New Zealand PM : GCSB to access some metadata under law

Prime Minister John Key has clarified that the GCSB will be able to access some email metadata - such as viruses - but won't record other details.
The government's spy agency won't be allowed to trawl through New Zealanders' emails, but it will have the power to check for viruses or other security threats in emails to big Kiwi companies.
Prime Minister John Key has given some clarity to what "metadata" the Government Communications Security Bureau will be able to access under new powers in a controversial bill, and is promising his speech at its third reading - which could take place on Wednesday or Thursday - will give further clarity on the metadata issue.
The bill enables government departments and large companies of national significance to seek the GCSB's help with cyber-security protection, which will require a warrant, signed by the prime minister and the commissioner of security warrants.
Mr Key says the cyber-security function is to "protect" information, rather than accessing content.
He says the GCSB will be able to look at some email metadata, but that will not include addresses, the times emails were sent or received, or their content.
"Essentially it flows through a filter, and as it flows through that filter, it doesn't record for anything other than a hundredth of a second," he told media.
"It's looking for the viruses which are coming into the system - it's not looking at content, it's not looking at who sent the email, it's simply looking for the viruses and we don't record ... where the emails came from, who got them, any of that sort of stuff."
It is not clear whether the filter will also pick up keywords.
Mr Key is categorically ruling out "wholesale surveillance" of emails.
In cases where the GCSB wants to access the content of New Zealanders' emails, Mr Key expects the agency to apply for very specific warrants, and seek the New Zealander's consent, unless there are very good reasons not to.
Parliament's intelligence and security committee will be able to see what type of warrants are being signed off and ask questions about those.
The bill's most controversial provision makes it legal for the GCSB to spy on New Zealanders on behalf of the SIS, Defence Force and police, if they have a warrant.

EU Cyber Security major outage incidents 2012 ENISA Report

The European Union Agency for Network and Information Security (ENISA) released its report that provides an overview of the process and an aggregated analysis of the 79 incident reports of severe outages of electronic communication networks or services which were reported by national regulators during 2012.
Below a summary of some of the conclusions that can be drawn from the ENISA  incident reports;

• 18 countries reported 79 significant incidents, 9 countries reported no significant incidents.
•  Most incidents affected mobile telephony or mobile Internet (about 50 % of the incidents respectively). Incidents affecting mobile telephony or mobile Internet also affected most users (around 1,8 million users per incident). This is consistent with the high penetration rate of mobile telephony and mobile Internet.
•  In 37 % of the incidents there was an impact on the emergency number 112.
•  For most incident reports the root cause was “System failures” (75 % of the incidents). This was the most common root cause category also for each of the four services (fixed and mobile telephony and fixed and mobile Internet). In the category “System failures”, hardware failures were the most common cause, followed by software bugs. The assets most often affected by system failures were switches (e.g. routers and local exchange points) and home location registers.
• Incidents categorized with root cause third party failures, mostly power supply failures, affected around 2.8 Million users on average. Incidents involving the detailed cause overload affected around 9.4 million users on average.
•  Incidents caused by natural phenomena (mainly storms and heavy snowfall) lasted the longest: around 36 hours on average.
• Incidents caused by overload followed by power failures respectively had most impact in terms of number of users affected times duration.
• Overall, switches and home location registers were the network components or assets most affected by incidents.

ENISA publishes an annual report, to provide industry and government bodies in the EU with data about the annual summary reporting. The next annual report will be published in summer 2014, covering incidents that occurred in 2013.