In a reminder that user security will be 2016’s bottom line, on November 30, BlackBerry decided the best way to do business with Pakistan would be to not do business at all.

At stake is BlackBerry Enterprise Service (BES), which provides secure email and messaging communications. Pakistan wanted backdoor access to all BES traffic; BlackBerry responded by exiting the country altogether.

“BlackBerry provides the world’s most secure communications platform to government, military and enterprise customers. Protecting that security is paramount to our mission. While we recognize the need to cooperate with lawful government investigative requests of criminal activity, we have never permitted wholesale access to our BES servers,” explained BlackBerry Chief Operating Officer Marty Beard in a blog post.

BlackBerry’s exit is a fitting end to a year that has made Pakistan synonymous with surveillance state. Currently under review is a proposed Prevention of Electronic Crimes Bill (PECB), a document that has accurately been described as “a clear and present danger to human rights.” A joint statement from concerned parties including ARTICLE 19, Human Rights Watch, Privacy International and Pakistan’s Bolobhi and Bytes for All highlighted several flaws of the Bill:

• It would enable government to order service providers to remove or block access to any speech, sound, data, writing, image, or video, without any approval from a court.
• It would allow the Federal Government to share intelligence gathered from investigations with foreign spy agencies like the United States National Security Agency, without any independent oversight.
• It would mandate service providers to retain data about Pakistanis’ telephone and email communications for a minimum one year.
• It would enable the government to “seize” programs or data, defining seizing as to “make and retain a copy of the data”, without specifying the procedures by which the seized data is retained, stored, deleted or further copied.

“Tipping the scales: Security & surveillance in Pakistan,” a July 2015 report from Privacy International, further exposed Pakistan’s less-than-impressive record. According to the report, mass surveillance has been in place since at least 2005 and has been used to target journalists, lawyers, activists and opposition politicians, amongst others. Since 2011, all Internet service providers and phone companies have been ordered to ban encryption and virtual private networks. The report concludes on a grim note: “The practical capacity of the Pakistani government for communications surveillance now outstrips the current capacity of domestic and international law for effective regulation of that surveillance.”

Farieha Aziz of Bolo Bhi, a Pakistani pro-digital security and privacy not-for-profit that has drafted a letter in protest of PECB, was quick to predict that BlackBerry wouldn’t be the only company to resist the draconian Pakistani state. November 29th tweets from Aziz include: “Data demands by govt forcing Blackberry to exit Pak. Yet govt claims Amazon, eBay & PayPal are coming” and “Companies to whom privacy of data and protection of speech matters will be weary of presence in Pakistan. Getting worse, not better.”

Aziz may be right that BlackBerry will be the first of several businesses to refuse to do business in Pakistan, but this also may be one situation that has to get worse before it can get better. In 2016, a surveillance state without business will soon be no state at all.

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Originally published at blog.sumrando.com on December 10, 2015.

Thanksgiving may be an all-American holiday, but Cyber Monday no longer belongs to any country in particular. Internet users from Brazil, Colombia, Egypt, Uganda and the United Arab Emirates alike will go online November 30 in search of deals, but hackers will also be there, looking for information to steal. Before you shop online this Monday, protect yourself:

• Take advantage of two-factor authentication when possible: Many platforms offer an additional layer of protection beyond username and password. If this is an option, take it. Amazon.com, for example, will now text users a code that needs to be entered before logging in. To set this up, click on “Your Account”, “Change Account Settings” and finally “Advanced Security Settings”; your stored personal and credit card information will thank you.
• Answer security questions with fake answers: What is your mother’s maiden name? What year did you graduate high school? What street did you grow up on? With Facebook, Google and a little ingenuity, it’s not hard for a hacker to find the actual answers to your security questions. Think differently: What was your first pet’s name? To get to the other side.
• Beware of pop ups and unsolicited emails: The approaching holiday season means that retailers are working hard to get you to buy now more than ever — and that hackers are creating malicious links they hope you will click on. (Typos and mismatched URLs are warning signs worth noting.) Yes, you will receive an onslaught of pop ups and emails, but you do not have to click on their links or attachments. If you see an offer you like, type the URL into your browser rather than use the link provided.
• Look for HTTPS and a padlock in your browser: HTTP is not enough if you are about to enter personal or credit card information. A secure site will begin with https://.
• Choose credit over debit: A hacker with your debit card information also has access to your bank account. Credit cards, alternatively, typically have protections against unwanted purchases built into their user agreements.
• Avoid QR codes: Those pixelated squares that can be scanned by your phone’s camera can also be infiltrated by hackers to redirect to a malicious website. QR codes are convenient, but not worth the risk involved.
• Use a VPN for an extra layer of protection: Hoping to do a little mobile shopping while waiting in line for coffee? Whether you’re at the mall, a coffee shop or the airport, public Wi-Fi is an insecure hacker haven. Be sure to login to a VPN to secure your connection and encrypt your traffic.

