YCLOAK

If the tech industry is drawing one lesson from the latest WikiLeaks disclosures, it’s that data-scrambling encryption works, and the industry should use more of it.

 

Documents purportedly outlining a massive CIA surveillance program suggest that CIA agents must go to great lengths to circumvent encryption they can’t break. In many cases, physical presence is required to carry off these targeted attacks.

 

“We are in a world where if the U.S. government wants to get your data, they can’t hope to break the encryption,” said Nicholas Weaver, who teaches networking and security at the University of California, Berkeley. “They have to resort to targeted attacks, and that is costly, risky and the kind of thing you do only on targets you care about. Seeing the CIA have to do stuff like this should reassure civil libertarians that the situation is better now than it was four years ago.”

 

More encryption

 

Four years ago is when former NSA contractor Edward Snowden revealed details of huge and secret U.S. eavesdropping programs. To help thwart spies and snoops, the tech industry began to protectively encrypt email and messaging apps, a process that turns their contents into indecipherable gibberish without the coded “keys” that can unscramble them.

 

The NSA revelations shattered earlier assumptions that internet data was nearly impossible to intercept for meaningful surveillance, said Joseph Lorenzo Hall, chief technologist at the Washington-based civil-liberties group Center for Democracy & Technology. That was because any given internet message gets split into a multitude of tiny “packets,” each of which traces its own unpredictable route across the network to its destination.

 

The realization that spy agencies had figured out that problem spurred efforts to better shield data as it transits the internet. A few services such as Facebook’s WhatsApp followed the earlier example of Apple’s iMessage and took the extra step of encrypting data in ways even the companies couldn’t unscramble, a method called end-to-end encryption.

 

Challenges for authorities

 

In the past, spy agencies like the CIA could have hacked servers at WhatsApp or similar services to see what people were saying. End-to-end encryption, though, makes that prohibitively difficult. So the CIA has to resort to tapping individual phones and intercepting data before it is encrypted or after it’s decoded.

 

It’s much like the old days when “they would have broken into a house to plant a microphone,” said Steven Bellovin, a Columbia University professor who has long studied cybersecurity issues.

 

Cindy Cohn, executive director for Electronic Frontier Foundation, a group focused on online privacy, likened the CIA’s approach to ” fishing with a line and pole rather than fishing with a driftnet.”

 

Encryption has grown so strong that even the FBI had to seek Apple’s help last year in cracking the locked iPhone used by one of the San Bernardino attackers. Apple resisted what it considered an intrusive request, and the FBI ultimately broke into the phone by turning to an unidentified party for a hacking tool – presumably one similar to those the CIA allegedly had at its disposal.

 

On Wednesday, FBI Director James Comey acknowledged the challenges posed by encryption. He said there should be a balance between privacy and the FBI’s ability to lawfully access information. He also said the FBI needs to recruit talented computer personnel who might otherwise go to work for Apple or Google.

 

Government officials have long wanted to force tech companies to build “back doors” into encrypted devices, so that the companies can help law enforcement descramble messages with a warrant. But security experts warn that doing so would undermine security and privacy for everyone. As Apple CEO Tim Cook pointed out last year, a back door for good guys can also be a back door for bad guys. So far, efforts to pass such a mandate have stalled.

 

Still a patchwork

 

At the moment, though, end-to-end encrypted services such as iMessage and WhatsApp are still the exception. While encryption is far more widely used than it was in 2013, many messaging companies encode user data in ways that let them read or scan it. Authorities can force these companies to divulge message contents with warrants or other legal orders. With end-to-end encryption, the companies wouldn’t even have the keys to do so.

 

Further expanding the use of end-to-end encryption presents some challenges. That’s partly because encryption will make it more difficult to perform popular tasks such as searching years of emails for mentions of a specific keyword. Google announced in mid-2014 that it was working on end-to-end encryption for email, but the tools have yet to materialize beyond research environments.

 

Instead, Google’s Gmail encrypts messages in transit. But even that isn’t possible unless it’s adopted by the recipient’s mail system as well.

 

And encryption isn’t a panacea, as the WikiLeaks disclosures suggest.

