TikTok, TikTok: What Does That Sound Mean?
March 30, 2020
DarkCyber noted “TikTok, a Chinese Soft Power Time Bomb in US Living Rooms.” The SCMP is, of course, an independent, real news outfit. The use of the B work in the headline is not accidental. Maybe it is one of those warnings or messages hidden in plain sight. A digital purloined letter is one possibility.
Zoom, partially backed by investors from China, is another video outfit. “Zoom iOS App Sends Data to Facebook Even If You Don’t Have a Facebook Account” reports that video can be an interesting service to provide.
The SCMP article reports:
Privacy advocates and several US congressmen want to rein in the app over concerns it may censor and monitor content for the Chinese government, and be used for misinformation and election interference. This despite the fact that TikTok keeps its servers outside China and swears it will not hand over user data.
Would a Chinese company ignore a government order? Yeah, well, sure in bizarro world.
Zoom, on the other hand, shares data:
What the company and its privacy policy don’t make clear is that the iOS version of the Zoom app is sending some analytics data to Facebook, even if Zoom users don’t have a Facebook account…
Now a few questions:
- What data are sent where?
- With Chinese influence in both TikTok and Zoom what information finds its way (directly or indirectly) to Chinese data pools?
- Why are video services presumed to be innocent, just for fun services when Amazon, Facebook, Google, and other firms are essentially in the data collection and analysis business?
Yesterday a person with a mostly technical work history asked me why my Zoom account is listed under the name of a couple of my dogs and a defunct cigarette brand?
Now you know. A standalone computer. A separate Internet connection. An alias. A drug store debit card. These make me feel a little bit more secure when DarkCyber has to do a video conference call.
Maybe we will create a 30 second video about Zoom, Chinese influence, and data leakage? That’s good for eight or nine views.
Stephen E Arnold, March 30, 2020
Clearview: More Tradecraft Exposed
March 26, 2020
After years of dancing around the difference between brain dead products like enterprise search, content management, and predictive analytics, anyone can gain insight into the specialized software provided by generally low profile companies. Verint is publicly traded. Do you know what Verint does? Sure, look it up on Bing or Google.
I read with some discomfort “I Got My File From Clearview AI, and It Freaked Me Out.”
Here are some factoids from the write up. Are these true? DarkCyber assumes that everything the team sees on the Internet meets the highest standards of integrity, objectivity, and truthiness. DarkCyber’s comments are in italic:
- “Someone really has been monitoring nearly everything you post to the public internet. And they genuinely are doing “something” with it. The someone is Clearview AI. And the something is this: building a detailed profile about you from the photos you post online, making it searchable using only your face, and then selling it to government agencies and police departments who use it to help track you, identify your face in a crowd, and investigate you — even if you’ve been accused of no crime.”
- “Clearview AI was founded in 2017. It’s the brainchild of Australian entrepreneur Hoan Ton-That and former political aide Richard Schwartz. For several years, Clearview essentially operated in the shadows.”
- “The Times, not usually an institution prone to hyperbole, wrote that Clearview could “end privacy as we know it.” [This statement is a reference to a New York Times intelware article. The New York Times continues to hunt for real news that advances an agenda of “this stuff is terrible, horrible, unconstitutional, pro anything the NYT believes in, etc.”]
- “the company [Clearview] scrapes public images from the internet. These can come from news articles, public Facebook posts, social media profiles, or multiple other sources. Clearview has apparently slurped up more than 3 billion of these images.” [The images are those which are available on the Internet and possibly from other sources; for example, commercial content vendors.]
- “The images are then clustered together which allows the company to form a detailed, face-linked profile of nearly anyone who has published a picture of themselves online (or has had their face featured in a news story, a company website, a mug shot, or the like).” [This is called enrichment, context, or machine learning indexing and — heaven help DarkCyber — social graphs or semantic relationships. Jargon varies according to fashion trends.]
