WhatsApp patches flaw after spyware revelation

Yahoo – AFP, Rob Lever, May 14, 2019

Spyware injected into the popular messaging application WhatsApp could compromise
smartphones and lead to targeting of human rights activists, journalists and others
(AFP Photo/Kirill KUDRYAVTSEV)

Washington (AFP) - WhatsApp on Tuesday warned users to upgrade the application to plug a security hole that allowed for the injection of sophisticated malware that could be used to spy on journalists, activists and others.

Facebook-owned WhatsApp said it released an update to fix the vulnerability in the messaging app, used by 1.5 billion people around the world.

"WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices," a company statement said.

The WhatsApp spyware is sophisticated and "would be available to only advanced and highly motivated actors," the company said, adding that a "select number of users were targeted."

"This attack has all the hallmarks of a private company that works with a number of governments around the world" according to initial investigations, it added, but did not name the firm.

The spyware appears to be related to the Pegasus software developed by Israeli-based NSO group, which is normally sold to law enforcement and intelligence services, according to Washington-based analyst Joseph Hall.

A security flaw in WhatsApp, now fixed, allowed attackers to install spyware on 

phones (AFP Photo/NICOLAS ASFOURI)

The spyware "could have gotten into someone's hands" outside legitimate channels for nefarious purposes, Hall, chief technologist at the Center for Democracy and Technology, told AFP.

"It's unclear who is doing this."

Security researchers have found that Android and Apple phones can be infected with the spyware with a simple audio call through WhatsApp, even if the user does not answer, according to Hall, making detection more difficult.

Big risks

Hall said the unpatched security flaw opens the door to spying by rogue entities on human rights activists, journalists and others.

"The potential danger is quite large," he said.

"These kinds of apps that do encrypted messaging and encrypted phone calls tend to store the most secretive data that people need to protect."

He said dissidents and pro-democracy activists seeking to remain anonymous rely on these encrypted applications, as do journalists when speaking with sources about sensitive information.

Facebook did not comment on the number of users affected or who targeted them, and said it had reported the matter to US authorities.

It also informed EU authorities in Ireland about the "serious security vulnerability," according to a statement by the country's Data Protection Commission (DPC).

The revelation is the latest in a series of issues troubling WhatsApp's parent Facebook, which has faced intense criticism for allowing users' data to be harvested by research companies and over its slow response to Russia using the platform as a means to spread disinformation during the 2016 US election campaign.

WhatsApp is used by an estimated 1.5 billion people and 

its encryption feature has encouraged activsts, journalists 

and others for sensitive information (AFP Photo/Lionel 

BONAVENTURE)

Highly invasive software

WhatsApp said it has briefed human rights organizations on the matter, but did not identify them.

The NSO Group came to prominence in 2016 when researchers accused it of helping spy on an activist in the United Arab Emirates.

Its best-known product is Pegasus, a highly invasive tool that can reportedly switch on a target's phone camera and microphone, and access data on it.

The firm said Tuesday it only licenses its software to governments for "fighting crime and terror."

The NSO Group "does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions," it said in a statement to AFP.

"We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system."

Researchers at the University of Toronto's Citizen Lab have claimed that despite NSO's statement, Pegasus spyware is being misused by many governments.

The WhatsApp breach is the latest in a series of issues troubling its parent 

Facebook (AFP Photo/JUSTIN SULLIVAN)

"Pegasus appears to be in use by multiple countries with dubious human rights records and histories of abusive behavior by state security services," the researchers said in a report last year,

Amnesty International said meanwhile it would join a legal action this week in Israel by some 30 activists to revoke NSO's export license, claiming that one of its own staff members was targeted by a "particularly invasive" variant of the software in June 2018 via WhatsApp.

"NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics," said Danna Ingleton, deputy director of Amnesty Tech.

"As long as products like Pegasus are marketed without proper control and oversight, the rights and safety of Amnesty International's staff and that of other activists, journalists and dissidents around the world is at risk."

