Cyber wrap
Posted By Michael Chi on August 9, 2017 @ 12:32
Don’t say stupid things online
It’s been a big week for advocates of online OPSEC [1]. On Monday, a Google employee suffered a high-profile firing [2] after he circulated a ‘manifesto [3]’ railing against Google’s institutional ‘political bias’ against conservatives and the need to have an ‘honest discussion’. Google’s leaders—current [4] and former [5]—have universally taken issue with how consistently incorrect the manifesto is [6] in its core argument (about how women aren’t biologically suited for tech jobs) and how damaging it has been to the company’s reputation and to the team [7]. The fired employee is reportedly seeking any and all ‘legal remedies [8]’; power to you, guy.
The Google anti-diversity memo is a great example of what the Australian Public Service Commission (APSC) was trying to protect against when it provided more detailed guidelines [9] about what the APS Code of Conduct requires when it comes to making public comments, including on social media. Ironically, the APSC’s own communication about not staying stupid things online has become the latest example of poor online communication, and what was intended as guidance [10] has been interpreted as a heavy-handed (and unconstitutional [11]) gag order. Whether the confusion’s due to miscommunication or misrepresentation [12] from the media isn’t clear, but it’s a reminder that confusion quickly escalates [13] to fever pitch well before even the most eager 9-to-5 public servant has had their first coffee [14]. And if it’s that hard to communicate guidelines on social media use, it might be impossible to raise cyber hygiene [15] awareness [16] (PDF) and practices [17].
Stop worrying and love AI
Two Tencent chatbots have been taken offline for revision [18] after they provided politically inflammatory responses [19] to queries about the Communist Party, insulting the party as ‘corrupt and useless [20]’. The shutdown comes shortly after an (overblown [21]) wave of concern about Facebook chatbots ‘inventing their own language’. The two stories seem to be being picked up as the ‘patient zero’ case studies for FUD (fear, uncertainty and doubt) about impending AI doom.
New South Wales is pushing ahead with autonomous vehicles anyway, greenlighting a program for a two-year trial program [22] at Sydney Olympic Park. The trial will be going at a snail’s pace, though—the vehicles won’t be allowed to exceed 10 kilometres an hour along a closed-off road. Fingers crossed it all doesn’t go the way Tesla went at this year’s DEF CON [23].
The US Army has taken a far more cautious (but seriously belated [24]) approach to semi-autonomous vehicles, issuing a memo [25] mandating that all service members [26] cease use of DJI drones, software applications, and other equipment.
Sharing is caring
The Australian Signals Directorate will be sharing threat intelligence with [27] telcos and internet service providers, to help them provide, in turn, cost-effective cyber-security services for small to medium enterprises. This directly addresses the vulnerability to hacking of small and medium enterprises, which have been identified by both the government [28] and the opposition [29] as being sorely in need of protection, but without necessarily having the resources or expertise to protect themselves. Weirdly, however, this initiative ignores anti-virus and security software vendors—the companies that are perhaps best placed to immediately use this data to protect customers.
In similar research, Telstra has launched the Australian Digital Inclusion Index 2017 [30], which has surveyed digital access disparities between socioeconomic classes and found that Australia’s getting better at digital inclusion, which could translate into better cyber-security outcomes for Australia. (For the final word on that, keep your eyes peeled for the latest edition of ASPI’s cyber maturity report [31] later this year.)
The federal government has announced that it’ll be building a single ‘super logon’ to consolidate [32] across the dog’s breakfast of government accounts, which currently saddles users with managing 10 to 30 accounts. It’s not clear from that exclusive interview whether the initiative is the same one as the ‘GovPass’ and ‘Tell Us Once’ initiatives announced [33] in the 2017 budget. It’d be ironic if there were two separate programs under development to consolidate logins and accounts.
Regardless, work on GovPass continues unabated, and Airtasker, Travelex, Credit Union Australia and the Queensland Police Service have signed up for [34] AusPost’s Digital ID service, which is currently serving as a pilot program for later reconciliation with the wider GovPass program. Gavin Slater, the CEO of the Digital Transformation Agency, which is managing the GovPass program, has announced that he’s been working to repair relationships [35] with government agencies, after the then Digital Transformation Office became too ‘disruptive [36]’ for the APS’s tastes.
