The CyberWire Daily Briefing for 6.13.2013

Cyber Attacks, Threats, and Vulnerabilities

Google detects Iran phishing attacks ahead of election (BBC) Google says it has detected and stopped thousands of phishing attacks targeting email accounts of Iranian users ahead of the 14 June presidential election

Gmail accounts in Iran hacked, says Google (The Guardian) The company's security chief says it has blocked a 'politically motivated' phishing attack on tens of thousands of users in the lead-up to the presidential election

Anonymous warn Greek government of cyber-attack after ERT's shutdown (euronews) Hacktivist group Anonymous posted a video on YouTube warning the Greek government of their intention to launch a cyber-attack on state websites beginning on June 15th in retaliation to the shutdown of public broadcaster ERT and the dismissal of more

IOL comes under cyber attack (Independent Online) Independent Newspapers today came under attack from an organisation that claimed it did it because of the media group's alleged support of Zimbabwean leader Robert Mugabe. The attack led to Independent Newspaper's internet and e-mail systems going

127 Israeli Website Hacked by Indonesian Hackers (Hack Read) A group of Indonesian hackers from Biang Kerox Team have hacked and defaced 127+ Israeli based websites. Team left their deface page along with a message on hacked websites, yet reason for hacking sites was not mentioned, according to the deface message: Biang Kerox Team Was Here! Sultan Haikal, Prof Lang Ling Lund, AntonKill, Xevil BHC, Biang Kerox Team- All Indonesia Hacker. All sites were hacked

Swaziland's United Nation and United Nation Development Programme Websites Hacked by Group Hp Hack (Hack Read) A Saudi hacker going with the handle of Dr.TaiGar from Group Hp Hack has hacked and defaced the official websites of United Nation and United Nation Development Programme designated for the Kingdom of Swaziland. Group Hp Hack seems connected to well known hacker DrSHA6H left a deface page, a written message along with a Youtube video on both hacked sites, criticizing the role of UN, US and Arab countries

Breach at Lucile Packard Children's Hospital Potentially Affects 12,900 Patients (eSecurity Planet) A password-protected laptop was stolen from a secured area of the hospital

RARSTONE Found In Targeted Attacks (TrendLabs Security Intelligence Blog) Earlier in February we blogged about RARSTONE, a Remote Access Tool (RAT) that we discovered having some similar characteristics to PlugX, an older and more well-known RAT. In April, the same malware family used the Boston Marathon bombing as part of its social engineering bait

Features Conspire to Connect iPhones to Rogue Networks (Threatpost) A convenience feature native to iOS combined with a directory of carrier-specific SSID preloaded onto iPhones could lead to some devices automatically connecting to rogue networks spoofing a legitimate Wi-Fi access points

Rogue ads lead to SafeMonitorApp Potentially Unwanted Application (PUA) (Webroot Threat Blog) Our sensors just picked up yet another rogue ad enticing users into installing the SafeMonitorApp, a potentially unwanted application (PUA) that socially engineers users into giving away their privacy through deceptive advertising of the rogue application's "features"

New WordPress 3.5.1 vulnerability affects protected pages (Digital Journal) A zero-day vulnerability found in WordPress may have been released to the public prematurely. The following includes vulnerability details, plus the researcher's response to questions about the public release

Vanity Scam Strokes Egos to Steal Info (TechNewsDaily) The "Top 100 Executives" scam, as revealed on the anti-virus firm Bitdefender's HotforSecurity blog, lures professionals into parting with personal information, such as phone numbers, email addresses and job titles, by appealing to the executives' vanity

It Is More Than Metadata - The Meaning Behind The Mining (Big Men on Content) I am asked on a regular basis, "what do you do for a living" and I resorted long ago to just saying I work with computers. Most are just being polite and they really do not want to know any more than that. Every once in a while though my real job will pop up in common culture in the form of a single word or concept and suddenly what I do has relevance

Metadata is powerful content (FierceContentManagement) Who would have thought that in one week we would actually see the term metadata enter the mainstream lexicon, but that's what happened when NSA whistleblower Edward Snowden blew the lid off of a secret FISA court order that enables the NSA to mine all of the metadata related to phone calls from a division of Verizon (NYSE: VZ)

Security Patches, Mitigations, and Software Updates

BlackBerry Issues Z10, Playbook Secruity Advisories (Threatpost) BlackBerry's security incident response team has issued two advisories warning Z10 smartphone and PlayBook tablet users to upgrade to the latest version of the operating system and software on both platforms. The patches address a remote code-execution vulnerability in the Adobe Flash Player integrated into the BlackBerry products, as well as a privilege escalation flaw in the BlackBerry OS

Light June 2013 Patch Tuesday is No Reason to Slack (TrendLabs Security Intelligence Blog) Microsoft releases five security bulletins for June 2013, which is relatively light compared to previous ones. Despite this, users must update their systems immediately, to avoid possible web threats leveraging software vulnerabilities

Cyber Trends

Leaks in a Big Data Age (Bloomberg) A very large Internet company once had the noble impulse to share some of its data with the research community. It made three months of log files from its search service available to all. The company took many steps to preserve privacy, removing personal information and randomizing ID numbers in the belief that this would make it impossible to identify any of the more than 650,000 customers who'd used the service. But Internet hobbyists, professional researchers, and journalists were able to ferret out many of the users. No. 4417749, for example, was a Georgia widow. Another user appeared to be planning a murder. Today, the AOL Search Log Scandal is remembered as one of the weirdest missteps in Internet history

