Canadian Spy Agency Tracking Users Of Free WiFi At Airports, Hotels, Coffee Shops & Libraries

from the free-wifi dept

A few years ago, we wrote about why, for many years, whenever you were in a public place like an airport or a hotel, you’d often see an available WiFi option called Free Public WiFi — though if you looked carefully, it was an ad hoc (computer-to-computer) network, rather than to a WiFi access point. It turns out that it was because of a stupid bug in Windows XP, which also explains why it’s a lot less common these days. Of course, some people always would joke that it was really spy agencies trying to get you to connect to their WiFi. Except, that might not be that much of a joke. The latest reporting on Snowden documents from Glenn Greenwald, in association with some reporters from the CBC, reveals that the Canadian equivalent of the NSA, the Communications Security Establishment Canada (CSEC) has been tracking people as they connect to WiFi networks in a variety of public places including airports, hotels, coffee shops and libraries. The main focus appears to be on airports, but then they use that data to create a map of information about where someone goes.

Just two months ago, the head of the CSEC, John Foster, insisted that the CSEC does not spy on anyone in Canada:

“I can’t comment in detail on the intelligence operations or capabilities of ourselves or our allies. What I can tell you is that CSEC, under its legislation, cannot target Canadians anywhere in the world or anyone in Canada, including visitors to Canada.”

And yet, as this report shows, they absolutely are collecting tons of data on Canadians and visitors to Canada. And not just a few. The document shows that in a test that “swept a modest size city,” they collected information on over 300,000 people. Also, they can then use that information to track where a person goes, creating profiles over time. The document reveals that they’re just testing this capability (which was created in coordination with the NSA), but it indicates the plan is for all of the “Five Eyes” countries to use a similar system — though the reporters say they’ve been told the system is now fully operational, and not just in test mode.

It’s not clear from the document exactly how the CSEC is able to get this data. The CBC report questions a few potential sources, such as key airports and Boingo (the company that supplies WiFi to many public hotspots) and both deny providing the information. The Boingo denial seems reasonable, since in the presentation it actually indicates that they have trouble getting information on users on Boingo’s network.

The reporters spoke to multiple experts who all say that there’s no possible way that this effort is legal under Canadian law. After all, as Foster himself stated above, the CSEC cannot target anyone on Canadian soil, but they clearly do. The article even quotes Ontario’s privacy commissioner Ann Cavoukian who seems horrified by this revelation:

Ontario’s privacy commissioner Ann Cavoukian says she is “blown away” by the revelations.

“It is really unbelievable that CSEC would engage in that kind of surveillance of Canadians. Of us.

“I mean that could have been me at the airport walking around… This resembles the activities of a totalitarian state, not a free and open society.”

For all the wonders of free WiFi, there’s one more downside to keep in mind. If you’re using it, you’re almost certainly being tracked by a spy agency.

Filed Under: airports, canada, csec, free wifi, john foster, library, privacy, tracking, wifi

T-Mobile Writes The Best Press Release You'll Ever See From A Phone Company

from the someone-had-some-fun dept

Our general rule is that we ignore press releases, because they’re fake news. People still send them to us sometimes, but I’ve got a pretty good email filter that filters them right into the trash. Every so often there’s an interesting press release, but it’s rare. It’s even rarer from a large company. Rarer still: an interesting press release from a telco. And yet, here’s T-Mobile with what may be the best press release you’ll ever see from a phone company, outright ridiculing AT&T’s plan to offer T-Mobile customers $450 to switch to AT&T. To be fair, T-Mobile, which has basically been the also-ran of the mobile world for years, has decided in the past year or so that the best strategy to change that is to basically do pretty much everything differently than mobile operators have done in the past, bucking lots of trends with concepts that are actually (gasp!) consumer friendly. It’s kind of shocking to see a phone company come to the conclusion that, hey, perhaps treating customers right is a competitive advantage, but it does appear that T-Mobile has (to some extent) embraced that concept.