- “Clearview packages this database into an easy-to-query service (originally called Smartcheckr) and sells it to government agencies, police departments, and a handful of private companies….As of early 2020, the company had more than 2,200 customers using its service.” [DarkCyber wants to point out that law enforcement entities are strapped for cash, and many deals are little more than proofs-of-concept. Some departments cycle through policeware and intelware in order to know what the systems do versus what the marketing people say the systems do. Big difference? Yep, yep.]
- “Clearview’s clients can upload a photo of an unknown person to the system. This can be from a surveillance camera, an anonymous video posted online, or any other source.”
- “In a matter of seconds, Clearview locates the person in its database using only their face. It then provides their complete profile back to the client.”
Now let’s look at what the write up reported that seemed to DarkCyber to be edging closer to “real news.”
This is the report the author obtained:
The article reports that the individual who obtained this information from Clearview was surprised. DarkCyber noted this series of statements:
The depth and variety of data that Clearview has gathered on me is staggering. My profile contains, for example, a story published about me in my alma mater’s alumni magazine from 2012, and a follow-up article published a year later. It also includes a profile page from a Python coders’ meet up group that I had forgotten I belonged to, as well as a wide variety of posts from a personal blog my wife and I started just after getting married. The profile contains the URL of my Facebook page, as well as the names of several people with connections to me, including my faculty advisor and a family member (I have redacted their information and images in red prior to publishing my profile here).
The write up includes commentary on the service, its threats to individual privacy, and similar sentiments.
DarkCyber’s observations include:
- Perhaps universities could include information about applications of math, statistics, and machine learning in their business and other courses? At a lecture DarkCyber gave at the University of Louisville in January 2019, cluelessness among students and faculty was the principal takeaway for the DarkCyber team.
- Clearview’s technology is not unique, nor is it competitive with the integrated systems available from other specialized software vendors, based on information available to DarkCyber.
- The summary of what Clearview does captures information that would have been considered classified and may still be considerate classified in some countries.
- Clearview does not appear to have video capability like other vendors with richer, more sophisticated technology.
Why did DarkCyber experience discomfort? Some information is not — at this time or in the present environment — suitable for wide dissemination. A good actor with technical expertise can become a bad actor because the systems and methods are presented in sufficient detail to enable certain activities. Knowledge is power, but knowledge in the hands of certain individuals can yield unexpected consequences. DarkCyber is old fashioned and plans to stay that way.
Stephen E Arnold, March 26, 2020
Contact Tracing: A Tradecraft Component Released as Open Source Software
March 25, 2020
DarkCyber does not want to beat the drum about keeping some information from finding its way into general circulation. We want to point to “Singapore Government to Make Its Contact Tracing App Freely Available to Developers Worldwide.” The article states:
the Government [of Singapore] will be making the software for its contact-tracing application TraceTogether, which has already been installed by more than 620,000 people, freely available to developers around the world.
With the code in open source, those with some technical skill can develop, enhance, expand, and implement some of the features of TraceTogether.
The article points out:
the TraceTogether app can identify people who have been within 2m of coronavirus patients for at least 30 minutes, using wireless Bluetooth technology.
The article includes a how to graphic. The method revealed in the diagram, in the opinion of DarkCyber, seems similar to specialized tools available but in close hold mode for a number of years.
DarkCyber chooses to let the article speak for itself and you, gentle reader, to formulate your own upsides and downsides to the information disclosed by the Straits Times.
Stephen E Arnold, March 25, 2020
Wolfram Mathematica
March 19, 2020
DarkCyber noted “In Less Than a Year, So Much New: Launching Version 12.1 of Wolfram Language & Mathematica” contains highly suggestive information. Yes, this is a mathy program. The innovations are significant for analysts and some government professionals. To cite one example:
I’ve been recording hundreds of hours of video in connection with a new project I’m working on. So I decided to try our new capabilities on it. It’s spectacular! I could take a 4-hour video, and immediately extract a bunch of sample frames from it, and then—yes, in a few hours of CPU time—“summarize the whole video”, using SpeechRecognize to do speech-to-text on everything that was said and then generating a word cloud…
DarkCyber reacts positively to other additions and enhancements to the Mathematica “system.” Version 12.1 will make it easier to develop specific functions for policeware and intelware use cases.