NSA chief warns U.S. unprepared for cyber attack (Examiner.com) With some 90 percent of the nation's critical infrastructure owned by the private sector, it is no surprise that National Security Agency chief General Keith Alexander said on Wednesday that America is ill-prepared to handle a cyber attack

'Cyber-terror is growing threat' to under-defended infrastructure systems (The Times of Israel) The online world is a mystery to many people, especially adults, according to Eugene Kaspersky, head of the anti-virus and cyber protection firm that bears his name. "We're all immigrants in the new world of cyberspace," Kaspersky said at a roundtable

NSA Leak Ushers In New Era Of The Insider Threat (Dark Reading) A determined user or contractor hell-bent on leaking data can't be stopped, but businesses should revisit their user access policies and protections. If the National Security Agency (NSA) can't stop sensitive data leaks out of its organization, who can? That's the question dogging many enterprises in the wake of revelations that a former technical assistant at the CIA and then contractor for NSA siphoned and leaked classified data about an alleged secretive surveillance program being conducted by the NSA that mines Internet firms' data from their servers. Edward Snowden dropped the bombshell, including slides from an NSA PowerPoint on the so-called NSA PRISM program, before being fired by NSA contractor Booz-Allen Hamilton this week after admitting he was a source of the leaks

Tech Hiring Binge May Pose Security Risks For Government (USA Today) The Pentagon and the intelligence community are both ramping up cyber capabilities in the face of repeated attacks on U.S. companies from China and elsewhere and concerns about how terrorists use technology to communicate and raise money. The Snowden case raises questions about whether the government has opened itself to security breaches in its rush to hire computer experts

The Most Dangerous Countries for Computer Attacks (Bloomberg) China and the U.S. may dominate the headlines when it comes to hacker attacks, but countries in the developing world are the most vulnerable to online assaults, according to a study by Kaspersky Lab, one of the top makers of security software

Retail Privacy Policies Need To Focus On How The Data Is Used Rather Than Just What Is Collected (StoreFrontBackTalk) Privacy policies, if written well, explain to customers exactly what data you are going to collect, and what you are going to do with it. Problem is, most retailers have no idea what data they are collecting, or what they are going to do with it. As a result, retailers end up writing privacy policies that are either false or misleading, and this can lead to big legal problems. In fact, it may be better to have a policy that says either "we have no idea what we are collecting and what we will do with it" or "we will collect everything we can and use it in any way we want." But that's not good public relations, writes Legal Columnist Mark Rasch

SMBs see benefits from the cloud for security and availability (SC Magazine UK) Microsoft has also released an updated version of its Cloud Security Readiness Tool (CSRT), based on the Cloud Security Alliance's Cloud Controls Matrix, which enables organisations to assess the current state of the security of their IT environment

UK banks fear cyber-attack more than euro crisis (PC Pro) The UK's top banks see cyber-attacks as a greater risk to their businesses than the European debt crisis, according to Bank of England officials. Global cyber crime in the financial sector has become a more pressing worry, underlined by a series of

UK cloud users more positive about security (ComputerWeekly) "Organisations are keen to understand how cloud adoption would compare with their existing on-premises policies, procedures and compliance, and that can be a complex task," said John Howie, chief operating officer, Cloud Security Alliance (CSA)

SC Congress Canada: Nation continues as growing breeding ground for malware (SC Magazine) Attackers are targeting Canada with increasing ferocity due to the country's IT infrastructure that make it a ripe launching pad for attacks, a panel of experts said Tuesday at the annual SC Congress Canada in Toronto. In the first quarter of 2013, researchers saw an 83 percent increase in the number of command-and-control servers in the country that were used to operate botnets of infected computers, according to data revealed at the panel

MDM is 'table stakes' for security in the BYOD space, says Symantec chief (FierceMobileIT) Mobile device management is "table stakes" for security in the BYOD space, commented Steve Bennett, president and CEO of Symantec (NASDAQ: SYMC), during his keynote discussion at the Gartner Security and Risk Management summit being held here this week

BYOD to spur 8.7 percent growth in security market, predicts Gartner (FierceMobileIT) The BYOD trend is having a far-reaching influence on the entire security industry, according to research released on Tuesday by Gartner at its security summit

Enterprises make the move to custom-built apps, app stores (FierceMobileIT) Enterprises are moving away from publicly available apps and public app stores in favor of apps that are custom-built for their needs and internal app stores to distribute those apps securely

Companies Should Expect More Cyberattacks (Wall Street Journal (video)) Mandiant CEO Kevin Mandia, in an interview with The Wall Street Journal, says companies should expect and be preparing for more cyber attacks from China and elsewhere

Marketplace

DISA Set to Buy Mobile Device Manager (ExecutiveGov) The Defense Information Systems Agency says it will soon acquire a mobile device management system from an unnamed contractor, Defense Systems reported Monday

CSIS notes shortcomings of federal spending transparency efforts (FierceGovernment) Federal spending data systems have improved in recent years but still come up short in their efforts to fully inform the public on government spending, says a June 6 brief from the Center for Strategic and International Studies

Hagel calls on Congress to stop sequestration cuts for 2014 (FierceGovernment) For the military to get back to an acceptable readiness level, Congress must stop sequestration cuts, Defense Secretary Chuck Hagel said while defending President Obama's fiscal 2014, $526.6 billion DoD budget request during a June 11 Senate Appropriations subcommittee on defense hearing

