Saturday, May 30
LANGEVIN, ET AL.: Public-private collaboration
Tuesday, May 26, 2009
James R. Langevin, Mark Gerencser and Charles G. Boyd
COMMENTARY:
Attacks against U.S. computer networks - most of them privately owned - are increasing in number and severity. Let's hope the new administration moves decisively to foster collaboration between the public and private sector so America can become cyberresilient.
The reasons for doing so are manifest. In 2007 alone (the last year for which records are fully tabulated), the Department of Homeland Security tracked more than 37,000 cyber-attacks - a more than 800 percent increase over 2005. The Defense Department's computers are probed hundreds of thousands of times every day, and in 2007, hackers believed to be backed by the Chinese military took down the unclassified e-mail system in the Office of the Secretary of Defense for more than a week.
Meanwhile, U.S. companies lost more than $1 trillion worth of intellectual property last year because of cyber-intrusions. The energy sector is particularly vulnerable, with global utility operations hit by an estimated 1,000 hackers annually. A major cyber-attack could result in weeks-long power outages or cause even more damage to the national economy - a prospect we can hardly afford.
In December, a cyber-attack simulation conducted by the nonpartisan Business Executives for National Security, headquartered in the District, highlighted America's vulnerability and the need for a comprehensive, national approach to cybersecurity. Over two days, more than 230 senior leaders from industry, government, Congress, academia and the military tried to respond to a simulated cyber-attack that decimated telecommunications in the Eastern United States and damaged financial institutions and other targets.
At nearly every turn, the participants encountered difficulty restoring normal operations. Their failure to plan for the attack - and the difficulty they experienced communicating with one another when the simulated attack was under way - prolonged recovery time to the point of major system failures.
The simulation revealed that while parts of the federal government and some private companies are doing a lot to strengthen their own cyberdefenses, the United States is only addressing pieces - and not the whole - of cybersecurity. This approach will fail because cybersecurity is, like a chain, only as strong as its weakest link.
Focusing cybersecurity efforts solely on one's own organization robs attention from the bigger picture. Whether they realize it or not, companies, government agencies and other organizations are part of an interconnected system that cannot absorb a major attack. Narrow-point solutions such as firewalls, anti-virus software and intrusion-detection technology help, but they don't suffice.
True protection requires cyberresilience. That can be achieved only through collective action and cooperation on a scale rarely witnessed before: a national effort involving business, government and society - similar to the way "Y2" - the apprehension about what would occur with the advent of the year 2000 - was approached, but designed for the long haul and not just one event.
No single organization has the capacity to build this resilience. We need to work as a large and inclusive community across government, industry and nonprofit organizations - a megacommunity of sorts.
Melissa Hathaway, recently named by President Obama to review the nation's cybersecurity policies, was chosen in part for her ability to foster collaboration within government to deal with cyberthreats. We hope her report urges collaboration beyond government - involving business and society as a whole - so America can become cyberresilient.
Resilience is different from risk avoidance (working to ensure nothing happens) or even risk management (choosing what to protect and what not to protect). Resilience assumes bad things will happen and requires advance planning and preparation. "We will need to end a culture where we ignore problems until they become full-blown crises," Mr. Obama said recently when discussing the economy. This is also true of cybersecurity.
A lot is at risk: financial systems, power grids, air traffic control and more. A major cyber-attack will happen, and it will affect more than we think. The question is: Will we be ready - and resilient?
Rep. James R. Langevin, Rhode Island Democrat, is co-chairman of the Center for Strategic and International Studies (CSIS) Commission on Cybersecurity for the 44th Presidency. Mark Gerencser is a senior vice president at Booz Allen Hamilton. Charles G. Boyd is president and chief executive officer of Business Executives for National Security.
