The Ethical Investigator

In September 2011, Gauss, a new malware described by the tech-press “as a cyber-espionage tool kit” emerged from the Middle East.  Gauss steals highly sensitive data, including browser passwords, online bank accounts as well as cookies and system configurations.  Gauss closely resembles the malware Flame and Stuxnet, which according to Kaspersky Labs, were created in state-sponsored factories.  Consequently, analysts believe that it too might be state-sponsored.  Since its debut, Gauss appears to have infected 2,500 machines worldwide.  However, the total number of victims may actually be much higher, in the realm of tens of thousands. 

And that number could just keep growing.  Shortly after Gauss was discovered in June 2012, its command and control infrastructure was disabled.  This may sound like a victory, but it is actually far from the truth.  As tech journalist Larry Dignan explains on Cnet.com, the Gauss “malware is dormant waiting for servers to become active.” In other words, it may continue to wreck havoc.

Admittedly, this sort of thing—state-sponsored hackers breaking into bank accounts— could keep one up at night.  What is interesting from an investigative point of view, however, is the way that computer scientists have figured out how to root out the Gauss malware before it causes harm.  Apparently, computer scientists have determined that the font Palida Narrow is used during a Gauss cyber attack.  Therefore, programs designed to detect Gauss check for that particular font to help determine whether the malware is in fact present and needs to be rooted out. 

To be clear, the font does not cause the theft to occur.  Instead, its presence merely correlates with the malware that does.  It is an indirect and yet highly elegant and quick way to detect whether a problem may exist.

As investigators, we can’t always get exactly to the evidence we want to prove.  Sometimes it merely doesn’t exist.  Often, ethical and legal constraints keep us from being able to obtain the facts we definitively need to prove what we are investigating. 

It’s easy to get lost searching for the unsearchable, pining for that one nugget that will help everything fall into place.  But investigators don’t have that luxury. 

So, we sometimes have to do what the computer scientists have done by pinpointing a font as a sign of trouble: We have to take a step back and look for clues elsewhere.  This may mean getting off one path and onto another. For instance, we may not have direct evidence of wrongdoing, but we can scour the evidence in order to detect patterns that suggest wrongdoing.  Alternatively, we can review the facts to see if we can find any that correlate with what it is we’ve been asked to help prove or disprove.

This is not about making assumptions—we never say that because x exists, therefore y.  Instead, it is about being able to look for solutions that advance our clients’ knowledge, even if they fall short of the ideal solution.  

The news is out and it’s not good. In fact, it’s downright troubling.  It seems that every day, usually several times a day, there is more and more information available about the dangers of the Internet.  It’s enough to make a Luddite out of even the most devoted technophile.  Here’s a sampling of some of the latest updates on the lack of privacy on the Internet, and threats to personal and financial information:

• Online Tracking is Worse Than We Thought: UC Berkeley Law School recently released its first ever Web Privacy Census, which was aimed at measuring how companies track visitors to their websites. The report confirmed that all the top 100 web sites use cookies to track users and visitors. If that’s not worrisome enough, the study also determined that the use of tracking software on users' computers has doubled in the past year. This is about more than tracking users anonymously to provide targeted advertising—like when you scroll a website for a grill and then you check your email and suddenly see ads for some of the same grills you clicked on from the sites you just visited.  Apparently, companies are just as likely to collect and use personal information in ways that may subject consumers to price discrimination, lowered credit scores and limits, and even identity theft.

• Social Networking Can Be Dangerous: The FBI recently issued a new warning on social networking.  The FBI pointed out that hackers are not only threatening governments—they are also targeting individual users via social networks, exposing the users and their workplaces, if they are online in the office, to great harm.  Hackers either exploit personal connections through social networks or write and manipulate computer code to gain access and/or install unwanted software on personal or company computers or phones. 

• Tweets and Facebook Posts May be Used Against You: The courts continue to weigh in on whether social networking may be used against users who post information on their personal sites.  While the judiciary’s responses vary on a case-by-case basis, so far the trend seems to be that posts on Facebook or tweets may be used as grounds for dismissals from jobs, or even against defendants in criminal or civil cases.

Politicians are paying attention.  Senators and Representatives have introduced a plethora of competing bills and held or plan to hold a number of hearings to discuss how best to protect Internet users.  A good summary of the most recent efforts can be found on the Data Privacy Monitor blog run by the law firm Baker Hostetler.  Issues being addressed include protections to safeguard users’ privacy, requiring greater transparency from companies about how they troll for information from users and what they use that data for, and clearer terms of use that allow consumers to easily opt out of having their time online tracked.  In addition, the National Telecommunications & Information Administration (NTIA) has announced its first meeting to develop a code of conduct in order to uncover how companies that provide apps for mobile devices deal with personal information.

