These kinds of data brokers fuel a large and mostly invisible data market. But there are times where aspects of it (accidentally) emerge from the shadows.
Recent reporting, first covered by 404 Media, reveals how Fog Reveal sells geolocation services to government agencies. Geofences can be placed around targeted persons’ friends’ and families’ homes, places of worship, doctors’ offices, and offices of a person’s lawyer. Fences can be established retroactively as well as proactively.
Fog Reveal and similar companies are offering an expansive for-sale surveillance capacity. And the capacity, which was once the thing of science fiction, has somehow become banally available for those who can convince private vendors to provide access to the data they have collected.
There remains an open question of how to remedy the current situation: should the focus be on regulating bad actors after they appear or, instead, invest the political capital required to stop the processes enabling the data collection in the first place?
Five Eyes countries have regularly and routinely sought, and gained, access to foreign telecommunications infrastructures to carry out their operations. The same is true of other well resourced countries, including China.
Salt Typhoon’s penetration of American telecommunications and email platforms is slowly coming into relief. The New York Times has an article that summarizes what is being publicly disclosed at this point in time:
The full list of phone numbers that the Department of Justice had under surveillance in lawful interception systems has been exposed, with the effect of likely undermining American counter-intelligence operations aimed at Chinese operatives
Phone calls, unencrypted SMS messages, and email providers have been compromised
The FBI has heightened concerns that informants may have been exposed
Apple’s services, as well as end to end encrypted systems, were not penetrated
American telecommunications networks were penetrated, in part, due to companies relying on decades old systems and equipment that do not meet modern security requirements. Fixing these deficiencies may require rip-and-replacing some old parts of the network with the effect of creating “painful network outages for consumers.” Some of the targeting of American telecommunications networks is driven by an understanding that American national security defenders have some restrictions on how they can operate on American-based systems.
Some of the Five Eyes, led by Canada, have been developing and deploying defensive sensor networks that are meant to shore up some defences of government and select non-government organizations.1 But these edge, network, and cloud based sensors can only do so much: telecommunications providers, themselves, need to prioritize ensuring their core networks are protected against the classes of adversaries trying to penetrate them.2
At the same time, it is worth recognizing that end to end communications continued to be protected even in the face of Salt Typhoon’s actions. This speaks the urgent need to ensure that these forms of communications security continue to be available to all users. We often read that law enforcement needs select access to such communications and that they can be trusted to not abuse such exceptional access.
Setting aside the vast range of legal, normative, or geopolitical implications of weakening end to end encryption, cyber operations like the one perpetrated by Salt Typhoon speak to governments’ collective inabilities to protect their lawful access systems. There’s no reason to believe they’d be any more able to protect exceptional access measures that weakened, or otherwise gained access to, select content of end to end encrypted communications.
We are seeing some governments introducing, and sometimes passing, laws that would foster more robust security requirements. In Canada, Bill C-26 is generally meant to do this though the legislation as introduced raised some serious concerns. ↩︎
In an impressive operation, a Russian APT reportedly targeted a Washington, DC network after daisy chaining through a sequence of neighbouring networks and devices in 2022. The trick: they may have done so without ever using any local operatives.
This is a movie-like kind of operation and speaks to the immense challenges in defending against very well resourced, motivated, and entrepreneurial adversaries.
Earlier this week the Intelligence Commissioner (IC) appeared at the Standing Senate Committee on National Security, Defence and Veterans Affairs on Bill C-26, along with federal Privacy Commissioner. The bill is intended to enhance the cybersecurity requirements that critical infrastructure providers must adopt.
The IC’s remarks are now public. He made four very notable comments in his opening remarks:
The IC warned that the proposed amendments to the Telecom Act would allow the minister to essentially compel the production of any information in support of orders. This information could include personal information – which under broad exceptions, could then be widely disclosed.
Part 2 allows for the regulators to carry out the equivalent of unwarranted searches – where again, personal information could be collected.
The CSE will play a vital role and will be the holder of this information, in a technological form or otherwise, which will contain elements for which we have a reasonable expectation of privacy.
In light of the invasive nature of the Bill, he asserted that it is important that meaningful safeguards be part of the legislation so that Canadians have confidence in the cybersecurity system.
His responses to comments at committee — not yet available through Hansard — made even more clear that he believed that amendments are needed to integrate appropriate oversight and accountability measures into the legislation. The IC’s comments, combined with those of the federal Privacy Commissioner of Canada and civil society representatives, constitute a clear warning to senators about the potential implications of the legislation.
While at Committee, Commissioner Dufresne recognized the value of making explicit the OPC’s oversight role concerning the legislation. He, also, reaffirmed the importance of requiring any collection, use, or disclosure of personal information to be both necessary and proportionate. And should the Standing Committee decline to adopt this amendment they were advised to, at a minimum, include a requirement that data only be retained for as long as necessary. Government institutions should also be required to undertake privacy impact assessments and consult with the OPC.