Tuesday, May 26
FBI Explains Its CAIR Cut Off
The Council on American-Islamic Relations (CAIR) is not "an appropriate liaison partner" for the FBI because of evidence linking the organization and its founders to Hamas, an FBI assistant director said in a letter to a U.S. Senator. "In light of that evidence, the FBI suspended all formal contacts between CAIR and the FBI," Richard C. Powers, an assistant director in the FBI's office of Congressional Affairs, wrote in a letter to Sen. Jon Kyl (R-AZ). Today, the FBI is unsure whether the relationship between CAIR and Hamas ever was severed, Powers wrote. In February, Kyl was joined by fellow senators Charles Schumer (D-NY) and Tom Coburn (R-OK) in writing FBI Director Robert Mueller to praise the FBI's policy toward CAIR. IPT News, May 7, 2009
http://www.investigativeproject.org/1029/fbi-explains-its-cair-cut-off
Call the Terrorists What They Are
There are several lessons that the U.S. government and public should learn from the foiled plot by four radical Muslims, disclosed today, to bomb synagogues in New York and shoot down a military plane using a Stinger missile.
For President Obama, the "enemy" can no longer be limited to just al Qaeda, as he has insisted in pre- and post- campaign interviews. When asked who the enemy is, he reflexively says "al Qaeda." He has categorically refused to use the term "radical Islam" or "Islamic extremism." But that is exactly what we are facing?and have been facing for the past three decades.
http://www.thedailybeast.com/blogs-and-stories/2009-05-21/call-the-terrorists-what-they-are/full/
Monday, May 25
Fox News covers the Explosion on 3rd & 92nd at 3:30am NYC
NEW YORK - Windows were shattered at a Starbucks on Manhattan's Upper East Side early Monday morning.
Police Commissioner Ray Kelly says an explosive-like device, possibly containing fireworks, went off outside the store at 3:30 a.m.
There are no injuries. Kelly says there are no witnesses to the blast.
The NYPD bomb squad is on the scene at 1642 Third Avenue at 92nd Street.
Speaking at the scene of the explosion Monday morning, Kelly told reporters there was no call to police before the explosion. Seven calls to 911 came in immediately following the explosion.
There is a history of low-order explosions outside Starbucks stores across the country, said Kelly.
The city has experienced other early morning explosions in recent years. Small explosions occurred at the British and Mexican consulates and at a military recruiting station in Times Square.
Police Commissioner Kelly says the only similarity between Monday morning's explosion and other small blasts in New York City is the time. All have occurred between 3:30 a.m. and 4:30 a.m.
Police investigators say no one was inside the shop at the time of the explosion. There is no damage inside the store.
The explosion left a gaping hole in the bench.
An apartment building above Starbucks was evacuated. Seven people were forced from their homes and returned hours later.
No one was injured in the blast.
Several lanes of Third Avenue near 92nd Street are closed due to a massive police investigation. Expect bus diversions in the area of the explosion. The M 98, M 101, M 102 and M 103 bues are re-reouted.
Thursday, May 21
FBI Makes Arrest
Tuesday, May 12
Will Marketing Kill Social Media?
http://searchengineland.com/will-marketing-kill-social-media-18940
Monday, May 4
US 'should go on cyber-offensive'
http://news.bbc.co.uk/2/hi/technology/8026964.stm
Sunday, May 3
BIRTH-CERTIFICATE TERROR ALARM
By LARRY CELONA and ANDY GELLER
April 25, 2009 --A stack of blank birth certificates has been stolen from the city Health Department's offices, leading investigators to worry that they may have fallen into the hands of terrorists, The Post has learned.
On March 12, an employee discovered that 104 certificates with the agency's stamp on them were missing from the department's offices at 125 Worth St., near City Hall, sources said.
It was the first time in 10 years that blank birth certificates were stolen from the department.
The NYPD and the city's Department of Investigation are investigating.
"It's like hitting the Lotto for a terrorist," one investigator said.
"Forged documents are one of the primary concerns of Homeland Security. After you get that birth certificate, you can get any document you want. This is extremely serious."
The missing documents were in a box of blank certificates that was stacked on other similar boxes.
The employee noticed they were missing because there was a break in the numbers on the certificates.
Investigators believe the theft was carried out by someone who has access to the offices, probably an employee.
New legislation targets organized shoplifting
The Public Safety and Human Services Committee heard a presentation from retailers, police and prosecutors hoping to encourage the passage of a Senate Bill 1059, which would make organized retail theft a separate criminal charge and a Class 4 felony.