 

According to the purported CIA documents, spies have found ways to exploit holes in phone and computer software to grab messages when they haven’t been encrypted yet. Although Apple, Google and Microsoft say they have fixed many of the vulnerabilities alluded to in the CIA documents, it’s not known how many holes remain open.

 

“There are different levels where attacks take place, said Daniel Castro, vice president with the Information Technology and Innovation Foundation. “We may have secured one level (with encryption), but there are other weaknesses out there we should be focused on as well.”

 

Cohn said people should still use encryption, even with these bypass techniques.

 

“It’s better than nothing,” she said. “The answer to the fact that your front door might be cracked open isn’t to open all your windows and walk around naked, too.”

 
…

If this week’s WikiLeaks document dump is genuine, it includes a CIA list of the many and varied ways the electronic device in your hand, in your car, and in your home can be used to hack your life.

It’s simply more proof that, “it’s not a matter of if you’ll get hacked, but when you’ll get hacked.” That may be every security expert’s favorite quote, and unfortunately they say it’s true. The WikiLeaks releases include confidential documents the group says exposes “the entire hacking capacity of the CIA.”

The CIA has refused to confirm the authenticity of the documents, which allege the agency has the tools to hack into smartphones and some televisions, allowing it to remotely spy on people through microphones on the devices.

Watch: New Generation of Hackable Internet Devices May Always Be Listening

WikiLeaks also claimed the CIA managed to compromise both Apple and Android smartphones, allowing their officers to bypass the encryption on popular services such as Signal, WhatsApp and Telegram.

For some of the regular tech users, news of the leaks and the hacking techniques just confirms what they already knew. When we’re wired 24-7, we are vulnerable.

“The expectation for privacy has been reduced, I think,” Chris Coletta said, “… in society, with things like WikiLeaks, the Snowden revelations … I don’t know, maybe I’m cynical and just consider it to be inevitable, but that’s really the direction things are going.”

The internet of things

The problem is becoming even more dangerous as new, wired gadgets find their way into our homes, equipped with microphones and cameras that may always be listening and watching.

One of the WikiLeaks documents suggests the microphones in Samsung smart TV’s can be hacked and used to listen in on conversations, even when the TV is turned off.

Security experts say it is important to understand that in many cases, the growing number of wired devices in your home may be listening all the time.

“We have sensors in our phones, in our televisions, in Amazon Echo devices, in our vehicles,” said Clifford Neuman, the director of the Center for Computer Systems Security, at the University of Southern California. “And really almost all of these attacks are things that are modifying the software that has access to those sensors, so that the information is directed to other locations. Security practitioners have known that this is a problem for a long time.”

Neuman says hackers are using the things that make our tech so convenient against us.

“Certain pieces of software and certain pieces of hardware have been criticized because, for example, microphones might be always on,” he said. “But it is the kind of thing that we’re demanding as consumers, and we just need to be more aware that the information that is collected for one purpose can very easily be redirected for others.”

Tools of the espionage trade

The WikiLeaks release is especially damaging because it may have laid bare a number of U.S. surveillance techniques. The New York Times says the documents it examined lay out programs called “Wrecking Crew” for instance, which “explains how to crash a targeted computer, and another tells how to steal passwords using the autocomplete function on Internet Explorer.”

Steve Grobman, chief of the Intel Security Group, says that’s bad not only because it can be done, but also because so-called “bad actors” now know it can be done. Soon enough, he warns, we could find our own espionage tools being used against us.

“We also do need to recognize the precedents we set, so, as offensive cyber capabilities are used … they do give the blueprint for how that attack took place. And bad actors can then learn from that,” he said.

So how can tech-savvy consumers remain safe? Security experts say they can’t, and to remember the “it’s not if, but when” rule of hacking.

The best bet is to always be aware that if you’re online, you’re vulnerable.
…

New U.S. solar installations nearly doubled last year, but slowing demand for both residential and large-scale systems, falling panel prices and concerns about looming federal tax reform are still dampening investor appetite for the sector.

Solar installations soared 97 percent to 14.8 gigawatts in 2016, according to a report released Thursday by Wood Mackenzie and the Solar Energy Industries Association. The technology is cheaper than ever, with panel prices dropping 40 percent last year, and many utilities procuring solar on the basis of cost alone.