And then there’s this press release. At the beginning of January, AT&T directly began offering T-Mobile users $450 to switch. Apparently the company has realized that if it can’t buy T-Mobile directly, it might as well just buy its customers. Now, most companies when targeted by a larger competitor in this manner might sort through a variety of responses, and I’m sure at some point, perhaps late at night under the influence of an extra alcoholic beverage or two, someone might suggest the following. But to actually go ahead with it… well… that’s a bit bold. In short, T-Mobile flips the offer on its head, noting that since it only applies to T-Mobile users, AT&T users now have a “risk free” way to test out T-Mobile — and they throw in hilarious fake quotes from AT&T Mobility’s CEO, Ralph de la Vega, mock the “death star” and a variety of other things you don’t normally see in a telco press release — such as comparing de la Vega to Darth Vader.

T-Mobile US, Inc. (NYSE: TMUS) today announced that pretty much everyone at the company is overcome with emotion and still kind of processing the decision by now-ex-rival AT&T to leave the dark side, step into the light, and join hands in supporting the Un-carrier consumer revolution.

“Call it an awakening,” said Ralph de la Vega, president and CEO of AT&T Mobility, “but I felt it was time to really stir things up and put the customer first for a change. And by “customer” I’m referring to our former customers who switch to T-Mobile, because our current customers don’t really qualify.” De la Vega said that the new T-Mobile switching offer was custom designed to entice its millions of contract customers to go ahead and give T-Mobile a try. “If for any reason you don’t love T-Mobile’s 4G LTE network, which is now faster than ours[i], we’ll actually pay you up to $450 to come back to AT&T, I kid you not.”

Ok, De La Vega didn’t actually say that, but he might as well have. Thanks to AT&T’s apparent change-of-heart and incredibly generous $450 T-Mobile customer buy-back campaign, insane numbers of its very own customers and even families of AT&T employees are enjoying a risk-free, zero-cost opportunity to switch to the Un-carrier. If customers making the switch are not completely satisfied with T-Mobile and its state-of-the-art nationwide 4G LTE network (now fastest in the U.S.)i, AT&T will cover the costs for customers switching back to their own slower network, up to $450 with trade-in[ii]. Details of the new AT&T offer can be found at att.com/att/switcherpromo.

“Wow. I mean … wow,” breathed John Legere, president and CEO of T-Mobile. “I guess we all have moments of doubt. You know? Like, can the darkness ever be defeated? But that they’ve singled us out in this way is just so affirming. I guess we must be doing something right. I mean, if AT&T can change, it feels like anything’s possible.

“It’s kind of like that scene where Darth Vader’s lying there and Luke helps take off his helmet,” Legere continued, “and you see that, okay, sure, Darth Vader’s pretty ugly, but he’s human after all.”

[….] “Somebody pinch me,” said Mike Sievert, Chief Marketing Officer. “By offering a risk-free way for their millions of customers to come over to T-Mobile – AT&T has helped put this Un-carrier consumer movement into overdrive. At T-Mobile we stand for Contract Freedom, and I want to thank our friends at AT&T for helping us liberate their former customers. This isn’t just about switching offers — it’s about T-Mobile giving customers the service, the network, and the wireless experience they deserve, without having to worry when they switch.”

Sievert noted that AT&T’s recent full-page ad in The New York Times had signaled a real turning point in his mind – that the former industry rival had truly stepped out of the darkness and was seeking to mend its ways and support the Un-carrier consumer movement.

“I mean, a full page ad in The New York Times,” said Sievert. “That says commitment to me.”