Under current state laws, a shoplifter can be charged with a misdemeanor or a felony, depending on the value of the goods, and be punished by up to two years in prison. Under the bill, organized retail theft - defined as shoplifting with the intent to resell or trade the merchandise - would be a felony, regardless of the value of the stolen goods. It would be punishable by up to 3 1/2 years in prison.
Committee chairwoman Linda Gray, R-Phoenix, who sponsored the bill, said the legislation will be among the first to go through committee for a vote after the budget is completed. "I think (the response) will be good," she said. "It affects all of us. Those are prices we're absorbing."
The bill would bring Arizona on par with 35 other states that have either enacted legislation or have introduced bills to combat organized retail theft, according to Michelle Ahlmer, president of the Arizona Retail Association. The bill comes at the recommendation of a task force commissioned during the 2007 session to look into the growing trend.
The two-page report also recommended more education and training for officers and a full-time law-enforcement task force that would work with retailers to combat the crime full time.
Retailers insist they're doing their part to work with law enforcement to battle the growing trend by sharing information about suspects and trends and protecting their merchandise.
http://www.azcentral.com/arizonarepublic/local/articles/2009/04/30/20090430politics-shoplifting0430.html
Cybersecurity Review Sets Turf Battle
That measure followed two others introduced earlier this week on the electric grid and a proposed White House cybersecurity office. Cybersecurity experts say they expect some version of these or related bills to become law.
http://online.wsj.com/article/SB124113159891774733.html
Monday, April 27
Low-flying Air Force One lookalike freaks out NYC
Posted By admin On April 27, 2009
Raw Story [2]
Monday, April 27, 2009
A number of buildings in New York City were evacuated Monday morning after a trio of low-flying planes flew near the Statue of Liberty.
“An Air Force One lookalike, the backup plane for the one regularly used by the president, flew low over Manhattan on Monday morning, accompanied by two F-16 fighters, so Air Force photographers could take pictures,” the New York Times reports [3]. “But a lack of awareness about the flyover led to the evacuation of several buildings in Lower Manhattan and Jersey City, N.J., and perplexed officials at the Port Authority of New York and New Jersey and other authorities were inundated with calls from anxious ferry passengers, office workers and residents in the area.”
“It is pre-planned, pre-coordinated with everyone involved,” FAA spokesman Jim Peters said [1]. “It’s a military flight over New York to take photos.”
Peters added, “We’ve gotten reports several buildings in Jersey City were evacuated.”
One eyewitness told the New York Times, “People came pouring out of the buildings, the American Express Building, all the buildings in the Financial District by the water. And even the construction guys over by 100 North End Avenue area, they all got out of their buildings. Nobody knew about it. Finally some guy showed up with a little megaphone to tell everyone it was a test, but the people were not happy. The people who were here 9/11 were not happy. New York City police were standing right there and they had no knowledge of it. The evacuations were spontaneous. Guys from the floor came out, and one guy I talked to was just shaking.”
One NYC television station received a number of phone calls from New York City residents “furious that local authorities hadn’t notified anyone about the fly-over.”“According to many callers who flooded CBS 2 with their concerns, at about 10 a.m. the aircraft were seen flying at low altitudes over the Statue of Liberty and parts of lower Manhattan,” WCBS reports [5].
One sample follows: “We saw a low-flying 747 buzz the Southwest edge of Manhattan, at Battery Park City, with a fighter jet appearing to chase it on its left wing. At about Rector Street or so, it took a hard left and looked to be headed straight for Jersey City. It flew over J.C., turned south, and continued to climb over Newark. It left our sight, only to return on the same path a second time about five minutes later. It was confusing and panicked the office. We dialed 9-1-1 and considered whether to evacuate. We were told by 9-1-1 that it was ‘authorized’ to be there. We later learned, from your website, that it was part of a DOD ‘photo op.’ NotifyNYC advises it was ‘part of an approved federal activity.’ To conduct a ‘photo op,’ unwarned in advance to Lower Manhattan residents and workers, in that manner was completely irresponsible.”
Newsday notes [6], “About 1,000 workers gathered along the Hudson River esplanade until a security officer with a bullhorn told them it was a planned exercise.”
“After the incident, New York City released an advisory that the flyover was ‘part of an approved federal activity,’” Reuters reports [7].