Remarkable because the “system” can geo-everything. That’s important in many situations.
Stephen E Arnold, March 19, 2020
Israel and Mobile Phone Data: Some Hypotheticals
March 19, 2020
DarkCyber spotted a story in the New York Times: “Israel Looks to Repurpose a Trove of Cell Phone Data.” The story appeared in the dead tree edition on March 17, 2020, and you can access the online version of the write up at this link.
The write up reports:
Prime Minister Benjamin Netanyahu of Israel authorized the country’s internal security agency to tap into a vast , previously undisclosed trove of cell phone data to retract the movements of people who have contracted the corona virus and identify others who should be quarantined because their paths crossed.
Okay, cell phone data. Track people. Paths crossed. So what?
Apparently not much.
The Gray Lady does the handwaving about privacy and the fragility of democracy in Israel. There’s a quote about the need for oversight when certain specialized data are retained and then made available for analysis. Standard journalism stuff.
DarkCyber’s team talked about the write up and what the real journalists left out of the story. Remember. DarkCyber operates from a hollow in rural Kentucky and knows zero about Israel’s data collection realities. Nevertheless, my team was able to identify some interesting use cases.
Let’s look at a couple and conclude with a handful of observations.
First, the idea of retaining cell phone data is not exactly a new one. What if these data can be extracted using an identifier for a person of interest? What if a time-series query could extract the geolocation data for each movement of the person of interest captured by a cell tower? What if this path could be displayed on a map? Here’s a dummy example of what the plot for a single person of interest might look like. Please, note these graphics are examples selected from open sources. Examples are not related to a single investigation or vendor. These are for illustrative purposes only.
Source: Standard mobile phone tracking within a geofence. Map with blue lines showing a person’s path. SPIE at https://bit.ly/2TXPBby
Useful indeed.
Second, what if the intersection of two or more individuals can be plotted. Here’s a simulation of such a path intersection:
Source: Map showing the location of a person’s mobile phone over a period of time. Tyler Bell at https://bit.ly/2IVqf7y
Would these data provide a way to identify an individual with a mobile phone who was in “contact” with a person of interest? Would the authorities be able to perform additional analyses to determine who is in either party’s social network?
Third, could these relationship data be minded so that connections can be further explored?
Source: Diagram of people who have crossed paths visualized via Analyst Notebook functions. Globalconservation.org
Can these data be arrayed on a timeline? Can the routes be converted into an animation that shows a particular person of interest’s movements at a specific window of time?
Source: Vertical dots diagram from Recorded Future showing events on a timeline. https://bit.ly/39Xhbex
These hypothetical displays of data derived from cross correlations, geotagging, and timeline generation based on date stamps seem feasible. If earnest individuals in rural Kentucky can see the value of these “secret” data disclosed in the New York Times’ article, why didn’t the journalist and the others who presumably read the story?
What’s interesting is that systems, methods, and tools clearly disclosed in open source information is overlooked, ignored, or just not understood.
Now the big question: Do other countries have these “secret” troves of data?
DarkCyber does not know; however, it seems possible. Log files are a useful function of data processes. Data exhaust may have value.
Stephen E Arnold, March 19, 2020
Medical Surveillance: Numerous Applications for Government Entities and Entrepreneurs
March 16, 2020
With the Corona virus capturing headlines and disrupting routines, how can smart software monitoring data help with the current problem?
DarkCyber assumes that government health professionals would want to make use of technology that reduced a Corona disruption. Enforcement professionals would understand that monitoring, alerting, and identifying functions could assist in spotting issues; for example, in a particular region.