British PM approves Huawei role in 5G network: report

Yahoo – AFP, April 24, 2019

Last month, Britain identified "significant technological issues" in Huawei's engineering
processes that pose "new risks" for the nation's telecommunications (AFP Photo/
JOHN MACDOUGALL)

London (AFP) - British Prime Minister Theresa May has given the go-ahead for China's Huawei to help build a 5G network, shrugging off security warnings from senior ministers and Washington, the Daily Telegraph reported Wednesday.

The country's National Security Council, which is chaired by May, agreed Tuesday to allow the Chinese technology giant limited access to build "non-core" infrastructure such as antennas, the report said.

The decision was made despite concerns raised over May's approach by Home Secretary Sajid Javid, Foreign Secretary Jeremy Hunt, Defence Secretary Gavin Williamson, International Trade Secretary Liam Fox and International Development Secretary Penny Mordaunt.

Downing Street declined to comment but Huawei welcomed the newspaper report.

"Huawei welcomes reports that the UK government is moving towards allowing Huawei to help build the UK's 5G network," it said in a statement.

"This green light means that UK businesses and consumers will have access to the fastest and most reliable networks thanks to Huawei's cutting edge technology.

"While we await a formal government announcement, we are pleased that the UK is continuing to take an evidence-based approach to its work and we will continue work cooperatively with the government, and the industry."

The United States has however banned Huawei's 5G technology from its territory and urged allies in the so-called Five Eyes intelligence sharing collective -- which also includes Australia, Britain, Canada and New Zealand -- to follow suit.

Huawei is the leading manufacturer of equipment for next-generation 5G mobile networks with almost instantaneous data transfer that will become the nervous system of Europe's economy, in strategic sectors like energy, transport, banking and health care.

The technology titan faces pushback in some Western markets over fears Beijing could spy on communications and gain access to critical infrastructure.

Last month, Britain identified "significant technological issues" in Huawei's engineering processes that pose "new risks" for the nation's telecommunications, according to a government report.

Manhunt for hackers behind global cyberattack

Yahoo – AFP, Robin MILLARD, May 14, 2017

The huge cyberattack wiped out display screens at rail stations in Germany
(AFP Photo/Boris Roessler)

London (AFP) - International investigators hunted Saturday for those behind an unprecedented cyber-attack that affected systems in dozens of countries, including at banks, hospitals and government agencies, as security experts sought to contain the fallout.

The assault, which began Friday and was being described as the biggest-ever cyber ransom attack, struck state agencies and major companies around the world -- from Russian banks and British hospitals to FedEx and European car factories.

"The recent attack is at an unprecedented level and will require a complex international investigation to identify the culprits," said Europol, Europe's police agency.

Europol said a special task force at its European Cybercrime Centre was "specially designed to assist in such investigations and will play an important role in supporting the investigation".

The attacks used ransomware that apparently exploited a security flaw in Microsoft operating systems, locking users' files unless they pay the attackers a designated sum in the virtual currency Bitcoin.

Images appeared on victims' screens demanding payment of $300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!"

Payment is demanded within three days or the price is doubled, and if none is received within seven days the files will be deleted, according to the screen message.

But experts and government alike warn against ceding to the hackers' demands.

"Paying the ransom does not guarantee the encrypted files will be released," the US Department of Homeland Security's computer emergency response team said.

"It only guarantees that the malicious actors receive the victim's money, and in some cases, their banking information."

'Painful'

Experts and officials offered differing estimates of the scope of the attacks, but all agreed it was huge.

Mikko Hypponen, chief research officer at the Helsinki-based cyber security company F-Secure, told AFP it was the biggest ransomware outbreak in history, saying that 130,000 systems in more than 100 countries had been affected.

He said Russia and India were hit particularly hard, largely because Microsoft's Windows XP -- one of the operating systems most at risk -- was still widely used there.

French police said there were "more than 75,000 victims" around the globe, but cautioned that the number could increase "significantly".

The virus spread quickly because the culprits used a digital code believed to have been developed by the US National Security Agency -- and subsequently leaked as part of a document dump, according to researchers at the Moscow-based computer security firm Kaspersky Lab.

