More about India App Banning
July 23, 2020
India and China are not likely to hold a fiesta to celebrate the digital revolution in the next month or two. “Government Said to Ask Makers of 59 Banned Chinese Apps to Ensure Strict Compliance” explains that India has some firm ideas about the potential risks of Chinese-centric and Chinese-developed mobile applications. The risks include actions “prejudicial to sovereignty, integrity and security of the country.”
The write up states:
If any app in the banned list is found to be made available by the company through any means for use within India, directly or indirectly, it would be construed as a violation of the government orders…
It is not clear what action the Indian government can take, but obviously the issue is perceived as important; specifically, the accusation relates to the:
stealing and surreptitiously transmitting users’ data in an unauthorized manner to servers which have locations outside India.
Among the nearly 60 banned apps are:
- Club Factory
- TikTok
- UC Browser
- Xiaomi
Plus, some less high profile services:
- Bigo Live
- CamScanner
- Helo
- Likee
- Shein
There will be workarounds, of course. It is not clear if a citizen persists in using a Xiaomi phone and its baked in apps (some of which route interesting information through data centers in Singapore) what the consequences will be.
Censorship of the Internet is thriving and becoming an active measure in India and other countries. Why? Because Internet, of course.
Stephen E Arnold, July 23, 2020
Data Flow: Getting More Expensive and Non Real Time
July 22, 2020
DarkCyber does not have a dog in this fight. We want to point you to “Top EU Court Ditches Transatlantic Data Transfer Deal.” The write up states:
Europe’s highest court ruled on Thursday [July 16, 2020] that a transatlantic data transfer deal is invalid because of concerns about US surveillance in a decision that could disrupt thousands of companies that rely on the agreement. The ruling effectively ends the privileged access companies in the United States had to personal data from Europe and puts the country on a similar footing to other nations outside the bloc, meaning data transfers are likely to face closer scrutiny.
There are work arounds; however, these add bureaucratic friction and mean that real time data access may be less real time. “Old” data is often “useless” data.
Stephen E Arnold, July 22, 2020
Google May Want to Spin Up Some New Jargon
July 20, 2020
Marketwatch published “Barr Blasts Apple and Google As All Too Willing to Cooperate with China.” The report states:
The criticism of U.S. companies came amid a broad speech on China, in which Barr said the Chinese Communist Party was seeking to “make the world safe for dictatorship” and accused China of waging an “economic blitzkrieg” against the U.S. in a bid for global dominance.
How has Google responded? We noted “Google’s Mission Is to Get Technology to More People: Sundar Pichai”, which is a short video. The article stated:
Google and Jio “would work together to increase internet access for millions of Indians, who do not currently have a smartphone, while improving the mobile experience for all.”
With testimony looming before Congress, Google’s alleged “fraternizing” with a country on the radar of the Attorney General and positioning investments in India as a way to improve “the mobile experience for all” does not capture several nuances about the 21st century of the Google:
- Google needs eyeballs to sell ads in order to keep Wall Street and stakeholders content. So “advertising.”
- Google appears to be keen on finding some way to generate revenue directly or on the periphery of the “China market.” So a country Google suggested change cannot kick the habit of thinking about revenue from the world’s largest market.
- Google seems somewhat disconnected from the increased scrutiny individuals like Mr. Barr are giving the company with the great booth give away: A Googley mouse pad.
Net net: A different PR spin may be needed. Hint: “For all” may connote Google advertising.
Stephen E Arnold, July 20, 2020
Once Again: NSO Group Becomes a Magnet for Real Journalists
July 16, 2020
We spotted one of those “We don’t have or can’t tell you where we got this information” write ups. The article is “Source: Spain Is a Customer of NSO Group.” The main idea of the article is that a government licensed software developed for … wait for it … governments. According to the “source” with some inputs from other real news outfits like The Guardian and El Pais, the NSO Group’s specialized software was used to obtain information about … wait for it … politicians in Spain.
