MCViewPoint

Opinion from a Libertarian ViewPoint

Posts Tagged ‘WhatsApp’

Private Spies Hired by the FBI and Corporate Firms Infiltrate Discord, Reddit, WhatsApp

Posted by M. C. on May 12, 2023

Leading “threat intelligence” firms are creating fake online personas to gain access to every corner of the web.

U.S. intelligence agencies also have a record of coming up empty after infiltrating private, online spaces, raising the possibility that the security justifications for the current incursions are weaker than the agencies are claiming. The documents leaked by former National Security Agency contractor Edward Snowden revealed that FBI and CIA spies had created fake personas to hunt for potential terror plots discussed in online games, such as World of Warcraft and Second Life, as well as on platforms like Xbox Live. Those initiatives fizzled after the intelligence agencies found little to no evidence of terror communications.

https://substack.com/inbox/post/119946213

LEE FANG

That anonymous internet persona with an anime cartoon avatar in your Discord chat might actually be a contractor sent to spy on you. 

Enter the world of “threat intelligence.” 

It’s the term of art for a growing set of surveillance and security firms that create fake online personas to infiltrate and scrape data from private corners of the internet. The industry provides corporate and government clients with insight into conversations on private, invite-only Discord chats, WhatsApp groups, Reddit forums, and dark web message boards to help those powerful customers keep tabs on a variety of potential threats, from political hacktivists to the illegal markets that traffic in stolen passwords and intellectual property. 

I spoke to representatives of ZeroFox, DarkOwl, Searchlight Cyber, Recorded Future, CyberInt, Flashpoint, and other threat intelligence firms at RSA Conference 2023, an annual convention for cyber security professionals from across the world that is held in San Francisco. 

“We have personnel who already have established credentials in these environments so that we’re able to go in and look for things,” said A.J. Nash, the vice president of intelligence at ZeroFox, a leader in the threat intelligence industry that is based in Baltimore, Maryland.

Nash confirmed that the company is active in Discord, an audio and video group chat app popular among young video-game players.

“We can do the same thing with Discord,” Nash added. “It’s hard to infiltrate a small group because everybody knows everybody. But some of the groups that are larger, yeah, we have the ability to get into some opportunities.”

An executive at DarkOwl, a Denver-based threat intelligence firm that provides clients with a special database of information from its snooping, explained that the company creates fake identities and usernames to gain admission to many of the private platforms and chatrooms that it uses to collect information. 

“What we do, we work with personas,” said Magnus Svärd, a director at DarkOwl. “We’ve done this at scale since 2018 so there’s some trust in the personas that we’ve built up, whether they’re on Discord, on Telegram, or wherever.”

Searchlight Cyber, a British firm that specializes in dark web message boards, similarly uses internet personas to gain access to private online forums and chat platforms.

“We actually get invited to those. We have human actors and get invited. We obviously don’t identify as Searchlight on them,” said Peter Ritter, a sales manager at the firm. “Then we see what’s going on there.”

CyberInt, an Israeli threat intelligence firm, advertises how its team of analysts uses fake personas to thwart hackers, retail fraud, hacktivists, and other cyber security threats.

In one video posted by CyberInt, an analyst for the firm discusses her approach to go into online communities and “detect threat actors when they are young or starting out at 14 or 15, that’s when I start observing and documenting their malicious activities.” At that age, they are “more careless and open,” the analyst said.

In another CyberInt marketing video, the firm walks a potential client through the process of using a fake online alias to contact a hacker over the messaging app Telegram and “get as much information as we can.”

Danny Miller, a director of marketing at CyberInt, confirmed to me that his firm has analysts infiltrating Discord servers, among other platforms.

Many of these firms maintain close ties to law enforcement and government agencies. Several are currently under contract with the Federal Bureau of Investigation or military intelligence.

The role of ZeroFox’s collaboration with the FBI, in particular, came to light in documents unearthed by the special House committee investigating the U.S. Capitol riot on Jan. 6, 2021. In a Jan. 3, 2021, email exchange between FBI officials preparing for the right-wing protests slated to occur, one official noted that the FBI team charged with monitoring groups due to assemble at the Capitol had just signed on with ZeroFox days earlier.  The official said that the agency  was still learning how to use the software to monitor social media posts from political extremists headed for Washington on Jan. 6, 2021.

