Revolving Doors And Regulatory Capture Are Ensuring E-Voting Remains An Insecure Mess

(Mis)Uses of Technology

from the we're-from-the-government-and-we're-here-to-secure-corporate-boardroom-p dept

Despite the long list of bad news generated by electronic voting machines, their market share only continues to grow. Rather than consider them the attack vectors they are, state and county legislators have decided to toss caution and paper ballots to the wind. The future is now. And it’s riddled with vulnerabilities.

Maybe there shouldn’t be a rush to digitize the democratic process, at least not while manufacturers are still shipping machines pre-loaded with security flaws and inadequate software. The push for e-voting machine deployment isn’t organic, of course. It’s an organized push that starts with the machines’ manufacturers and ends in regulatory capture.

Sue Halpern has exposed the paper trail connect voting machine manufacturers to ill-advised rollouts in her article for the New Yorker. The heaviest pushes target legislatures that make purchasing calls for the entire state. Most states allow the decision to be made at the county level, which decreases the chance the entire state will be affected by voting machine hacking or malfunctions. But in states like Georgia and Delaware, a successful pitch to the state legislature can mean hundreds of millions of dollars in sales.

The pay-for-play begins in the usual way: paid junkets that take state advisory boards to major cities for the usual wine/dine/schmooze-fests with all expenses paid. An investigation by McClatchy showed the Governor Brian Kemp’s chief of staff, David Dove, attended an event held by voting machine manufacturer ES&S (Election Systems & Software) — timed impeccably to capture the state’s $100 million voting machine market. To the surprise of no one, the state’s election commission decided to award ES&S this contract. But it had to do so over the voices of non-purchased stakeholders who saw nothing good in replacing one faulty e-voting machine with a similarly faulty product.

In doing so, the panel rejected the advice of computer scientists and election-integrity advocates, who consider hand-marked ballots to be the “most reliable record of voter intent,” and also the National Academies of Sciences, Engineering, and Medicine, which recommended that all states adopt paper ballots and conduct post-election audits.

This continued the proud Georgia tradition of voting machine vendor cross-pollination in the state legislature, which kicked off almost a two decades ago. In 2002, Diebold secured a $54 million contract to provide the state with voting machines. Diebold’s lobbyist was a former Georgia state official. When problems developed, ES&S stepped in, killing off legislation addressing election integrity issues and capturing a very key demographic.

In 2006, a bill requiring a verifiable paper record of each ballot, introduced in the Georgia legislature at the urging of election-integrity advocates, failed after the state’s elections director, Kathy Rogers, opposed it. Rogers, of course, later went to work for E.S. & S.

Another legislator took an extended trip through the lawmaker/lobbyist revolving door. Charles Harper went from sod farmer to state rep to lobbyist for ES&S before ending up as the deputy chief of staff in Governor Brian Kemp’s office. Brian Kemp, of course, spent the last election hastily patching voting machine vulnerabilities following the exposure of flaws, blaming the Democratic Party for the alleged hack, doxxing absentee voters, and, finally, overseeing voting integrity operations of an election he participated in.

Congress has tried to fix this problem… multiple times. It opened this year’s session with a 571-page bill full of reforms and paper ballot mandates. The problem is previous attempts to install these reforms have failed after receiving pushback from state officials. Voting machine vendors are focusing on states and counties, where the decisions (and purchases) are made. And it’s working.

Last year, the Democratic congressman Bennie Thompson, of Mississippi, proposed the Election Security Act; a year before, the Republican Mark Meadows, the chair of the right-wing House Freedom Caucus, introduced the Paper Act, which was endorsed by the former Department of Homeland Security Secretary Michael Chertoff and by Grover Norquist, the president of the conservative organization Americans for Tax Reform. The Senate’s attempt to reform election practices, last year’s Secure Elections Act, had bipartisan support, too, but was killed by the White House before it got out of committee.

You can’t remove money from politics and you can’t banish lobbyists from petitioning on the behalf of the causes and corporations they represent. But you can oust politicians who prefer corporations to constituents. Changes can be made and it all starts with those who serve their own interests rather than the public’s. Shining a light on regulatory capture is the first step.

Filed Under: brian kemp, e-voting, georgia, lobbying, regulatory capture

More Than Two Years After It Took Them, The FBI Still Won't Return Family Videos Seized During A Raid Of A Security Researcher's Home [UPDATED]

Legal Issues

from the making-life-miserable-for-citizens-just-because dept

UPDATE: Good news! Justin Shafer says the FBI has finally come up with a date to meet with him about the personal data/videos still in the agency’s possession. Hopefully, Shafer will have his stuff back shortly he meets with the FBI on February 15th.

