controversial provision makes it legal for the GCSB to spy on New Zealanders on behalf of the SIS, Defence Force and police, if they have a warrant.

EU Cyber Security major outage incidents 2012 ENISA Report

The European Union Agency for Network and Information Security (ENISA) released its report that provides an overview of the process and an aggregated analysis of the 79 incident reports of severe outages of electronic communication networks or services which were reported by national regulators during 2012.
Below a summary of some of the conclusions that can be drawn from the ENISA  incident reports;

• 18 countries reported 79 significant incidents, 9 countries reported no significant incidents.
•  Most incidents affected mobile telephony or mobile Internet (about 50 % of the incidents respectively). Incidents affecting mobile telephony or mobile Internet also affected most users (around 1,8 million users per incident). This is consistent with the high penetration rate of mobile telephony and mobile Internet.
•  In 37 % of the incidents there was an impact on the emergency number 112.
•  For most incident reports the root cause was “System failures” (75 % of the incidents). This was the most common root cause category also for each of the four services (fixed and mobile telephony and fixed and mobile Internet). In the category “System failures”, hardware failures were the most common cause, followed by software bugs. The assets most often affected by system failures were switches (e.g. routers and local exchange points) and home location registers.
• Incidents categorized with root cause third party failures, mostly power supply failures, affected around 2.8 Million users on average. Incidents involving the detailed cause overload affected around 9.4 million users on average.
•  Incidents caused by natural phenomena (mainly storms and heavy snowfall) lasted the longest: around 36 hours on average.
• Incidents caused by overload followed by power failures respectively had most impact in terms of number of users affected times duration.
• Overall, switches and home location registers were the network components or assets most affected by incidents.

ENISA publishes an annual report, to provide industry and government bodies in the EU with data about the annual summary reporting. The next annual report will be published in summer 2014, covering incidents that occurred in 2013.
 

British authorities destroyed Guardian Hard Disks

The Guardian newspaper's editor says British authorities destroyed an unspecified number of its hard drives in an apparent attempt to keep secrets leaked by former National Security Agency contractor Edward Snowden from Chinese spies.
Alan Rusbridger made the claim in an opinion piece published Monday on the Guardian's website, saying that a pair of staffers from British eavesdropping agency GCHQ monitored the process in what he called "one of the more bizarre moments in the Guardian's long history."
He said the hard drives were torn apart in the basement of the Guardian's north London office with "two GCHQ security experts overseeing the destruction ... just to make sure there was nothing in the mangled bits of metal which could possibly be of any interest to passing Chinese agents."
It was not clear exactly when the incident occurred. Rusbridger gave a vague timeline, suggesting that it happened within the past month or so. Guardian spokesman Gennady Kolker declined to comment further, and messages left with GCHQ after working hours were not immediately returned. An operator at the intelligence agency's switchboard said no one was available until Tuesday.
Rusbridger said the destruction was the culmination of weeks of pressure on the Guardian by British officials.
Shortly after his paper began publishing reports based on Snowden's leaks, he said he was contacted by "a very senior government official claiming to represent the views of the prime minister" who demanded the return or destruction of Snowden's material. There followed a series of increasingly tough meetings in which officials demanded the Guardian comply.
Eventually, he said, officials threatened legal action, and that's when the editor allowed British agents into his basement.
A spokesman for British Prime Minister David Cameron declined comment.
Rusbridger said the destruction wouldn't curb the Guardian's reporting, suggesting that copies of the Snowden files were held elsewhere and that reporting would continue outside the U.K. He added that British police's recent detention of David Miranda the partner of Guardian reporter Glenn Greenwald and the seizure of the former's laptop, phones, and other devices would similarly have no effect on Greenwald's work.
Snowden's leaks published in the Guardian, The Washington Post, and other publications have exposed the details of the United States' global surveillance apparatus, sparking an international debate over the limits of American spying. And as lawmakers debate reforms and civil liberties group go to court, journalists have been wrestling with the implications of mass surveillance.
Rusbridger said Monday that the spies were growing so powerful "it may not be long before it will be impossible for journalists to have confidential sources."
Meanwhile, G29, an umbrella organization that includes data protection agencies across Europe, said Monday it wrote EU Justice Commissioner Viviane Reding last week to demand details on the extent of U.S. surveillance efforts in the wake of the leaks.
The organization said in a statement it is demanding "specifics regarding the exact nature of the data collected" by PRISM, and details on how U.S. authorities access Europeans' data and the recourse EU citizens have.
The National Security Agency's PRISM operation compels major Internet firms to hand over detailed contents of communications such as emails, video chats and more.
Germany's independent privacy watchdogs say the surveillance programs breach an EU-U.S. pact meant to ensure cross-border data protection.

Google 'pay per gaze' advertising looks to log user emotions via Glass

Google has been granted patents for a device that could monitor users' eyes and emotional reactions in order to deliver accurate advertising campaign analytics.
The patents, which Google applied for in 2011, show images of a Google Glass-style headset, which would keep track of users' eye movements. It describes the idea as a "gaze-tracking device that communicates with a server", which in turn keeps track of what the user looks at, creating a "gazing log" for advertisers.
In addition, the patent discusses going even further with the technology, introducing the idea of a sensor that keeps track of pupil dilation in order to judge the effectiveness of ad campaigns. "For example, if the advertiser desires to generate a shocking advertisement to get noticed or a thought-provoking advertisement, then the inferred emotional state information and/or the gazing duration may be valuable metrics to determine the success of the campaign with real-world consumers," the patent notes.
The patent document notes that privacy would be taken into account. "Personal identifying data may be removed from the data and provided to the advertisers as anonymous analytics," it said.
"In one embodiment, users may be given opt-in or opt-out privileges to control the type of data being gathered, when the data is being gathered, or how the gathered data may be used or with whom it may be shared."
A business model behind the technology was also outlined, suggesting that the price of each gaze could change depending on the level of interaction. "[An] additional feature of a pay-per-gaze advertising scheme may include setting billing thresholds or scaling billing fees dependent upon whether the user looked directly at a given advertisement item, viewed the given advertisement item for one or more specified durations, and/or the inferred emotional state of the user while viewing a particular advertisement."