See the rest here

Be seeing you

Posted in Uncategorized | Tagged: , , , , , | Leave a Comment »

Beware: Our New Online Culture is a Feast for Mass Surveillance | The American Conservative

Posted by M. C. on April 11, 2020

What! You still haven’t taped over your PC and selfie camera lenses?

Nothing is private online unless you are using VPNs and secure email. Even then…

Do you really think Facebook messenger and (Facebook’s) WhatsApp are secure?

https://www.theamericanconservative.com/articles/beware-our-new-online-culture-is-a-feast-for-mass-surveillance/

The rapid spread of COVID-19 has caused network traffic to surge as Internet users resort to video conferencing to work remotely.

For example, last December online meeting provider Zoom hosted roughly 10 million participants. In March this statistic jumped to 200 million. The public’s stampede to the cloud is an auspicious development for the intelligence community as sensitive discussions that once occurred in physical office buildings are now channeled through a relatively small number of digital gatekeepers. The implications are unsettling.

From the vantage point of professional spies, the desire to eavesdrop on popular communication channels is all but irresistible. In the United States we’ve witnessed classified programs like PRISM, where the NSA succeeded in convincing all of the big names in Silicon Valley to participate. Chatting up tech CEOs on a first name basis. Authoritarian regimes like China are even more eager to tap commercial data streams. Which is particularly salient given that most of Zoom’s engineers work over in China and that Zoom has unfettered access to the online conferences that it hosts despite marketing claims to the contrary.

Hence, efforts to limit the spread of contagion offer a golden opportunity to double down on mass surveillance. Data collection tools wielded during an emergency on behalf of public safety —facial recognition, drones, mobile device apps, smart phone geolocation, payment card records— over time take on a hue of legitimacy. Furthermore the bureaucrats using such tools are loath to give up their newfound access and will actively identify additional threats to justify it.

China serves as an instructive example. The Communist Party remains in power through an unspoken agreement with the rest of Chinese society. It’s the sort of deal that exists in many repressive nations. The government assures economic growth and in return citizens are expected to stay out of politics and submit to extreme social control measures. The Chinese government asserts that growth will continue at around 6 percent, but keep in mind that it also aggressively censors bad economic news, in the same manner that it suppressed news about the COVID-19 outbreak.

It’s highly unlikely that the Party will be able to keep delivering results forever. The COVID-19 outbreak will simply hasten a looming economic crisis in China, despite the Party’s best efforts to maintain control. With China’s towering mountain of debt, zombie factories, and conspicuous industrial overcapacity, it’s just a matter of time before the average citizen realizes that they’re not going to get what they were promised. This raises the specter of military action as the government directs attention outward in search of enemies to mobilize its restive populace. Against this backdrop mass surveillance will be ramped up in a desperate attempt to buttress the status quo.

Common sense dictates that relying on technology that’s developed in a police state like China is inherently risky. The instinctive response for many users is to turn to American technology. However, thanks to whistleblowers like Edward Snowden the public record shows that domestic companies are also cooperating with the intelligence community as well as monetizing their access to user data. So if you’re wondering whether a particular online platform is secure, you’re asking the wrong question. The salient question is which group of security services and big data aggregators have access?

Sadly this makes achieving higher levels of communication security a sort of DIY affair. The key is to prevent the current COVID-19 setting from becoming the new normal by recognizing what’s at stake. The more that we rely on Internet platforms to communicate the more power we yield to a narrow set of vested interests. Such that our need to stay in touch with each other during a disaster secretly morphs into a feeding frenzy for spies. Just as it did in the wake of the 9/11 attacks. As always, freedom entails responsibility. This means leaving mainstream channels for sensitive discussions and doing so in a manner that doesn’t create baseline anomalies that might alert watchers.

Pervasive monitoring is not the behavior of a confident nation. Mass surveillance isn’t the harbinger of stability. It’s a dangerous political tremor. A display of anxiety rather than strength. An indicator that leaders have recklessly chosen to dispense with civil liberties behind closed doors under the guise of addressing perceived threats. As citizens we have an obligation to protect the values which actually make America strong. To encourage lawmakers to resist the impulse to trade essential liberty for short-term promises of security and to forge our own paths forward when they fail to do so.

