| |
Chinese Firms Lead in Seeking Deals Needing U.S. Security Clearance
Wall Street Journal (12/19/13) Mauldin, William
A new report released on Dec. 19 by the U.S. Treasury Department disclosed that Chinese companies sought the most U.S. acquisitions in 2012 that required special clearance for national security reasons. That finding comes as some U.S. officials are growing concerned that Chinese companies are attempting to acquire sensitive technologies owned by American companies. According to the report, the Treasury Department's Committee on Foreign Investment in the U.S. (CFIUS) reviewed 23 acquisitions by Chinese companies in 2012, up from 10 in 2011 and six in 2010. Most of the Chinese acquisitions were for manufacturing companies, and only six involved "critical technology companies" such as those in the defense, nuclear, and toxins industries. In previous years, U.K. companies topped the review list, but they came in second in 2012 with 17 requests, down from 25 in 2011. All in all, the CFIUS reviewed 114 business deals in 2012, with 45 that led to follow-up investigations and 20 that saw companies withdrawing their requests. However, 2012 was the first time in 20 years in which the White House put a stop to a deal reviewed by CFIUS. In that case, the president stopped China-based Ralls Corp. from buying wind farms located in or near a naval-weapons training facility in Oregon.
Gunman at Reno Hospital Kills One and Wounds Two
New York Times (12/18/13) Onishi, Norimitsu
A gunman walked into a hospital in Reno, Nev., Tuesday afternoon and opened fire, killing one person and injuring two others before shooting and killing himself. Authorities and witnesses say that the gunman entered the Center for Advanced Medicine at Renown Regional Medical Center at around 2:05 p.m. and proceeded to the third floor, which is home to an outpatient clinic for specialized treatment. It was there that the gunman opened fire, prompting hospital officials to issue "code triage" and "code orange" announcements warning of the situation. Those announcements prompted some patients to escape the building. Once police officers arrived on the scene, they searched the building one floor at a time and found the gunman dead of a self-inflicted gunshot wound. However, the hospital remained in lockdown for two hours after the building was declared secure. It remains unclear whether the gunman knew any of the victims or what his motive may have been.
Senate Democrats Introduce Bill to Bar Employers From Using Credit Checks
Washington Post (12/18/13) P. A17 Douglas, Danielle
Senate Democrats on Tuesday introduced the Equal Employment for All Act, which would block companies from performing credit checks on job applicants. Lawmakers say the practice contributes to unemployment and disproportionately affects women and minorities, who suffered the greatest credit damage during the financial crisis. “No one should be denied the chance to compete for a job because of a credit report that bears no relationship to job performance,” declared Sen. Elizabeth Warren (D-Mass.), one of seven bill co-sponsors. The proposal provides an exemption for jobs that require a national security clearance. Otherwise, it is an effort to stop employers from disqualifying would-be hires based on poor credit. The Fair Credit Reporting Act allows companies to check a credit history with a job applicant’s consent. A 2012 survey by the Society for Human Resource Management found that 47 percent of employers use credit checks in their hiring decisions. Some companies use credit reports to decide if applicants who would be dealing with finances can manage their own money, said Elizabeth Milito, senior executive counsel at the National Federation of Independent Business. Many other jobs, however, require credit checks that, advocates and lawmakers argue, provide no indication of a worker's ability to, for example, deliver packages or manage a stockroom. Advocates also point out that credit reports often contain inaccuracies. The proposed bill has no GOP support, and so it is uncertain whether it will make it to the Senate floor.
Stores Have Free Reign to Recoup Shoplifting Losses
Associated Press (12/16/13)
At least nine people have filed lawsuits against Macy's, saying that employees at the company's flagship store in New York City bullied them into paying fines for allegedly shoplifting. The lawsuits also claim that the retailer harassed shoplifting suspects with letters demanding payment. The plaintiffs in these cases claim that Macy's is abusing a New York state law that allows retailers to collect a penalty of five times the cost of stolen merchandise, up to $500 per item, plus as much as $1,500 if the stolen merchandise cannot be resold. A spokeswoman for Macy's said the company has a policy in place that prohibits the use of coercion when trying to recover fines from shoplifting suspects. The spokeswoman added that the company's practices are consistent with those used in the rest of the retail industry and that they are within the parameters of the law. Other retail industry experts say that laws that allow retailers to hold and fine shoplifting suspects are generally applied correctly. At least 27 states have laws in place that allow retailers to detain and fine shoplifting suspects, even if the person has not technically stolen anything, is wrongly accused, or has had the criminal charges against him dropped.
