FBI seizes domain Russia allegedly used to infect 500,000 consumer routers

Enlarge (credit: Wikipedia)

The FBI has seized a key domain used to infect more than 500,000 home and small-office routers in a move that significantly frustrates a months-long attack that agents say was carried out by the Russian government, The Daily Beast reported late Wednesday.

The takedown stems from an investigation that started no later than last August and culminated in a court order issued Wednesday directing domain registrar Verisign to turn over control of ToKnowAll.com. An FBI affidavit obtained by The Daily Beast said the hacking group behind the attacks is known as Sofacy. The group—which is also known as Fancy Bear, Sednit, and Pawn Storm—is credited with a long list of attacks over the years, including the 2016 hack of the Democratic National Committee.

As Ars reported earlier Wednesday, Cisco researchers said the malware that infected more than 500,000 routers in 54 countries was developed by an advanced nation and implied Russia was responsible, but the researchers didn’t definitively name the country.

Read 6 remaining paragraphs | Comments

Biz & IT – Ars Technica

Michigan Takes On The NSA With New Law, But Probably Won’t Have Much Of An Impact

In the months following the appearance of the Snowden leaks, several state legislatures attempted stiff arm snooping feds by introducing bills prohibiting collect-it-all programs from being deployed against Americans by the NSA. Most targeted the NSA’s warrantless collection of metadata, creating a warrant requirement for the collection of data within the state’s borders.

Others were a bit more creative, forbidding state law enforcement from participating in federal surveillance efforts or, in the case of Utah, where a new NSA data center was being built, forbidding the state’s water supply from being used in data collection efforts (to cool the agency’s many, many servers).

In Michigan, one of these laws is actually being enacted. As the Washington Examiner reports, the effective date of the Fourth Amendment Rights Protection Act is nearly five years to the day from the first Snowden leak.

Former National Security Agency contractor Edward Snowden marks five years in exile next month. And 11 days after the anniversary of his initial public surveillance disclosure, the first state will implement a law that arguably cuts the NSA off from local water and electricity.

There isn’t a known NSA facility in Michigan, but the law’s author says it sends a clear message with a ban on state and local officials, including law enforcement and public utilities, cooperating with federal agencies that allegedly collect personal data without legal process.

“It hangs up a sign on Michigan’s door saying, ‘No violation of the Fourth Amendment, look elsewhere’,” said state Rep. Martin Howrylak, a Republican. “Democrats as well as Republicans would certainly stand very strong in our position on what this law means.”

Michigan’s Fourth Amendment Rights Protection Act takes effect June 17 after passing with a single “no” vote in the legislature.

The bill was originally introduced last spring, but received wholehearted support for both sides of the state legislature, passing unanimously in the Senate and receiving only a single “no” vote in the House. The bill received the governor’s signature in March.

Since there are no known collections operating out of Michigan at this time, the law has limited utility. It will mostly serve as a deterrent, suggesting the NSA and others look elsewhere for real estate when opening new data centers. It could also serve to block metadata collections from telco providers located in the state, but those targeted by the NSA are headquartered elsewhere, beyond the reach of this law.

The wording of the law suggests it won’t do much to prevent federal surveillance activities. Even though it does mention the use of warrants, it does not actually make them a requirement.

This state or a political subdivision of this state shall not assist, participate with, or provide material support or resources to a federal agency to enable it to collect or to facilitate in the collection or use of a person’s electronic data or metadata, unless 1 or more of the following circumstances apply:

(a) The person has given informed consent.

(b) The action is pursuant to a warrant that is based upon probable cause and particularly describes the person, place, or thing to be searched or seized.

(c) The action is in accordance with a legally recognized exception to warrant requirements.

(d) The action will not infringe on any reasonable expectation of privacy the person may have.

(e) This state or a political subdivision of this state collected the electronic data or metadata legally.

The language doesn’t suggest the surveillance exposed by the first Snowden leak (cellphone metadata) would be affected, even with the new law in place. The “expectation of privacy” surrounding third party records — which almost all metadata is — is nonexistent. There is some judicial discussion about cell site location info currently underway, but call data — like that exposed by the first Snowden leak — is still considered a third party record, something federal agencies can collect without a warrant and without troubling a “reasonable expectation of privacy.”

At best, the law would encourage local agencies to check with their legal teams before pursuing partnerships with federal agencies. It may also result in the use of warrants in cases where warrants aren’t usually thought to be needed. It’s more of a symbolic victory against federal incursion than a solid protector of residents’ Fourth Amendment rights. It may limit federal surveillance in the state simply because it makes local cooperation merely a possibility, rather than a foregone conclusion.

It may not be the best anti-surveillance bill, but it does at least show anti-mass surveillance sentiment still lives and breathes in some local legislatures five years after the Snowden leaks made their debut.

Permalink | Comments | Email This Story

Techdirt.