But the dramatic drop in panel prices has hampered solar manufacturers’ profits and ramped up competition for utility-scale contracts among developers, companies said in recent weeks while reporting fourth-quarter results. Add in a slowdown in the residential market, tax reform pushed by U.S. President Donald Trump, climbing interest rates and falling oil prices, and stock market investors remain skittish about solar.

2017 a transition year

Credit Suisse analyst Andrew Hughes said in a client note on Thursday that the key risk to his “outperform” rating on shares of residential solar player Sunrun was “investor sentiment, which in a rising interest rate and falling oil price market obscured by tax policy uncertainty remains tepid.”

The MAC Global Solar Energy index, which tracks shares of solar power companies, slid 43 percent in 2016. The index has recovered to gain nearly 8 percent so far this year but remains 65 percent below its year-ago level.

U.S. module manufacturers and project developers SunPower and First Solar Inc are both viewing 2017 as a transition year for their businesses, they said after reporting in February losses for the fourth quarter of last year.

SunPower Chief Executive Tom Werner in a conference call predicted “intense competition for the forseeable future in mainstream power plants,” adding that some companies were selling panels at below cash cost.

A slowdown is forecast

Indeed, the solar industry report released Thursday forecasts a slowdown in the market this year after last year’s boom. Utility systems accounted for more than 10.5 GW of the total in 2016, but are not expected to exceed 10 GW again until 2021, the report said.

The 2016 boom was largely due to a rush by developers to claim a federal tax credit for solar systems that had been expected to expire at the end of the year. The five-year extension of that credit, however, has allowed projects to be pushed into this year and beyond.

Though Trump has not called for ending tax credits for solar and other renewable energy, he has expressed doubts about the role of clean power sources.

Home installations are growing

On the solar residential side, installations grew 19 percent to 2.6 GW last year, down from 66 percent growth in 2015. Growth has slowed in major markets like California, where many of the households most interested in solar have already put up panels.

Tesla, which acquired residential market leader SolarCity late last year, said last month that it deployed 201 megawatts of solar in the fourth quarter, a more than 20 percent drop from the same period a year earlier.

SolarCity rival Sunrun reported a quarterly profit that topped Wall Street estimates due to cost cuts, but said growth would be substantially slower in 2016. System deployments rose 40 percent in 2016, but are expected to rise just 15 percent this year, Sunrun said.

“While it may be slowing, it is still growing. That is an important piece of the story,” Abigail Ross Hopper, president of the Solar Energy Industries Association, said in an interview. “Some of that resetting is to be expected.”
…

With the broad release of Google Assistant last week, the voice-assistant wars are in full swing, with Apple, Amazon.com, Microsoft and now Alphabet’s Google all offering electronic assistants to take your commands.

Siri is the oldest of the bunch, and researchers including Oren Etzioni, chief executive officer of the Allen Institute for Artificial Intelligence in Seattle, said Apple has squandered its lead when it comes to understanding speech and answering questions.

But there is at least one thing Siri can do that the other assistants cannot: speak 21 languages localized for 36 countries, a very important capability in a smartphone market where most sales are outside the United States.

Microsoft Cortana, by contrast, has eight languages tailored for 13 countries. Google’s Assistant, which began in its Pixel phone but has moved to other Android devices, speaks four languages. Amazon’s Alexa features only English and German. Siri will even soon start to learn Shanghainese, a special dialect of Wu Chinese spoken only around Shanghai.

The language issue shows the type of hurdle that digital assistants still need to clear if they are to become ubiquitous tools for operating smartphones and other devices.

Speaking languages natively is complicated for any assistant. If someone asks for a football score in Britain, for example, even though the language is English, the assistant must know to say “two-nil” instead of “two-nothing.”

At Microsoft, an editorial team of 29 people works to customize Cortana for local markets. In Mexico, for example, a published children’s book author writes Cortana’s lines to stand out from other Spanish-speaking countries.