Revelations That Ikea Spied on its Employees Stir Outrage in France
New York Times (12/16/13) Clark, Nicola
A regional court in France is investigating Ikea's French unit, which allegedly carried out illegal investigations into hundreds of people--including employees, job candidates, and customers-- over a 10-year period. The investigation is specifically focusing on the alleged actions of former Ikea France CEO Jean-Louis Baillot, current CEO Stefan Vanoverbeke, and Financial Director Dariusz Rychert, and nine others who have been accused of violating French law by either taking an active role in the investigations or having knowledge of the efforts to collect information on targeted individuals. The investigations that were allegedly carried out at the behest of Ikea France's top managers reportedly focused on the collection of criminal histories, driving, records, and vehicle registrations, either to vet current or prospective employees or to weaken the arguments of Ikea customers who had made complaints against the company. Investigators also believe that Ikea may have also used the information it collected in its investigations to settle workplace complaints or to force an employee to resign. However, it remains unclear why the company carried out such extensive investigations. Ikea France has already conducted its own investigation into the matter and has fired Baillot as a result. The company has remained largely silent in the face of the accusations, saying only that certain managers had engaged in activities that were contrary to its values and ethical standards.
Panel Urges New Curbs on Surveillance by U.S.
Washington Post (12/19/13) Nakashima, Ellen; Soltani, Ashkan
The White House panel charged with making recommendations for reforming the intelligence community's surveillance programs issued a report on Wednesday calling for an end to the National Security Agency's collection of telephone metadata. The panel determined that the program could be safely ended because the information gleaned from collecting telephone metadata--which includes numbers dialed and call times and lengths--has not played an important role in preventing terrorist attacks. The report also called for an end to NSA's practice of storing telephone metadata, saying that telephone companies or third parties should hold on to that data instead. The recommendations state that the federal government should only be able to access this data with an order from the Foreign Intelligence Surveillance Court that would only be issued if officials are able to prove they have a reasonable suspicion that the data in question is relevant to an authorized terrorism investigation. The panel said it is necessary for telephone companies or third parties to store telephone metadata because the NSA's storage of such information creates potential privacy and civil liberties risks. But critics say that searching telephone metadata for relevant information would be too complicated if the information is no longer stored by the NSA. The Obama administration will announce next month whether it will adopt any of the recommendations included in the report, which was written for advisory purposes only.
Senate Asks C.I.A. to Share its Report on Interrogations
New York Times (12/18/13) Mazzetti, Mark
Members of the Senate Intelligence Committee on Tuesday called for the CIA to release an internal study performed several years ago on the agency's terrorist detention and interrogation program. Sen. Mark Udall (D-Colo.) said the study needs to be released because he believes its findings are essentially the same as those of a Senate Intelligence Committee report that found that the CIA provided misleading information about the amount of intelligence produced by the use of harsh interrogation methods. But although the CIA's study and the Intelligence Committee's report came to essentially the same conclusion, Udall said, the agency issued a document challenging the facts included in the Intelligence Committee's report as well as its overarching conclusions. Udall added that if it was true that the CIA's study and the Intelligence Committee's report were basically the same, the CIA needs to explain why its formal response to the Intelligence Committee's report was so different than the results of its study. CIA spokesman Dean Boyd said that the agency agreed with a number of the conclusions in the Intelligence Committee's report but that it found "significant errors" in the document. He added that the CIA is working with members of the Intelligence Committee to determine the best way to declassify the CIA's internal study.
Judge: NSA’s Collecting of Phone Records is Probably Unconstitutional
Washington Post (12/17/13) Nakashima, Ellen; Marimow, Ann E.