The government isn’t done jerking around security researcher Justin Shafer quite yet. Shafer came across a bunch of dental patient information in an improperly secured database. This discovery led to the FTC levying a $250,000 fine against the software provider, Schein, for falsely portraying its faux encryption as actual encryption. After notifying affected parties, Shafer was thanked for his help with a raid by FBI agents.

This happened days after the FTC announced its settlement with Schein. FBI agents dragged Shafer outside of his house in his boxers at 6:30 in the morning and took every electronic device in the house except for his wife’s phone. His children were awakened by shouting men pointing guns at their parents.

This wasn’t the only time Shafer was raided. He was raided once more, again for suspicions he was engaged in illegal hacking, this time allegedly in conjunction with TheDarkOverlord. Neither of these two raids resulted in anything more than a bunch of seized electronics and Shafer’s family being taught to fear, if not hate, federal agents. No charges were brought as the result of these two raids.

This second raid led to Shafer directing his anger at the agent who had secured the search warrant, Special Agent Nathan Hopp. Following this raid, Shafer tracked down Hopp and Hopp’s wife via social media, engaging a series of unwise (but not actually threatening) confrontations with the agent’s wife. In one message to her, he implored SA Hopp’s wife to return video recordings of his children, which had been seized along with everything else.

This led to a third raid by FBI agents — this time in response to Shafer’s alleged “threats.” Shafer was released on bail, but quickly sent back to jail after he vented about his treatment by the FBI in an ill-advised blog post. Shafer spent eight months in jail before finally being released. The DOJ pursued a superseding indictment, most likely because its original indictment failed to impress the judge presiding over Shafer’s case.

The situation got even more petty and bizarre when the DOJ demanded Twitter hand over info of all accounts engaged in a conversation about Special Agent Hopp — one that culminated in Justin Shafer delivering an apparently threatening smiley face emoji. Most of the convo participants were easily identified, making this weird flex by the DOJ a vulgar display of stupidity and vindictiveness.

Last March, the cavalcade of petty stupidity finally came to a close. Well, almost. Shafer signed a plea agreement with the DOJ, pleading guilty to a single count of retaliating against a federal official. (The FBI’s multiple acts of retaliation against Shafer are apparently within the bounds of the law…) Shafer has finished his probation and done everything he’s supposed to, but the government isn’t holding up its end of the bargain.

According to his plea agreement [PDF], the government could choose to seize one specific set of data. Under “Financial Obligations,” the plea agreement specifies:

The Court may order the forfeiture of the Defendant’s interest in the following property: All electronically/digitally stored means of identification (other than the Defendant’s own) stored on electronic storages [sic] devices and/or media seized from the Defendant pursuant to the execution of federal search warrants.

The FBI has so far refused to return anything to Justin Shafer. The hard drives containing leaked patient data also contained more than 250 family videos. The FBI has made no move to forfeit anything else it seized. It has also said it will meet with Shafer to delete the patient information he downloaded during his security research. But ten months after broaching the subject, the FBI hasn’t set a date for returning Shafer’s personal files that were swept up along with the data the FBI sought.

On top of that, the court never ordered the forfeiture of the leaked patient data, so the FBI technically can’t even keep that. Understandably, the feds may move for forfeiture of this specific data if Shafer tries to get it back, but for now, it doesn’t really have any legal basis to hold onto anything it seized during the May 2016 raid that started the ball rolling on this debacle.

The FBI should have returned everything it wasn’t authorized to keep once it had a signed plea deal in hand. It has no use for anything found on any of the seized devices, especially since it undoubtedly knows where to find and remove the patient data the court says Shafer shouldn’t have back. But ten months later, it has made no move to return the files it seized, which include 250 family videos of no possible interest to the FBI.

There’s no reason the FBI can’t just hand over everything but the patient data without making Shafer and his legal rep jump through a bunch of hopps hoops. But it seems the FBI isn’t through with Shafer. Given the history on display here, the lack of forward motion by the agency that raided Shafer’s home three times but only managed to walk away with single (bullshit) count of retaliation via threatening a family member (read the law and the indictment to see why this charge is bullshit) can only be seen as vindictive.

The entire picture is ugly: reported data breaches were treated as criminal acts by an agent with too much free time and a vivid imagination. When his (repeated) target lashed out, the DOJ expanded past its fantasies of a Shafer-DarkOverlord partnership to punish Shafer for stupid, but not truly threatening, internet activities. Now it’s sitting on his personal belongings because it can, not because it needs to.