Keeping up with all the changes is daunting, but as we’ve said before, in our entries "The Myth of Online Privacy" and "Fight Hackers With Encryption," there are simple steps you can take to protect yourself.  This article, “How to Keep Your Facebook Profile Private Yet Usable,” written by Dave Copeland details the best ways to protect yourself on Facebook, short of not signing up in the first place. Numerous software programs exist to block tracking data from being stored on your computers.  Creating a clear Internet use policy for your company and making sure your employees understand what is expected of them is also a good plan.

And, as always, doing the bare minimum is crucial: encrypting emails, only using secure Wi-Fi connections and avoiding some of the most common tricks used to activate malware that can log keystrokes or record phone calls.

None of these measures will provide complete protection, but they are good places to start to ensure that you and your company are being proactive about guarding against some of the dangers that lurk online. 

A quick reflection on the executive at Allstate, who according to the Wall Street Journal lost his job in part because of profanity-laced comments about a superior to colleagues in a bar.

How did the Journal get the story? Not by crawling around blogs, not by looking at the executive’s Facebook page, but by old-fashioned interviewing.

As we’ve pointed out here and here, very little of our lives sits out there on the Internet. How many of your ex colleagues, friends, romantic partners, apartments, cars and other possessions are linked to you via Google? Less than one or two percent in most cases.

To find out about people, you nearly always have to talk to others about them. That’s what the newspaper did in this case: they talked to people who the paper said had either heard the comments by the executive, Joseph Lacher, or else people familiar with the company’s internal investigation.

No Facebook, no LinkedIn, no blogging, no emails accidentally sent to the wrong person.

It’s an investigation that could have taken place just this way 20, 40, or even 80 years ago. And as we often tell clients, it’s an indispensible part of investigations today too.

Of course, a lot of what you may hear could turn out to be gossip. But being gossip doesn't always mean something isn't true. It can also mean that it's factual information someone doesn't want you to know about. 

With all the focus on tech IPOs that reward gaming and chatting, it’s nice to see a company dedicated to privacy getting a little of bit of venture cash behind it. With just $1.5 million raised so far, CertiVox is still a tech minnow, but its idea is a solid one: people need to be able to trust that some privacy online is still a possibility.

Remember all that spam e-mail for male enhancement and mysterious lottery winnings? Most people have become wise to the classic spam or phishing schemes, and hackers have stepped up their game. The new tactics are spear-phishing (researching and targeting specific users) and whale-phishing (targeting executives who have access to the most information).

One way this works is for hackers to research their target in the social network, pick one of the target’s “friends” and set up an e-mail account that looks like it belongs to the friend. The target won’t think twice about clicking on the malicious link that comes in from their friend. With this tactic, some hackers seek to simply create mischief, others are targeting corporations.

Recently we wrote about a particularly worrying study on corporate security breaches – think Sony, Lockheed Martin and Citigroup. The data shows that the problem lies largely with employees’ mobile devices and the completely unencrypted transfer of information. People are using Facebook, sending e-mails and clicking on links, all of which results in a public transfer of information that can be intercepted. Hackers bet on our complacency and “that’s just how the internet works” attitude and win every day.

Now comes CertiVox, whose goal is to provide government-grade encryption to corporations and your web browser. Their new (and free) PrivateSky plug-in allows you to encrypt what you do online and show it only to those for whom it’s intended. Your e-mail is no longer an open postcard and your Facebook rants stay private. For corporations, there are more robust solutions for the entire network.

A concern here is that a good encryption product, one that does not allow the product’s creator to see the message, could fall into the hands of criminals. Governments can crack highly sophisticated encryption programs, but at what cost in time and money? If CertiVox gets big enough, will it have to cough up its code to government authorities in order to keep going, as Research in Motion did in India?

While we don’t vouch for CertiVox’s reliability or competitiveness, it’s certainly a step in the right direction that such a company is able to raise cash to keep itself going.

(Photo Credit: Sasha Wolff) 

A chilling story in the Wall Street Journal’s Digits Blog yesterday told us that LinkedIn, Netflix and Foursquare “stored various forms of users’ personal data in plain text on a mobile device, putting sensitive information at risk to computer criminals.”

As if to confirm worst-case scenarios, Citibank then revealed that hackers have accessed the accounts of some 200,000 credit card customers in North America.

Even with a rash of data breaches, encryption is the part of computer security we tend to forget about. We know increasingly that social networking can let too many strangers into our lives and that we should think twice before entrusting anyone with sensitive financial information.