Data Security Breaches Present Emerging Risks, Opportunities for Agents
April 27, 2009
http://www.insurancejournal.com/news/national/2009/04/27/99922.htm
Excerpts from the news article
Data security represents both a new market opportunity to sell insurance coverage and a new risk ? especially for independent insurance agencies that may not be compliant with data security laws or have plans in place to protect their own companies from data breaches.
While data security is an evolving issue, failing to protect data can have a huge financial impact on a company. The average total per-incident cost of a data security breach was $6.65 million, compared to an average per-incident cost of $6.3 million in 2007, according to the "U.S. Cost of Data Breach Study" conducted by data protection company PGP Corp. and information management research firm The Ponemon Institute.
The PGP/Ponemon study indicated that data breach incidents cost U.S. companies $202 per compromised customer record in 2008, meaning that companies incur additional costs with an abnormal churn in lost customers. More than 84 percent of data breach cases in 2008 involved organizations that had more than one data breach. And, more than 88 percent of all cases in the study involved insider negligence.
The cost of lost business continued to be the most costly effect of a breach, averaging $4.59 million or $139 per record compromised. Lost business now accounts for 69 percent of data breach costs, up from 65 percent in 2007, compared to 54 percent in the 2006 study.
"After four years of conducting this study, one thing remains constant: U.S. businesses continue to pay dearly for having a data breach," said Dr. Larry Ponemon, chairman and founder of The Ponemon Institute. "As costs only continue to rise, companies must remain on guard or face losing valuable customers in this unpredictable economy."
>>>>Nevertheless, it's important for business owners to get up to speed about how to handle a breach. "If a breach occurs, the ability to respond must be timely," said Shena Crowe, Infragard Coordinator for the Federal Bureau of Investigation. "Companies only have about 30 days or less."
>>>>>Of course, that means agents and brokers must educate themselves. "Our major challenge as an industry right now is educating agents and brokers as to what kind of questions they need to ask their insureds, to get their arms around what kind of information their clients have," Katona said.
Among questions to consider are:
* Does the client transacts business over the Internet?
* Does the client move information to another party over the Internet?
* What are the underpinnings of the client's technology?
* Does the data environment have a firewall?
* What processes and procedures are in place for things like encryption?
* What processes and procedures are in place for people accessing company computers?
"Spend time to manuscript coverage to match the client's exposure," Cisco Systems' Lamb said.
Above all, agents and brokers should take steps to ensure they're covered themselves.
"Insurance agents and brokers, obviously, capture a lot of information to write coverage for their insureds," Katona said. The Gramm-Leach-Bliley Act requires companies to have certain security measures in place. For smaller agencies, absorbing the costs of securing doors or having password protection and certain security measures in place can be difficult. But "98 percent of the agents we deal with are not Gramm-Leach compliant," Katona said. "As a group of insurance agents and brokers, we have a responsibility to protect that data."
Wednesday, April 22
Call to rally against cyber crime
,,,At the conference, RSA President Mr Coviello suggested a number of ways the industry could come together to mitigate the cyber security threat.
RSA President Art Coviello
Mr Coviello said the global cyber threat continues to escalate
He outlined three key practices that included collaborating on standards, sharing technologies and integrating technologies and controls into the infrastructure.
Brett Galloway, Senior Vice-President of Cisco's Wireless Technology Group, agreed with that collaborative approach and said it was already happening to some degree.
"The work that goes on between the companies, the standards and the work that goes on between companies operationally to integrate, inter-operate and make sure that our customers bring these solutions together is actually quite profound and important.
"We clearly live in an era of increasing sensitivity and increasing threat not only from commercial bad guys but other sorts of bad guys as well," noted Mr Galloway.
http://news.bbc.co.uk/1/hi/technology/8011160.stm
Friday, April 17
ODNI ANNOUNCES STUDENT OPPORTUNITY THIS SUMMER IN NATIONAL INTELLIGENCEANALYSIS
The hands-on seminar, the first such exercise sponsored by the ODNI, will be held July 13 through July 24 in Washington , D.C. and will address the theme: ?Political Instability ? International Systems in Transition.?