Finally, in cases of cyber incidents that may result in a material breach, his office should be notified; this could entail the OPC being notified by the Communications Security Establishment based on a real risk of significant harm standard. Information sharing agreements should also be put in place that provide minimum privacy safeguards while also strengthening governance and accountability processes.
Should other Canadian jurisdictions propose their own cybersecurity legislation to protect critical infrastructure and regulated bodies it will be interesting to monitor for the consistency in the amendments called for by Canada’s privacy regulators.
When people are at risk, law enforcement agencies can often move quickly to obtain certain information from online service providers. In the United States this can involve issuing Emergency Data Requests (EDRs) absent a court order.1
While the full extent of the threat remains unknown, of Verizon’s total 127,000 requests for data in Q2 of 2023, 36,000 were EDRs. And Kodex, a company that is often the intermediary between law enforcement and online providers, found that over the past year it had suspended 4,000 law enforcement users and approximately 30% of EDRs did not pass secondary verification. Taken together this may indicate a concerning cyber policy issue that may seriously endanger affected individuals.
These are just some of the broader policy and cybersecurity challenges that are key to keep in mind, both as new laws are passed and as new cybersecurity requirements are contemplated. It is imperative that lawful government capabilities are not transformed into significant and powerful tools for criminals and adversaries alike.
There are similar kinds of provisions in the Canadian Criminal Code. ↩︎
Apple has quietly introduced an enhanced security feature in iOS 18.1. If you haven’t authenticated to your device recently — the past few days — the device will automatically revert from the After First Unlock (AFU) state to the Before First Unlock (BFU) state, with the effect of better protecting user information.1
Users may experience this new functionality by sometimes needing to enter their credentials prior to unlocking their device if they haven’t used it recently. The effect is that stolen or lost devices will be returned to a higher state of security and impede unauthorized parties from gaining access to the data that users have stored on their devices.
There is a secondary effect, however, insofar as these protections in iOS 18.1 may impede some mobile device forensics practices when automatically returning seized devices to a higher state of security (i.e., BFU) after a few days. This can reduce the volume of user information that is available to state agencies or other parties with the resources to forensically analyze devices.
While this activity may raise concerns that lawful government investigations may be impaired it is worth recalling that Apple is responsible for protecting devices from around the world. Numerous governments, commercial organizations, and criminal groups are amongst those using mobile device forensics practices, and iOS devices in the hands of a Canadian university student are functionally same as iOS devices used by fortune 50 executives. The result is that all users receive an equivalent high level of security, and all data is strongly safeguarded regardless of a user’s economic, political, or socio-cultural situation.
Each week is seemingly accompanied by news of some perimeter security appliance being successfully exploited by adversaries. Sophos has produced a report — covered by Wired — which outlines their 5-year efforts to identify and combat such adversaries. It’s a wild read both in terms of the range of activities undertaken by Sophos and for making clearer to the public the range of intelligence activities that private organizations undertake as part of their cybersecurity operations.
Some of the major revelations, and activities undertaken, by Sophos include:
A broader group of China-based researchers developed hacking techniques and supplied them to Chinese government APTs.
Historically the exploitation of Sophos appliances was being carried out using 0-days but, in recent assessments, APTs are using N-days to target end-of-life equipment.
Sophos included code in one of its hotfixes to obtain additional information from consumer devices and expose more information about adversaries to the company.
Sophos went to far as to deploy, “its own spy implants to the Sophos devices in Chengdu they were testing on—essentially hacking the hackers, albeit only through code added to a few installations of its own products the hackers had obtained.”
Targets of Chinese APTs were often located throughout Asia, and most recently included “another country’s nuclear energy regulatory agency, then a military facility in the same country and the airport of the country’s capital city, as well as other hacking incidents that targeted Tibetan exiles.”
Sophos found that the adversaries had built a bootkit which is designed to infect low-level code. The company is asserting this may be the first time a firewall bootkit has ever been seen. They have no intelligence that it has ever been deployed in the wild.
It’s uncommon for the details of how private companies have developed their defensive strategies over a longer period of time to be made public, and so this is helpful for broadening the space for discussion. Sophos’ activities are, also, significant on the basis that the private company implanted its own systems to develop intelligence concerning its Chinese adversaries.
There has been extensive normative and legal discussion on the risks linked with “hacking back” and Sophos’ actions are another step towards normalizing such behaviour, albeit under the auspice of a company targeting its own equipment. I personally don’t think that Sophos’ defence that they were targeting their own equipment meaningfully isolates the broader implications of their actions. Perimeter appliances are extensively deployed and their decision may both normalize such behaviours broadly by private firms for their own ends and, also, further open the doors to some governments pressuring private firms to deploy implants on behalf of said governments. Neither of these trajectories are likely to end well.
These activities are occurring despite OpenAI’s warnings that Whisper should not be used in high-risk domains.
The article reports that a “machine learning engineer said he initially discovered hallucinations in about half of the over 100 hours of Whisper transcriptions he analyzed. A third developer said he found hallucinations in nearly every one of the 26,000 transcripts he created with Whisper. The problems persist even in well-recorded, short audio samples. A recent study by computer scientists uncovered 187 hallucinations in more than 13,000 clear audio snippets they examined.”