The write up states:
The cell phones of several politicians in Spain, including that of the president of one of the countries’ autonomous regional parliaments, were targeted with spyware made by NSO Group, an Israeli company that sells surveillance and hacking tools to governments around the world, according to The Guardian and El Pais . Motherboard confirmed the specifics with security researchers who investigated the attempted hack and a Facebook employee who has knowledge of the case.
Interesting. But a couple of questions come to mind:
- Was the alleged use of the software a complement to an investigation; for example, inciting civil unrest?
- Was the alleged use of the software gathering data on matter one and obtained information on a collateral or unrelated matter two?
- Why aren’t the sources identified? Policy or some special rules of “real” journalism that elude me?
The disclaimer “We cannot confirm whether these specific attempted hacks” does nothing to alter my perception of the article; to wit: The article wants to draw attention to a particular specialized software developer and connect that company to the alleged use of the software by a licensee of the software. How’s that work? Consider the manufacturer of a knife. The purchaser of the knife uses it to kill an intruder. Is the knife manufacturer responsible? What applies to companies which are in the business of developing specialized software tools is different from the knife manufacturer.
I want to point out the Bank Info Security reported that an Israeli court dismissed a complaint against the NSO Group. Amnesty International accused the NSO group of violating human rights. On the surface, it seems that the allegations of Amnesty International were found to be without much heft.
The real question is, “Why are outfits like Vice and Amnesty International chasing NSO Group?”
DarkCyber has some hunches about the “why”? For example:
- Companies which develop specialized services and operate in a classified or community environment populated by government customers are somehow offensive to the “real” journalists. Is this a factor? Sensibilities are activated.
- The “real” journalists are just now realizing that those charged with enforcing the laws of countries are using specialized tools for investigations or addressing challenges which in the opinion of the government customers threaten civil order. This “sudden discovery” is like a child’s getting a new toy for her birthday. By golly, that toy is going to get some attention because it is novel to the childish mind.
- The “real” journalists are trying to come up with “news” which is stale, routine, and institutionalized in government entities throughout the world. The focus, however, is one the producer of specialized software, not on the specific government entity licensing the software.
DarkCyber believes the truth is closer to the child’s fascination with what the child with its immature perception sees as mesmerizing.
News flash for the “real” journalists: Chasing vendors of specialized software may not be the revenue and attention magnet for which the publications hunger. Plus, there may be some unintended consequences of speculative writing about topics presented without context.
Stick with facts and identified sources. Could the NSO Group articles be converted into a Quibi program? Advance the “real” agenda with short video. Worth a shot? Sources may not be needed for a short form Quibi thing.
Stephen E Arnold, July 16, 2020
Google, TikTok, and Seriousness
July 15, 2020
Short form video is in the news. TikTok captivates millions of eyeballs. Many of these eyeballs belong to Americans. Most of these Americans choose not to understand several nuances of “free” 30 second videos created, transmitted, viewed, and forwarded via a mobile device; to wit:
- Software for mobile phones can covertly or overtly suck up data and send those data to a control node
- Those data can be cross correlated in order to yield useful insights about the activities, preferences, and information flowing into and out of a mobile device equipped with an application. Maybe TikTok does this too?
- Those digital data can be made available to third parties; for example, advertising analytics vendors and possibly, just maybe, a country’s intelligence services.
The Information published one of those “we can’t tell you where we got these data but by golly this stuff is rock solid” stories. This one is called “TikTok Agreed to Buy More Than $800 Million in Cloud Services From Google.” Let’s assume that this story about the Google TikTok deal is indeed accurate. We learn:
Last week, though, word surfaced of a buzzy new customer for Google Cloud—TikTok, the app for sharing short videos that is the year’s runaway social media hit. The deal is a lucrative one for Google Cloud, The Information has learned. In a three-year agreement signed in May 2019, TikTok committed to buying more than $800 million of cloud services from Google over that period…
What’s with the Google? Great or lousy business judgment? Does Google’s approach to a juicy deal include substantial discounts in order to get cash in the door? Is the deal another attempt by the Google to get at least some of the China market which it masterfully mishandled by advising the Chinese government to change its ways?