What’s interesting is that the application of intelware systems and methods to health issues is likely to become a robust business. However, despite the effective application of established techniques, identifying signals in a stream of data is an extension of innovations reaching back to i2 Analyst Notebook and other sensemaking systems in wide use in many countries’ enforcement and intelligence agencies.
What’s different is the keen attention these monitoring, alerting, and identifying systems are attracting.
Let’s take one example: Bluedot, a company operating from Canada. Founded by an infectious disease physician, Dr. Kamran Kahn. This company was one of the first firms to highlight the threat posed by the Coronavirus. According to Diginomica, BlueDot “alerted its private sector and government clients about a cluster of unusual pneumonia cases happening around a market in Wuhan, China.”
BlueDot, founded in 2013, combined expertise in infectious disease, artificial intelligence, analytics, and flows of open source and specialized information. “How Canadian AI start-up BlueDot Spotted Coronavirus before Anyone Else Had a Clue” explains what the company did to sound the alarm:
The BlueDot engine gathers data on over 150 diseases and syndromes around the world searching every 15 minutes, 24 hours a day. This includes official data from organizations like the Center for Disease Control or the World Health Organization. But, the system also counts on less structured information. Much of BlueDot’s predictive ability comes from data it collects outside official health care sources including, for example, the worldwide movements of more than four billion travelers on commercial flights every year; human, animal and insect population data; climate data from satellites; and local information from journalists and healthcare workers, pouring through 100,000 online articles each day spanning 65 languages. BlueDot’s specialists manually classified the data, developed a taxonomy so relevant keywords could be scanned efficiently, and then applied machine learning and natural language processing to train the system. As a result, it says, only a handful of cases are flagged for human experts to analyze. BlueDot sends out regular alerts to health care, government, business, and public health clients. The alerts provide brief synopses of anomalous disease outbreaks that its AI engine has discovered and the risks they may pose.
DarkCyber interprets BlueDot’s pinpointing of the Corona virus as an important achievement. More importantly, DarkCyber sees BlueDot’s system as an example of innovators replicating the systems, methods, procedures, and outputs from intelware and policeware systems.
Independent thinkers arrive at a practical workflow to convert raw data into high-value insights. BlueDot is a company that points the way to the future of deriving actionable information from a range of content.
Some vendors of specialized software work hard to keep their systems and methods confidential and in some cases secret. Now a person interested in how some specialized software and service providers assist government agencies, intelligence professionals, and security experts can read about BlueDot in open source articles like the one cited in this blog post or work through the information on the BlueDot Web site. The company wants to hire a surveillance analyst. Click here for information.
Net net: BlueDot provides a template for innovators wanting to apply systems and methods that once were classified or confidential to commercial problems. Business intelligence may become more like traditional intelligence more quickly than some anticipated.
Stephen E Arnold, March 16, 2020
Banjo: A How To for Procedures Once Kept Secret
March 13, 2020
DarkCyber wrote about BlueDot and its making reasonably clear what steps it takes to derive actionable intelligence from open source and some other types of data. Ten years ago, the processes implemented by BlueDot would have been shrouded in secrecy.
From Secrets to Commercial Systems
Secret and classified information seems to find its way into social media and the mainstream media. DarkCyber noted another example of a company utilizing some interesting methods written up in a free online publication.
DarkCyber can visualize old-school companies depending on sales to law enforcement and the intelligence community asking themselves, “What’s going on? How are commercial firms getting this know how? Why are how to and do it yourself travel guides to intelligence methods becoming so darned public?”
It puzzles DarkCyber as well.
Let’s take a look at the revelations in “Surveillance Firm Banjo Used a Secret Company and Fake Apps to Scrape Social Media.” The write up explains:
- A company called Pink Unicorn Labs created apps which obtained information from users. Users did not know their data were gathered, filtered, and cross correlated.
- Banjo, an artificial intelligence firm that works with police used a shadow company to create an array of Android and iOS apps that looked innocuous but were specifically designed to secretly scrape social media. The developer of the apps was Pink Unicorn. Banjo CEO Damien Patton created Pink Unicorn.