The program will include lectures, field trips to agencies and work on an intelligence problem under the direction of analysts drawn from the Intelligence Community. Students who qualify will receive Secret level security clearances for the duration of the seminar.
The curriculum is being developed by the Philip Merrill Center for Strategic Studies of the Paul H. Nitze School of Advanced International Studies of the Johns Hopkins University and by the seminar?s co-sponsors, the Deputy Director of National Intelligence for Analysis and the Office of the Intelligence Community Centers for Academic Excellence. Successful applicants will receive travel expenses, room and board, course materials and a $1,000 stipend.
Application deadline is April 30.
http://www.dni.gov/cae/index.htm
Monday, April 13
Be on the Lookout for New Police Tool: Twitter
"Latest homicide in the city is NOT a random act. Male, 33, shot in 1500 block N. 39. More details as we have them," read the recent entry.
http://www.officer.com/web/online/Top-News-Stories/Be-on-the-Lookout-for-New-Police-Tool--Twitter/1$46213
Wednesday, April 8
Mistake by 911 operator could have been prevented with technology
Mistake by 911 operator is cited
http://www.philly.com/philly/news/local/20090408_Mistake_by_911_operator_is_cited.html
Pittsburgh Post-Gazette
PITTSBURGH - When Richard Poplawski's mother called 911 to ask that her son be removed from their home in the Stanton Heights section of the city, she acknowledged that he had weapons. But that crucial piece of information never was relayed to the three Pittsburgh police officers who responded Saturday and were fatally shot.
"It should have gone out," said Robert A. Full, Allegheny County's chief of emergency services.
"There was human error," Full said Monday. "We are all living this, now, forever and ever."
Full would not identify the 911 call-taker other than to say she had been on the job for less than a year, including training. She was placed on paid administrative leave and has been offered counseling.
Former Fraternal Order of Police President James Malloy described such an omission as "heartbreaking." Officers knowing that someone involved in a domestic dispute has guns would handle the situation with more caution, he said.
Margaret Poplawski called 911 at 7:03 a.m. Saturday asking for police to remove her son from her home.
On a recording of that call, she sounded calm, even irritated, several times when she was asked to repeat basic information. She paused twice to chide her son in the background, saying, "Are you moving or what? Or the police gotta come?"
Poplawski: I'm requesting that he gets out. He came in last night when I was gone. . . . He stays, he comes and goes, but I want him out.
911 call taker: Does he have any weapons or anything?
Poplawski: Yes. They're all legal.
Call taker: OK, but he's not threatening you with anything?
Poplawski: Look, I'm just waking up from a sleep. I want him gone.
Call taker: OK, we'll send 'em over, OK?
Poplawski: Sounds good.
The message went to the police dispatcher: "No weapons."
DHS Announces Nearly $970 Million in Preparedness Grant Final Allocations
?Freight Rail Security Grant Program (FRSGP) ? $15 million to target resources for security plans, vulnerability assessments, employee security awareness training and GPS tracking systems for railroad cars transporting toxic inhalation materials.
?Intercity Passenger Rail (Amtrak) ? $25 million for Amtrak to protect critical surface transportation infrastructure and the traveling public from acts of terrorism, major disasters and other emergencies within the Amtrak rail system.
?Intercity Bus Security Grant Program (IBSGP) ? $11.7 million to assist operators of fixed-route intercity and charter bus services to support security plans, facility security upgrades and vehicle and driver protection.
?Trucking Security Program (TSP) ? $2.2 million to implement security improvement measures and policies that focus on the purchase, installation or enhancement of equipment and systems related to tractor and trailer tracking systems; to help develop a system for DHS to monitor, collect and analyze tracking information; and to develop plans to improve the transport and distribution of supplies and commodities during catastrophic events. DHS did not receive enough applications to fully fund the program through the initial solicitation, so only $2.2 million is being announced at this time.
?Port Security Grant Program (PSGP) ? $388.6 million to protect critical port infrastructure from terrorism, enhance maritime domain awareness and risk management capabilities to protect against improvised explosive devices and other non-conventional weapons; and to conduct training and exercises and support implementation of the Transportation Worker Identification Credential (TWIC).