Nope. The new Google wants to grow by locking down multi year contracts. The belief is that these “big deals” will give the Google Cloud the protein shake muscles needed to deal with the Microsofties and the Bezos bulldozer.
New management, new thinking at the GOOG, and there will be more of the newness revealed with each tweak of a two decades old “system.”
At the same time as the Information “real” news story arrived in the DarkCyber news center, a pundit published MBA type write up popped into our “real news” folder. This write up is “The TikTok War.”
Unlike the Information’s story, the Stratechery essay is MBA consultant speak, which is different from “real news.” The point of the 3,900 word consultant report is:
I believe it is time to take China seriously and literally…
There you go: An MBA consulting revelation. One should take China seriously and literally.
Okay. Insight. Timely. Incisive.
From this conclusion, TikTok’s service is no longer appropriate in the US. Banning is probably a super duper idea if I understand the TikTok War. (How does one fight a war by banning digital information? Oh, well, irrelevant question. What’s that truism about ostriches putting their heads in the sand? Also irrelevant.)
Let’s step back and put these two different TikTok articles in a larger context.
The Information wants everyone to know that a mysterious “source” has said that Google has a three year deal with TikTok. This is a surprise? Nope. Google is on the hunt for cash because after Google’s own missteps, it is faced with hard to control costs and some real live “just like Google” competitors; namely, Amazon, Apple, Facebook, and Netflix. There’s also the mounting challenges of political and social annoyances to add some spice to the Googlers’ day.
The MBA consultant analysis points out that China has to be taken seriously. Prior to TikTok, China was not taken seriously? I suppose TikTok is the catalyst for seriousness. More likely, the TikTok thing evokes MBA consultant outputs to confirm what many people sort of intuit but have not been able to sum up with a “now is the time” utterance.
In my lecture yesterday for the National Cyber Crime Conference, I presented a diagram of how Chinese telecommunications and software systems can exfiltrate information with or without TikTok.
Banning an app is another one of those “Wow, the barn burned and Alibaba built a giant data center where the Milking Shorthorns once stood” moments.
Sourceless revelations about Google’s willingness to offer a deal to a China centric TikTok and MBA consultant revelations that one should take China seriously warrants one response: The ship sailed, returned, built a giant digital port, and has refueled for a return journey. Ban away.
Stephen E Arnold, July 15, 2020
Germany Is Getting Serious about Content
July 13, 2020
If accurate, Germany is moving ahead of the Five Eyes’ group in terms of access to online data. “New German Law Would Force ISPs to Allow Secret Service to Install Trojans on User Devices” reports:
A new law being proposed in Germany would see all 19 federal state intelligence agencies in Germany granted the power to spy on German citizens through the use of Trojans. The new law would force internet service providers (ISPs) to install government hardware at their data centers which would reroute data to law enforcement, and then on to its intended destination so the target is blissfully unaware that their communications and even software updates are being proxied.
If accurate, this is an important law. Germany’s experience with this type of legislation will put some oomph in the Five Eyes’ partners efforts as well as influence other European entities.
Stephen E Arnold, July 13, 2020
Intelligence Agencies and Covid
July 11, 2020
Ever since (probably before) China unleashed the COVID-19 virus on the world, countries have prepped their intelligence agencies one how to gather information about a vaccine. Ekathimerini spoke with retired CIA operative Marc Polymeropoulos about gathering intelligence in, “The Key Role Of Intelligence In The Corona Virus Battle.” Polymeropoulos stated he would have deployed agents around the world to not only gather information, but potentially recruit people to assist the CIA. He also said:
“ ‘The first matter of business for the secret service in the pandemic is not looking for ventilators or diagnostic tests, as Israel’s Mossad did. It’s checking whether the scientific data being reported to the World Health Organization (WHO) by China, for example, is accurate or not. To do this, they recruit whistleblowers, tap communications between civil servants, and mine information from open sources,’ says Polymeropoulos. ‘Their second mission is to evaluate whether the spread of the virus and the reactions of the public in the places that are being hit the hardest are affecting the stability of their governments…”
Whoever had the latest scientific information related to the virus would mean billions of dollars for the winning country. Polymeropoulous, however, explained that the US secret services were warned about COVID-19 back in January, but dropped the ball. He believes once the pandemic is over, Congress will investigate why it got out of control.