Microsoft said the situation was "painful" and that it was taking "all possible actions to protect our customers".

It issued guidance for people to protect their systems, while taking the highly unusual step of reissuing security patches first made available in March for Windows XP and other older versions of its operating system.

Europe worst hit

US software firm Symantec said the majority of organisations affected were in Europe, and the attack was believed to be indiscriminate.

The companies and government agencies targeted were diverse.

In the United States, package delivery group FedEx said it was "implementing remediation steps as quickly as possible," while French carmaker Renault was forced to stop production at sites in France, Slovenia and Romania.

Russia's interior ministry said some of its computers had been hit by a "virus attack" and that efforts were underway to destroy it. The country's banking system was also attacked, although no problems were detected, as was the railway system.

Germany's rail operator Deutsche Bahn said its station display panels were affected. Universities in Greece and Italy also were hit.

China's network information safety working group sent a warning to universities about the cyber-attack and the National Internet Emergency Center suggested that users update Windows security patches.

Shanghai's Fudan University received reports that a large number of school computers were infected with the virus.

Accidental 'kill switch'

Kaspersky said it was "trying to determine whether it is possible to decrypt data locked in the attack -- with the aim of developing a decryption tool as soon as possible."

On Saturday, a cyber security researcher told AFP he had accidentally discovered a "kill switch" that could prevent the spread of the ransomware.

The researcher, tweeting as @MalwareTechBlog, said registering a domain name used by the malware stops it from spreading, though it cannot help computers already affected.

"If you have anything to patch, patch it," the researcher said in a blog post. "Now I should probably sleep."

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, Kaspersky said.

"Unlike most other attacks, this malware is spreading primarily by direct infection from machine to machine on local networks, rather than purely by email," said Lance Cottrell, chief scientist at the US technology group Ntrepid.

G7 finance ministers meeting in Italy vowed to unite against cyber crime, as it represented a growing threat to their economies and should be tackled as a priority. The danger will be discussed at the G7 leaders' summit next month.

In Britain, the attack disrupted care at National Health Service facilities, forcing ambulances to divert and hospitals to postpone operations.

"There will be lessons to learn from what appears to be the biggest criminal cyber-attack in history," Interior minister Amber Rudd said.

"But our immediate priority as a government is to disrupt the attack, restore affected services as soon as possible, and establish who was behind it so we can bring them to justice."

burs-sst/kb

Ransomware: Malicious code blocks access to the data in your computer, allowing hackers to take it pic.twitter.com/DgZFD5kaAn

— AFP news agency (@AFP) May 12, 2017

Related Article:

Renault shuts down sites after being hit by cyberattack

EU court rules against Facebook over transatlantic data deal

Yahoo – AFP, 6 Oct 2015

The 'Safe Harbour' agreement reached by the United States and European 

Commission in 2000 was based on the premise that US laws offered similar 

privacy protection to those in the European Union (AFP Photo/Leon Neal)

Luxembourg (AFP) - The European Union's top court on Tuesday ruled that a key transatlantic data sharing deal relied on by companies such as Facebook was invalid in the light of spying revelations in the Edward Snowden scandal.

In a major blow to US tech firms, the court said the 2000 "Safe Harbour" agreement between the United States and the EU did not sufficiently guarantee the protection of Europeans' personal data and must be struck out.

The stunning decision stems from a David-and-Goliath complaint against social media giant Facebook lodged against Irish authorities by Max Schrems, an Austrian law student privacy campaigner.

Austrian right-to-privacy activist Max

 Schrems waits for the verdict at the

 European Court of Justice (SCJ) in 

Luxembourg on October 6, 2015

 (AFP Photo/John Thys)

"The Court of Justice declares that the (European) Commission’s US Safe Harbour Decision is invalid," the European Court of Justice in Luxembourg said in its three-page judgment.

The court said Irish authorities now had to decide whether transfer of data from Facebook's European subscribers to the United States should be suspended "on the ground that that country does not afford an adequate level of protection of personal data."

