Wolfram Mathematica
March 19, 2020
DarkCyber noted “In Less Than a Year, So Much New: Launching Version 12.1 of Wolfram Language & Mathematica” contains highly suggestive information. Yes, this is a mathy program. The innovations are significant for analysts and some government professionals. To cite one example:
I’ve been recording hundreds of hours of video in connection with a new project I’m working on. So I decided to try our new capabilities on it. It’s spectacular! I could take a 4-hour video, and immediately extract a bunch of sample frames from it, and then—yes, in a few hours of CPU time—“summarize the whole video”, using SpeechRecognize to do speech-to-text on everything that was said and then generating a word cloud…
DarkCyber reacts positively to other additions and enhancements to the Mathematica “system.” Version 12.1 will make it easier to develop specific functions for policeware and intelware use cases.
Remarkable because the “system” can geo-everything. That’s important in many situations.
Stephen E Arnold, March 19, 2020
Israel and Mobile Phone Data: Some Hypotheticals
March 19, 2020
DarkCyber spotted a story in the New York Times: “Israel Looks to Repurpose a Trove of Cell Phone Data.” The story appeared in the dead tree edition on March 17, 2020, and you can access the online version of the write up at this link.
The write up reports:
Prime Minister Benjamin Netanyahu of Israel authorized the country’s internal security agency to tap into a vast , previously undisclosed trove of cell phone data to retract the movements of people who have contracted the corona virus and identify others who should be quarantined because their paths crossed.
Okay, cell phone data. Track people. Paths crossed. So what?
Apparently not much.
The Gray Lady does the handwaving about privacy and the fragility of democracy in Israel. There’s a quote about the need for oversight when certain specialized data are retained and then made available for analysis. Standard journalism stuff.
DarkCyber’s team talked about the write up and what the real journalists left out of the story. Remember. DarkCyber operates from a hollow in rural Kentucky and knows zero about Israel’s data collection realities. Nevertheless, my team was able to identify some interesting use cases.
Let’s look at a couple and conclude with a handful of observations.
First, the idea of retaining cell phone data is not exactly a new one. What if these data can be extracted using an identifier for a person of interest? What if a time-series query could extract the geolocation data for each movement of the person of interest captured by a cell tower? What if this path could be displayed on a map? Here’s a dummy example of what the plot for a single person of interest might look like. Please, note these graphics are examples selected from open sources. Examples are not related to a single investigation or vendor. These are for illustrative purposes only.
Source: Standard mobile phone tracking within a geofence. Map with blue lines showing a person’s path. SPIE at https://bit.ly/2TXPBby
Useful indeed.
Second, what if the intersection of two or more individuals can be plotted. Here’s a simulation of such a path intersection:
Source: Map showing the location of a person’s mobile phone over a period of time. Tyler Bell at https://bit.ly/2IVqf7y
Would these data provide a way to identify an individual with a mobile phone who was in “contact” with a person of interest? Would the authorities be able to perform additional analyses to determine who is in either party’s social network?
Third, could these relationship data be minded so that connections can be further explored?
Source: Diagram of people who have crossed paths visualized via Analyst Notebook functions. Globalconservation.org
Can these data be arrayed on a timeline? Can the routes be converted into an animation that shows a particular person of interest’s movements at a specific window of time?
Source: Vertical dots diagram from Recorded Future showing events on a timeline. https://bit.ly/39Xhbex
These hypothetical displays of data derived from cross correlations, geotagging, and timeline generation based on date stamps seem feasible. If earnest individuals in rural Kentucky can see the value of these “secret” data disclosed in the New York Times’ article, why didn’t the journalist and the others who presumably read the story?
What’s interesting is that systems, methods, and tools clearly disclosed in open source information is overlooked, ignored, or just not understood.
Now the big question: Do other countries have these “secret” troves of data?
DarkCyber does not know; however, it seems possible. Log files are a useful function of data processes. Data exhaust may have value.
Stephen E Arnold, March 19, 2020
Medical Surveillance: Numerous Applications for Government Entities and Entrepreneurs
March 16, 2020
With the Corona virus capturing headlines and disrupting routines, how can smart software monitoring data help with the current problem?