?Buffer Zone Protection Program (BZPP) ? $48.6 million to increase preparedness capabilities of jurisdictions responsible for safeguarding critical infrastructure sites and key resource assets, such as chemical facilities and nuclear power plants, through planning and equipment acquisition.
?Emergency Operations Center (EOC) Grant Program ? $33 million to improve emergency management and preparedness capabilities by supporting flexible, sustainable, secure and interoperable EOCs to address identified deficiencies and needs. The grant provides funding for construction or renovation of a state, local or tribal government?s principal EOC.
?Interoperable Emergency Communications Grant Program (IECGP) ? $48.6 million for planning, training, exercises and equipment to states, territories, local and tribal governments to carry out initiatives identified in Statewide Communication Interoperability Plans, and improve interoperable emergency communications for responding to natural disasters and acts of terrorism.
?Driver?s License Security Grant Program (DLSGP) ? $48.6 million to prevent terrorism, reduce fraud and to improve the reliability and accuracy of personal identification documents that states and territories issue.
http://www.dhs.gov/ynews/releases/pr_1239203061205.shtm
Homeland Security shifts policy to target employers with illegal workers
www.chicagotribune.com/news/nationworld/chi-immigration_tuesmar31,0,5809124.story
WASHINGTON ? Stepping into the political minefield of Immigration reform, Homeland Security Secretary Janet Napolitano will soon direct federal agents to emphasize targeting American employers for arrest and prosecution over the laborers who enter the country illegally to work for them, department officials said Monday. The shift in emphasis will be outlined in revamped field guidelines issued to agents of Homeland Security's Immigration and Customs Enforcement division as early as this week, according to several officials familiar with the change in policy. It is in keeping with comments that President Barack Obama made during last year's campaign, when he said past enforcement efforts have failed because they focused on illegal immigrants rather than the companies that hire them?
Alleged Money Scam Roils Islamic Center
By Del Quentin Wilber and Michelle Boorstein Washington Post Tuesday, March 31, 2009; B01
http://www.washingtonpost.com/wp-dyn/content/article/2009/03/30/AR2009033002925.html?
In the Islamic Center of Washington, beneath the 160-foot minaret that towers over Embassy Row, a tale of intrigue has simmered for years. It is marked by bitter recriminations between two men who are credited with rehabilitating its reputation as a prominent symbol of Islam in the United States. The center's business manager has been accused of stealing $430,000 from the mosque in a complicated check scam. The key witness against him is the center's director and imam, a Saudi who says he noticed the crime when he spotted too many checks being written to a gardener. The Iranian-born business manager has a different story. He says the imam told him to take the money. About half was used to pay off debts and living expenses of two women who were close to the imam, and the rest was used to pay informants for tips about the mosque's security, he said. It was enough to confound a jury, which deadlocked 9 to 3 after the business manager's three-week trial last May. Now prosecutors are attempting to retry him, and the manager is firing back. He has accused the imam of committing perjury and obstructing justice. A federal judge is expected to rule in coming weeks on whether to drop the charges or prevent the imam from testifying?
Miami Drug Case Has Hezbollah Tie
http://www.investigativeproject.org/blog/2009/03/miami-drug-case-has-hezbollah-tie.html
An arrest in Colombia earlier this month seems to support concerns that Hezbollah is working with Mexican and South American drug cartels to establish a better foothold in the West. El Nuevo Herald, the Spanish-language edition of the Miami Herald, reported on the arrest of Jose Alberto Henao Jaramillo, who is wanted in a drug and money laundering case in Miami. That case already netted more than 100 arrests http://www.elnuevoherald.com/noticias/america_latina/story/409615.html by the U.S. Drug Enforcement Agency, El Nuevo Herald reported. Among them is Chekri Mahmoud Harb, who goes by the name "Taliban," and has alleged Hezbollah connections. The paper cites a Colombian government intelligence report which said "part of the money was presumably distributed for terrorist activities of groups like Hezbollah." Harb is charged with four conspiracy counts related to drug trafficking. It's a tangible sign http://www.investigativeproject.org/documents/misc/261.pdf amid growing concerns that Hezbollah is tapping South and Central American drug routes to extend its reach http://www.investigativeproject.org/blog/2009/03/a-journalists-chilling-call-for-competition.html closer to the American border.