"YAY," Schrems tweeted after the judgment.

He later said in a statement that the decision was a "milestone when it comes to online privacy."

"It clarifies that mass surveillance violates our fundamental rights. This decision is a major blow for US global surveillance that heavily relies on private partners," he said.

Schrems filed the case against Ireland's data protection authority because Facebook's European headquarters are based there.

Major US web giants including Facebook and Apple have set up headquarters in Ireland to take advantage of favourable tax laws. Facebook data is then transferred to servers in the United States.

'Inaccurate assertions'

But Schrems had argued that the 15-year-old Safe Harbour deal is too weak to guarantee the privacy of European residents in the wake of details provided by former US National Security Agency (NSA) contractor and whistleblower Snowden.

The data deal allows data transfers by thousands of businesses on the grounds that US laws offer similar protection to those in the 28-nation European Union.

The European Commission -- the executive arm of the EU -- is widely expected to announce the imminent agreement of a new version of the Safe Harbour pact with the United States.

There was no immediate reaction to the judgment from Washington, but last month the United States said an opinion by the EU court's top legal counsel which reached similar conclusions was based on "inaccurate assertions".

Former NSA contractor Edward 

Snowden leaked details of the vast

 surveillance programs (AFP Photo)

The case comes amid widespread tensions between Brussels and Washington on issues of regulation, with several EU anti-trust probes currently underway into US tech firms.

"The United States does not and has not engaged in indiscriminate surveillance of anyone, including ordinary European citizens," the US mission to Brussels said in a statement last week.

"We fully respect the European Union's legal process; however, we believe that it is essential to comment in this instance because the Advocate General's opinion rests on numerous inaccurate assertions about intelligence practices of the United States."

Snowden, who remains wanted by the United States and currently lives in Moscow, opened a Twitter account last week, just days before the judgment.

His revelations showed that the NSA's PRISM programme used Silicon Valley giants Apple, Google and Facebook to gather user data.

In the wake of the scandal, the EU and Washington began talks to revamp Safe Harbour.

In Hague, court rules for Dutch tech-privacy advocates

A Dutch court has scrapped a national data retention law. The judge ruled that, although saving metadata might help solve crimes, it certainly breached the privacy of telephone and Internet users.

Deutsche Welle, 11 March 2015

A court in the Netherlands struck down a law requiring telecoms and Internet service providers to store their clients' private phone and email data, saying it breached EU privacy rules. The decision took effect immediately on Wednesday, but officials announced that the Security and Justice Ministry could appeal.

"The judge ruled that data retention is necessary and effective to combat serious crime," according to the district court in The Hague. "Dutch legislation, however, infringes on the individual's right to privacy and the protection of personal data." The court added that "the law therefore contravenes the Charter of Fundamental Rights of the European Union."

The law had previously required telephone companies in the Netherlands to store information about all fixed and mobile calls for a year. Internet providers had to store information on their clients' use for six months.

In April 2014, the European Court of Justice struck down a 2006 EU law forcing telecoms to store electronic metadata - the time, date, duration and destination of communiques, but not the content - for up to two years. The practice was ruled to be invasive, despite the claimed anti-terror potential. Advocate General Pedro Cruz Villalon had declared the 2006 legislation illegal and told the European Union's 28 member states to take the necessary steps to withdraw it.

'Far-reaching crime'

The written ruling by Gerard van Ham conceded that scrapping the data storage "could have far-reaching consequences for investigating and prosecuting crimes," but, the judge added, this could not justify the privacy breaches that the law entails. The judge did not set a deadline for disposing of the data.

According to Privacy First, one of seven organizations that took the government to court last month, the ruling "will bring to an end years of massive privacy breaches." The Dutch Association of Journalists was also a party to the suit.

After last year's ruling in the EU court, the government had announced that it would amend its law. However, in a written statement released on Wednesday, officials from the Security and Justice Ministry criticized the court's decision.

"Providers are no longer required to store data for investigations," the officials complained in the statement. "The ministry is seriously concerned about the effect this will have on fighting crime."