“They really pride themselves on what’s truly Mexican. [Cortana] has a lot of answers that are clever and funny and have to do with what it means to be Mexican,” said Jonathan Foster, who heads the team of writers at Microsoft.

Google and Amazon said they plan to bring more languages to their assistants but declined to comment further.

At Apple, the company starts working on a new language by bringing in humans to read passages in a range of accents and dialects, which are then transcribed by hand so the computer has an exact representation of the spoken text to learn from, said Alex Acero, head of the speech team at Apple. Apple also captures a range of sounds in a variety of voices. From there,

an acoustic model is built that tries to predict words sequences.

Then Apple deploys “dictation mode,” its text-to-speech translator, in the new language, Acero said. When customers use dictation mode, Apple captures a small percentage of the audio recordings and makes them anonymous. The recordings, complete with background noise and mumbled words, are transcribed by humans, a process that helps cut the speech recognition error

rate in half.

After enough data has been gathered and a voice actor has been recorded to play Siri in a new language, Siri is released with answers to what Apple estimates will be the most common questions, Acero said. Once released, Siri learns more about what real-world users ask and is updated every two weeks with more tweaks.

But script-writing does not scale, said Charles Jolley, creator of an intelligent assistant named Ozlo. “You can’t hire enough writers to come up with the system you’d need in every language. You have to synthesize the answers,” he said. That is years off, he said.

The founders of Viv, a startup founded by Siri’s original creators that Samsung acquired last year, is working on just that.

“Viv was built to specifically address the scaling issue for intelligent assistants,” said Dag Kittlaus, the CEO and co-founder of Viv. “The only way to leapfrog today’s limited functionality versions is to open the system up and let the

world teach them.”
…

One of Hawaii’s islands may soon be powered by solar energy, at least during the night.

In the biggest project since it acquired the solar cell giant SolarCity, the Tesla company will build a 13-megawatt solar farm on the island of Kauai, covering more than 44 acres (18 hectares). The solar cells will charge a 53-megawatt hour battery station able to provide most of the island’s power at night.

The batteries, called Powerpacks, will be built by Tesla’s new Gigafactory.

Right now, Kauai residents are paying very high prices for energy, so the plan is to gradually transition to renewable sources, including wind and biomass.

Kauai plans to generate 70 percent of its power from renewable sources by 2030 and to completely wean itself from fossil-generated electricity by 2045.

Tesla says that once it’s in full production, the Kauai solar energy plant will lower the fossil fuel burn by over 6,000 metric tons a year.
…

China is seeking an international agreement to enhance state control over the internet in order to fight cyberattacks and cyberterrorism. Beijing wants to extend the existing idea of sovereignty over land and sea to cyberspace.

Beijing has released its first white paper discussing how it will persuade different countries to join together in an international partnership. The idea is to enhance the power of individual governments over cyberspace and reduce the role of the private sector.

“Countries in the whole world have increasing concerns [about cyberattacks] in this regard. Cyberspace should not be a space of no laws,” Long Zhou, coordinator of the Cyber Affairs division of the Foreign Ministry said last week while releasing copies of “International Strategy of Cooperation on Cyberspace,” China’s first policy paper on the issue.

Censorship

Analysts see it as a grandiose plan to extend the Chinese idea of censorship across large parts of the world. China has been criticized in developed countries for controlling the internet with a heavy hand and not allowing Google, Facebook, Twitter and many foreign news websites to be seen in China.

The first set of organizations that will be hit, if the Chinese campaign gains momentum, are American companies that play a dominant role in the internet space, analysts said.

“The inventors of cyberspace were idealistically and ideologically convinced that they had created a domain of perfect freedom, where anyone could gain entry and behave as if no laws existed,” Sheila Jasanoff, director of the program on science, technology and society at Harvard University’s Kennedy School told VOA.

“It has been interesting to see how this allegedly wide open and free space has gradually been ‘written over’ with all the markers of national sovereignty and rivalry,” she said.

Russian role in U.S. polls

China is taking advantage of the uproar in the United States over alleged cyberattacks by Russia to interfere in the recent presidential election.

Asked about the alleged Russian interference, Long said, “Especially in recent years, the number of cybersecurity events throughout the world is increasing, posing challenges to all countries’ efforts to maintain political, economic stability and protecting all citizens’ rights and interests.”

