PUBLISHER'S NOTE: In recent years, I have found myself publishing more and more posts on the application of artificial intelligence technology to policing, public safety, and the criminal justice process, not just in North America, but in countries all over the world, including China. Although I accept that properly applied science can play a positive role in our society, I have learned over the years that technologies introduced for the so-called public good, can eventually be used against the people they were supposed to benefit. As reporter Sieeka Khan writes in Science Times: "In 2017, researchers sent a letter to the secretary of the US Department of Homeland Security. The researchers expressed their concerns about a proposal to use the AI to determine whether someone who is seeking refuge in the US would become a positive and contributing member of society or if they are likely to become a threat or a terrorist. The other government uses of AI are also being questioned, such as the attempts at setting bail amounts and sentences on criminals, predictive policing and hiring government workers. All of these attempts have been shown to be prone to technical issues and a limit on the data can cause bias on their decisions as they will base it on gender, race or cultural background. Other AI technologies like automated surveillance, facial recognition and mass data collection are raising concerns about privacy, security, accuracy and fairness in a democratic society. As the executive order of Trump demonstrates, there is a massive interest in harnessing AI for its full, positive potential. But the dangers of misuse, bias and abuse, whether it is intentional or not, have the chance to work against the principles of international democracies. As the use of artificial intelligence grows, the potential for misuse, bias and abuse grows as well. The purpose of this 'technology' series, is to highlight the dangers of artificial intelligence - and to help readers make their own assessments as to whether these innovations will do more harm than good.
Harold Levy: Publisher: The Charles Smith Blog;
------------------------------------------------------------
PASSAGE OF THE DAY: "Thomas Rid, a cybersecurity expert at Johns Hopkins University, called the Shadow Brokers episode “the most destructive and costly N.S.A. breach in history,” more damaging than the better-known leak in 2013 from Edward Snowden, the former N.S.A. contractor. “The government has refused to take responsibility, or even to answer the most basic questions,” Mr. Rid said. “Congressional oversight appears to be failing. The American people deserve an answer.” The N.S.A. and F.B.I. declined to comment. Since that leak, foreign intelligence agencies and rogue actors have used EternalBlue to spread malware that has paralyzed hospitals, airports, rail and shipping operators, A.T.M.s and factories that produce critical vaccines. Now the tool is hitting the United States where it is most vulnerable, in local governments with aging digital infrastructure and fewer resources to defend themselves."
STORY: "In Baltimore and beyond, a stolen N.S.A. tool wreaks havoc," by reporters Nicole Perlroth and Scott Shane, published by The New York Times on May 25 2019.
PHOTO CAPTION: "The
National Security Agency headquarters in Maryland. A leaked N.S.A.
cyberweapon, EternalBlue, has caused billions of dollars in damage
worldwide. A recent attack took place in Baltimore, the agency’s own
backyard.
GIST: Since 2017, when the N.S.A. lost control of the tool,
EternalBlue, it has been picked up by state hackers in North Korea,
Russia and, more recently, China, to cut a path of destruction around
the world, leaving billions of dollars in damage. But over the past
year, the cyberweapon has boomeranged back and is now showing up in the
N.S.A.’s own backyard. It is not just in Baltimore. Security experts say EternalBlue attacks have reached a high,
and cybercriminals are zeroing in on vulnerable American towns and
cities, from Pennsylvania to Texas, paralyzing local governments and
driving up costs. The
N.S.A. connection to the attacks on American cities has not been
previously reported, in part because the agency has refused to discuss
or even acknowledge the loss of its cyberweapon, dumped online in April
2017 by a still-unidentified group calling itself the Shadow Brokers.