The extent to which governments and corporations monitor private individuals has risen to the forefront in the wake of a series of documents released since 2013 by the American intelligence whistleblower Edward Snowden. According to the latest report, New Zealand has monitored neighbors in the Asia-Pacific region. A new anti-terror law in China requires that foreign corporations allow the government to access their data.

The Wikimedia Foundation has sued the US National Secutiry Agency over its mass surveillance of private individuals. And consumer advocates have lashed out at large corporations that harvest personal data for commercial purposes.

mkg/rc (Reuters, AFP, AP)

Related Article:

Dutch justice minister, deputy resign over drugs dealer cash deal

German citizens' communication data reportedly passed to NSA

Germany's BND foreign intelligence agency has for years passed data on German citizens to the NSA, according to media reports. All data on Germans was previously said to have been filtered out.

Deutsche Welle, 4 Oct 2014

From 2004 to 2008, raw data was siphoned from an internet exchange point in Frankfurt and forwarded to the NSA, the Süddeutsche Zeitung newspaper and regional public broadcasters NDR and WDR reported on Friday.

The reports cited secret government documents submitted to the ongoing parliamentary inquiry into NSA spying.

It was first reported in June that the BND was handing information collected in Frankfurt to the NSA, codenamed "Eikonal," but information on German citizens was said to have been filtered out.

According to the latest Bundestag documents, however, BND internal tests showed that at least 5 percent of the German citizens' communications data could not be filtered.

An "absolute and mistake-free" separation of German and foreign citizens' communications is not possible, the secret documents said.

Frankfurt's DE-CIX internet exchange point is the largest in the world. Data streams from various internet providers meet there to be passed onto their respective destinations.

dr/jm (AFP, dpa, Reuters)

New privacy battle looms after moves by Apple, Google

Yahoo – AFP, Rob Lever, 1 Oct 2014

A new battle is brewing over privacy for mobile devices, after moves by Google

 and Apple to toughen the encryption of their mobile devices sparked complaints from

law enforcement (AFP Photo/Lluis Gene)

Washington (AFP) - A new battle is brewing over privacy for mobile devices, after moves by Google and Apple to toughen the encryption of their mobile devices sparked complaints from law enforcement.

The issue is part of a long-running debate over whether tech gadgets should have privacy-protecting encryption which makes it difficult for law enforcement to access in time-sensitive investigations.

FBI director James Comey reignited the issue last week, criticizing Apple and Google for new measures that keep smartphones locked down -- without even the company holding the keys to unlock the data.

FBI director James Comey reignited the

issue last week, criticizing Apple and Google

for new measures that keep smartphones

locked down (AFP Photo/Georges Gobet)

"What concerns me about this is companies marketing something expressly to allow people to place themselves beyond the law," the FBI chief said, warning that law enforcement may be denied timely access, even with a warrant, in cases ranging from child kidnapping to terrorism.

Former FBI criminal division chief Ronald Hosko made a similar point in an opinion piece in the Washington Post, citing a case in which the agency used smartphone data to solve a brutal kidnapping just in time to save the life of the victim.

"Most investigations don't rely solely on information from one source, even a smartphone," he said. "But without each and every important piece of the investigative puzzle, criminals and those who plan acts destructive to our national security may walk free."

Crypto Wars 2.0

Observers who follow privacy and encryption say they have seen this debate before.

In the mid-1990s, as the Internet was gaining traction, the government pressed for access to digital "keys" to any encryption software or hardware, before abandoning what ended up being a futile effort.

"This is Crypto Wars 2.0," says Joseph Hall of the Center for Democracy and Technology, a digital rights group active in both campaigns.

Today, "the main difference is that phones are increasingly deeply personal, containing much more daily life and interaction than a desktop from the 1990s" Hall said.

Hall argued that giving law enforcement access requires companies to "engineer vulnerabilities" which could be exploited by hackers or others.

"There's no way to tell the difference between a good guy and bad guy when they walk through the back door," he said.