Yes, T-Mobile also uses the press release to pitch its own deal for mobile phone users to switch to T-Mobile, but this is quite a press release. If other companies actually did press releases like this, I might have to actually adjust my email filters…

Filed Under: darth vader, john legere, press releases, ralph de la vega, turning the tables
Companies: at&t, t-mobile

Really Bad Idea: Senator Klobuchar Wants To Mandate A 'Kill Switch' In All Mobile Phones

from the could-she-please-hire-a-technologist? dept

We hadn’t heard much from Senator Amy Klobuchar recently, but every time she gets anywhere near legislation involving technology, you should run screaming for the hills (or, rather, call your own Senators to tell them to block whatever awful plan she’s come up with). It’s amazing that one Senator can get technology so wrong. Klobuchar, famously, backed the companion bill to PIPA, called S.978 in the previous Congress, which would have made unauthorized streaming of content into a felony, putting all sorts of perfectly reasonable YouTube users at risk of possible criminal charges, and possibly jailtime. In 2012, she tried to introduce the “Cloud Computing Act of 2012” which would have modified the CFAA to apply criminal enforcement to cloud computing as well. However, legal experts described the bill as a complete disaster, with one saying that her “definition of cloud computing service is incoherent.”

Her latest move is to propose a bill that would mandate a kill switch in all mobile phones that could be activated remotely. The idea, here, is that this would allow those who had their phones stolen to disable them, rendering them (sorta) useless. It seems that, as with the other bills discussed above, Senator Klobuchar introduces these with the best of intentions, but with no clue about how technology works, or the likely “unintended” consequences of such things.

First, putting such a kill switch into all phones almost guarantees that it will be misused and abused in some form — whether by government officials looking to cut off communications (as has been done at the tower level) or by malicious hackers looking to kill a ton of phones. The kill switch is just too tempting a target. Second, the actual benefit of this is likely to be limited. Phones will still get stolen and people will figure out how to hack their way around the kill switch within hours of it existing. Third, there’s simply no reason for a law here. There are numerous software products that allow individuals to effectively do this on their own if they so desire. Mandating it, and adding fines to mobile operators who don’t offer such a thing seems totally unnecessary.

So, even if we assume the best, and believe that, with all of these laws, Senator Klobuchar has the best of intentions, could she please hire someone who understands basic technology before writing any more bad laws that will cause harm?

Filed Under: amy klobuchar, kill switch, mobile phones

NSA Collecting Hundreds Of Millions Of Text Messages Daily, Looking At 'Untargeted' Messages & Data

from the collect-it-all dept

The latest in the ongoing revelations for the Ed Snowden leaks is that the NSA and GCHQ are collecting what appears to be hundreds of millions of text messages every day. While it does try to “minimize” messages involving Americans, it appears to allow access to the rest of the database to the GCHQ in the UK, who does use it to spy on UK phone numbers. GCHQ staff are told to avoid viewing actual content of UK text messages, but it’s unclear if that’s enforced. As the NSA notes, this database, called DISHFIRE, is “a goldmine to exploit.”

And, yes, they’re exploiting it. And no, not just against “targets.”

The NSA has made extensive use of its vast text message database to extract information on people’s travel plans, contact books, financial transactions and more – including of individuals under no suspicion of illegal activity.

The NSA runs a program called “Prefer” across all the information in the database to turn up “gems” that it admits “are not in current metadata stores and would enhance current analytics.”

The NSA sure does like its smiley faces, doesn’t it? Among the data they’re able to access? Each day this data gives them details of “over 800,000 financial transactions, either through text-to-text payments or linking credit cards to phone users.” It also tracks travel information from things like itinerary texts as well as cancellations and delays. Thought it was nice that your airline informed you of your flight delay? Sounds like the NSA got to know about it too. It’s not entirely clear from the report how the NSA/GCHQ are getting access to these messages. Reporters spoke to Vodafone, who insisted that they were not handing over such data, but these days, you never know who’s being truthful. In response to all of this, the NSA repeated its nearly impossible to believe claim that its “activities are focused and specifically deployed against — and only against — valid foreign intelligence targets in response to intelligence requirements.” Valid foreign intelligence targets send 200 million text messages a day? Yeah…