Utilizing two-factor authentication, typing in a URL, and logging into your SumRando VPN connection are measures that will slow down your Cyber Monday shopping, but they will also protect your purchases from the prying eyes of hackers. Isn’t your security worth it?

Originally published at blog.sumrando.com on November 27, 2015.

If you’re one of the millions of people who check Facebook daily, you may have noticed a hostility in your news feed that wasn’t there a week ago. Users are upset that Facebook offered a flag in solidarity with the Paris bombings, but not one in support of Kenya; that Safety Check was turned on for Paris, but not Beirut; that they cannot express sympathy for Paris without being criticized for not sympathizing with other bombed cities; that the rights of refugees have been called into question…

Be it an act of recognition, apology, or pacification, Facebook activated Safety Check for the second time in less than a week, this time for Tuesday’s bombing in Yola, Nigeria. Historically, Safety Check had been reserved for times of natural disaster (think: April’s earthquake in Nepal), but Paris was the precedent that shifted the tool into the realm of human disaster.

Regardless, given that Nigeria’s Safety Check was not accompanied with a flag overlay, it’s clear that Nigeria has been given the ‘Free Basics’ treatment, if also likely that Facebook had little interest in perpetuating the very flag war it had begun.

A disaster is one of the few reasons we can imagine a user would want to broadcast their location and status to others; for that, we applaud Safety Check and its growing ubiquity.

Regarding flag overlays, however, we remind you that your Facebook page is just that: your page. Facebook’s suggestions are always yours to leave or take; your profile picture is yours to modify as you see fit.

Facebook has been littered with French flags in the past week, but there are also countless examples of users taking matters into their own hands. Of note:

• Allflags.world was created to add an overlay of flags from all countries attacked by ISIS to profile pictures. The website includes 27 countries and welcomes submissions of any countries overlooked.
• Facebook user Hubert Southall posted “All cries need to be heard” and has offered to create any overlay not provided by Facebook for any user in need.

No platform is perfect, but what Facebook has always done well is enable users to express themselves to friends and the public as they (more or less) wish. The hostility of the past week demonstrates that Facebook users everywhere want equal treatment and also that messages are perhaps best expressed without Facebook’s prompting.

Originally published at blog.sumrando.com on November 19, 2015.

• Internet connection records (ICRs) retained for one year, to be accessed in order to identify the sender of a communication or the communications services a person is using or to determine whether a person has been accessing or making available illegal material online. ICRs include main web addresses visited, but not the content or profiles viewed or the searches performed on each page.
• Targeted equipment interference, allowing for data to be obtained from computers, tablets, smart phones, cables, wires and static storage devices, through a warrant process similar to the aforementioned.

Until 2016, the Bill remains a draft, leaving time for the very “scrutiny and debate” Home Secretary Theresa May requested in the Bill’s foreword.
One British human rights organization, Liberty, is promoting just that by encouraging concerned citizens to sign their names in support of an eight-point Safe and Sound plan, which seeks:

1. Prior judicial authorisation of all surveillance requests.
2. No blanket powers forcing communications companies to store more personal data.
3. Surveillance conducted for tightly defined reasons such as the investigation of serious crime and preventing loss of life, with requests and warrants targeting individuals on the basis of suspicion in criminal activity.
4. Improved redress and increased transparency for those who have been under unlawful surveillance or are no longer under suspicion.
5. Use of intercept evidence in court to bring perpetrators to justice.
6. Data-sharing arrangements between UK and other countries made public and set out in law.
7. Legislative protection against the breaking of our country’s encryption standards.
8. Recognition of the unique threat posed by hacking to British people’s security.