Cindy Cohn of the Electronic Frontier Foundation says the FBI has been making these arguments since 1995, with the same flawed logic.

"We've seen this movie before," Cohn said.

"Regulating and controlling consumer use of encryption was a monstrous proposal officially declared in 2001," she said in a blog post. "But like a zombie, it's now rising from the grave, bringing the same disastrous flaws with it."

In 2013, before the revelations of massive surveillance from leaked National Security Agency documents, the FBI called for broader authority to capture mobile communications which fall outside traditional surveillance, such as Skype and Google Hangouts.

But civil liberties activities say leaked NSA documents suggest that contrary to FBI claims made last year, the government has many tools at its disposal.

"There are an increasing number of places where we leave our digital trails," Hall said, including in the Internet cloud, where it can be accessed with a court order.

No back doors

Jennifer Granick, director of civil liberties at the Stanford University Center for Internet and Society, said the FBI argument overlooks the fact US tech firms must compete in the global marketplace.

The issue is part of a long-running debate over whether tech gadgets should have

 privacy-protecting encryption which makes it difficult for law enforcement to

access in time-sensitive investigations (AFP Photo)

"Global customers do not want backdoored products any more than Americans do, and with very good reason," Granick writes on the "Just Security" blog.

"Authoritarian countries like Russia, China, the United Arab Emirates, Sudan, and Saudi Arabia want to censor, spy on, and control their citizens' communications. These nations are just as able to make demands that Apple and Google decrypt devices as the FBI is, and to back up those demands with effective threats."

On balance, she said, "the public is more secure, not less secure, with the wide use of strong cryptography -- including cryptography without back doors."

Mike Janke, chief executive of the firm Silent Circle which makes the fully encrypted Blackphone, said the FBI is making a "false cry" against Google and Apple because the law enforcement agency can easily gain access to a phone -- through a carrier tap, or location tracking, for example.

Greater privacy, Janke said, comes from the harder encryption on Blackphone, but law enforcement can still track a user's location as long as the battery is inside.

While a small number of people may use encryption for nefarious purposes, Janke said, "do you sacrifice the privacy and trade secrets of everyone else because of that?"

Right Livelihood Award to Snowden

Moscow-exiled US whistleblower Edward Snowden and British Guardian editor Alan Rusbridger are to receive the Right Livelihood Award. They're among five persons awarded Sweden's "alternative Nobel prize."

Deutsche Welle, 24 Sep 2014

The Stockholm-based Right Livelihood Award Foundation on Wednesday praised Snowden, a former US intelligence agent, for "revealing the unprecedented extent of state surveillance."

Rusbridger was forced to destroy data

It said Rusbridger, the editor in chief of Britain's The Guardian newspaper, also won the award for "responsible journalism in the public interest.

"None of them could have done what they did without the other, " said foundation director Ole von Uexkull.

The announcement, originally set for Thursday, was brought forward, after a leak by Swedish broadcaster SVT.

Foundation denied access

Von Uexkull, the nephew of Jacob von Uexkull who founded the prize in 1980, said all winners had been invited to a December 1 award ceremony in Stockholm.

Discussions on "potential" travel arrangements for Snowden, who remains exiled in Russia, would be held with the Swedish government, von Uexkull said.

He added that the foundation had been denied access to the Swedish foreign ministry's media room, where award ceremonies have been held since 1995.

Three other winners

Snowden, who is wanted by the US for exposing mass data collection by the US National Security Agency (NSA) and Rusbridger are honorary winners, meaning they will not receive the award's customary 500,000 kronor (54,500 euros).

The other three prize winners, named to receive the monetary award, are Pakistani human rights lawyer Asma Jahanger, Sri Lankan rights activist Basil Fernando and US environmentalist Bill McKibbben.

Jahanger is a human rights lawyer who has defended women, children, religious minorities and the poor in Pakistan, the award citation said.

Fernando, originally from Sri Lanka, led the Hong Kong-based Asian Human Rights Commission for nearly two decades and now serves as its director of policy and programs.