Years later, the agency and the Federal Bureau of Investigation still
do not know whether the Shadow Brokers are foreign spies or disgruntled
insiders. Thomas Rid, a cybersecurity
expert at Johns Hopkins University, called the Shadow Brokers episode
“the most destructive and costly N.S.A. breach in history,” more
damaging than the better-known leak in 2013 from Edward Snowden, the
former N.S.A. contractor. “The
government has refused to take responsibility, or even to answer the
most basic questions,” Mr. Rid said. “Congressional oversight appears to
be failing. The American people deserve an answer.” The N.S.A. and F.B.I. declined to comment. Since
that leak, foreign intelligence agencies and rogue actors have used
EternalBlue to spread malware that has paralyzed hospitals, airports,
rail and shipping operators, A.T.M.s and factories that produce critical
vaccines. Now the tool is hitting the United States where it is most
vulnerable, in local governments with aging digital infrastructure and
fewer resources to defend themselves. On May 7, city workers in Baltimore had their computers frozen by hackers. Officials have refused to pay the $100,000 ransom.Credit. Before
it leaked, EternalBlue was one of the most useful exploits in the
N.S.A.’s cyberarsenal. According to three former N.S.A. operators who
spoke on the condition of anonymity, analysts spent almost a year
finding a flaw in Microsoft’s software and writing the code to target
it. Initially, they referred to it as EternalBluescreen because it often
crashed computers — a risk that could tip off their targets. But it
went on to become a reliable tool used in countless
intelligence-gathering and counterterrorism missions. EternalBlue
was so valuable, former N.S.A. employees said, that the agency never
seriously considered alerting Microsoft about the vulnerabilities, and
held on to it for more than five years before the breach forced its
hand. The Baltimore attack, on May 7, was a classic ransomware
assault. City workers’ screens suddenly locked, and a message in flawed
English demanded about $100,000 in Bitcoin to free their files: “We’ve
watching you for days,” said the message, obtained by The Baltimore Sun. “We won’t talk more, all we know is MONEY! Hurry up!” Today,
Baltimore remains handicapped as city officials refuse to pay, though
workarounds have restored some services. Without EternalBlue, the damage
would not have been so vast, experts said. The tool exploits a
vulnerability in unpatched software that allows hackers to spread their
malware faster and farther than they otherwise could. North
Korea was the first nation to co-opt the tool, for an attack in 2017 —
called WannaCry — that paralyzed the British health care system, German
railroads and some 200,000 organizations around the world. Next was
Russia, which used the weapon in an attack — called NotPetya — that was
aimed at Ukraine but spread across major companies doing business in the
country. The assault cost FedEx more than $400 million and Merck, the
pharmaceutical giant, $670 million. The
damage didn’t stop there. In the past year, the same Russian hackers
who targeted the 2016 American presidential election used EternalBlue to
compromise hotel Wi-Fi networks. Iranian hackers have used it to spread
ransomware and hack airlines in the Middle East, according to
researchers at the security firms Symantec and FireEye. “It’s
incredible that a tool which was used by intelligence services is now
publicly available and so widely used,” said Vikram Thakur, Symantec’s
director of security response. One
month before the Shadow Brokers began dumping the agency’s tools online
in 2017, the N.S.A. — aware of the breach — reached out to Microsoft
and other tech companies to inform them of their software flaws.
Microsoft released a patch, but hundreds of thousands of computers
worldwide remain unprotected. Microsoft
employees reviewing malware data at the company’s offices in Redmond,
Wash. EternalBlue exploits a flaw in unpatched Microsoft software.CreditKyle Johnson for The New York Times Hackers
seem to have found a sweet spot in Baltimore, Allentown, Pa., San
Antonio and other local, American governments, where public employees
oversee tangled networks that often use out-of-date software. Last July,
the Department of Homeland Security issued a dire warning
that state and local governments were getting hit by particularly
destructive malware that now, security researchers say, has started
relying on EternalBlue to spread. Microsoft,
which tracks the use of EternalBlue, would not name the cities and
towns affected, citing customer privacy. But other experts briefed on
the attacks in Baltimore, Allentown and San Antonio confirmed the
hackers used EternalBlue. Security responders said they were seeing
EternalBlue pop up in attacks almost every day. Amit
Serper, head of security research at Cybereason, said his firm had
responded to EternalBlue attacks at three different American