Filed Under: gchq, nsa, sms, surveillance, text messages

Researcher Says Simple Security Fixes From Carriers Would Have Prevented NSA Collection Of Cell Communications

from the we're-nos.-1-whatever,-why-try-harder? dept

Hanlon’s Razor states: never attribute to malice that which is adequately explained by stupidity. Replace “stupidity” with “laziness” and you’ve got one researcher’s theory as to why cell phone carriers failed to make basic efforts to provide a secure product — one that would have prevented the NSA’s collection of communications. (h/t to DSLreports)

The world’s mobile phone carriers have failed to implement technology fixes available since 2008 that would have thwarted the National Security Agency’s ability to eavesdrop on many mobile phone calls, a cyber security expert says.

Karsten Nohl, chief scientist with Berlin’s Security Research Labs, told Reuters ahead of a highly anticipated talk at a conference in Germany that his firm discovered the issue while reviewing security measures implemented by mobile operators around the world…

None of the carriers surveyed had implemented measures for thwarting a method that allows the NSA to eavesdrop on most mobile calls by unscrambling a widely used encryption technology known as A5/1[…] Nohl said that method would have been blocked if carriers had applied two patches released in 2008.

Were carriers compelled to leave this hole open for NSA exploitation? It’s a good question, but Nohl says the more likely explanation is that carriers simply didn’t find the problem worth addressing.

“I couldn’t imagine it is complicity. I think it is negligence,” he said. “I don’t want to believe in a worldwide conspiracy across all worldwide network operators. I think it is individual laziness and priority on network speed and network coverage and not security.”

As has been observed everywhere, the path of least resistance is favored by many entities, even those not explicitly performing government work. Making a minimum of effort dumped customers’ conversations right into the NSA’s lap.

Of course, if the NSA had knocked on these carriers’ doors and asked for a small favor, like leaving a security hole big enough to drive a semi full of unused privacy protections through, chances are many would have said, “Sure, why not.” Verizon and AT&T have only very belatedly joined the national conversation on intelligence gathering, after spending months shuffling around the periphery while staring at the floor. For years, these providers have handed over everything the agency’s asked for and shown an active interest in helping it anticipate what it might need next.

But Nohl’s theory dismisses a worldwide conspiracy to dump cell phone customers’ conversations into the waiting ears of the NSA — something that’s more likely to be true. While American carriers have proven to be useful NSA allies, very little has been exposed about the compliance rate of foreign carriers. Not that their resistance would matter much (or that they’d even be approached directly), as foreign intelligence agencies have been just as “helpful” as AT&T and Verizon in terms of granting access to data and communications — much of which ultimately ends up in the NSA’s sprawling lockboxes.

The moral here, if Nohl is correct, is that the industry’s idle hands are the NSA’s workshop. Not doing something can be just as harmful as complete complicity.

Filed Under: carriers, nsa, privacy, security, surveillance

Wireless Mesh Networks, The NSA, And Re-building The Internet

from the exploring-all-the-avenues dept

One of the bitter lessons we learned from Snowden’s leaks is that the Internet has been compromised by the NSA (with some help from GCHQ) at just about every level, from our personal software and hardware, through ISPs to major online services. That has prompted some in the Internet engineering community to begin thinking about how to put back as much of the lost security as possible. But even if that’s feasible, it’s clearly going to take many years to make major changes to something as big and complex as the Net.

However, there’s an alternative approach to digital connectivity that has been around for a while, and that’s already being used around the world. Wireless meshes allow ad-hoc networks to be set up independently of the Internet’s main wiring by hooking together a local collection of suitable devices. Mesh networks can be thrown up and torn down quickly; devices can join and leave them dynamically; and they can recover from breaks in the wireless links by setting up alternative paths. They can either be run as local area networks, disconnected from the Internet, or hooked into it, allowing single or multiple links to be shared by the entire mesh.