But how many of us encrypt data on our computers? It’s so easy to do, and I would argue that it should become best practice for professionals everywhere. Our firm does so it, so that if our computers were ever stolen thieves would find nothing but encrypted garbage where case files should be. We like the free, open-source Truecrypt program, available here. Other alternatives are available but at a cost.

But what about email? There is plenty of evidence that a deleted email can stick around in many forms on your computer or server even after you hit “delete,” but few think about the dozen servers between your office and the server of the person receiving your email. Both you and the recipient can do whatever you want, but your unencrypted email may be stuck (for years or decades) on multiple servers in multiple countries, all ready to be hacked.

While it’s true that hackers with enough patience and computing power can break many encryption codes, the idea is to raise the cost for criminals even to try.  If you encrypt just the tiny portion of your emails carrying sensitive financial information, you direct a hacker right to your most vulnerable material. If you encrypt thousands of emails, a hacker will give up after working for hours to unveil messages that say “Happy Birthday!” or “Tks, will do.”

Yesterday the U.S. Commerce Department issued its green paper on cybersecurity, but stopped short of recommending encryption of emails. It strikes us that for certain highly sensitive matters encryption of email is worth the trouble. There can be problems with forwarding, and in many cases it makes sense for both sides to have an encryption program. Otherwise, you need to keep the same string of messages going for a non-licensee to benefit from the encryption-licensee’s program.

At the very least, we should all make sure our email accounts have their own passwords. That way if someone looks at your desktop computer at work, your Microsoft Outlook can at least stay locked. Password protection for Outlook can be arranged by setting a password for your Personal Folders File (.pst) within Outlook. You can do this on the File menu under Data File Management.  

We now know that Apple will use next week's Worldwide Developer’s Conference to unveil iCloud, its new cloud storage product. Apple’s first attempt at cloud storage, MobileMe, was such a failure that Steve Jobs publicly tore into the Apple team for tarnishing the company’s reputation. 

It looks like the 2.0 version will probably be getting it right and customers will now be able to share their documents, movies, music and photos from the Apple "cloud" (and by cloud, we mean Apple-owned servers on the ground in fire-proof rooms). Most of Apple's customers will use the company's products without thinking twice about the sensitivity of the information they are handing over. 

That’s a lot of trust that could be misplaced. The risk for any form of cloud computing is that you no longer have exclusive access to your files. Cloud storage by Apple and others sounds economical in terms of hard-drive space saved at your office and used more efficiently by Apple, but cloud computing creates vast opportunities for theft of private information and, as we’ve written before here, there’s no proof that Apple will be able to protect yours. 

For now, speculation has it that iCloud will be used mostly for sharing movies, music and photos. But the plan is also to integrate it into the upcoming iPad and iPhone software iOS 5, creating an operating system that will be able to communicate with the Apple cloud with or without your approval. A further concern is that the very popular apps that define Apple’s devices could be able to transmit information over the new cloud-based system. 

Simply put, your files and information, including location and other personal data, are going to be somewhere in cyberspace, where they stand a chance of being intercepted. Or Apple could just have unlimited access to them. 

This type of information interception has the U.S. Senate taking first steps in formally drafting laws that aim to further protect personal data. In mid-April, Senators John Kerry and John McCain offered a privacy bill that would “strike a balance between consumer advocacy groups and the [tech] industry.” Now that Apple is introducing iCloud to their enormous following, the Senate’s discussion on adequate regulation could not be coming at a better time. 

Although the Kerry/McCain bill is a step in the right direction, a solution from lawmakers will probably take more time than is required for companies, such as Apple, to roll out new products and gather large quantities of sensitive information. 

Apple, Google and Amazon are in the communications business, but their leaders all need to take some courses at Hamburger University to learn how to communicate with their customers.

Any trial lawyer or investigator will tell you that WHEN something happens can be at least as important as the event itself.

Take the responses to three of the largest news stories of the past week:

1)  the revelation that iPhones and Droids transmit the location of the phones back to phone makers Apple and Google several times a day;

2) The partial breakdown of the Amazon “cloud” of servers that house prominent websites across the country. A whole of bunch of websites were down for a prolonged time;

3) The savage beating by two women of a third woman in a Baltimore McDonald’s caught on tape and widely viewed across the U.S.

ReadWriteWEb’s initial review of Amazon was not good. A little bit of updating as the crash wore on, but nothing an ordinary person could look at and understand.

And days after the Wall Street Journal reported that Apple and Google were regularly collecting data as to the location of the owners of their handsets, Apple remains mute. Google defended its policy, but on its website there was nothing that an ordinary customer could easily find to read that would give comfort. Readers of the Journal were told that Google’s advice was to perform a “factory reset” to insure the kind of privacy many may have thought they already had with a Droid phone.