Be seeing you

 

Posted in Uncategorized | Tagged: , , , , , , , , | Leave a Comment »

Uh-oh: Silicon Valley is building a Chinese-style social credit system

Posted by M. C. on September 1, 2019

In China, scoring citizens’ behavior is official government policy. U.S. companies are increasingly doing something similar, outside the law.

https://www.fastcompany.com/90394048/uh-oh-silicon-valley-is-building-a-chinese-style-social-credit-system

By Mike Elgan

Have you heard about China’s social credit system? It’s a technology-enabled, surveillance-based nationwide program designed to nudge citizens toward better behavior. The ultimate goal is to “allow the trustworthy to roam everywhere under heaven while making it hard for the discredited to take a single step,” according to the Chinese government.

In place since 2014, the social credit system is a work in progress that could evolve by next year into a single, nationwide point system for all Chinese citizens, akin to a financial credit score. It aims to punish for transgressions that can include membership in or support for the Falun Gong or Tibetan Buddhism, failure to pay debts, excessive video gaming, criticizing the government, late payments, failing to sweep the sidewalk in front of your store or house, smoking or playing loud music on trains, jaywalking, and other actions deemed illegal or unacceptable by the Chinese government.

It can also award points for charitable donations or even taking one’s own parents to the doctor.

Punishments can be harsh, including bans on leaving the country, using public transportation, checking into hotels, hiring for high-visibility jobs, or acceptance of children to private schools. It can also result in slower internet connections and social stigmatization in the form of registration on a public blacklist.

China’s social credit system has been characterized in one pithy tweet as “authoritarianism, gamified.”

At present, some parts of the social credit system are in force nationwide and others are local and limited (there are 40 or so pilot projects operated by local governments and at least six run by tech giants like Alibaba and Tencent).

Beijing maintains two nationwide lists, called the blacklist and the red list—the former consisting of people who have transgressed, and the latter people who have stayed out of trouble (a “red list” is the Communist version of a white list.) These lists are publicly searchable on a government website called China Credit.

The Chinese government also shares lists with technology platforms. So, for example, if someone criticizes the government on Weibo, their kids might be ineligible for acceptance to an elite school.

Public shaming is also part of China’s social credit system. Pictures of blacklisted people in one city were shown between videos on TikTok in a trial, and the addresses of blacklisted citizens were shown on a map on WeChat.

Some Western press reports imply that the Chinese populace is suffocating in a nationwide Skinner box of oppressive behavioral modification. But some Chinese are unaware that it even exists. And many others actually like the idea. One survey found that 80% of Chinese citizens surveyed either somewhat or strongly approve of social credit system.

It can happen here

Many Westerners are disturbed by what they read about China’s social credit system. But such systems, it turns out, are not unique to China. A parallel system is developing in the United States, in part as the result of Silicon Valley and technology-industry user policies, and in part by surveillance of social media activity by private companies.

Here are some of the elements of America’s growing social credit system.

Insurance companies

The New York State Department of Financial Services announced earlier this year that life insurance companies can base premiums on what they find in your social media posts. That Instagram pic showing you teasing a grizzly bear at Yellowstone with a martini in one hand, a bucket of cheese fries in the other, and a cigarette in your mouth, could cost you. On the other hand, a Facebook post showing you doing yoga might save you money. (Insurance companies have to demonstrate that social media evidence points to risk, and not be based on discrimination of any kind—they can’t use social posts to alter premiums based on race or disability, for example.)

The use of social media is an extension of the lifestyle questions typically asked when applying for life insurance, such as questions about whether you engage in rock climbing or other adventure sports. Saying “no,” but then posting pictures of yourself free-soloing El Capitan, could count as a “yes.”

PatronScan

A company called PatronScan sells three products—kiosk, desktop, and handheld systems—designed to help bar and restaurant owners manage customers. PatronScan is a subsidiary of the Canadian software company Servall Biometrics, and its products are now on sale in the United States, Canada, Australia, and the United Kingdom.

PatronScan helps spot fake IDs—and troublemakers. When customers arrive at a PatronScan-using bar, their ID is scanned. The company maintains a list of objectionable customers designed to protect venues from people previously removed for “fighting, sexual assault, drugs, theft, and other bad behavior,” according to its website. A “public” list is shared among all PatronScan customers. So someone who’s banned by one bar in the U.S. is potentially banned by all the bars in the U.S., the U.K., and Canada that use the PatronScan system for up to a year. (PatronScan Australia keeps a separate system.)