One such wireless mesh comes from The New America Foundation’s Open Technology Institute, which describes itself as follows:

The Open Technology Institute formulates policy and regulatory reforms to support open architectures and open source innovations and facilitates the development and implementation of open technologies and communications networks. OTI promotes affordable, universal, and ubiquitous communications networks through partnerships with communities, researchers, industry, and public interest groups and is committed to maximizing the potentials of innovative open technologies by studying their social and economic impacts – particularly for poor, rural, and other underserved constituencies. OTI provides in-depth, objective research, analysis, and findings for policy decision-makers and the general public.

Its Commotion project has just reached an important milestone:

Open Technology Institute (OTI) announced today that it has completed Beta testing and upgrades of its groundbreaking mesh networking toolkit, and is launching Commotion 1.0 in time for the new year. The launch represents the first full iteration of the technology, which makes it possible for communities to build and own their communications infrastructure using “mesh” networking. In mesh networks, users connect their devices to each other without having to route through traditional major infrastructure.

Commotion 1.0 is an open-source toolkit that provides users software and training materials to adapt mobile phones, computers, and other wireless devices to create decentralized mesh networks so they can connect and share local services. A mesh network can function locally as an Intranet, but when one user connects to the Internet, all users will have access to it as well.

Of course, neither Commotion nor other wireless meshes are proof against the NSA’s huge array of tricks and tools that we have recently found out about. Indeed, OTI provides an explicit “warning label” for its mesh:

Commotion

Cannot hide your identity
Does not prevent monitoring of internet traffic
Does not provide strong security against monitoring over the mesh
Can be jammed with radio/data-interference

But it’s important to remember that Commotion and the other wireless mesh systems were designed in a more innocent time, before we knew the extent to which we were being spied upon, and how much the basic protocols of the Internet had been compromised. Now that we’ve learnt about all those things, it would be good to use that knowledge to spur the creation of the next generation of wireless mesh systems with high levels of security and privacy, so that we can add them to our own collection of tools and tricks in the fight to build a surveillance-resistant Net.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: commotion, infrastructure, mesh networks, privacy, security, wireless, wireless mesh networks
Companies: open technology institute, oti

US-Israeli Security Company Selling Mobile Phone Surveillance Products To Agencies Around The World

from the NSA-power-at-budget-prices! dept

Privacy International, which has done a very thorough job digging into the backgrounds of the many private companies involved in the surveillance “industry” around the world, has just released a promotional document from the American-Israeli Verint, a security company that provides NSA-level cell phone surveillance power to entities around the world.

[A] scaled down version of this system is also being sold by private surveillance contractors to the highest bidder. The company behind it? Israeli-American company Verint. Their Skylock technology claims to have the ability to “Remotely locate GSM and UMTS targets located anywhere in the world at cell level precision”.

The brochure Privacy Int’l obtained doesn’t go into detail as to how it achieves this, but what is shown is both impressive and disturbing.

From a brochure collected this year we have discovered one of the newest additions to Verint’s product line: mobile phone tracking on an international scale. Previously, mobile phone tracking required presence in the particular areas of interest, focusing on the tracking of phones through monitoring Base Stations (Cell Towers) and local networks to pinpoint location. In the past, if a law enforcement agency wanted location data they requested information from the relevant telecommunication firm operating in that specific territory. By way of an example, this would result in the UK not being able to obtain a French mobile phone’s location without help from the French. Now it would appear that Verint have bypassed the territoriality requirement.With this latest news, we know that location tracking has become borderless in the same way as communications surveillance. The ability to do this has likely come from a focus on international phone systems rather than domestic or regional networks which would never reach the worldwide nature of location tracking Verint is advertising.

Some details on Verint’s SKYLOCK offering are available online (under the name ENGAGE). While the brochure seems to indicate this is solely a military product (the brochure cover only lists “Military, Special Forces, Navy, Search and Rescue, Border Control” and the photos contained show only military personnel), the inside notes make it clear these products are available to “law enforcement” as well.