Filed Under: doj, fbi, justin shafer, raids, seized items

California Cops Continue To Pretend New Public Records Law Allows Them To Erase Years Of Past Misconduct From The Record

Legal Issues

from the and-yet,-people-continue-to-distrust-cops.-it's-a-mystery. dept

On January 1st, a California law went into effect turning long-shielded police misconduct records into public records. Prior to its enactment, at least one law enforcement agency executed a mass purge of older records, preemptively stunting the law’s effectiveness.

The law has also faced legal challenges from California police unions and law enforcement agencies seeking a declaration that the law is not retroactive and PDs should only have to release misconduct records created past the date of the law’s effectiveness. The state Supreme Court declined an invitation to review the law, but three police unions in Contra Costa County have managed to secure a temporary restraining order while this aspect of the law is sorted out.

The law doesn’t contain any language suggesting it does not apply retroactively. But it also doesn’t contain any language specifically stating it applies retroactively and that’s the wedge law enforcement agencies are trying to drive between themselves and their new obligations to the public. But the lawsuits aren’t just coming from the law enforcement side. Agencies are now being sued for failing to turn over documents the new law says the public can obtain.

In a legal test of a new state law requiring the release of police records in shootings and other cases, The Sacramento Bee and the Los Angeles Times jointly sued the Sacramento Sheriff’s Department Friday, charging that the department is refusing to follow the statute that requires the release of records on deputies who fired their weapons or engaged in misconduct on duty.

The papers sought records of officer-involved shootings dating back to 2014. The Sheriff’s Departments responded by saying it had no obligation to turn over records created prior to January 1, 2019 and would not do so until it had “clear legal authority” to release them. This lawsuit [PDF] forces the issue, putting it on the court’s timetable, rather than the Sheriff’s.

As the plaintiffs point out, it’s not just transparency activists reading the law as retroactive. It’s also one of California’s largest police unions.

Respondent has taken the position that Senate Bill 1421 does not apply to the records requested “so only records of covered events occurring on or after January 1, 2019 will be disclosed.” (See Exhibit B; Exhibit D.) Respondent is mistaken. Indeed, even an opponent of Senate Bill 1421, the Los Angeles County Professional Peace Officers Association (“LACPPOA”), admitted, “Moreover, our reading of Senate Bill 1421 is that making the records of an officer’s lawful and in policy conduct is retroactive in its impact. In other words, notwithstanding that the officer’s conduct was entirely in policy, his or her records are available for public inspection irrespective of whether or not they occurred prior to the effective date of SB 1421.”

The state’s courts are going to be filling up with similar filings from both sides over the coming weeks. This should hopefully expedite erasing the supposed ambiguity from the law. Hopefully, the courts will consider the intent of the law’s crafters, which was to give the public access to police misconduct records to better the police/public relations. This is clearly stated in the legislation itself:

SECTION 1.

The Legislature finds and declares all of the following:

(a) Peace officers help to provide one of our state’s most fundamental government services. To empower peace officers to fulfill their mission, the people of California vest them with extraordinary authority — the powers to detain, search, arrest, and use deadly force. Our society depends on peace officers’ faithful exercise of that authority. Misuse of that authority can lead to grave constitutional violations, harms to liberty and the inherent sanctity of human life, as well as significant public unrest.

(b) The public has a right to know all about serious police misconduct, as well as about officer-involved shootings and other serious uses of force. Concealing crucial public safety matters such as officer violations of civilians’ rights, or inquiries into deadly use of force incidents, undercuts the public’s faith in the legitimacy of law enforcement, makes it harder for tens of thousands of hardworking peace officers to do their jobs, and endangers public safety.

Nothing in that language suggests legislators wanted to reset the clock on January 1st, giving all law enforcement officers a clean slate going forward. The intent of the law is not to erase past misconduct. That doesn’t serve its ultimate purpose, which is to restore the “public’s faith in the legitimacy of law enforcement.” Reading the law the way police unions want it read will only further deteriorate this ailing relationship.

Filed Under: california, discipline, foia, police, records, transparency

Chinese Court Creates App To Alert Citizens Of Deadbeat Debtors In Their Area

(Mis)Uses of Technology

from the ENJOY-YOUR-IMPROVED-CITIZEN-EXPERIENCE dept

No one’s ever going to confuse China for a free and open country, but it seems like the government is trying just a bit too hard to let citizens know they belong to the government, rather than the other way around.