In the words of Liberty’s Director, Shami Chakrabati, “After all the talk of climbdowns and safeguards, this long-awaited Bill constitutes a breath-taking attack on the Internet security of every man, woman and child in our country. We must now look to Parliament to step in where Ministers have failed and strike a better balance between privacy and surveillance.” The Investigatory Powers Bill is neither perfect nor complete; let Parliament know where you stand before this Bill becomes law.

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Originally published at blog.sumrando.com on November 10, 2015.

They all tried to mitigate the potential damage of the Cybersecurity Information Sharing Act (CISA), but to no avail. Their proposed amendments would have protected personally identifiable information and the framework of the Freedom of Information Act, and restricted the definitions of cybersecurity threat and threat indicator.

Instead, last Tuesday, the Senate approved CISA as is by a vote of 74 to 21. The legislation will allow U.S. companies to voluntarily share user data with the U.S. Department of Homeland Security, which in turn could pass that data along to the NSA and FBI. The bill, already widely criticized by the civil liberties and technology communities alike, has repeatedly been associated with two main concerns: first, it will enable companies to share users’ information regardless of protections under other laws and agreements and second, it will empower the U.S. government to domestically prosecute foreign nationals who have committed cybercrimes against U.S. companies, regardless of their location.

SumRando reached out to Arnold Jin, Seattle attorney and former Government Surveillance Fellow at the American Civil Liberties Union of Washington (ACLU-WA), for his response to the legislation:

“The recent Senate vote in favor of S. 754, the Cybersecurity Information Sharing Act (CISA), is troubling and disappointing on many fronts. The issue of government intelligence gathering has never been one of access or lack of information amongst law enforcement agencies. What is troubling about the current CISA bill is that it uses broad and vague terms to define a ‘cyber threat indicator.’ It is largely an explicit way for the government to conduct mass surveillance under the guise of providing a ‘safe harbor’ for the companies who comply with this bill. It is not insignificant that many of the largest tech companies have signed letters in opposition to this legislation.

“The definition of who would be a cyber threat suspect is so broad that it will inevitably capture the data of innocent citizens who are engaged in completely benign behavior. Furthermore, mistakes will happen. S. 754 provides no mechanism for protecting the incorrect information that gets shared between parties and worse, brings such sharing to a global level, considering that most companies these days are multinational and have a physical if not virtual presence in several other countries. Another factor to consider is that when one person travels and uses a tech provider’s services in another country, does that information then become subject to domestic or international cyber threat assessments? That situation is decidedly much more common in this day and age of modern travel.

“At a minimum I would urge Congress to follow the recommendations made to the committee in the letter submitted by professors who research and/or teach cyber law and cybersecurity on October 26, 2015. That letter endorsed the previous concerns addressed by more than 60 technologists, which included the signatories of some of the most respected security researchers in the world who highlighted that the problem behind recent cyber attacks has nothing to do with security threat information sharing; rather, more ‘robust and meaningful private efforts to prevent intrusions into networks and leaks out of them’ are what is needed. CISA does nothing to advance those goals. As we saw with Sony last year, most system hacks are predicated on some sort of phishing or social engineering attack. Quite often the largest problem is not the setting of security policy or privacy by design principles, but rather mass consumer adoption of these privacy protective measures.”

CISA is currently being reconciled with the House of Representatives’ version of the bill; from there, President Obama is expected to sign it into law.

For now, however, CISA remains a bill under review. Take a moment to remind Congress that you do not support CISA at www.decidethefuture.org and to tell Obama that you believe the government should “reject any law, policy, or mandate that would undermine our security” by signing the SaveCrypto.org petition, if you haven’t already.

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Originally published at blog.sumrando.com on November 4, 2015.