DarkCyber assumes that government health professionals would want to make use of technology that reduced a Corona disruption. Enforcement professionals would understand that monitoring, alerting, and identifying functions could assist in spotting issues; for example, in a particular region.
What’s interesting is that the application of intelware systems and methods to health issues is likely to become a robust business. However, despite the effective application of established techniques, identifying signals in a stream of data is an extension of innovations reaching back to i2 Analyst Notebook and other sensemaking systems in wide use in many countries’ enforcement and intelligence agencies.
What’s different is the keen attention these monitoring, alerting, and identifying systems are attracting.
Let’s take one example: Bluedot, a company operating from Canada. Founded by an infectious disease physician, Dr. Kamran Kahn. This company was one of the first firms to highlight the threat posed by the Coronavirus. According to Diginomica, BlueDot “alerted its private sector and government clients about a cluster of unusual pneumonia cases happening around a market in Wuhan, China.”
BlueDot, founded in 2013, combined expertise in infectious disease, artificial intelligence, analytics, and flows of open source and specialized information. “How Canadian AI start-up BlueDot Spotted Coronavirus before Anyone Else Had a Clue” explains what the company did to sound the alarm:
The BlueDot engine gathers data on over 150 diseases and syndromes around the world searching every 15 minutes, 24 hours a day. This includes official data from organizations like the Center for Disease Control or the World Health Organization. But, the system also counts on less structured information. Much of BlueDot’s predictive ability comes from data it collects outside official health care sources including, for example, the worldwide movements of more than four billion travelers on commercial flights every year; human, animal and insect population data; climate data from satellites; and local information from journalists and healthcare workers, pouring through 100,000 online articles each day spanning 65 languages. BlueDot’s specialists manually classified the data, developed a taxonomy so relevant keywords could be scanned efficiently, and then applied machine learning and natural language processing to train the system. As a result, it says, only a handful of cases are flagged for human experts to analyze. BlueDot sends out regular alerts to health care, government, business, and public health clients. The alerts provide brief synopses of anomalous disease outbreaks that its AI engine has discovered and the risks they may pose.
DarkCyber interprets BlueDot’s pinpointing of the Corona virus as an important achievement. More importantly, DarkCyber sees BlueDot’s system as an example of innovators replicating the systems, methods, procedures, and outputs from intelware and policeware systems.
Independent thinkers arrive at a practical workflow to convert raw data into high-value insights. BlueDot is a company that points the way to the future of deriving actionable information from a range of content.
Some vendors of specialized software work hard to keep their systems and methods confidential and in some cases secret. Now a person interested in how some specialized software and service providers assist government agencies, intelligence professionals, and security experts can read about BlueDot in open source articles like the one cited in this blog post or work through the information on the BlueDot Web site. The company wants to hire a surveillance analyst. Click here for information.
Net net: BlueDot provides a template for innovators wanting to apply systems and methods that once were classified or confidential to commercial problems. Business intelligence may become more like traditional intelligence more quickly than some anticipated.
Stephen E Arnold, March 16, 2020
Banjo: A How To for Procedures Once Kept Secret
March 13, 2020
DarkCyber wrote about BlueDot and its making reasonably clear what steps it takes to derive actionable intelligence from open source and some other types of data. Ten years ago, the processes implemented by BlueDot would have been shrouded in secrecy.
From Secrets to Commercial Systems
Secret and classified information seems to find its way into social media and the mainstream media. DarkCyber noted another example of a company utilizing some interesting methods written up in a free online publication.
DarkCyber can visualize old-school companies depending on sales to law enforcement and the intelligence community asking themselves, “What’s going on? How are commercial firms getting this know how? Why are how to and do it yourself travel guides to intelligence methods becoming so darned public?”
It puzzles DarkCyber as well.
Let’s take a look at the revelations in “Surveillance Firm Banjo Used a Secret Company and Fake Apps to Scrape Social Media.” The write up explains:
- A company called Pink Unicorn Labs created apps which obtained information from users. Users did not know their data were gathered, filtered, and cross correlated.
- Banjo, an artificial intelligence firm that works with police used a shadow company to create an array of Android and iOS apps that looked innocuous but were specifically designed to secretly scrape social media. The developer of the apps was Pink Unicorn. Banjo CEO Damien Patton created Pink Unicorn.