VOA News has a similar story: “COVID-19 Offers ‘World Of Opportunity’ For Spies, Terrorists Australians Spy Boss Says.” Australia’s spy chief and Australian Security Intelligence Organization warned that the world is going to face more cyber-crime, extremist propaganda, and espionage during the pandemic. The panic associated with the pandemic makes people ripe for exploitation.
“It believes that extremist groups have spread their ideology and tried to radicalize Australians. Other common scams include phishing for personal information, online shopping fraud and the theft of pension funds, as well as fake crypto currency and celebrity endorsements. There are also allegations that foreign governments have used the pandemic to covertly gather sensitive information online.”
The pandemic has promoted fear, which makes people more susceptible to disinformation, cyber attacks, and scams. Some politicians even use it as an excuse to spy on their citizens and restrict their privacy rights online.
Maintaining order and safety is paramount during crises, but no one has found the right balance between citizens’ rights and government power.
One thing intelligence agencies know is that human behaviors have changed based on past emergencies.
Whitney Grace, July 11, 2020
Huawei and Its Sci-Fi Convenience Vision
July 9, 2020
One of the DarkCyber research team spotted what looked like a content marketing, rah rah article called “Huawei’s 1+8+N Strategy Will Be a Big Success in China As It Has No Competitors.”
We talked about the article this morning and dismissed its words as less helpful than most recycled PR. The gem in the write up is this diagram which was tough to read in the original. We poked around and came across a Huawei video which you can view on the Sparrow News Web site.
Here’s a version of the 1+8+N diagram. If you are trying to read the word “sphygmomanometer” means blood pressure gizmo. The term is shorthand for “smart medical devices”.
The idea is that the smartphone is the de facto surveillance device. It provides tags for the device itself and a “phone number” for the device owner. Burner phones registered to smart puppets require extra hoops, and government authorities are going to come calling when the identify of the burner phone’s owner is determined via cross correlation of metadata.
The diagram has three parts, right? Sort of. First, the “plus” sign in the 1+8+N is Huawei itself. Think of Huawei as the Ma Bell, just definitely very cozy with the Chinese government. The “plus” means glue. The glue unites or fuses the data from the little icons.
The focal point of the strategy is the individual.
From the individual, the diagram shows no phone computing devices. There are nine devices identified, but more can be added. These nine devices connected to an individual are all smart; that is, Internet of things, mobile aware, surveillance centric, and related network connected products.
The 1
The “1” refers to the smartphone.
The 8
The eight refers to the smart devices an individual uses. (The smartphone is interacting with these eight devices either directly or indirectly as long as there is battery and electrical power.)
Augmented / virtual reality “glasses”
Earphones
Personal computers
Speakers
Tablets
Televisions
Watches
Vehicles
The connection between and among the devices is enabled by Huawei HiLink or mobile WiFi, although Bluetooth and other wireless technologies are an option.
The N
The N like the math symbol refers to any number of ecologies. An ecology could be a person riding in a vehicle, watching a presentation displayed by a connected projector, a smart printer, a separate but modern smart camera, a Chinese Roomba type robot, a smart scale for weighing a mobile phone owner, a medical device connected or embedded in an individual, a device streaming a video, a video game played on a device or online, a digital map.
These use cases cluster; for example, mobile, smart home, physical health, entertainment, and travel. Other categories can, of course, be added.
Is 1+8+N the 21st Century E=MC^2?