An Open (Of Course) Letter to My Friend, the NSA (Zócalo Public Square) Sorry, But It's Really Tough Nowadays To Hire a Non-Leaking Hacker. Dear NSA, We need to have a chat, so I trust you're reading this. Of course you are; good. Now, let's see…how should I put this? Look, you've done a great job cultivating that whole "spook" image for the past 60 years. Really, you've just been terrifyingly adept at creating an environment of ironclad secrecy, even more so than the CIA, who've bungled too many overseas jobs to be the

Top-Secret Crate Packers Among Legions Hired With Leaker (Bloomberg) To the growing list of U.S. jobs that require Top Secret clearances add this one: packing and crating. A June 2 job posting on the website of CACI International Inc. (CACI) (CACI), a government contractor that works for the Defense Department and intelligence agencies, seeks a full-time "packer/crater" to prepare products such as "chillers, generators, boats and vehicles" for shipping

John Thomas Named Leidos Strategic Development EVP (GovConWire) John Thomas, previously acting national security sector president at Science Applications International Corp. (NYSE: SAI), has been appointed executive vice president of strategic development at Leidos

Sir Roger Carr to Serve as BAE Systems Non-Executive Director and Chairman (GovConWire) Sir Roger Martyn Carr will join the BAE Systems board as non-executive director and chairman designate, effective October 1, 2013

Top Booz Allen Execs Go Public, Avoid Mentioning the S-Word (Wall Street Journal) Government contractor Booz Allen Hamilton has been the subject of intense media attention after its role in intelligence programs was highlighted by leaks from a former employee. But you wouldn't know it from a presentation made by the the company's

Booz Allen Estimate Lowered by Susquehanna on Contract Risks (Bloomberg) Intelligence agencies may "freeze" certain Booz Allen Hamilton Holding Corp. projects while they review its handling of classified information after an employee revealed a secret U.S. electronic surveillance program, according to Susquehanna Financial Group

FT: Government Secrecy and Classified Information Is Often Outsourced (Moneynews) Edward Snowden, the man who leaked the information about the surveillance programs, worked at the National Security Agency (NSA) as an employee of Booz Allen Hamilton, one of the largest private contractors for U.S. intelligence agencies. The firm

The (profitable) business of intelligence gathering (San Francisco Chronicle) That would be Booz Allen Hamilton, which this column featured back in October 2011 when the company announced the expansion of its San Francisco presence to keep up with its work in a variety of fields, including cyber security. Who knew that 25

Spy stoppers: meet the companies benefiting from the PRISM privacy scare (The Verge) The world is still reeling from the leaked details of the NSA's PRISM program, reported to give the government's top spies access to personal user data collected by Google, Apple, Microsoft, and other services. But while the mainstream is fighting over

Content Security Firm Content Raven Raises $2 Million (SecurityWeek) Content Raven, a Marlborough, Massachusetts-based company that helps customers control and secure content and intellectual property distributed externally, today announced that it secured $2 million in a Series A round, led by Mass Ventures

FireHost Snags $12 Million Expand its Secure Cloud Hosting Business (SecurityWeek) FireHost, a Dallas-based cloud hosting provider that has made security the focus of its offerings, today announced that it has raised $12 million in a Series D funding round

Products, Services, and Solutions

Want Protection? Orange France Makes Security Fundamental (Lookout) Orange believes security should be fundamental to the mobile experience, that's why they're helping to make this one of the first apps on peoples' phones. Now, Orange France customers who purchase Oragami Jet or Open Jet plans or "case and flight" insurance, will have Lookout Premium included. Lookout will also be pre-loaded on a number of Orange France Android devices. People protect their phone through insurance. It makes sense that they also insure the security, privacy and loss of the device through mobile security offering like Lookout. Lookout's free app will also be pre-installed on many Orange France Android devices

LockPath launches auditing tool (Help Net Security) LockPath released Audit Manager as part of the latest version of its Keylight platform, which enhances the end-to-end internal audit process

Review: Vulnerability scanning with PureCloud (Help Net Security) nCircle PureCloud is a cloud-based network security scanning product built upon the companies' vulnerability and risk management system IP360. The company was recently acquired by Tripwire

ESET Launches Security Solution for SharePoint Server (Security Week) Security software maker ESET this week launched a new solution designed to protect company data and assets stored on Microsoft SharePoint servers

Broadcom's XLP900 Flagship Processor Packs 80 CPUs (Converge Network Digest) The new flagship processor features end-to-end virtualization, advanced security capabilities such as deep-packet inspection (DPI), and innovative network and application intelligence technology with wire-speed networking and multi-layer QoS capabilities

Dell Cloud Aims for Federal Clients to Meet FedRAMP, NIST Standards (The New New Internet) Dell has launched a new cloud computing portfolio that aims to help federal government customers meet criteria set by the Federal Risk and Authorization Management Program approval process and the National Institute of Standards and Technology

Prevent Account Takeover with RSA Silver Tail 4.0 (RSA) Account Takeover is a significant threat to Financial Institutions today. Man in the Middle (MiM) and Man in the Browser (MiB) attacks were nearly impossible to detect with one solution, until

Adobe Echosign iOS update simplifies electronic signature process (FierceContentManagement) This week, Adobe (NASDAQ: ADBE) announced an update to the iOS version of its EchoSign electronic signature app to make it simpler to undertake electronic signature transactions on iOS devices. Adobe also announced that it was building a new data center specifically for EchoSign data