Brasil: In 2005, hoping to mitigate the rise of Halloween, Brasil’s government made October 31 a two-holiday occasion by adding Saci Day to the roster. Saci, the beloved one-legged troublemaker from traditional Brazilian folklore, seems to have worked his magic on the imported Halloween: check Twitter this weekend and we predict you’ll see more than a mention or two of Dia do Saci.

Saudi Arabia: A 2009 report from the United States consulate, made public by WikiLeaks, revealed that the rules of conservatism don’t apply to KSA’s elite, especially on Halloween: “Behind the façade of Wahabi conservatism in the streets, the underground nightlife for Jeddah’s elite youth is thriving and throbbing. The full range of worldly temptations and vices are available — alcohol, drugs, sex — but strictly behind closed doors. This freedom to indulge carnal pursuits is possible merely because the religious police keep their distance when parties include the presence or patronage of a Saudi royal and his circle of loyal attendants, such as a Halloween event attended by ConGenOffs on October 29…As one high society Saudi remarked, “The increased conservatism of our society over these past years has only moved social interaction to the inside of people’s homes.””

United States: In 2011, Ohio University’s Students Teaching About Racism in Society (STARS) launched ‘We’re a culture, not a costume’, a campaign to challenge the cultural and ethnic stereotypes that have become normalized in Halloween costumes. Sarah Williams, then-president of STARS, explained, “The best way to get rid of stereotypes and racism is to have a discussion and raise awareness.” The group has succeeded in initiating a national dialogue that continues to this day.

Rwanda: In 2013, Minister of Sport and Culture Protais Mitali banned celebrating Halloween in any capacity, public or private. Mitali argued that Halloween undermined Rwandan culture and labeled the ban an act of protectionism against Western influence. A Twitter debate ensued, as well as articles in favor of and against Rwanda’s Halloween ban. Of note, Ugandan writer Bwesigye bwa Mwesigire equated Rwanda’s ban with using “a sledge hammer to swat a mosquito” and Akua Djane of Ghana argued, “If Halloween came to Ghana from Nigeria for example, Ghanaians would call it “juju”, evil, occult…But because Halloween came from “the whites”, Ghanaians and other Africans have embraced it, no questions asked! Poor Africa.”

Russia: In 2014, Georgy Fyodorov of Russia’s Public Chamber petitioned Culture Minister Vladimir Medinsky for a nationwide Halloween ban: “Unfortunately, since the 1990s, lifestyles and behaviors that are very different from our cultural values are being actively thrust upon us. I believe it is necessary to give an ideological assessment to this holiday and launch a counteroffensive.” Medinsky dismissed the petition as a request beyond the scope of his office. This year, Russia’s Arkhangelsk region has taken up Fyodorov’s fight by banning Halloween celebrations in schools.

For many, October 31 is one night of freedom following 364 of conformity to social norms that antagonize their very nature. Once released, this bottled expression frequently oversteps its boundaries and delves into the otherwise forbidden fruits of carnal pleasure, stereotyping and worship of the foreign other. Underneath, however, is a holiday whose global appeal is rooted in a desire to be honest — to show people who we really are, who we want to be and how we really think, sentiments that find themselves expressed most openly from behind anonymity’s mask. Halloween brings out a version of ourselves that perhaps isn’t our ‘best’ self, but also doubles as an opportunity to challenge those beliefs that would otherwise remain within.

Halloween is yet another example of the ineffectiveness of constraints on freedom of speech and freedom of expression. Restrict what people can say and do and they’ll simply keep it in until they can hold it no longer; what form it takes at that point is anyone’s guess.

Love it or hate it, participate or conscientiously object, recognize that this October 31 is your opportunity for self-expression.

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Originally published at blog.sumrando.com on October 29, 2015.

When Facebook launched in 2004, search was a tool for locating friends. Last year, its functionality expanded to include the individual posts of friends. Now, any post set to ‘public’ can be found via Facebook search.

On October 22, Facebook not only announced the change, but also created a new section of its Newsroom page: Search FYI, a sure sign of additional change to come. Based on Facebook’s current trajectory, it seems safe to assume that Search FYI will become the home of future privacy-reducing announcements.

