John Scott-Railton Profile picture
Oct 5 10 tweets 5 min read Read on X
CATASTROPHIC: Chinese hackers massively wiretapped 🇺🇸USA by compromising the interception portals mandated under US law.

Remember this the next time a government demands encryption backdoors.

By: @bysarahkrouse @dnvolz @aviswanatha @bobmcmillan h/t @RonDeibert

READ: wsj.com/tech/cybersecu…Image
Image
Image
Image
Manufacturers of networking and phone gear must follow specific standards for 'lawful interception' in different jurisdictions (e.g. CALEA & ETSI's standards)

But as we learn time & time again, the scope of potential access & harm almost never matched by efforts to detect & block malicious use.Image
There's constant pressure from governments to bake-in systems for access.

Failure to comply with those demands is met with big sanctions. Just look at Durov.

Yet I predict that there will be zero meaningful accountability over this breach.

When commercial entities build systems that capture or can access mass data, hackers & intelligence services will come for them.

Whether it's for advertising or lawful interception.

They will get breached. It's just a matter of when.

Image
History note: Remember the 2004-2005 #Greek wiretapping case?

Wiretapping functionality in Vodafone's @ericsson switches was exploited to duplicate Greek gov calsl to prepaid phones, likely by a certain foreign government.

Perhaps #China thought it would be funny to recycle a plot line.

en.wikipedia.org/wiki/Greek_wir…Image
Image
Image
Image
The real story of the SALT TYPHOON compromise is one of recklessness & prioritizing access over security again & again.
We must not keep all our national security eggs in Verizon & ATT's baskets.

Legacy carriers & ISPs keep proving to us that protecting & securing our data is just not a priority.

More encryption in more places & privacy-focused companies are both sorely needed.
Pardon the interruption while every civil liberties advocate points out that they've warned about this for decades👇

Regularly scheduled programming of officials demanding backdoors & making unrealistic promises of safety will return shortly.

Personal observation: Anyone else notice that when backdoor hawks leave government... many moderate or shift their positions on surveillance and interception?

I believe that the give us access position with a blindness to downside risk & abuse potential is a side effect of having power. An arrogance of the position.

And when you lose it, the issue reframes towards reality. And the lessons of history.
Reflect on the volume of discussion of a TikTok as a national security threat to the US from #China.

At least we've got a choice of whether or not to install it.

Yet with China's compromise of US lawful intercept portals, we're all stuck in that data. No choice.

But I predict no similar outrage or congressional hearings.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with John Scott-Railton

John Scott-Railton Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @jsrailton

Oct 3
BREAKING: @Microsoft & @TheJusticeDept take simultaneous action against 🇷🇺Russian FSB-backed hacking group.

#StarBlizzard/ #ColdRiver has been targeting a wide swath of US officials & civil society.

Sweet moment because civil society played a key role in the lawsuit. Thanks to @NonprofitISAC & our partner @accessnow, voices of victims from our collaborative investigation into the spear phishing operation were included. 1/Image
Image
Image
Image
2/ Back in August we @citizenlab alongside our partners
@accessnow w/@DeptFirst, Arjuna Team & RESIDENT.ngo published a collaborative investigation into Russian gov-backed phishing.👇

The clever attacks were causing harm around the world.
x.com/jsrailton/stat…
3/ The Russian spear phishing that we tracked used techniques honed from years of targeting civil society.

& years of adapting to technical countermeasures.

And it persisted targeting civil society & journalists, despite recent naming & shaming.

Read 7 tweets
Sep 16
NEW: fresh 🇺🇸US sanctions dropping on mercenary spyware industry.

Biden administration just fired a 2nd salvo against the #Intellexa consortium, which sells #Predator spyware.

The spyware is linked to human rights abuses around the globe & was used to target US officials. 1/

home.treasury.gov/news/press-rel…Image
Image
Image
Image
2/ Back in March, US first used ‘big gun’ @USTreasury sanctions against #Intellexa.

It was precedent-setting & sent a chill through the spyware industry.

Today’s sanctions against yet-more Intellexa people read as the US saying "can you hear me yet?"
3/ Quick review of some ways that the Biden Harris administration has been tackling the problem of mercenary spyware proliferation:

Targeted Actions against bad companies:
Big headache
✅@CommerceGov Entity Listing
(Now US companies can't sell you products)

Migraine
✅ @StateDept Visa Bans
(You aren't coming to the US)

Cluster Headache
✅@USTreasury Dept Sanctions
(Your assets are blocked, good luck banking anywhere)

Executive Actions
✅ The 2023 Executive Order
(The big US market is closed to spyware companies enabling human rights abuse & natsec harms)

Diplomatic Efforts
✅ 2023 Joint State on Commercial Spyware
(Wide set of norms on stopping misuse, consequences for bad companies & transparency + oversight)
✅ Participation in other countries efforts (e.g. UK/FR-led Pall Mall Process)Image
Image
Image
Image
Read 6 tweets
Sep 1
If you collect it, they will come.