DuckDuckGo search continues its slow and steady climb (FierceContentManagement) DuckDuckGo, the intrepid little search engine that could, continues to grow at a steady pace, hitting an impressive 2 million unique searches this week

Trend Micro Launches New Web App Security Offering (SecurityWeek) Trend Micro has launched a new security as a service solution that uses automated and expert analysis to help protect web applications. Generically named "Trend Micro Web App Security", the new offering is a service that provides enterprise-grade security with vulnerability detection and protection for web applications and the platforms they are deployed on

Security Suited for the Data Center (SecurityWeek) Better Security Intelligence and Attacker Identification can add an Important New Layer to Protect the Data Center. Perimeter firewalling has you covered like a muumuu on Memaw. While we thank our lucky stars in many ways for Memaw's muumuu, we still feel like Memaw could do better for herself. And so can you when it comes to data center security

A Starter Kit for the Internet of Things (IEEE Spectrum) What good is it for the ordinary machines in your house—thermostats, garage door openers, refrigerators, and more—to become "smart," if the added features go unused? Ayla Networks wants to unlock those features for users by helping manufacturers make them controllable from smartphones

Technologies, Techniques, and Standards

Don't Take Vulnerability Counts At Face Value (Dark Reading) With flaw tallies varying by up to 75 percent, vulnerability data needs to be taken with a grain of salt, yet reports based on the data fail to include caveats, Black Hat presenters say. In 2012, there were 5,291 vulnerabilities documented by security researchers and software firms. Wait, no, make that 8,137. No, 9,184. Well, it could even be 8,168 or 5,281

10 Ways Small Businesses Can Save Money On Security (Dark Reading) Small and midsize businesses have limited IT resources. Here are some ways they can stretch their security dollars. When it comes to technology and company size, many things are relative. The smaller the company, the smaller the need for, say, servers and software licenses. In at least one area, however, all things are not relative: security

4 Tips for Cloud Compliance (eSecurity Planet) Moving data to the cloud can be scary, as you must ensure cloud providers handle it in a way that meets regulatory requirements. Four best practices can help

Stupid Little IPv6 Tricks (Internet Storm Center) With the IPv6 Summit on Friday, various IPv6 related topics are of course on my mind. So I figured to put together a quick laundry list of "stupid little IPv6 tricks/topics". Let me know what issues you are running into as well

Two-Factor Authentication: Something To Consider (TrendLabs Security Intelligence Blog) The past few weeks have seen some very high-profile sites adopt two-factor authentication in one form or another. First was Twitter, followed soon by Evernote and Linkedin. For users of these sites, these represent a welcome improvement to their security. In the event that their password is (somehow) compromised, an attacker faces another barrier before they can gain access

Microsoft criticized for botnet takedown tactics (CSO) Security pros are said to be against any vendor modifying a person's computer without permission, even if the intention is good

Was Microsoft's takedown of Citadel effective? (Naked Security) Last week, Microsoft took aim at more than 1,400 Citadel botnets by sinkholing their command and control infrastructure. What was the actual effect of this takedown? SophosLabs takes a look

PCI's New PIN Rules: A New Document Is Issued To Require You To Create A New Document (StoreFrontBackTalk) When the PCI Security Council issued new rules for PIN transactions on Friday (June 7), beyond the usual small tweaks and updates, there was essentially only one new rule impacting retailers: Device manufacturers need to specify how retailers need to use the devices to stay PCI compliant

SC Congress Canada: CISOs must approach security as a strategy (SC Magazine) To gain the most headway in protecting their organizations from advanced threats, security management must take on a "gatekeeper" approach to defend corporate data, said Jack Danahy, director for North American security consulting and delivery at IBM, who presented a keynote address Tuesday at the annual SC Congress Canada in Toronto

CISO: Banks need to carefully weigh pros, cons of MDM versus MAM (FierceMobileIT) Banks need to carefully weigh the pros and cons of deploying mobile device management versus mobile application management solutions when considering BYOD programs, advised Vas Rajan, chief information security officer at CLS Bank

Johns Hopkins expert talks about NSA's PRISM surveillance program, data mining (Hub) Matthew Green is encryption expert in JHU's Information Security Institute. Matthew Green, an assistant professor in the Department of Computer Science and the Information Security Institute at Johns Hopkins, is an expert in encryption. He spoke with us about PRISM, the top-secret National Security Agency surveillance operation that was first made public late last week by The Washington Post and The Guardian

NSA Leaks Show Low-Level IT Worker as Secrecy's Weak Link (Bloomberg) In the vast, secretive world of U.S. intelligence -- a realm of clandestine agents, voracious supercomputers and eagle-eyed satellites -- the IT guy was the weakest link

Using Metadata to Find Paul Revere (Kieran Healy) I have been asked by my superiors to give a brief demonstration of the surprising effectiveness of even the simplest techniques of the new-fangled Social Networke Analysis in the pursuit of those who would seek to undermine the liberty enjoyed by His Majesty's subjects. This is in connection with the discussion of the role of "metadata" in certain recent events and the assurances of various respectable parties that the government was merely "sifting through this so-called metadata" and that the "information acquired does not include the content of any communications". I will show how we can use this "metadata" to find key persons involved in terrorist groups operating within the Colonies at the present time. I shall also endeavour to show how these methods work in what might be called a relational manner