From Facebook’s perspective, the shift provides the opportunity to “find out what the world is saying about topics that matter” and, with a current collection of 2 trillion individual posts, they certainly have the capacity to make that a reality. Regardless, it’s not hard to see that Facebook also hopes public search will give users one less reason to turn to Google or Twitter.

Fortunately, individual users remain in control of their posts’ privacy settings, which means now is a great time to update your Facebook account:

Our suggestions:

• Protect your future posts: Click on the ‘Privacy Shortcuts’ padlock icon in the top right corner of your Facebook page. From the dropdown menu, click on ‘Who can see my stuff?’ and then ‘Who can see my future posts?’ Customize this as you like; we support ‘Only Me’, ‘Friends’ and anything in between.
• Protect your past posts: Click on the ‘Privacy Shortcuts’ padlock icon in the top right corner of your Facebook page. At the bottom of the dropdown menu, click on ‘See More Settings’ and then ‘Limit Past Posts’ under ‘Who can see my stuff?’. By selecting ‘Limit Old Posts’, any post you’ve already shared will now be shared with your friends only.

Our words of caution:

• You always have the option to change the privacy settings of individual posts. If you choose to use this feature, keep in mind that Facebook defaults your account settings to your most recent setting. So, if you decide it’s safe to share your World Series enthusiasm publicly, be sure to readjust your privacy settings immediately after or all your future posts will go global.
• Facebook was created as a platform to let information go viral, not protect it. Your privacy settings will not stop friends from including you in their public posts and, in spite of your best efforts to limit your audience, your posts will reach friends of friends every time you tag someone.

Facebook’s latest change is a clear attempt to compete with the services offered by Google and Twitter. Its success, however, rests on users’ willingness to make their posts public. In the interest of not converting the internet into a one-platform forum, let’s keep Facebook amongst friends.

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Originally published at blog.sumrando.com on October 26, 2015.

Barcodes. QR codes. Little boxes containing so much information, they are used to purchase items, process orders and even check into flights. It’s hard to believe a person would go out of his way to share these little squares of personal data with the world, yet it happens all the time.

Earlier this month Brian Krebs reported on what Cory, a reader, could do with a friend’s boarding pass barcode posted on Facebook: “I found a website that could decode the data and instantly had lots of info about his trip. Besides his name, frequent flyer number and other [personally identifiable information], I was able to get his record locator (a.k.a. “record key” for the Lufthansa flight he was taking that day). I then proceeded to Lufthansa’s website and using his last name (which was encoded in the barcode) and the record locator was able to get access to his entire account. Not only could I see this one flight, but I could see ANY future flights that were booked to his frequent flyer number from the Star Alliance.”

With the frequent flyer account, Cory was able to not only see, but also modify upcoming flights, which included changing passengers’ seats and canceling flights altogether. Furthermore, he recognized that a quick Facebook search for his friend’s maternal relatives was all he needed to answer the not-so-secure security question “What is your Mother’s maiden name?” in order to reset his friend’s Star Alliance PIN number.

Krebs’ report is a good reminder of the insecurities we tend to overlook and of the need to make small changes in our daily routines in order to enhance our overall security.

The ensuing news has come up with two solutions to this problem: either shred, burn or eat your boarding passes immediately following a flight or simply refuse to create the evidence that will later need to be destroyed; in other words, use an electronic boarding pass on your phone.

What few reports have mentioned is that technologically-speaking, simplicity tends to lead to less security instead of more, as is the case with boarding passes. Airports from Brasil to the Netherlands to India entice travelers online with offers of free public Wi-Fi, but fail to mention the great risks that come with connecting. Before you pull out your phone in an airport, know that cybercriminals worldwide take advantage of travelers by creating unofficial Wi-Fi connections they can exploit as well as hacking into already-existing connections.

There are no easy answers when it comes to determining the safest way for you to reach your final destination, but above all else:

1. If you choose to use unsecured airport Wi-Fi, protect yourself with a VPN’s secure internet connection.

2. Be creative — not honest — with your security question answers. See McSweeney’s list of Nihilistic Password Security Questions for inspiration if need be.

3. And, whatever you do, don’t post your boarding pass to Facebook, no matter how much you want to brag about your travel adventures.

www.sumrando.com