The Australian Digital Health Agency published Australia’s National Digital Health Strategy [37] (PDF) and outlined an action plan to make sure all Australians have a My Health record by 2018. The aim is to improve the protection of healthcare data and interoperability between healthcare organisations. However, privacy activists are concerned [38] that the consolidated health data will present an increased privacy risk [39], which is why it’s a good thing that the agency will be establishing [40] a Digital Health Cyber Security Centre to make sure Australia’s health data security is at the cutting edge of international best practice.
Open data dashboards tied up with strings
Open data dashboards have been popping up like daisies this week. The Alliance for Securing Democracy has launched a new online dashboard [41], Hamilton 68 [42], tracking bot networks and troll accounts linked (after three years of observing [43]) with Russian influence operations on Twitter. The top hashtag used by these accounts [44] was MAGA, or Make America Great Again, the campaign slogan of US President Donald Trump. As with most social media analysis projects, the transparency of the methodology has been criticised [45].
Black hats, white hats, and cyber diplomats
US ‘cyber-diplomat’ Christopher Painter has signed off [46], writing a parting note on Medium about the continuing importance of diplomacy in cyberspace. Even after working for 26 years in this (highly depressing) space, he’s reportedly still passionate, calling cyber ‘the new black [47]’.
Famed ‘hero [48]’ and supposedly white-hat hacker @MalwareTechBlog [49], aka Marcus Hutchins, was arrested at Las Vegas Airport shortly after Black Hat and DEF CON 2017. The FBI has accused Hutchins [50] of creating, distributing and updating [51] ‘Kronos’ (the banking trojan that was designed to [52] infect computers and grab online banking credentials for profit) in 2014 and 2015. Hutchins has ponied up US$30,000 in bail, and is set to face a Nevada court [53] on 14 August.
Article printed from The Strategist: https://aspistrategist.ru
URL to article: /cyber-wrap-176/
URLs in this post:
[1] online OPSEC: http://lifehacker.com/how-youre-embarrassing-yourself-online-without-knowing-495859415?IR=T
[2] high-profile firing: https://www.washingtonpost.com/news/on-leadership/wp/2017/08/07/a-googlers-manifesto-is-the-hr-departments-worst-nightmare/
[3] manifesto: https://www.gizmodo.com.au/2017/08/exclusive-heres-the-full-10-page-anti-diversity-screed-circulating-internally-at-google/
[4] current: https://www.recode.net/2017/8/7/16110696/firing-google-ceo-employee-penned-controversial-memo-on-women-has-violated-its-code-of-conduct
[5] and former: https://medium.com/@yonatanzunger/so-about-this-googlers-manifesto-1e3773ed1788
[6] incorrect the manifesto is: http://money.cnn.com/2017/08/06/technology/culture/google-diversity/index.html
[7] to the team: https://motherboard.vice.com/en_us/article/ywpamw/internal-reaction-to-google-employees-manifesto-show-anti-diversity-views-have-support
[8] legal remedies: http://www.telegraph.co.uk/technology/2017/08/08/google-fires-employee-behind-anti-diversity-memo-perpetuating/
[9] provided more detailed guidelines: http://www.apsc.gov.au/publications-and-media/current-publications/making-public-comment
[10] intended as guidance: http://www.themandarin.com.au/82248-new-advice-public-servants-posting-social-media-no-new-rules/
[11] and unconstitutional: https://www.crikey.com.au/2017/08/07/the-new-social-media-policy-for-public-servants-may-breach-the-constituion/
[12] misrepresentation: http://www.apsc.gov.au/home/news-and-events/social-media
[13] quickly escalates: http://www.canberratimes.com.au/national/public-service/new-public-service-social-media-policy-is-overreach-union-boss-nadine-flood-20170806-gxqjyq.html
[14] had their first coffee: http://www.skynews.com.au/news/politics/federal/2017/08/07/crackdown-on-public-servants--facebook-posts.html
[15] cyber hygiene: https://www.pm.gov.au/media/2016-04-21/launch-australias-cyber-security-strategy-sydney
[16] awareness: https://www.acsc.gov.au/publications/ACSC_Cyber_Security_Survey_2016.pdf
[17] and practices: https://www.cio.com.au/article/625281/aussies-perceived-invincibility-public-wi-fi-putting-them-risk-suggests-survey/