As Privacy Int’l points out, Verint’s offering operates “independently of local service providers,” meaning pretty much every legal obstacle is demolished. What no one knows is going on won’t hurt them. One product is targeted at satellite communications, but even considering that limited scope, it’s still very powerful.

Here’s what ENGAGE/SKYLOCK can do:

– Intercept voice calls and text messages
– Decrypt A5/1 and A5/2 encryptions with an embedded decipher
– Operate undetected leaving no electromagnetic signature
– Selectively downgrade UMTS traffic to GSM

Other ENGAGE products target wireless communications. Verint’s intercept-in-a-box can do all of the following.

– Actively and passively intercept WiFi communications based on: 802.11 a/b/g/n, 2.4Ghz, and 5GHz
– Active interception of mobile handsets, even when not intentionally connected to a WiFi network
– Intercept target communication at a distance with zero packet loss
– Choose from multiple active interception methods to overcome encryption of private communication
– Identify access points and intercept MAC addresses in the area

Verint also gives its purchasers the power to target phones using 3G networks, remotely activate cell phone mics, and block cellular communication.

The capabilities that were presumed to only be in the hands of national intelligence agencies now can be had by nearly anyone who can come up with the money. Powerful cell phone surveillance products are a growth market. Anything that can increase data and communication harvesting while simultaneously eliminating a majority of legal restrictions and oversight practically sells itself.

We may feel this sort of power is OK in the “right hands,” but we don’t get to decide which hands this ends up in. We may believe the NSA should be able to do this sort of thing (overseas, preferably), but that local law enforcement agencies should be forced to jump through warrant and subpoena hoops before tracking locations and intercepting communications. But ultimately it doesn’t matter what we prefer. That call is made by Verint and it’s in the business of selling surveillance products, not protecting the privacy of the world’s citizens.

Filed Under: mobile phones, surveillance
Companies: verint

Disappointing: Google Releases… Then Removes Great Privacy Feature From Android

from the bring-it-back! dept

Peter Eckersley, over at EFF, has a disappointing blog post, noting that Google apparently released and then very quickly removed a really good privacy feature in Android. Basically, it would let users have much more granular control over what kind of data an app could access. Right now, when you install an app on Android, the system will tell you what kind of data it wants to access, and then you have to agree across the board, or not install the program. The new feature effectively gave users something of a line-item veto, blocking specific types of data access, while allowing others to go forward, so that people would still use the apps, but block certain attempts to access certain kinds of data they didn’t want that app to see.

Thus, it’s really unfortunate that Google so quickly removed such a great feature. Google claims the feature was “released by accident.” You could see how some app developers might be upset about such a feature, but hopefully not the good ones. If anything, this will drive app developers to be much more protective and careful both in how they design their apps and in how they explain the need for data access to users. As Eckersley notes, the right thing for Google to do here is to re-enable this feature. The fact that it released it, shows that they’ve actually been working on it and have the code. Hopefully, the true story for why it was removed was merely that the code wasn’t quite ready, and that the code will be returned in the near future. In the meantime, however, those who jailbreak or root their device can get the same functionality — but hopefully it will become standard on Android before too long.

Filed Under: android, privacy
Companies: google

In News That Will Surprise No One, NSA Has Cracked Mobile Phone Encryption To Listen In On Calls

from the duh dept

One of the latest reports from the Snowden documents over at the Washington Post falls more into the “well, duh” category than many previous reports. The NSA has easily cracked the A5/1 encryption used to encrypt mobile phone conversations on many GSM mobile networks. Of course A5/1 has been around forever, and others have shown that it’s not particularly secure for quite some time. But, it’s just a reminder that, yes, of course, the NSA could listen in on calls. Some networks do use more modern encryption, which is much harder for the NSA to crack, and it sounds like the recent revelations are leading at least some mobile operators to upgrade the encryption on their network. Still, at this point, it seems safe to assume that if you want to have a truly private conversation, you shouldn’t use a phone.

Filed Under: a5/1, encryption, mobile phones, nsa, privace