Just recently, the government began engaging in door-to-door censorship, sending cops to citizens’ houses to order them to delete forbidden tweets. That’s certainly not going to help the tweeter’s Citizen Score — a dystopian credit score that takes far more than debt into account to measure the worthiness of the country’s billion-plus citizens. The score tracks purchases, social circles, and online opinions to raise and lower scores. Certain purchases will raise scores while others that the government doesn’t consider worthwhile (like videogames) will lower it.

It’s far worse than that, though. Low-scoring members of your social circle can lower your score as well, forcing people to ditch their unhelpful friends and replace them with people more closely aligned with the government’s preferences. There are perks attached to higher scores, which basically give citizens the privilege to travel after they’ve proven themselves worthy servants of the state.

On top of that, there’s the pervasive surveillance. Facial recognition tech is everywhere, used to do everything from fine jaywalkers to lock people out of public housing. The government has plans to erect 600 million CCTV cameras to ensure nothing citizens do in public goes unobserved.

The latest addition to the government’s citizen repression toolkit is something that would break a reader’s suspension of disbelief if were included in dystopian sci fi novel:

The Chinese Government has developed a mobile app that tells users if they are near someone who is in debt. The app, called a “map of deadbeat debtors,” flashes when the user is within 500 meters of a debtor and displays that person’s exact location.

Should anyone want to name/shame/report Hot Deadbeats In Their Area, they can obtain the app from the WeChat platform. WeChat is in the process of being converted into a national ID system by the government, which will certainly help it tabulate citizen scores and out undesirables. With more than one billion Chinese users, WeChat has the ability to turn a communications platform into one-stop shop for data, communications, and personal info of a large percentage of the population.

At this point, the deadbeat app only affects a single province. This is due to it being the product of a court ruling, rather than a Chinese government mandate.

Deadbeat debtors in North China’s Hebei province will find it more difficult to abscond as the Higher People’s Court of Hebei on Monday introduced a mini-program on WeChat targeting them.

The article from China News is brief but it suggests the court has decided to outsource debt collection for fines and fees, as well as the enforcement of judgments against debtors secured by debt collection entities. But the court does know how to project the same cheery “for the good of the people” facade that accompanies every step the Chinese government takes towards all-encompassing dystopia.

“It’s a part of our measures to enforce our rulings and create a socially credible environment,” said a spokesman of the court.

Yep. There’s no society more credible than a population turned against itself.

Filed Under: china, deadbeats, debtors, locations technology, privacy, surveillance
Companies: wechat

The Criminal Justice System Is Relying On Tech To Do Its Job And That's Just Going To Make Everything Worse

(Mis)Uses of Technology

from the laying-the-groundwork-for-human-misery dept

The criminal justice system appears to be outsourcing a great deal of its work. On the law enforcement side, automatic license plate readers, facial recognition tech, and predictive policing have replaced beat cops walking the streets and patrolling the roads. Over on the judicial side, analytic software is helping make sentencing decisions. This is supposed to make the system better by removing bias and freeing up government personnel to handle more difficult duties algorithms can’t handle.

As is the case with most things government, it works better in theory than in practice. ALPRs create massive databases of people’s movements, accessible by a hundreds of law enforcement agencies subject to almost zero oversight. More is known about facial recognition’s failures than its successes, due to inherent limitations that churn out false positives at an alarming rate. Predictive policing is the algorithmic generation of self-fulfilling prophecies, building on historical crime data to suggest future crimes will occur in high crime areas.

While the judicial side might seem more promising because it could prevent judges from acting on their biases when handing down sentences, the software can only offer guidance that can easily be ignored. That and the software introduces its own biases based on the data it’s fed.

The logic for using such algorithmic tools is that if you can accurately predict criminal behavior, you can allocate resources accordingly, whether for rehabilitation or for prison sentences. In theory, it also reduces any bias influencing the process, because judges are making decisions on the basis of data-driven recommendations and not their gut.

You may have already spotted the problem. Modern-day risk assessment tools are often driven by algorithms trained on historical crime data.

As we’ve covered before, machine-learning algorithms use statistics to find patterns in data. So if you feed it historical crime data, it will pick out the patterns associated with crime. But those patterns are statistical correlations—nowhere near the same as causations. If an algorithm found, for example, that low income was correlated with high recidivism, it would leave you none the wiser about whether low income actually caused crime. But this is precisely what risk assessment tools do: they turn correlative insights into causal scoring mechanisms.