Judgment about what kind of behavior qualifies for inclusion on a PatronScan list is up to the bar owners and managers. Individual bar owners can ignore the ban, if they like. Data on non-offending customers is deleted in 90 days or less. Also: PatronScan enables bars to keep a “private” list that is not shared with other bars, but on which bad customers can be kept for up to five years.

PatronScan does have an “appeals” process, but it’s up to the company to grant or deny those appeals.

Uber and Airbnb

Thanks to the sharing economy, the options for travel have been extended far beyond taxis and hotels. Uber and Airbnb are leaders in providing transportation and accommodation for travelers. But there are many similar ride-sharing and peer-to-peer accommodations companies providing similar services.

Airbnb—a major provider of travel accommodation and tourist activities—bragged in March that it now has more than 6 million listings in its system. That’s why a ban from Airbnb can limit travel options.

Airbnb can disable your account for life for any reason it chooses, and it reserves the right to not tell you the reason. The company’s canned message includes the assertion that “This decision is irreversible and will affect any duplicated or future accounts. Please understand that we are not obligated to provide an explanation for the action taken against your account.” The ban can be based on something the host privately tells Airbnb about something they believe you did while staying at their property. Airbnb’s competitors have similar policies.

It’s now easy to get banned by Uber, too. Whenever you get out of the car after an Uber ride, the app invites you to rate the driver. What many passengers don’t know is that the driver now also gets an invitation to rate you. Under a new policy announced in May: If your average rating is “significantly below average,” Uber will ban you from the service.

WhatsApp

You can be banned from communications apps, too. For example, you can be banned on WhatsApp if too many other users block you. You can also get banned for sending spam, threatening messages, trying to hack or reverse-engineer the WhatsApp app, or using the service with an unauthorized app.

WhatsApp is small potatoes in the United States. But in much of the world, it’s the main form of electronic communication. Not being allowed to use WhatsApp in some countries is as punishing as not being allowed to use the telephone system in America.

What’s wrong with social credit, anyway?

Nobody likes antisocial, violent, rude, unhealthy, reckless, selfish, or deadbeat behavior. What’s wrong with using new technology to encourage everyone to behave?

The most disturbing attribute of a social credit system is not that it’s invasive, but that it’s extralegal. Crimes are punished outside the legal system, which means no presumption of innocence, no legal representation, no judge, no jury, and often no appeal. In other words, it’s an alternative legal system where the accused have fewer rights.

Social credit systems are an end-run around the pesky complications of the legal system. Unlike China’s government policy, the social credit system emerging in the U.S. is enforced by private companies. If the public objects to how these laws are enforced, it can’t elect new rule-makers.

An increasing number of societal “privileges” related to transportation, accommodations, communications, and the rates we pay for services (like insurance) are either controlled by technology companies or affected by how we use technology services. And Silicon Valley’s rules for being allowed to use their services are getting stricter.

If current trends hold, it’s possible that in the future a majority of misdemeanors and even some felonies will be punished not by Washington, D.C., but by Silicon Valley. It’s a slippery slope away from democracy and toward corporatocracy.

In other words, in the future, law enforcement may be determined less by the Constitution and legal code, and more by end-user license agreements.

Be seeing you

China's Terrifying "Social Credit" System Has Already ...

Posted in Uncategorized | Tagged: , , , , | Leave a Comment »

WhatsApp co-founder Jan Koum is leaving Facebook after clashing over data privacy

Posted by M. C. on May 1, 2018

I don’t know anything about Jan Koum but obviously he isn’t dumb. He couldn’t see what Facebook is all about? He didn’t see the CIA/In-Q-Tel connection? Did Zuck con him with a pack of fake promises?

Koum’s concern with privacy appears genuine, that is the non sequitur. The real story would be interesting.

https://www.theverge.com/2018/4/30/17304792/whatsapp-jan-koum-facebook-data-privacy-encryption

Nick Statt

WhatsApp co-founder and CEO Jan Koum is leaving the company amid arguments with parent company Facebook over data privacy and the messaging app’s business model, according to a report from The Washington Post. Koum, together with his fellow co-founder Brian Acton, sold WhatsApp to Facebook in 2014 for an eye-popping sum of $19 billion, $3 billion of which consisted of Facebook stock granted to both Koum and Acton, who left the company back in September. Koum confirmed his departure in a personal Facebook posttoday… Read the rest of this entry »

Posted in Uncategorized | Tagged: , , , | Leave a Comment »