While the patent does not refer to Google's augmented reality Glass headwear, the images show head-mounted hardware, which looks remarkably similar to Glass, suggesting that future iterations of the gadget could include this technology.
Glass has provoked ire from both privacy bodies and government departments, with the UK's Department for Transport admitting it was looking to ban the use of Glass while driving before the device arrives in the UK.

Making The World Unsafe For GPS Jammers

The U.S. is building and testing more compact GPS anti-jamming systems for smaller (as small as 200 kg/440 pounds) UAVs.
This is part of a program to equip all American UAVs, even the smallest ones, with more secure GPS. While all UAVs can be “flown” by the operator the GPS makes it a lot easier for the operator to keep track of exactly where his UAV is at all times and sometimes the UAV is programmed to simply patrol between a series of GPS coordinates.
If the GPS jams or fails the operator can usually use the video feed to find landmarks on the ground and bring the UAV back to where it can be seen and landed.
While American troops have not yet encountered much (if any) battlefield jamming, the threat exists. The most tangible threat is from North Korea, which has long made, sold and itself used GPS jammers. Last year North Korea attacked South Korea with a massive GPS jamming campaign. The jamming began in late April, 2012 and continued for over two weeks. It took about a day for South Korea to confirm that the signal was coming from North Korea and was mainly aimed at the South Korean capital (Seoul). The jamming had little impact inside the city itself (the ground based jamming signal was blocked by buildings and hills) and was only noted by several hundred aircraft landing or taking off from local airports and over a hundred ships operating off the coast. In all these cases the ships and aircraft had backup navigation systems, which were switched on when GPS became unreliable. This is how navigation systems, especially those that rely on an external (satellite) signal are designed.
This is the third time North Korea has used GPS jamming against South Korea. For most of March, 2011, North Korea directed a GPS jamming signal across the border towards Seoul. A separate jammer has been directed at cell phone traffic. The GPS jamming signal could be detected up to a hundred kilometers south of the DMZ.
The usual response to GPS jamming is to bomb the jammers, which are easy to find (jamming is nothing more than broadcasting a more powerful version of the frequency you want to interfere with). But such a response could lead to more fighting in Korea, so the south protested and refrained from responding with force. The jamming is a nuisance more than a threat and most military equipment is equipped with electronics and other enhancements to defeat it. The North Korean jamming confirmed what was already suspected of them. So now, South Korean and American electronic warfare experts have an opportunity to study the effects of jamming on a large metropolitan area. It is causing intermittent problems for users of GPS devices and many more cell phone connectivity problems. There were briefer and less powerful jamming incidents in August and December of 2010.
Meanwhile, this is old news for the U.S. Department of Defense which has spent most of the last two decades developing anti-GPS jamming technology. For years military aircraft have been equipped with complex and expensive GPS receivers that will usually continue to work even if they are being jammed. There are several ways you can defeat attempts to jam GPS signals. While some of the methods are well known, others are classified. No one has successfully used GPS jammers in combat yet but the potential is there. Now the North Koreans are giving large scale demonstration of GPS jamming.
Anti-jamming technology is more complex. None of the major players (the U.S., Russia, China, Israel, and several other industrialized countries) are talking and for good reason. If you don't know what techniques the other guys are using, you can't deal with them.
China and Russia are both selling GPS jammers. Six years ago China brought to market a powerful, truck mounted, GPS jamming system. These "GPS jamming vans" are meant to create a protective "bubble" over an area the van is in the middle of. Sales have been slow.
A year before the 2003, invasion of Iraq, it was believed that Saddam had bought many GPS jammers, to deal with U.S. JDAM GPS smart bombs. The JDAM has a backup inertial guidance system, so that if the GPS signal is jammed the less accurate inertial guidance system takes over. The inertial guidance (INS) will land the bomb within 30 meters (92 feet) of the target while GPS gets to within 10 meters (31 feet). The U.S. Air Force does not discuss what, if any, jam-proofing it is doing for its JDAM bombs. The Iraqi GPS jamming efforts had no significant effect on the 2003, campaign.
There are several approaches to defeating GPS jamming, and knowing which one each American GPS guided weapon uses makes it easy to develop a way to jam the "jam-proof" GPS. So the U.S. Air Force is understandably reluctant to discuss what they are doing. Given the cost of jam proofing all existing GPS weapons, it's more likely that jam-proof GPS weapons will only be used against targets where the GPS accuracy is vital. Against most targets the accuracy provided by the inertial guidance system will do. Also note that you can bomb GPS jammers with a bomb equipped with a guidance system that homes in on a GPS jamming signal. For that reason it's thought that any use of GPS jammers will involve dozens of jammers in each area so protected. The GPS jamming has no effect on the even more accurate laser guided bombs, and some countries buy smart bombs with both laser and GPS/INS systems.