Correlation is not causation. Past performance is not indicative of future results. And an individual being sentenced is not the average of 20 years of historical crime data. The software may steer judges away from personal biases, but it creates new ones to replace them. It’s a lateral “improvement” that does little more than swap the inputs.

Once you’ve got a system brought up to speed on garbage in, the biases multiply and perpetuate. Sentencing decisions based on biased data generate more bad data for the sentencing software… which then leads to successively harsher sentences for the same criminal act with each iteration. As the recursive data rolls in, the sentencing recommendations will justify themselves because who can argue with raw data?

This is not to say tech should not be used by the criminal justice system. It’s that it needs to be subject to rigorous oversight and its employers made aware of its limitations, including its innate ability to reinforce biases, rather than remove them. This isn’t something to be taken lightly. The lives and liberties of Americans are literally at stake. Taking a hands-off approach to tech deployment is highly irresponsible, and it indicates those in power care very little about what happens to the people they serve.

Filed Under: algorithms, criminal justice, technology

Guy Who Forged A Court Order To Delist Content Issues More Bogus Takedown Notices To Remove Posts Discussing His Forgery

Legal Issues

from the when-your-logic-is-a-flat-circle dept

The wholly-expected has occurred as a result of Eugene Volokh’s exposure of bogus takedown demands targeting unflattering content — like criminal complaints and factual news articles detailing criminal acts. The Volokh Conspiracy has been targeted by two bogus takedown requests by the same party who engaged in the bogus takedown requests Volokh previously wrote about.

The first one received targeted a post of Volokh’s hosted at the Washington Post. Hilariously, it claims Volokh is the real troll here.

A group of trolls/rivals are continually targeting us and creating copied content to bully, defame, and threaten our business and staff. Also, there is same content has been posted on different sites. The respective links of the copied content are mentioned below.

That’s not what DMCA notices are for, even if any of these assertions were true. But none of it is true, starting from word one. The publication of a criminal complaint cannot be defamatory, and in no way did Volokh “bully” or “threaten” Don Lichterman, who previously forged a court order to try to remove content detailing him being sued for copyright infringement. Volokh covered this case, as he has several others where the same tactics (forged court documents) have been used.

The DMCA notice doesn’t even claim there’s been any copyright infringement. I guess that’s a good thing, considering one of the URLs targeted links to the criminal complaint filed against Lichterman for forging a court order.

The second notice is a bit more on point, even though it’s no more honest than the first one. This one is a delisting request tied to a court order, so there’s no abuse of the DMCA process. That being said, the court order doesn’t say what Lichterman wants it to say. Here’s Volokh’s summation of the second bogus takedown attempt.

As best I can tell, the theory behind the deindexing request is that this order somehow requires that Mr. Lichterman’s name be redacted from the Criminal Complaint, and that therefore my post, which links to a copy of the complaint, should be deindexed. But of course nothing in this order so requires: It appears that the court ordered that the presentence report remain sealed (as is normal with such reports), and required the removal of information from certain “sentencing submissions” — but it says nothing about the Criminal Complaint, which is a public document. (The Complaint was originally filed under seal, but was unsealed a few weeks later, as the prosecution began.)

The Lumen Database’s post of the takedown request sums up the problem with this request a little more succinctly (although it’s unclear whether Google added this or Lumen did):

This Judgment does not apply to search engine providers, including Google Inc.

Not only is Lichterman wrong about the contents of the court order (perhaps deliberately wrong), but he’s wrong about who it actually affects. Lichterman is unclear about a lot of things and seems to assume just forwarding a court order referencing sealed documents should be enough to push Google into action.

But these tactics have been used too often to be effective anymore. Multiple sites have covered fraudulent takedown notices — some including forged court documents and others involving entirely falsified lawsuits snuck past inattentive judges. A rogue strain of “reputation management” emerged over the last few years — one that operates using nothing but disreputable tactics. Google is paying more attention to claims targeting press coverage of criminal actions or other unflattering content and, for the most part, has refused to humor these bogus requests.

All Don Lichterman has succeeded in doing here is draw more attention to his prosecution for forging court documents. He’s only bullying himself.

Filed Under: censorship, copyright, defamation, dmca, don lichterman, eugene volokh, fake lawsuits, takedowns
Companies: google

NY Governor Offers Journalists A Gift No Journalist Would Be Interested In Receiving

Journalism

from the stop-trying-to-help dept

File under: Things No One Asked For

In case you can’t read/see the tweet, it’s New York governor Andrew Cuomo threatening to enact a #JournalistsLivesMatter law — something no journalist has ever suggested they might want.