Research and Development

Quantum dreams may be dead (Fudzilla) Quantum cryptography might not be the security secret weapon that the industry has been hoping for. In theory Quantum cryptography might allow you to encrypt a message in such a way that it would never be read by anyone. But recently methods that were

Computer memory can be read with a flash of light (Nature) Prototype device combines speed and durability. Modern computer-memory technologies come with a trade-off. There is speedy but short-term storage for on-the-fly processing — random-access memory, or RAM — and slow but enduring memory for data and programs that need to be stored long term, typically on a hard disk or flash drive. But a prototype memory device described today in Nature Communications1 combines speed, endurance and low power consumption by uniting electronic storage with a read-out based on the physics that powers solar panels

Academia

HCC awarded cybersecurity certification (Baltimore Sun) Distinction comes from NSA and Homeland Security. Howard Community College has received a national certification that not only highlights its information and cybersecurity programs but will also help provide its students an inside track for careers in the field, according to school officials

Legislation, Policy, and Regulation

Mozilla wants 500M users to tell gov't: "stop watching us" (Ars Technica) Activists hope for an anti-spying coalition reminiscent of anti-SOPA protests. Mozilla wants users to visit Stopwatching.us, a site opposed to government spying online. Hoping to tap into the wave of anti-SOPA Internet activism that flooded Congress last year, Mozilla has joined with a variety of activist groups to found an anti-spying coalition called StopWatching.Us

Forget PRISM: Global Cyberchiefs Say They Need to Pry Even Further (TIME) The exposure of the PRISM data-collection program might not fall squarely under the heading of the third annual International Cyber Security Conference, which concluded on Wednesday at Tel Aviv University. The secret data-collection program, by which U.S. intelligence agencies routinely vacuum up huge amounts of private communications from Internet users, stands outside the realm of safeguarding the cyberworld from attacks. PRISM is defended as an antiterrorism measure, necessary to detect plots as they are hatched between evildoers communicating with one another online

NSA: 'Dozens of attacks' prevented by snooping (The Register) The National Security Agency has defended its slurping of phone records and other business data on the grounds the information contained has helped it fight terrorism. In a congressional hearing on cybersecurity and government surveillance on Tuesday, NSA Director General Keith Alexander said the NSA's data slurping had let it avert terror attacks

Meet Obama's lawyer at the NSA, the next guy about to undergo some serious surveillance (Quartz) Legislators and pundits have been baying for the blood of James Clapper, the Director of National Intelligence, over last week's revelations of wide-ranging NSA surveillance. But the next person on their hit-list could be someone even Washington doesn't know too well. Meet Rajesh [Raj] De, the general counsel for the US National Security Agency, and the lawyer with perhaps the biggest influence on the Obama administration's approach to large-scale surveillance

NSA Snooping Was Only the Beginning. Meet the Spy Chief Leading Us Into Cyberwar (Wired) General Keith Alexander has been building a secret army capable of launching devastating cyberattacks. Now it's ready to unleash hell

New Bill Would Declassify FISC Opinions (Threatpost) A group of eight senators from both parties have introduced a new bill that would require the attorney general to declassify as many of the rulings of the secret Foreign Intelligence Surveillance Court as possible as a way of bringing into the sunlight much of the law and opinion that guides the government's surveillance efforts

Google Details Low-Tech Cooperation With Surveillance Program (Washington Post) Google on Wednesday played down its role in a secret government surveillance program, detailing for the first time how it typically hands over data to federal officials

NSA Prism: Patriot Act Author Questions Scope (InformationWeek) White House says NSA's surveillance programs implement FISA and Patriot Act -- but Patriot Act author is not sure. Meanwhile, privacy groups turn up the heat

Defending NSA Prism's Big Data Tools (InformationWeek) The more you know about NSA's Accumulo system and graph analysis, the less likely you are to suspect Prism is a privacy-invading fishing expedition

The Obama Surveillance Revelations Are Pushing Liberals Over the Edge (The Atlantic) Progressives are mad as hell at the administration when it comes to civil liberties, and they're not going to take it anymore. The email went out shortly after midnight Thursday, a few hours after the news broke about the Obama administration's large-scale monitoring of Americans' cell-phone records: "You are being spied on." It was sent by the Progressive Change Campaign Committee, a leading liberal organization

House members voice skepticism about surveillance programs after FBI, NSA briefing (McClatchy) Members of Congress on Tuesday expressed growing doubts about the way the country's top-secret surveillance programs are managed, even as the top legislators from each party voiced confidence in the programs and showed little interest in a public discussion of the issue

NSA snooping in a striptease society (USA Today) In his statement about National Security Agency data mining from company servers President Obama said that "modest encroachments on privacy" are worth it to protect the country. He also indicated that this surveillance is regularly reviewed by federal

N.S.A. Scandal: God Save Us From the Lawyers (The New Yorker) As the repercussions of Edward Snowden's leaks about domestic surveillance continue to be debated, law professors and lawyers for the Bush and Obama Administrations are out in force, claiming that the spying agencies have done nothing wrong and it's all much ado about nothing

Declassify It (Slate) Congress has never been able to stop the over-classification of national security matters. Could they succeed now

Loosen The Gag On Google (Washington Post) Since Mr. Snowden's leaks, government officials - including President Obama - have warned that revealing too much information about the government's intelligence-gathering could hamper the collection of critically important information. We won't argue with that. But if the government is to live up to its responsibilities to the public - and if it is to maintain support for its intelligence-gathering techniques - the public must know as much as possible about how it is interpreting and applying the law