- Why create apps that seemed to do one while performing data inhalation: “Dataminr received an investment from Twitter. Dataminr has access to the Twitter fire hose. Banjo, the write up says, “did not have that sort of data access.” The fix? Create apps that sucked data.
- The apps obtained information from Facebook, Twitter, Instagram, Russian social media app VK, FourSquare, Google Plus, and Chinese social network Sina Weibo.
- The article points out: “Once users logged into the innocent looking apps via a social network OAuth provider, Banjo saved the login credentials, according to two former employees and an expert analysis of the apps performed by Kasra Rahjerdi, who has been an Android developer since the original Android project was launched. Banjo then scraped social media content.”
- The write up explains, Banjo, via a deal with Utah, has access to the “state’s traffic, CCTV, and public safety cameras. Banjo promises to combine that input with a range of other data such as satellites and social media posts to create a system that it claims alerts law enforcement of crimes or events in real-time.”
Discussion
Why social media? On the surface and to most parents and casual users of Facebook, Twitter, and YouTube, there are quite a few cat posts. But via the magic of math, an analyst or a script can look for data which fills in missing information. The idea is to create a record of a person, leave blanks where desirable information is not yet plugged in, and then rely on software to spot the missing item. How is this accomplished? The idea is simple. One known fact appears in the profile and that fact appears in another unrelated item of content. Then the correlated item of content is scanned by a script and any information missing from the profile is plugged in. Using this method and content from different sources, a clever system can compile a dossier on an entity. Open source information yields numerous gems; for example, a cute name applied to a boy friend might become part of a person of interest’s Dark Web handle. Phone numbers, geographic information, friends, and links to other interesting content surface. Scripts work through available data. Data can be obtained in many ways. The methods are those which were shrouded in secrecy before the Internet started publishing essays revealing what some have called “tradecraft.”
Net Net
Banjo troubles DarkCyber on a number of levels:
- Secrecy has significant benefits. Secrets, once let loose, have interesting consequences.
- Users are unaware of the risks apps pose. Cluelessness is in some cases problematic.
- The “now” world looks more like an intelligence agency than a social construct.
Stephen E Arnold, March 13, 2020
DCGS: Palantir and BAE Seem to Be Winners
March 9, 2020
DarkCyber noted “BAE, Palantir Earn Spots on $823M Army Contract.” The Distributed Common Ground System Army has an interesting history. To make a long story short, DCGS chugs along. BAE System will compete for task orders with Palantir.
The write up reports:
That system provides the Army with intelligence from multiple sources over networks of varying security levels and includes “laptops and desktops, fixed, portable and vehicle-mounted servers, and ground stations to receive, share and store collected intelligence” and software programs to analyze and share that information.
According to the US Army:
DCGS-A connects Soldiers to the Intelligence Community, other Services, multiple joint intelligence, surveillance and reconnaissance (ISR) platforms and sensors and Army Mission Command systems. It gives commanders the ability to view ISR information in one place. It also integrates that information into tools that can support intelligence development.
The key point is that DCGS A becomes a “model” approach for other military branches as well as for some of the US government’s enforcement entities.
Stephen E Arnold, March 9, 2020
Smart Intelligence Analysis Software: What Operators Need Versus What Operators Get
February 24, 2020
DarkCyber noted “The ABCs of AI Enabled Intelligence Analysis.” The major problem with today’s intelware solutions is stated clearly:
The inability to adjust analysis tools to the operational environment is a prodigious problem.
Vendors want operators (licensees) to adapt to their environment. The idea is that the vendor’s environment is the only way to get the most out of an intelware system. What if the customer does not like this approach? Yeah.
Now the marketers, developers, and field engineers will insist that this statement is incorrect.
Here’s a passage from the write up which explains the operator’s point of view:
There are two key concepts to any data-centric system: First, analysis tools and applications should change with the data, and second, data should be easily accessible. Analysts must be able to configure the tools and algorithms of the systems to meet the realities of the battlefield, and data access should be as seamless as possible.