Let’s make assaulting the press a felony in New York State. Last year saw heinous and deadly attacks against members of the press, journalists must be protected from the threat of physical harm for just for doing their jobs.

While it’s refreshing to see a political figure think someone other than law enforcement might need a little extra protection, sentencing enhancements that only apply when certain people are assaulted or killed is never the answer. The state already has a law against assaulting journalists. It’s called assault. And in certain cases, it can be felony. (Which, ironically enough, happens anytime anyone assaults a cop in New York.)

There’s no reason for journalists to be afforded extra protections just because of their job. If it doesn’t make sense for cops, it doesn’t make sense for journalists. A profession is not a race, gender, or religious persuasion. Hate crime laws make very little sense themselves, but at least they address the fact people may be targeted for aspects about themselves they have no control over. Journalists and cops don’t need to be journalists and cops. A person’s race is not a choice and they can be targeted for abuse and physical attacks simply for being the wrong color.

But there’s a disturbing aspect to this proposal you won’t find in Blue Lives Matter laws: the government gets to pick and choose who’s a journalist. That’s something we really don’t want the government to be doing because it invites direct intervention in First Amendment protected activities.

We’ve already seen some legislators attempt to do this while pushing for shield laws. While it’s a good idea to leave journalists unmolested by government agencies — especially in light of Attorney General nominee William Barr’s remarks during his confirmation hearing — the laws allow the government to decide who’s a journalist and who can be forced to turn over sources without repercussion.

Journalism is an action as much as it is a profession. WikiLeaks personnel should be eligible for shield law protections as should a local blogger who covers small town political issues. Anyone continuously pestering the government with FOIA requests is engaged in journalism, even if all they do is dump the documents in the public domain with a minimum of commentary. Shield laws — and Cuomo’s severe misreading of the room — make journalism just a bit riskier by giving the government the power to decide who’s qualified to bring you the news.

Filed Under: andrew cuomo, journalism, journalists, journalists lives matter, new york

French Defense Secretary Says Country Is Willing To Fire First In Cyber Wars

(Mis)Uses of Technology

from the only-good-things-can-come-of-this dept

Over the past few years, politicians and intelligence officials have floated the idea of hacking back. When not pushing the idea of treating cyber wars like declarations of actual war, these officials have seen nothing wrong with hacking back against cyberattackers or allowing private companies to do the same.

It may seem like there’s nothing wrong with a “best defense is a good offense” theory of deterrence, but it’s not that simple. First of all, attribution is often more difficult than these officials imagine. Hacking back against the wrong party is only going to escalate tensions. At worst, it could result in international incidents where those hacking back have broken laws in other countries. At best, it will just become another forever war countries throw money at — one that’s sure to result in expanded government power at the expense of the taxpayers, both in terms of tax dollars and civil liberties.

France has been scratching its itchy trigger finger for awhile now. Roughly a year ago, the government shot down a proposal giving private companies the right to retaliate against cyberattacks. It felt doing so would only lead to further “instability in cyberspace.” That assessment is likely correct. But the French government apparently only felt private hack backs would lead to instability. If the government did it, no such instability should occur… apparently.

As far as offensive actions are concerned, the [Strategic Review of Cyberdefense] may not want companies to unleash hack-backs after an online attack, but it does want to keep that option open for the French authorities.

Not sure how a government-run cyberattack would lead to greater stability, but there you have it. The French government is apparently so confident in its ability to carry out non-destabilizing cyberattacks that it’s not even going to wait around to get hacked first. Defense Secretary Florence Parly had this to say at a recent cybersecurity forum:

“The cyber weapon is not only for our enemies,” said France’s defence secretary this afternoon, speaking through a translator. “No. It’s also, in France, a tool to defend ourselves. To respond and attack.”

Her remarks will be seen as moving the debate about offensive cyber capabilities – not just so-called “active defence” but using infosec techniques as another weapon in the arsenal of state-on-state warfare – to a new level. Coming from a prominent NATO member and EU country, it could set the tone for future discussion of nation states’ offensive cyber doctrines.

If France is going to start a cyberwar, it’s not going to do it alone. Parly also called for “more cooperation and partnerships” from other European governments, suggesting their asses will also be on the line if France kicks off WWIII/CyberWar I with a misdirected cybersortie. While Parly is correct in her assessment that cyber threats are border-less, it seems a little audacious to suggest everyone else is obligated to bail you out if you take the lead in hacking forward.

Filed Under: cyberattacks, first strike, france, hack back