Investigators will eventually identify any consumer product that persistently records people's activities.

One day, they'll show up, requesting access.

If the data is consistently helpful, they'll stop asking & start demanding.

Once this happens enough the company will probably create a law enforcement portal to simplify access & save customers the trouble...🧵Image
2/ So many companies build consumer products with inherent pervasive surveillance collection without planning for the inevitable moment when demands begin coming in.

If you collect it, the demands will always come.

When you don't anticipate this moment in how you balance your design decisions, you expose yourself & your consumers to a lot of pressure. And introduce society to new kinds of surveillance.

It's an ethical conundrum in societies with a rule of law and judicial oversight.

And it is entirely more ominous when your product reaches countries that have none of that.
3/ Transparency: reworked the thread since folks flagged that I'm not the only person that likes "if you collect it, they will come" to describe risks from data collection:

Some spots it shows up in, there are surely more I couldn't find with a quick search:

- ISC2 contributor mgorman discussing risks from Google's Sensorvault

-Whitney Merrill(@wbm312) discussing risks from COVID data collection👇

-The Irreal Blog, in an interesting post about search warrants

-Me, quoted in "Cybersecurity and Humanitarian Organizations - On a Collision Course?" (Amaral & Verity, 2018).


community.isc2.org/t5/Tech-Talk/I…
irreal.org/blog/?p=10054
reliefweb.int/report/world/c…
Image
Image
Image
Read 4 tweets
Aug 25
WARNING: Account impersonating the popular @harris_wins now has a blue check.

Top result is a copycat with 72k+ followers that spreads inflammatory falsehoods.

Genuine account isn't even the first search result. Please report: ❌@kamala_wins47Image
Image
Image
Image
2/ This copycat regularly & misleadingly claims censorship to request amplification.

Over 200k people saw this particular misinformation, thousands more amplified it.

The account should never have been verified, and it astonishes me that @Safety hasn't pulled it yet. Image
3/ More false claims every few hours = more dilution of reality & partisan polarization.

All to sell... mugs & shirts.

Tip: you can find some related accounts by searching for "bestusatee" (online storefront this spammer is using)

Image
Image
Read 5 tweets
Aug 25
Misunderstandings about #Telegram & encryption are already shaping the conversation about Pavel Durov's detention. So, here's a primer.

Telegram is often seen as an "encrypted messenger" but for many users it functions a lot more like an unencrypted social network. 1/
2/ Remember, most #Telegram features are not end-to-end-encrypted, e.g.:

No e2e encrypted by default:
❌Regular messages

Never e2ee:
❌ Groups
❌Channels

E2ee only when you opt into:
✅ Secret chats

If you see an❌ this means that Telegram can/could access the contents.
3/ Absence of end-to-end encryption across much of the platform means #Telegram has the keys & could technically be compelled to moderate & give governments access to that user activity.

The potential for access inevitably draws gov attention to #Telegram & CEO Pavel Durov.
Read 6 tweets
Aug 21
NEW: Researchers find microplastics in human brains.

Moreover, shards of microplastics in autopsied brain tissue increased between samples collected in 2016 vs. 2024.

Frontal cortex tissue (executive function, learning & memory, judgement...) concentrations were 7-30x those previously found in livers & kidneys.

Incredibly alarming potential implications for #AlzheimersDisease, dementia, blood brain barrier health etc.

Caveats: early days in methodology for spotting & characterizing these particle loads & understanding their impacts on brain health.

And that's just focusing on the physical particles.

There's a whole second disturbing tier of questions around what potentially toxic compounds like plasticizers will leach from #microplastics, especially as the particle size gets smaller.

Preprint: ncbi.nlm.nih.gov/pmc/articles/P…Image
Image
Image
Image
2/ There doesn't appear to be a place on earth that hasn't got a microplastics load.

Dust in the atmosphere? Yep. The ocean? Yep. Creatures in it? Yep. Ocean breezes by the seashore? Yep.

Now our brains.

It's like the radioisotopes from atmospheric nuclear testing. Only there's no test ban in sight, and more are pouring into the ecosystem with every moment.

But the impact on us and our world are shockingly ill- understood.
3/ There is no home test for #microplastics.

If it existed, people would be demanding action.

We are in a honeymoon of mostly-ignorance.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(