Possibly. What is clear is that Huawei has done a very good job of mapping out the details of the Chinese intelligence and surveillance strategy. By extension, one can view the diagram as one that could be similar to those developed by the governments of Iran, North Korea, Russia, and a number of other nation states.
The smartphone delivers on its potential in the 1+8+N diagram, if the Huawei vision gets traction.
Observations
The 1+8+N equation has been around since 2019. Its resurfacing may have more to do with Huawei’s desire to be quite clear about what its phones and other products and services can deliver.
The company uses the phrase “full scene” instead of the American jargon of a 360 degree view.
Neither phrase captures the import of data in multiple dimensions. Tracking and analyzing data through time enables a number of interesting dependent features, services, and functions.
The 1+8+N may be less about math and more about intelligence than some of the write ups about the diagram discuss.
Stephen E Arnold, July 9, 2020
Consumers As Unwitting Data Conduits as Cyberware Flames
June 30, 2020
India and China are not friending one another. The issue I noted today concerns social media services designed — maybe targeted is a more appropriate word — at consumers.
Most users of apps like TikTok of 30 second video renown are not aware and do not want to know about data surveillance, known to some as data sucking or data hoovering. (A Hoover was a vacuum cleaner for DarkCyber readers unfamiliar with such a device.)
Information has been floating around that TikTok and other “authorized” apps available from the Google and from the would-be Intel-killer Apple allow the basic social media function to take place while the app gobbles a range of data. Put something on your clipboard? Those data are now in a server in Wuhan.
“India Bans TikTok As Tensions with China Escalate” reports:
India’s Ministry of Electronics and Information Technology said in a statement Monday that it had received many complaints about misuse and transmission of user data by some mobile apps to servers outside India.
Yes, another Captain Obvious insight. Is Captain Obvious working for one of India’s government services?
For those who have wandered the aisles of some interesting conferences, TikTok data is only the tip of the data iceberg.
In fact, I told one hip real news person that chasing some of the smaller data resellers was like understanding the global nature of agribusiness by talking to a quinoa farmer 20 miles from Cusco.
The information is interesting to DarkCyber for three reasons:
- The insight light bulb is flashing in some government units. That’s a start.
- India is recognizing that consumers going about their daily lives are providing an intelligence windfall of reasonably good size. Consumers use their mobile phones, consumers talk, and consumers enter secure facilities and check out craze dances in the break room.
- Cyber warfare is not just chewing away at juicy servers in Australia or Canada. Cyber warfare is wrapped up in those low cost, feature packed hardware devices which, according to the sticker on the box, are “smart.”
The current time period is one filled with interesting activities. What do you think, Captain Obvious?
Stephen E Arnold, June 30, 2020
App Store Curation: Hey, the Method Is a Marvel
June 29, 2020
I don’t think about app store curation policies. One of the DarkCyber researchers was excited about Hey. At lunch, this individual groused about Apple’s editorial review process or what I call curation. Newspapers in the good old days used to do curation. Not so much any more. I still have a headache after my talk with a New York based big time real journalist.
I read “Another 53 iOS Apps Besides TikTok Are Grabbing Clipboard Data.” The write up, if accurate, illustrates how a company can create its own myth from Olympus. Then do exactly what most Silicon Valley companies do; that is, anything that is easy and good for them.
The write up states:
ikTok may be ending its nosy clipboard reading on iOS, but that doesn’t mean other app developers are mending their ways. Security researcher Tommy Mysk told Ars Technica in an interview that an additional 53 apps identified in March are still indiscriminately capturing universal clipboard data when they open, potentially sharing sensitive data with other nearby devices using the same Apple ID. The apps are major titles, too — they’d normally be trustworthy. The behavior is visible in news apps for Fox News, the New York Times and the Wall Street Journal. You’ll also find it in games like Bejeweled, Fruit Ninja and PUBG Mobile.
Did Aristotle cover this type of mental glitch in his Nicomachean Ethics?
Of course he did.
Stephen E Arnold, June 29, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