[18] been taken offline for revision: http://www.reuters.com/article/us-china-robots-idUSKBN1AK0G1
[19] politically inflammatory responses: http://www.bbc.com/news/world-asia-china-40815024
[20] corrupt and useless: https://www.reuters.com/article/us-china-robots-idUSKBN1AK0G1
[21] overblown: https://www.gizmodo.com.au/2017/08/no-facebook-did-not-panic-and-shut-down-an-ai-program-that-was-getting-dangerously-smart/
[22] a two-year trial program: http://www.abc.net.au/news/2017-08-02/trial-to-bring-driverless-cars-to-nsw/8766110
[23] the way Tesla went at this year’s DEF CON: https://www.usatoday.com/story/tech/2017/07/28/chinese-group-hacks-tesla-second-year-row/518430001/
[24] seriously belated: https://www.wired.com/2015/02/white-house-drone/
[25] issuing a memo: https://www.suasnews.com/2017/08/us-army-calls-units-discontinue-use-dji-equipment/
[26] mandating that all service members: https://www.reuters.com/article/us-usa-army-drones-idUSKBN1AK2C0
[27] sharing threat intelligence with: http://www.afr.com/business/telecommunications/spy-data-to-help-small-medium-businesses-beat-cyber-threats-20170801-gxmyhz
[28] the government: https://ministers.pmc.gov.au/tehan/2017/protection-against-ransomware
[29] the opposition: http://www.gaibrodtmann.com.au/small_business_cyber_security_too_little_too_late_from_government
[30] Australian Digital Inclusion Index 2017: http://apo.org.au/node/97751
[31] ASPI’s cyber maturity report: https://www.aspistrategist.ru/report/cyber-maturity-asia-pacific-region-2016
[32] ‘super logon’ to consolidate: http://www.couriermail.com.au/news/queensland/turnbull-government-working-on-onestop-cyber-logon/news-story/d0ec6dfb143d81cab3ca79af232a596c
[33] initiatives announced: https://ministers.pmc.gov.au/taylor/2017/budget-commits-70m-boost-digital-government-delivery
[34] have signed up for: https://www.itnews.com.au/news/auspost-signs-cua-qps-as-first-digital-id-customers-470302
[35] been working to repair relationships: https://www.itnews.com.au/news/dta-ceo-seeks-to-mend-damaged-relations-with-agencies-470162
[36] disruptive: http://www.canberratimes.com.au/national/public-service/turnbulls-digital-disrupters-still-bleeding-talent-20170704-gx4som.html
[37] Australia’s National Digital Health Strategy: https://www.digitalhealth.gov.au/about-the-agency/publications/australias-national-digital-health-strategy/ADHA-strategy-doc-(2ndAug).pdf
[38] concerned: https://twitter.com/trentyarwood/status/718927965338243073
[39] increased privacy risk: http://www.zdnet.com/article/australias-digital-health-strategy-gets-the-nod-without-data-interoperability-controls/
[40] the agency will be establishing: https://www.computerworld.com.au/article/625703/digital-health-record-custodian-establishes-cyber-security-centre/
[41] launched a new online dashboard: http://securingdemocracy.gmfus.org/blog/2017/08/02/hamilton-68-new-tool-track-russian-disinformation-twitter
[42] Hamilton 68: http://dashboard.securingdemocracy.org/
[43] after three years of observing: http://dashboard.securingdemocracy.org/about
[44] top hashtag used by these accounts: https://www.businessinsider.com.au/russian-propaganda-website-tracker-2017-8?r=US&IR=T
[45] has been criticised: https://amp.meduza.io/en/feature/2017/08/03/tracking-russian-propaganda-in-real-time
[46] has signed off: https://medium.com/@C_Painter/the-case-for-diplomacy-in-cyberspace-8ca1ca8c97b3
[47] the new black: https://medium.com/@katherinerc/snowclones-memech%C3%A9s-and-why-linguistics-matters-6829bc92d11c
[48] hero: http://www.independent.co.uk/news/uk/home-news/marcus-hutchins-malwaretech-wannacry-arrest-latest-in-court-nhs-hack-hacker-hero-plead-not-guilty-a7878266.html
[49] @MalwareTechBlog: https://twitter.com/malwaretechblog
[50] FBI has accused Hutchins: https://www.documentcloud.org/documents/3912524-Kronos-Indictment-R.html
[51] creating, distributing and updating: https://www.theguardian.com/technology/2017/aug/04/wannacry-marcus-hutchins-kronos-malware-arrest
[52] was designed to: https://www.crn.com.au/news/kronos-malware-what-is-the-banking-trojan-linked-to-wannacry-hero-470199
[53] face a Nevada court: https://www.itwire.com/security/79352-marcus-hutchins-gets-bail,-to-face-court-on-14-aug.html
Click here to print.