Lean Toward Freedom (Washington Post) The hardest thing in an argument is to acknowledge competing truths. We know that our government will continue with large-scale surveillance programs to prevent future terrorist attacks. We also know that such programs have operated up to now with too little public scrutiny and insufficient concern over their long-term implications for our rights and our privacy

Snowden Knows Best? (Washington Post) Journalists have a professional commitment to the idea that more debate is better, so we instinctively side with leakers. But I'm skeptical about some of the claims of Edward Snowden, the young National Security Agency (NSA) contractor who leaked secrets about that agency's surveillance programs to The Post and the Guardian

Don't Air NSA's Activities In Public (USA Today) The Obama administration has given Americans little reason to trust its stewardship. Its IRS has abused the taxing power to pursue ideological opponents. Its Justice Department has misused prosecutorial authority to wiretap news reporters. The White House still cannot fully account for the U.S. Consulate attack in Benghazi, Libya

Robust Debate On Snooping Depends On Having The Facts (USA Today) When news broke last week that the government has been collecting the phone records of millions of Americans, President Obama said he "welcome(s) the debate" over whether his administration has struck the right balance between national security and privacy

Could Overreaction to Cybersecurity Threats Hurt Transparency at Home? (Slate) Last week, President Obama met with Chinese President Xi Jinping to discuss the ongoing problem of Chinese cyber espionage. The Obama administration has recently detailed increased efforts by some companies and their governments (most notably Chinese on both counts) to steal valuable information from the U.S. involving military hardware, hybrid technology, organic pesticides, and mobile communications, to name a few

Edward Snowden Claims NSA Documents Show U.S. Hacks China: Report (ABC News) Alleged NSA leaker Edward Snowden claimed today to have evidence that the U.S. government has been hacking into Chinese computer networks since at least 2009 an effort he said is part of the tens of thousands of hacking operations American cyber spies have launched around the world, according to a Hong Kong newspaper

Cyber espionage 'at the center' of diplomacy with China (FierceGovIT) President Obama underscored to Chinese President Xi Jinping that cyber theft of American intellectual property is "inconsistent with the kind of relationship that we want to build with China," National Security Advisor Tom Donilon told press after the two presidents met in for an informal summit in California earlier this month

Press Briefing by National Security Advisor Tom Donilon (The White House) MR. RHODES: Hey, everybody. Thanks for coming to this briefing to wrap up the meetings over the last two days between President Obama and President Xi. I'll turn it over here to our National Security Advisor Tom Donilon to give a readout of those meetings. Afterwards we'll take questions. Tom, of course, has been very focused on this China meeting as a lead person for the President on U.S.-China relations, so he can speak to anything associated with that or other foreign policy questions

Chinese cartoonists have field day with NSA revelations (Christian Science Monitor) The Chinese media have been particularly interesting to watch, given Edward Snowden's decision to seek refuge in Hong Kong and China's own history of state surveillance

Cyber, Security Focuses for Marine Forces Pacific (SIGNAL Magazine) Cyberwarfare is a primary concern for the U.S. Marine Corps as it continues its rebalance toward the Asia-Pacific region. With the growing involvement of cyber in every operation along with specific concerns of virtual attacks from large nations in the region, emphasis on the new domain is becoming increasingly important

Cyber Commander Calls for Consolidated Activities (Signal Magazine) The United States must "normalize" cyberspace operations if it is to protect and defend cyber assets, including the critical infrastructure, according to the commander of the U.S. Cyber Command (CYBERCOM). Gen. Keith B. Alexander, USA, who also is the

Hagel Addresses Cyber Jurisdiction in Hill Testimony (Department of Defense) In the House hearing, Hagel noted cyber is an interagency responsibility, with law assigning the Department of Homeland Security much of the lead responsibility, but with of the national capability centered in U.S. Cyber Command. The secretary noted

CIOs still lack authority, says GAO, CIOs (FierceGovIT) The vision of the Clinger-Cohen Act of 1996 was to give chief information officers more authority, for them to report to the agency head and to give them a seat at the management table, said David Powner, director of information technology management issues at the Government Accountability Office. "I don't think that's happened," he told the Senate Homeland Security and Governmental Affairs Committee June 11

National Security:India plans to counter global cyber attack (Oneindia) This assumes significance in the context of revelations that the US National Security Agency (NSA) had been helping itself to data from just about every major American internet company. Sources said the Union Cabinet and the Cabinet Committee on

State Plan For Cyber Threats To Electric Grid Taking Shape (CT Now) Dan Esty, the state's energy commissioner, sat across a conference table from Art House, Connecticut's head utility regulator, in the bunker of the State Armory in Hartford last July for a drill that simulated a statewide response to a major hurricane

Credit Unions Argue That Retailers Are Not Penalized When Breached. May I Ask What Planet You Live On? (StoreFrontBacktalk) A recent story in a popular security newsletter featured a headline that got the blood boiling of GuestView Columnist Steve Sommers. The essence of the piece involved the National Association of Federal Credit Unions (NAFCU) asking Congress to create laws to further punish victims of a breach. The upshot is that merchants do not have any skin in the game when they are victims of a data breach. Sommers vehemently begs to differ