Lee Branstetter, an associate professor of economics at the Heinz School of Policy and Management of the Carnegie Mellon University, saw the situation differently. 

“The China solution is a proposal to create huge barriers to the free flow of information across borders. It is hard to see how a global digital economy could function under such a regime,” he said.

Beijing action plan

China is trying to persuade world governments and international agencies, including the United Nations, to accept the principal of “cyber sovereignty” that allows each country to govern the internet in the manner it wants without interference from other governments. Long said the concept of land and sea sovereignty, which is recognized by the U.N., should be extended to the cyber world because the problems and situations are similar.

He said the international community is discussing the need to “produce new international legal instruments to deal with the security situation in cyberspace.” These situations include cyberterror or cross-boundary cybercrimes.

China plans to raise the issue at different international forums including U.N. agencies, the BRICS group — for Brazil, Russia, India and China — and the Shanghai Cooperation Organization. The Chinese endeavor has the support of Russia, which will join in the campaign for making international rules on cyberspace, Long said at a recent news conference.

Jasanoff is skeptical of the Chinese rationale.

“There is good reason to believe that China will do more to limit the freedom of information of its citizens than to ensure its own security with regard to things like critical infrastructure,” she said. “The most effective firewall will likely be against the creation of domestic networks of civilian information exchange and protest.”

Assertions of cybersovereignty from China and elsewhere are happening at a time when national sovereignty is in decline for many reasons, not least because the technological capability for both creating and breaking through security systems is highly dispersed, she said.

“Hackers for hire are distributed throughout the world, and recent experiences at all kinds of major institutions shows that hardly any are free from threats (and even the reality) of cyberattacks,” Jasanoff said.
…

Powered exoskeletons may help people with weak muscles move better. Exoskeletons are often made from metal, which means their joints are rigid. Now researchers at a university in Switzerland are working on flexible, rubber robots that could replace the metal joints in exoskeletons, making them far more flexible. VOA’s Deborah Block has a report.
…

Nike will launch a hijab for female Muslim athletes early next year, becoming the first major sports apparel maker to offer a traditional Islamic head scarf designed specifically for competition, the company said on Wednesday.

The head covering, marketed under the “Pro Hijab” brand, is designed to allow athletes to observe the traditional Islamic practice of covering the head without compromising performance.

Made from a lightweight, flexible material, the hijab is expected to hit stores shelves in early 2018, Nike said in a statement.

In recent years, the hijab has become the most visible symbol of Islamic culture in the United States and Europe. Many Muslim women cover their heads in public with the hijab as a sign of modesty, but some critics see it as a sign of female oppression.

With sensitivities over immigration and the perceived threat of Muslim extremism running high, the head scarf has led to attacks against Muslim women. At the same time, the hijab has evolved in a symbol of diversity that Nike has embraced.

The Women’s March on Washington, held the day after President Donald Trump’s inauguration, used the face of a woman wearing a hijab in an American flag pattern as its promotional image.

Muslim athletes visiting Nike’s headquarters in Beaverton, Oregon, just outside of Portland, have complained about the difficulties of wearing a hijab while competing, according to the company.

The company consulted with Muslim women athletes from around the world, including Middle Eastern runners and cyclists, in the designing the hijab.

Other companies have also set their sights on hijab sales to Muslim athletes.

Last year, Danish sportswear company Hummel unveiled a soccer jersey with an attached hijab for the Afghanistan national women’s soccer team.

Non-professional women Muslim athletes have used athletic hijabs made by smaller companies.

But Nike’s annual net sales in the billions and its reach in popular culture can do more to bring Muslim athletes into the fold, said Amna Al Haddad, a Nike sponsored weightlifter from the United Arab Emirates who consulted on “Pro Hijab.”

“[It will] encourage a whole new generation to pursue sports without feeling there is a limitation because of modesty or dress-code,” Haddad said.
…

Major technology firms say they are moving to fix any vulnerabilities in their operating systems, a day after WikiLeaks released documents pertaining to an alleged CIA hacking arsenal capable of spying on people through microphones in mobile phones and other electronic devices such as smart televisions.