This locational data that Apple and Google have access to is valuable. The stuff scientists can figure out about us based on where we are is astounding, and frightening if that information were to be used against us.

Contrast this corporate pattern of behavior with the episode revealed over the weekend when two women were caught on tape giving a severe beating to a woman at a McDonald’s restaurant in Baltimore. The revolting footage was made worse by the inactivity of bystanders who chose not to come to the aid of the beaten woman.

How easy was it to see what McDonald’s thought of this? Very. Right on the website’s media center was a prominent statement that the company was shocked at the incident and would investigate. You typed mcdonalds.com, and two clicks away you were at the statement.

Marketing experts will tell you that if you don’t have an “elevator speech” ready to go about your business (a 30-second answer to the question “What does your company do?”) then you’re not ready for primetime. In this case, Apple, Google and Amazon didn’t have elevator speeches ready to go.

Not having an elevator speech can mean one of two things: you’re unprepared for the question, or worse yet, you have no clear idea of what you think (or what you think it’s safe to say).

Here is where timelines are so important. If McDonald’s had waited a month to express outrage at this incident, the timing would have overtaken the content in importance. We might think McDonald’s was not really annoyed at the beating, but was responding in a way that a lawyer or consultant advised was prudent. That could still be the case, but the quick response by McDonald’s could also mean that it truly is incensed that its franchised restaurant staff failed to rescue the helpless victim of a beating.

What about Apple’s timeline? Whatever Apple ends up saying about the tracking features of the iPhone, how good will we feel about all the information Apple has on us when the company can’t even comment on one of the most discussed stories in the world at which it’s at the center.

For Apple, Google, and Amazon, the time for the elevator speech has passed. The doors have closed and we - the customers - will need to be reached in a different way. 

What is the right level of privacy we are entitled to expect on the web? The answer is expanding and contracting by the day, but not only because legislators in Europe are attacking cookies and newspaper stories, or that people are figuring out that “free” Facebook comes with a cost and are starting to pay attention to their privacy settings.

The very notion of what is supposed to be private and what isn’t is surprisingly subject to change across borders and even within countries over short periods of time. The right to privacy sounds good, but means nothing until you know what’s supposed to be off-limits.

Take your salary. How much you make at work is nobody’s business and the IRS can’t even share your information with other government agencies. Except as pointed out by Taxhistory.org, Congress has twice allowed the public to look at tax records – once during the Civil War, and then again for two years in the 1920s.

That would be unthinkable for many today, but why should it be? If you don’t want people to know how much money you have, why should they be able to look at a copy of the deed and mortgage for your house, to see that you paid $2.5 million and financed almost all of it? That’s standard procedure in the U.S. (and by the way is a great way to figure out what someone’s side company in Delaware is called: people often buy a house and then sell it to their new company).

Now skip on over to Norway, where everyone’s income tax records are a matter of public information. You can look them up here. Norwegians value their privacy, but just don’t define privacy as including the amount of money they earn.

Looking up old newspaper stories is a research tool many of us have enjoyed using for years. If you think a newspaper got it wrong, you have libel laws and can get the paper to run a correction. But now with Google comes a newly sought  “right to be forgotten.”  The Spanish Data Protection Authority is taking the side of a doctor who’s grown tired of seeing an old El Pais newspaper article about his alleged malpractice sticking around on the web all these years. 

Of course, taking something off Google doesn’t mean it will be forgotten. In the dark days before Google – prior to 1998 – we could still find out plenty of things about people’s pasts. This involved reading old newspaper articles and looking at courthouse records to see who had sued them, and then talking to relevant people to figure out what might have happened.

Since that’s what we do today in addition to looking at Google, the right to be forgotten is really just the right to kick bad stuff off Google.

Unless the right to be forgotten is just a first wedge toward real advances in privacy that cross the line into what many of us would call censorship. Would privacy advocates want the El Pais archives closed to the public? What about court records? We shred old traffic violations in many U.S. states after two years, but what if some of Bernard Madoff’s underlings were able to serve their time, get out of jail and have their court records and newspaper coverage made off-limits to new investors?

This is where Google’s global privacy counsel Peter Fleischer is going on his personal blog:

Privacy is the new black in censorship fashions. It used to be that people would invoke libel or defamation to justify censorship about things that hurt their reputations. But invoking libel or defamation requires that the speech not be true. Privacy is far more elastic, because privacy claims can be made on speech that is true.

No fewer than seven pieces of privacy-related legislation have either been introduced in the U.S. House or soon will be, says Bob Sullivan in a thoughtful privacy column at MSNBC.com.

Given that privacy can mean so many things to so many people, there may be a lot more heated debate over the contents – not to mention legal challenges -- than is happening in Europe today.