Emiratis told not to carry satellite phones when travelling to India (Emirates 24/7) The Ministry of Foreign Affairs has called on UAE nationals travelling to India to not enter the country carrying any satellite communication devices, such as Thuraya and Iridium

C.I.A. To Get First Woman In No. 2 Job (New York Times) The C.I.A.s deputy director, Michael J. Morell, is retiring after 33 years at the agency and will be replaced by Avril D. Haines, the top lawyer at the National Security Council, the C.I.A.s director, John O. Brennan, announced Wednesday

Litigation, Investigation, and Law Enforcement

Neglected Privacy Board to Probe Spygate Scandal (Wired) A long neglected and overlooked federal oversight board hit the limelight today when NSA chief Keith Alexander agreed publicly to cooperate with an investigation into the spygate scandal by the Privacy and Civil Liberties Oversight Board

Companies Complying with NSA's PRISM May Face E.U. Lawsuits (MIT Technology Review) U.S. companies that pass data from European Union citizens to the NSA's PRISM surveillance program could be breaching the E.U.'s data-protection laws. Legal challenges in Europe could cause headaches for both U.S. Internet companies and the U.S. government. Internet companies that pass data to the National Security Agency under the PRISM program could face legal action in the European Union, say privacy regulators and experts there

Robbery suspect seeks his NSA records (Politico) The lawyer for a man on trial in a South Florida armored car robbery is seeking cellphone records possibly produced by a recently revealed National Security Agency surveillance program, according to federal court documents. Attorney Marshall Dore Louis

Edward Snowden Is No Traitor (Bloomberg) What do the speaker of the House of Representatives, the chairwoman of the Senate Intelligence Committee and a former U.S. ambassador to the United Nations have in common? None of them seem to understand what "treason" is

NSA Prism Whistleblower Snowden Deserves A Medal (InformationWeek) Without Snowden's leaks, we wouldn't be pursuing rational, democratic debates on the government's post-Sept. 11 balance between security and civil liberties. Is Edward Joseph Snowden an altruistic whistle-blower? A reckless criminal? An outright traitor? Or somewhere in between? Those are frequently debated questions in the wake of Snowden's recent leaks of at least three National Security Agency (NSA) surveillance programs: Prism, which aims to intercept foreigners' audio, email and video from major Web services including Facebook, Gmail, Hotmail and Skype; Boundless Informant, a data mining tool that tracks where intelligence originates; and another program that analyzes millions of U.S. phone records, capturing metadata related to phone numbers called, call durations and the approximate geographical location of the caller

Is Edward Snowden a Traitor? (Slate) If he is, so was Daniel Ellsberg. The condemnations are raining down upon Edward Snowden, master leaker of National Security Agency surveillance programs. They come from the expected sources: House Speaker John Boehner calls him a "traitor." But they also come from people you might expect to be more sympathetic toward him. Legal experts Geoffrey Stone of the University of Chicago and Jeffrey Toobin of the New Yorker both believe he betrayed his country and should go to prison. So does New York Times columnist David Brooks

EXCLUSIVE: Whistleblower Edward Snowden talks to South China Morning Post (South China Morning Post) Ex-CIA contractor speaks to reporter from secret location in Hong Kong, revealing fresh details of US surveillance, pressure on Hong Kong, snooping and cyber attacks on China

Bin Laden accessed information from military leak (kfor.com) The case against an Oklahoma soldier, who is accused of providing classified information to WikiLeaks, continues Wednesday. Army Private Bradley Manning's court-martial resumes at Fort Meade. Prosecutors say Manning handed over

Chinese seller of pirated software sentenced to 12 years in US prison (CSO) Li Xiang was arrested after US agents lured him to a meeting in Saipan in June 2011. The operator of a website that sold more than $100 million worth of pirated software to customers worldwide was sentenced Tuesday to 12 years in a U.S. federal prison

US charges eight with multimillion-dollar cybercrime (CSO) The accused hacked financial institutions, laundered money and sent it overseas, say US prosecutors. U.S. federal prosecutors charged eight people on Wednesday in connection with a multimillion-dollar fraud that siphoned money from hacked accounts at banks and financial institutions, laundered it and sent it overseas

Spanish Police Leverage Twitter to Fight Crime (SecurityWeek) Spain's national police has built up an army of over half a million followers on Twitter, using them to help swoop on fugitives and get tip-offs on drug dealers in an open dialogue that has helped bring the force closer to the people

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Mobility Solutions for the Federal Market (Falls Church, Virginia, USA, Jul 16, 2013) With the improvements in mobile technology, smart phones and tablets, DOD, DHS and Civilian agencies have an opportunity to improve their service delivery models and the programs that serve their constituents. In order to accomplish this, Agencies across all branches of government must understand how and where mobile technology can be leveraged, where it's already being successfully leveraged to improve service delivery, and identify the areas of improvement necessary within their agency or program to ensure today's workforce is leveraging mobile technology to help their agency accomplish their goals. Join us at this highly interactive July 16th Potomac Officers Club Mobility Summit where our speakers will be addressing strategic issues.

2013 Cybersecurity Innovation Expo (Baltimore, Maryland, USA, Jun 10 - 13, 2013) Do not miss the opportunity to participate in the 2013 Cyber Innovation Forum with active participation from National Institute of Standards and Technology (NIST), the National Security Agency (NSA), and the Department of Homeland Security (DHS). This four-day event will take place at the Baltimore Convention Center on Monday, June 10 - Thursday, June 13 with the exposition taking place June 11-12.