In a statement issued Wednesday, Apple said it had already addressed many of the issues identified in the WikiLeaks documents, but said it would “continue work to rapidly to address any identified vulnerabilities.”

“We always urge customers to download the latest iOS to make sure they have the most recent security updates,” Apple said.

 

Samsung made a similar comment, saying it was aware of the report and “urgently looking into the matter.”

“Protecting consumers’ privacy and the security of our devices is a top priority at Samsung,” the South Korean electronics company said.

Security flaws

According to the WikiLeaks documents, the CIA identified weaknesses within the software used by Apple, Google, Microsoft and other U.S.-based manufacturers; but, instead of informing the companies of the vulnerabilities, the CIA “hoarded” the exploits, leaving people open to potential hacking.

“By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone; at the expense of leaving everyone hackable,” WikiLeaks said in a statement accompanying the release of the documents.

The CIA would neither confirm nor deny the legitimacy of the documents, although WikiLeaks boasts a nearly perfect record on the authenticity of the documents it publishes.
…

When the Trump administration issued its executive order in Janurary restricting travelers from certain countries, many tech companies and their employees were quick to express their objections.

But now, with the new executive order out limiting travel to the U.S. for people from six countries, the response from Silicon Valley has been largely muted.

Alphabet, the parent company of Google, Facebook and Microsoft has so far remained quiet.

In reaction to the first travel executive order, the three companies were among 100 U.S. tech firms that filed a legal brief in opposition. At the time, Google said 76 of its employees were affected by the executive order.

Still, some firms, such as Uber, Lyft, Mozilla and Airbnb, were quick to express their objections to Monday’s executive order.

Lyft, the ride-hailing firm, plans to meet with the American Civil Liberties Group this week to discuss how “we can further support their efforts,” Logan Green, Lyft’s CEO, said in a statement. The company gave the civil liberties organization $1 million in January.

“Our sentiment has not changed: President (Donald) Trump’s immigration ban is unjust and wrong,” an Uber spokesperson said. “We will continue to stand up for those in the Uber community affected.”

Salesforce CEO Marc Benioff tweeted a tribute to his grandfather, “Thinking of great grandfather Issac Benioff who came to US from Kiev as Refugee. W/O him no @Salesforce (2M jobs/200B GDP) or@GameOfThrones!” (Benioff’s cousin, David, is the co-creator of the hit TV series.)

Tech lobbying group and trade organizations have largely stayed mum about the limited travel ban.

One exception is TechNet, which represents tech firms such as Facebook and Apple. It put out a statement this week saying that “unfortunately, just like the first order, this new policy singles out individuals based on their country of origin and will adversely impact technology workers who live and work in our nation.”

The industry has been anxiously waiting for the Trump administration’s revamp of the H-1B visa program, which Silicon Valley uses to hire skilled workers. Late last week, the administration jettisoned an aspect of the H-1B visa application process called “premium processing,” which allowed companies to pay extra for their visa applications to be expedited.

That change underscored the uncertainty in the industry over how the Trump administration will ultimately handle both work visas and travel restrictions.

“What’s next?” said Evan Engstrom, executive director of Engine, an advocacy and research group focused on tech startups.

“What everyone is concerned about is what anti-immigration policies are going to be more expansive,” Engstrom said.

It’s a point echoed by a Yahoo executive.

“American businesses like Yahoo need certainty, particularly around the ability to hire and retain top talent. A piecemeal approach leaves question marks for companies and employees,” April Boyd, a Yahoo vice president and head of global public policy, said in a statement. “We encourage the administration to work with Congress on a thoughtful, lasting approach to bring positive change to the current immigration system.”

Each April 1, the U.S. holds a lottery for 65,000 H-1B visas and 20,000 additional visas for foreign students with master’s degrees. Last year, there were requests for more than 200,000, a record figure.

But critics say skilled-worker visa programs have hurt American workers. Companies have used them, they say, to hire foreign workers who are not highly skilled and who are paid lower than market rate wages.

The biggest users of the H-1B program have been outsourcing firms that provide IT consulting.
…