- Why create apps that seemed to do one while performing data inhalation: “Dataminr received an investment from Twitter. Dataminr has access to the Twitter fire hose. Banjo, the write up says, “did not have that sort of data access.” The fix? Create apps that sucked data.
- The apps obtained information from Facebook, Twitter, Instagram, Russian social media app VK, FourSquare, Google Plus, and Chinese social network Sina Weibo.
- The article points out: “Once users logged into the innocent looking apps via a social network OAuth provider, Banjo saved the login credentials, according to two former employees and an expert analysis of the apps performed by Kasra Rahjerdi, who has been an Android developer since the original Android project was launched. Banjo then scraped social media content.”
- The write up explains, Banjo, via a deal with Utah, has access to the “state’s traffic, CCTV, and public safety cameras. Banjo promises to combine that input with a range of other data such as satellites and social media posts to create a system that it claims alerts law enforcement of crimes or events in real-time.”
Discussion
Why social media? On the surface and to most parents and casual users of Facebook, Twitter, and YouTube, there are quite a few cat posts. But via the magic of math, an analyst or a script can look for data which fills in missing information. The idea is to create a record of a person, leave blanks where desirable information is not yet plugged in, and then rely on software to spot the missing item. How is this accomplished? The idea is simple. One known fact appears in the profile and that fact appears in another unrelated item of content. Then the correlated item of content is scanned by a script and any information missing from the profile is plugged in. Using this method and content from different sources, a clever system can compile a dossier on an entity. Open source information yields numerous gems; for example, a cute name applied to a boy friend might become part of a person of interest’s Dark Web handle. Phone numbers, geographic information, friends, and links to other interesting content surface. Scripts work through available data. Data can be obtained in many ways. The methods are those which were shrouded in secrecy before the Internet started publishing essays revealing what some have called “tradecraft.”
Net Net
Banjo troubles DarkCyber on a number of levels:
- Secrecy has significant benefits. Secrets, once let loose, have interesting consequences.
- Users are unaware of the risks apps pose. Cluelessness is in some cases problematic.
- The “now” world looks more like an intelligence agency than a social construct.
Stephen E Arnold, March 13, 2020
DCGS: Palantir and BAE Seem to Be Winners
March 9, 2020
DarkCyber noted “BAE, Palantir Earn Spots on $823M Army Contract.” The Distributed Common Ground System Army has an interesting history. To make a long story short, DCGS chugs along. BAE System will compete for task orders with Palantir.
The write up reports:
That system provides the Army with intelligence from multiple sources over networks of varying security levels and includes “laptops and desktops, fixed, portable and vehicle-mounted servers, and ground stations to receive, share and store collected intelligence” and software programs to analyze and share that information.
According to the US Army:
DCGS-A connects Soldiers to the Intelligence Community, other Services, multiple joint intelligence, surveillance and reconnaissance (ISR) platforms and sensors and Army Mission Command systems. It gives commanders the ability to view ISR information in one place. It also integrates that information into tools that can support intelligence development.
The key point is that DCGS A becomes a “model” approach for other military branches as well as for some of the US government’s enforcement entities.
Stephen E Arnold, March 9, 2020
Smart Intelligence Analysis Software: What Operators Need Versus What Operators Get
February 24, 2020
DarkCyber noted “The ABCs of AI Enabled Intelligence Analysis.” The major problem with today’s intelware solutions is stated clearly:
The inability to adjust analysis tools to the operational environment is a prodigious problem.
Vendors want operators (licensees) to adapt to their environment. The idea is that the vendor’s environment is the only way to get the most out of an intelware system. What if the customer does not like this approach? Yeah.
Now the marketers, developers, and field engineers will insist that this statement is incorrect.
Here’s a passage from the write up which explains the operator’s point of view:
There are two key concepts to any data-centric system: First, analysis tools and applications should change with the data, and second, data should be easily accessible. Analysts must be able to configure the tools and algorithms of the systems to meet the realities of the battlefield, and data access should be as seamless as possible.