CISSE 17th Annual Colloquium (Mobile, Alabama, USA, Jun 10 - 13, 2013) The Colloquium for Information Systems Security Education will meed in Mobile to discuss topics of great interest to our community, including cyber security education, certification, and accreditation.

3rd annual Cyber Security Summit (, Jan 1, 1970) Over the last 2 years, the summit has gathered 150+ senior Defence, National Security and Industry executives to address current and emerging cyber threats to Australia's security. Now in its 3rd year, ADM Cyber Security aims at: reviewing solutions to the ever increasing level of attacks, whether real or potential, [and] equipping all stakeholders with a wide range of actionable strategies.

Suits and Spooks La Jolla 2013 (LaJolla, California, USA, Jun 15 - 16, 2013) Exploring Cyber Warfighting and Threat Mitigation for Corporations and Governments. The original concept for this event was to look at what special operations forces and corporate CERTs or SOCs have in common…it readily became apparent that two broad areas kept coming up: threat mitigation through intelligence and active defense (a.k.a. offense as defense). San Diego is a wonderful location for exploring this theme thanks to its military and high technology industries. The FBI, NCIS, DOD, academia and some cutting edge INFOSEC startups will be represented.

25th Annual FIRST Conference (Bangkok, Thailand, Jun 16 - 21, 2013) The annual FIRST conference provides a setting for conference participants to attend a wide range of presentations delivered by leading experts in both the CSIRT field and from the global security community.

Hack in Paris (Paris, France, Jun 17 - 21, 2013) This five day event will examine forensics, malware analysis, and corporate hacking techniques, and what could be better, it is held at the Euro Disney conference center outside of Paris. It has attracted a stellar lineup of speakers and promises to be a very technical event with heavy emphasis on training. This is its second year.

2013 ICAM Information Day and Expo (Washington, DC, USA, Jun 18, 2013) This day provides a forum for the Identity, Credential and Access Management (ICAM) community to get first-hand information on current identity management and related technologies.

Buzzword Forensics: Mobile is the Future…and the Future is Now (Laurel, Maryland, Sioux Falls, Jun 18, 2013) Digital forensics is evolving, as all forensic sciences must evolve. With the explosive growth of the Internet as context, the discipline of digital forensics has evolved significantly since the last millennium. In today's talk we briefly explore this evolution from the Paleolithic last millennium to our present, and increasingly mobile ecosphere. Mobile device forensics has something old and something new. Open source and commercial tools have had spotty records over the years with respect to mobile device forensics. We will explore some of the similarities and look explicitly at some of the major differences between classic computer forensics and mobile device forensics, using demos of Android forensics as an exemplar. Al Holt, adjunct professor at Towson University, will be the presenter.

NASA National Capital Region Industry Days (Washington, DC, USA, Jun 25 - 27, 2013) This dedicated Information Technology Expo - sponsored by the Office of the Chief Information Officer - will serve as a focal point for NASA personnel to learn about the latest products and advances in the marketplace.

AFCEA International Cyber Symposium 2013 (Baltimore, Maryland, USA, Jun 25 - 27, 2013) Cyber threats and challenges grow every day. Successfully defending our networks requires a team approach. With this in mind, the Cyber symposium will engage the key players, including the U. S. Government, the International Community, Industry and Academia, to discuss the development of robust cyberspace capabilities and partnerships. The AFCEA International Cyber Symposium 2013 focuses on the critical missions of U.S. Cyber Command and the interface with Army Cyber Command, Marine Corps Forces Cyber Command, 10th U.S. Fleet Cyber Command, 24th Air Force Cyber, Department of Homeland Security, U.S. Coast Guard, DoD-CIO, National Security Agency (NSA), Defense Information Systems Agency (DISA), Defense Advanced Research Projects Agency (DARPA), Academia, Industry partners. The operational theme " Defining Full Spectrum Global Cyberspace Operations" will explore the operational security of DoD and Industry Networks, Cyber Operations with Joint and Coalition partners, and discuss the training and development of the cyber workforce.

ShakaCon (Honolulu, Hawaii, USA, Jun 25 - 28, 2013) This is the fifth year this "laid back security conference in paradise" is being held. Some solid presentations and training on malware analysis and penetration testing. After all, what could be better than "sun, surf, and C Shells?" There are intensive training classes on hacking mobile apps and even lock picking (the set of tools is included in the class registration).

Northern Virginia Technology Council: Security Threats: What Keeps You Awake at Night? (McLean, Virginia, USA, Jun 27, 2013) It's no secret that cybersecurity events are increasing in frequency and intensity. Many of these events are severe and pose significant risk to us as individuals, to our businesses, as well as our economy and national security. We've seen many reports in the press recently of well-funded nation states attempting to pilfer our networks in search of intellectual property. Every day bad guys are trying to gain access to our credit card information and other forms of personal information to steal our money and identities while others brazenly attempt to take over our data and systems and hold them for ransom. How is this happening? What can we do to protect ourselves? This conference addresses these issues.

American Technology Awards Technology and Government Dinner (Washington, DC, USA, Jun 30, 2013) TechAmerica Foundation hosts its Eleventh Annual Technology and Government Dinner at the Ronald Reagan Building in Washington DC. The dinner continues to serve as the premier Washington, DC technology networking event bringing hundreds of tech industry, congressional, and government leaders together at one venue to celebrate the partnership between industry and government.