U.S. District Court Judge Richard J. Leon issued a ruling on Monday saying that the National Security Agency's phone meta-data collection program likely violates the Fourth Amendment's prohibition of unreasonable searches. The ruling came in a lawsuit filed by conservative legal activist Larry Klayman--a case that Leon said "demonstrated a substantial likelihood of success" given the fact that the meta-data collection program is likely unconstitutional. Leon's ruling contained scathing criticism of the program, saying that collecting data on virtually every U.S. citizen so that it could be queried and analyzed without prior judicial approval amounted to an "indiscriminate" and "arbitrary invasion" of privacy. Leon also dismissed the federal government's claim that it needs to be able to engage in the warrantless collection of phone meta-data in order to maintain the agility to stop terrorist attacks, saying that no court has ever given the government license to perform "continuous, daily searches of virtually every American citizen without any particularized suspicion." The ruling included an injunction on the collection of phone data belonging Klayman and a co-plaintiff as well as an order for the government to destroy any existing data on the two that has already been collected. However, Leon issued a stay on this injunction pending the outcome of a government appeal.
Officials Say U.S. May Never Know Extent of Snowden’s Leaks
New York Times (NY) (12/15/13) Mazzetti, Mark; Schmidt, Michael S.
U.S. officials with information on the investigation into former National Security Agency (NSA) contractor Edward Snowden say that it may not be possible to determine the extent of the data breach he carried out against classified government networks. Part of the problem, the officials say, is that the Hawaii-based NSA outpost where Snowden was stationed did not have up-to-date software that tracked employee computer usage. Furthermore, Snowden concealed his activities by logging in to classified servers using passwords taken from other security agency employees and by hacking into firewall-protected data banks. One unidentified senior official admitted that investigators have "spent hundreds and hundreds of man-hours trying to reconstruct everything he has gotten, and they still don’t know all of what he took." But Rick Ledgett, who is heading the NSA's task force to examine the incident, said he believes that Snowden still has access to some unleaked documents, despite his claims to the contrary. Ledgett also said that he might consider advising President Obama to offer Snowden amnesty in exchange for those documents. Whether or not the president is prepared to make such an is unclear. In the meantime, the NSA is attempting to better secure its networks to prevent any future data breaches. When asked about these changes, Lonny Anderson, the NSA's chief technology officer, said that the government needs to take steps to prevent employees from accessing classified systems anonymously.
Threat Reporting Made Easy
Security Management (12/13) Gates, Megan
Thomas Nelson Community College, a member of the Virginia Community College System that has three campuses in the southeastern part of the commonwealth, implemented a new threat reporting system last year after concluding that its previous system was not effective. According to Garth MacDonald, the program manager of the Thomas Nelson Office of Safety and Emergency Preparedness, the threat reporting tool the college previously used made it difficult to share reports among different members of the Threat Assessment Team. This and other problems prompted Thomas Nelson Community College to adopt the Threat Assessment, Incident Management, and Prevention Services (TIPS) system in May 2012. The system, which is integrated into the college's Web site, allows users to make anonymous reports about individuals who display troubling or suspicious behavior. The service is customizable, meaning that administrators can create their own criteria and fields for reporting. Individuals who do not represent an imminent threat are usually the subject of an intervention involving a school counselor. Individuals who display more serious problems may receive treatment from local mental health service boards. Those who pose an imminent threat, meanwhile, are reported to police. MacDonald says he believes the new system has been an effective way to collect reports about suspicious activity on the college's campuses.
Target Says 40 Million Credit, Debit Cards May Have Been Compromised in Security Breach
Washington Post (12/20/13) Timberg, Craig; Yang, Jia Lynn ; Tsukayama, Hayley
Target said Thursday that cybercriminals were able to access information stored on the magnetic stripes of 40 million credit and debit cards used at nearly all of its U.S. stores, in what one consumer advocate said was the third-largest data breach ever reported. Representatives from Target said the breach--which involved the theft of information such as card numbers, expiration dates, and the three-digit security codes printed on the back of cards--may have begun Nov. 27 and lasted until Dec. 15. Law enforcement was notified immediately after the breach was discovered, Target said. However, company officials refused to say exactly when they found out about the breach, how it happened, or whether encryption was being used to protect payment card data. There is speculation that the cybercriminals were able to reach deeply into the retailer's corporate network, given the fact that the breach affected so many cards used at a large number of stores. But Forrester analyst Avivah Litan said it is also possible that the breach could have been carried out by a rogue Target employee using low-tech methods to exploit his ability to access certain systems. Krebs on Security blogger Brian Krebs says that more such breaches could take place in the future, since many retailers use payment systems that are similar to those used by Target.