universities, and found vulnerable servers in major cities like Dallas,
Los Angeles and New York. The costs
can be hard for local governments to bear. The Allentown attack, in
February last year, disrupted city services for weeks and cost about $1
million to remedy — plus another $420,000 a year for new defenses, said
Matthew Leibert, the city’s chief information officer. He
described the package of dangerous computer code that hit Allentown as
“commodity malware,” sold on the dark web and used by criminals who
don’t have specific targets in mind. “There are warehouses of kids
overseas firing off phishing emails,” Mr. Leibert said, like thugs
shooting military-grade weapons at random targets. The
malware that hit San Antonio last September infected a computer inside
Bexar County sheriff’s office and tried to spread across the network
using EternalBlue, according to two people briefed on the attack. This
past week, researchers at the security firm Palo Alto Networks
discovered that a Chinese state group, Emissary Panda, had hacked into
Middle Eastern governments using EternalBlue. “You
can’t hope that once the initial wave of attacks is over, it will go
away,” said Jen Miller-Osborn, a deputy director of threat intelligence
at Palo Alto Networks. “We expect EternalBlue will be used almost
forever, because if attackers find a system that isn’t patched, it is so
useful. Adm. Michael S. Rogers, who led the N.S.A. during the leak, has said the agency should not be blamed for the trail of damage.CreditErin Schaff for The New York Times. Until
a decade or so ago, the most powerful cyberweapons belonged almost
exclusively to intelligence agencies — N.S.A. officials used the term
“NOBUS,” for “nobody but us,” for vulnerabilities only the agency had
the sophistication to exploit. But that advantage has hugely eroded, not
only because of the leaks, but because anyone can grab a cyberweapon’s
code once it’s used in the wild. Some
F.B.I. and Homeland Security officials, speaking privately, said more
accountability at the N.S.A. was needed. A former F.B.I. official
likened the situation to a government failing to lock up a warehouse of
automatic weapons. In an interview in
March, Adm. Michael S. Rogers, who was director of the N.S.A. during
the Shadow Brokers leak, suggested in unusually candid remarks that the
agency should not be blamed for the long trail of damage. “If Toyota makes pickup trucks and someone takes a pickup truck, welds an
explosive device onto the front, crashes it through a perimeter and into
a crowd of people, is that Toyota’s responsibility?” he asked. “The
N.S.A. wrote an exploit that was never designed to do what was done.” At
Microsoft’s headquarters in Redmond, Wash., where thousands of security
engineers have found themselves on the front lines of these attacks,
executives reject that analogy. “I
disagree completely,” said Tom Burt, the corporate vice president of
consumer trust, insisting that cyberweapons could not be compared to
pickup trucks. “These exploits are developed and kept secret by
governments for the express purpose of using them as weapons or
espionage tools. They’re inherently dangerous. When someone takes that,
they’re not strapping a bomb to it. It’s already a bomb.” Brad Smith, Microsoft’s president, has called for a “Digital Geneva Convention”
to govern cyberspace, including a pledge by governments to report
vulnerabilities to vendors, rather than keeping them secret to exploit
for espionage or attacks. Last year,
Microsoft, along with Google and Facebook, joined 50 countries in
signing on to a similar call by French President Emmanuel Macron — the
Paris Call for Trust and Security in Cyberspace — to end “malicious
cyber activities in peacetime.” Notably
absent from the signatories were the world’s most aggressive
cyberactors: China, Iran, Israel, North Korea, Russia — and the United
States."
The entire story can be read at:
https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html
https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html
PUBLISHER'S NOTE: I am monitoring this case/issue. Keep your eye on the Charles Smith Blog for reports on developments. The Toronto Star, my previous employer for more than twenty incredible years, has put considerable effort into exposing the harm caused by Dr. Charles Smith and his protectors - and into pushing for reform of Ontario's forensic pediatric pathology system. The Star has a "topic" section which focuses on recent stories related to Dr. Charles Smith. It can be found at: http://www.thestar.com/topic/charlessmith. Information on "The Charles Smith Blog Award"- and its nomination process - can be found at: http://smithforensic.blogspot.com/2011/05/charles-smith-blog-award-nominations.html Please send any comments or information on other cases and issues of interest to the readers of this blog to: hlevy15@gmail.com. Harold Levy: Publisher; The Charles Smith Blog;