So what’s wrong? Here’s the explanation:
Within a data-centric context, the use of machine learning algorithms has led to breakthroughs in nearly every analysis endeavor, from fraud detection to image identification. To take advantage of these advances, intelligence analysts need systems that allow them to use computational tools and to constantly adjust, or retrain, their algorithms to a changing battlefield. Unfortunately, nearly all analysis software products in use today — including advanced systems like Palantir or Analyst Notebook — are closed systems that do not allow analysts to code custom algorithms, use the latest machine-learning algorithms, use the latest research in “explainable AI,” or even allow analysts to provide feedback to the software’s algorithms.
DarkCyber recommends taking a look at this write up.
Several observations:
- Marketers, vendors, and field engineers are busy with their own agendas. As a result, paying customers are usually ignored. Their requests are not on the road map, too difficult to make, or of no interest.
- Existing intelware solutions are purpose built to require training, support, and tradition. In one demo, the marketer could not understand that his actions were obscured by the control panel of the video conferencing system used to show off features. The person did not listen; the eager beaver was on auto pilot.
- Legacy systems like Analyst Notebook are often rarely used. The license is simply paid because, as one top dog law enforcement professional told me, “We don’t want to be without it. But no one has been to training recently. It is just here.”
These three problems are not part of the “AI baloney party.” I think these dot points underscore how deep the disconnect and how severe a problem today’s intelware helps foster.
For those who want to point out that certain tools developed in other countries are “better, faster, and cheaper.” Based on DarkCyber’s exposure to these systems, the newest tools are repeating the errors of the past 20 years.
A goldfish knows only water. The real world is different. But intelware fish don’t die. They force the customer to learn how to exist within their watery world.
Stephen E Arnold, February 24, 2020
Trovicor Acquired
February 21, 2020
Information online suggests that Trovicor, a lawful intercept and specialized services company, has been acquired. One source (Clairfield) identifies the purchasers as the French firm Boss Industries, which may be a red herring. Another source (Intelligence Online, which is paywalled, thank you very much) says that the buyer is Nexa Technologies. Trovicor operates from Dubai, a city which is on the path to displacing Herliya, Israel, as the Silicon Valley of intelware and policeware.
Why the confusion? No idea.
DarkCyber’s sources suggest that the owner of Trovicor is Nexa Technologies. Nexa has an office in Dubai, and the firm has been working to create an “alliance” or “tie up” among other specialized services companies called Intellexa. Those mentioned as part of the Nexa “alliance” are Senpai Technologies and WiSpear. Nexa offers some well regarded audio surveillance capabilities. Other capabilities of Nexa are likely to include:
Network Intelligence – remote intelligence collection and production solutions based on a range of data sources
Lawful intercept – Mobile phone centric and WiFi data
Cyber Intelligence services – Malware, OSINT
InSight Data Fusion and Analytics systems – Text processing and analysis
OverSight – Administrative modules (Source: Varindia)
Nexa may have put the allegations that it sold surveillance equipment to countries on a “do not sell to” list. The investigation, according to Corpwatch, was allegedly
an expansion of an ongoing investigation of Amesys, which was a unit of Bull International SAS in France, for the 2007 sale of a surveillance system named Eagle GLINT to the Gaddafi regime in Libya, for approximately $25 million. The investigation was initiated in the summer of 2011 after FIDH and LDH lodged a complaint alleging that Eagle GLINT enabled widespread oppression and human and civil rights violations of in Libya between 2007 and 2011.
Is Trovicor going to help Nexa challenge the leaders in specialized services?
Possibly. A more realistic scenario is to compete for the steadily increasing funds allocated to deal with threats to nation states by actors antagonist to these sovereignties. Displacing firms like BAE Systems, NSO, and Verint may be a challenge.
Stephen E Arnold, February 21, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