Target Hackers May Have Gotten Cover From Holiday Shopping Surge
Wall Street Journal (12/19/13) Schectman, Joel
Cybersecurity experts say that the hackers who stole data from 40 million credit and debit cards used at Target between Nov. 27 and Dec. 15 likely went undetected for so long because of the busy pre-holiday shopping rush. “It’s like trying to catch someone speeding through town during rush hour,” explains Greg Buzek, the president of the retail consulting firm IHL Group. It is unclear how hackers may have accessed the stolen data, and Target has thus far refused to comment on the exact nature of the attack due to the ongoing investigation. No matter which weakness the hackers exploited, Buzek says that their efforts were made much easier because such data breaches are usually identified via surges in traffic on the company's servers. However, such spikes are already expected during the holiday shopping season. “They waited until the busiest days of the year. If [Target] saw double traffic they could interpret it as ‘man we’re having a great day’…The spike in data traffic during that period is so huge it’s hard to delineate if something is happening,’” Buzek said. “The focus of retailers at that time is not typically security. It’s making sure the systems stay up.”
Chinese Hackers Reportedly Crashed Federal Election Commission Website
Fox News (12/19/13) Henneberg, Molly
The Center for Public Integrity, a non-partisan investigative journalism organization, says that Chinese hackers attacked and brought down the Federal Election Commission's Web site on Oct. 1. The attack took place on the first day that the FEC and other government agencies were closed as a result of the partial government shutdown. The Department of Homeland Security is investigating the attack and has so far found no evidence that any sensitive information or other personal data was compromised. However, the Center for Public Integrity described the attack as being "the worst act of sabotage" since the FEC was created 38 years ago. The organization says it does not know what the hackers' specific motivation may have been, but said the attackers were likely enemies of the U.S. who wanted to damage the country as well as its ideals of "freedom and democracy." Reports of the attack come after an independent audit earlier this year found that the FEC's IT systems were vulnerable to being hacked. FEC officials disputed the findings of the audit, saying that the agency's systems were secure.
New DDoS Malware Targets Linux and Windows Systems
IDG News Service (12/18/13) Constantin, Lucian
New malware designed to infect certain systems running Linux and Windows, including servers, could be used to launch four different types of distributed denial-of-service (DDoS) attacks, warns the Polish Computer Emergency Response Team (CERT Polska). The malware's Linux variant infects systems running that operating system by using a dictionary attack to guess passwords for the Secure Shell (SSH) service, which means Linux users can protect themselves by not running SSH and by using strong passwords. Once the malware is loaded onto the system, it runs in daemon mode and connects to a command-and-control (C&C) server using a hard-coded Internet Protocol address and port. The malware then sends information about the system—including CPU speed, system load, and network connection speed—back to the server and waits for instructions. Those instructions can include launching one of four types of DDoS attacks, including a DDoS Amplification attack, against a particular target. Meanwhile, the malware's Windows variant runs as a service on system startup and communicates with the C&C server using a domain name and a port that is different than the one the Linux variant uses. The two versions connect with the same C&C server, leading CERT Polska to conclude that the same group is behind both.
Bogus Antivirus Program Uses a Dozen Stolen Signing Certificates
IDG News Service (12/15/13) Kirk, Jeremy
Microsoft warns the cybercriminals behind a fake antivirus program that has been in circulation since 2009 are using stolen digital code-signing certificates to give the application an air of legitimacy. In a recent advisory, Microsoft said Antivirus Security Pro is using several stolen certificates issued to developers in the U.S., Britain, Canada, and other countries around the world. The fact that the cybercriminals had those certificates could be an indication they breached the software developers' networks. Such breaches may be occurring on a regular basis, since one of the certificates used to sign Antivirus Security Pro had been issued just three days before Microsoft found that it was being used to sign the application. The discovery that recently-issued certificates are being used to sign Antivirus Security Pro also is an indication that cybercriminals are not relying on certificates from an older stockpile, Microsoft says. The company warns software developers to take steps to protect their certificates, including storing the private keys used for code-signing on secure storage devices. Microsoft stresses that preventing certificate theft is important because a company's reputation could be damaged if one of its certificates is used to sign malware.
Abstracts Copyright © 2013 Information, Inc. Bethesda, MD |
No comments:
Post a Comment