McKibben is founder of 350.org, a grass-roots environmental movement aimed at spurring action to fight climate change.

lpj/kms (dpa, AFP, AP)

Von Uexkull, the nephew of Jacob von Uexkull who founded the prize in 1980, said all winners had been invited to a December 1 award ceremony in Stockholm.

Discussions on "potential" travel arrangements for Snowden, who remains exiled in Russia, would be held with the Swedish government, von Uexkull said.

He added that the foundation had been denied access to the Swedish foreign ministry's media room, where award ceremonies have been held since 1995.

Three other winners

Snowden, who is wanted by the US for exposing mass data collection by the US National Security Agency (NSA) and Rusbridger are honorary winners, meaning they will not receive the award's customary 500,000 kronor (54,500 euros).

The other three prize winners, named to receive the monetary award, are Pakistani human rights lawyer Asma Jahanger, Sri Lankan rights activist Basil Fernando and US environmentalist Bill McKibbben.

Jahanger is a human rights lawyer who has defended women, children, religious minorities and the poor in Pakistan, the award citation said.

Fernando, originally from Sri Lanka, led the Hong Kong-based Asian Human Rights Commission for nearly two decades and now serves as its director of policy and programs.

McKibben is founder of 350.org, a grass-roots environmental movement aimed at spurring action to fight climate change.

lpj/kms (dpa, AFP, AP)

US threatened Yahoo with huge fine over surveillance

Yahoo – AFP, 11 Sep 2014

Civil liberties activists hold a rally against surveillance of US citizens at the
Justice Department in Washington on January 17, 2014 (AFP Photo/Nicholas Kamm)

Washington (AFP) - US authorities threatened to fine Yahoo $250,000 a day if it failed to comply with a secret surveillance program requiring it to hand over user data in the name of national security, court documents showed Thursday.

The documents, made public in a rare unsealing by a secretive court panel, "underscore how we had to fight every step of the way to challenge the US government's surveillance efforts," Yahoo general counsel Ron Bell said in a blog post.

The documents shed new light on the PRISM program revealed in leaked files from former National Security Agency contractor Edward Snowden.

The program allowed US intelligence services to sweep up massive amounts of data from major Internet firms including Yahoo and Google.

Bell said 1,500 pages of documents were ordered released by the Foreign Intelligence Surveillance Court in the case dating from 2007. He said that in 2007, the government "amended a key law to demand user information from online services."

"We refused to comply with what we viewed as unconstitutional and overbroad surveillance and challenged the US government's authority," he said.

Yahoo's court challenge failed and it was forced to hand over the data. The court records were kept sealed.

"At one point, the US government threatened the imposition of $250,000 in fines per day if we refused to comply," Bell said.

Since the Snowden leaks, Yahoo and others have been seeking to make public these court documents to show they were forced to comply with government requests and made numerous attempts to fight these efforts.

The opening of these court dockers to the public "is extremely rare," Bell said, adding that the company was in the process of making the 1,500 pages publicly available online.

"We consider this an important win for transparency, and hope that these records help promote informed discussion about the relationship between privacy, due process, and intelligence gathering," Bell added.

But he said that "despite the declassification and release, portions of the documents remain sealed and classified to this day, unknown even to our team."

Foreign security software ousted from China's procurement list

Want China Times, Xinhua 2014-08-04

Kaspersky products on display during a product launch
in Beijing in 2011. (File photo/Xinhua)

A Chinese government procurement agency has excluded Symantec and Kaspersky, two foreign security software developers, from a security software supplier list.

According to a report from Beijing Youth Daily, all the five antivirus softwares in the list are from China, including Qihoo 360, Venustech, CAJinchen, Beijing Jiangmin and Rising.

China's homegrown technology companies also got the better of their foreign counterparts in the personal computer operating system supplier list, making Microsoft the only foreign brand.

There is no indication whether the move has some connection with China's emphasis on the security of IT products and software after Edward Snowden's leaks about the intelligence gathering project PRISM from the National Security Agency of the United States.

China's State Internet Information Office announced in May that it would start security vetting of major IT products and services for use by national security and public interests.