Transcription errors can be very serious. Research by Prof. Koenecke and Prof. Sloane of the University of Virgina found:
… that nearly 40% of the hallucinations were harmful or concerning because the speaker could be misinterpreted or misrepresented.
In an example they uncovered, a speaker said, “He, the boy, was going to, I’m not sure exactly, take the umbrella.”
But the transcription software added: “He took a big piece of a cross, a teeny, small piece … I’m sure he didn’t have a terror knife so he killed a number of people.”
A speaker in another recording described “two other girls and one lady.” Whisper invented extra commentary on race, adding “two other girls and one lady, um, which were Black.”
In a third transcription, Whisper invented a non-existent medication called “hyperactivated antibiotics.”
While, in some cases, voice data is deleted for privacy reasons this can impede physicians (or other medical personnel) from double checking the accuracy of transcription. While some may be caught, easily and quickly, more subtle errors or mistakes may be less likely to be caught.
One area where work stills needs to be done is to assess the relative accuracy of the AI scribes versus that of physicians. While there may be errors introduced by automated transcription what is the error rate of physicians? Also, what is the difference in quality of care between one whom is self-transcribing during a meeting vs reviewing transcriptions after the interaction? These are central questions that should play a significant role in assessments of when and how these technologies are deployed.
Since 2006 Toronto has hosted Nuit Blanche, where selected artists are invited to set up art installations from sundown at 7pm until sunrise at 7am the following day. For the past decade or so I’ve tried to get out and enjoy the exhibits. I usually try to walking from 1am until 7am when the installations are taken down.
This year many of the installations took place around Toronto’s downtown waterfront. This had the effect of clustering people in a common part of the city and enhancing the sense of togetherness associated with the art exhibits; in past years I often felt like I alone was still out at 7am but not this year!
Bay & Queens Quay, Toronto, 2024
Each year there are food stall and trucks, and this year was no exception. Even at 1 in the morning there were crowds who were looking to have a quick bite to carry them through the evening. I’d just arrived and had yet to feel the bite of hunger or thirst.
Lower Sherbourne & Queens Quay, Toronto, 2024
One of the exhibits this year included a series of skeletal shacks. They stood above us and we looked at what may happen when civilization degrades and this is what we remain left with.
Great Lakes Waterfront & Queen Quay, Toronto, 2024
Of course walking around this late at night meant there were often strong contrasts between shadow and light. I’ve visited this area of Toronto regularly over the past decade and captured people huddled in the same spot, but never with such dynamic contrast between the lit structure and the rest of the environment. I liked how the subjects were huddled away from the darkness that was just beyond the lit structure. Isn’t this the nature of humans: huddling in the light while the darkness is kept at bay?.
Dockside & Knapp, Toronto, 2024
Each year there are some exhibits that are at least slightly interactive. Every person who attended a particular film screening was first asked to pick up a custom hanger and think about it during the performance. It wasn’t self-apparent how this hanger necessarily mapped to film.
Queens Quay & Freeland, Toronto, 2024
This was the only colour image I made through the night. The exhibit projected videos of people’s homes on a condo wall and, beside it, the artist had set up a tent to represent how many of Toronto’s least fortunate must live their nights. This was one of the more poignant exhibits I saw through the evening.
Queens Quay & York, Toronto, 2024
A set of screens were set up in Love Park and rotated the images in them through the night. The eyes that regularly cropped up were eerie at that time of the early morning.
Great Lakes Waterfront & Harbour, Toronto, 2024
Continuing the theme of eyes, this separate video display regularly had an image of an eyeball looking into the audience. When it isolated the older woman I knew I had to hold onto the moment.
Spadina & Queens Quay, Toronto, 2024
One of the marque exhibits of the year were glowing fish that were placed in the harbour. Here, I’ve captured their luminescent being alongside one of the tall ships that is always docked; the effect is spectral, to my eye, with the fish racing towards the ghost-boat.
Bathurst & Queens Quay, Toronto, 2024
Hosting a project that raised the issue of disability inside a basketball court forced audiences to confront the ableism that permeates our lives, and especially contemporary sport. The exhibit forced audiences to acknowledge that disabled athletes have led the way in more accessible design that is now the norm for all athletes, disabled or not. By this time it was about 5am and the crowds were dying down, though spectators and attendees to the festival were still around in smaller numbers.
Richmond & Spadina, Toronto, 2024
This was the last exhibit that I documented and left with an image I was satisfied with. The artists were lowering a multi-coloured spider web that had been elevated above the attendees, when a sole last participant walked through the exhibit despite the efforts to tear it down by sundown. The subject is reaper-like in their image and spoke to the end of the exhibit, and the end of Nuit Blanche for 2024.
Queen & Chestnut, Toronto, 2024
On my way to breakfast I captured this image of Toronto’s City Hall as the sun was just starting to rise. All was quiet, including the parking garages, though the city had begun coming back to life once I got home an hour or so later to crawl into bed before a short nap ahead of afternoon activities.
Excited Pixels 