So what’s wrong? Here’s the explanation:
Within a data-centric context, the use of machine learning algorithms has led to breakthroughs in nearly every analysis endeavor, from fraud detection to image identification. To take advantage of these advances, intelligence analysts need systems that allow them to use computational tools and to constantly adjust, or retrain, their algorithms to a changing battlefield. Unfortunately, nearly all analysis software products in use today — including advanced systems like Palantir or Analyst Notebook — are closed systems that do not allow analysts to code custom algorithms, use the latest machine-learning algorithms, use the latest research in “explainable AI,” or even allow analysts to provide feedback to the software’s algorithms.
DarkCyber recommends taking a look at this write up.
Several observations:
- Marketers, vendors, and field engineers are busy with their own agendas. As a result, paying customers are usually ignored. Their requests are not on the road map, too difficult to make, or of no interest.
- Existing intelware solutions are purpose built to require training, support, and tradition. In one demo, the marketer could not understand that his actions were obscured by the control panel of the video conferencing system used to show off features. The person did not listen; the eager beaver was on auto pilot.
- Legacy systems like Analyst Notebook are often rarely used. The license is simply paid because, as one top dog law enforcement professional told me, “We don’t want to be without it. But no one has been to training recently. It is just here.”
These three problems are not part of the “AI baloney party.” I think these dot points underscore how deep the disconnect and how severe a problem today’s intelware helps foster.
For those who want to point out that certain tools developed in other countries are “better, faster, and cheaper.” Based on DarkCyber’s exposure to these systems, the newest tools are repeating the errors of the past 20 years.
A goldfish knows only water. The real world is different. But intelware fish don’t die. They force the customer to learn how to exist within their watery world.
Stephen E Arnold, February 24, 2020
Trovicor Acquired
February 21, 2020
Information online suggests that Trovicor, a lawful intercept and specialized services company, has been acquired. One source (Clairfield) identifies the purchasers as the French firm Boss Industries, which may be a red herring. Another source (Intelligence Online, which is paywalled, thank you very much) says that the buyer is Nexa Technologies. Trovicor operates from Dubai, a city which is on the path to displacing Herliya, Israel, as the Silicon Valley of intelware and policeware.
Why the confusion? No idea.
DarkCyber’s sources suggest that the owner of Trovicor is Nexa Technologies. Nexa has an office in Dubai, and the firm has been working to create an “alliance” or “tie up” among other specialized services companies called Intellexa. Those mentioned as part of the Nexa “alliance” are Senpai Technologies and WiSpear. Nexa offers some well regarded audio surveillance capabilities. Other capabilities of Nexa are likely to include:
Network Intelligence – remote intelligence collection and production solutions based on a range of data sources
Lawful intercept – Mobile phone centric and WiFi data
Cyber Intelligence services – Malware, OSINT
InSight Data Fusion and Analytics systems – Text processing and analysis
OverSight – Administrative modules (Source: Varindia)
Nexa may have put the allegations that it sold surveillance equipment to countries on a “do not sell to” list. The investigation, according to Corpwatch, was allegedly
an expansion of an ongoing investigation of Amesys, which was a unit of Bull International SAS in France, for the 2007 sale of a surveillance system named Eagle GLINT to the Gaddafi regime in Libya, for approximately $25 million. The investigation was initiated in the summer of 2011 after FIDH and LDH lodged a complaint alleging that Eagle GLINT enabled widespread oppression and human and civil rights violations of in Libya between 2007 and 2011.
Is Trovicor going to help Nexa challenge the leaders in specialized services?
Possibly. A more realistic scenario is to compete for the steadily increasing funds allocated to deal with threats to nation states by actors antagonist to these sovereignties. Displacing firms like BAE Systems, NSO, and Verint may be a challenge.
Stephen E Arnold, February 21, 2020
Africa: Booming Intelware and Policeware Markets?
February 20, 2020
DarkCyber has a difficult time determining what information is on the money and what information is on the floor of the data casino. We read “Inside Africa’s Increasingly Lucrative Surveillance Market.” The write up is chock full of details. Some of the allegedly accurate information was interesting.
Here’s a sampling of factoids to evaluate:
Market size, but it is not clear what “market” means, just Africa, the world, or developed countries: The cybersecurity market was worth $118.78bn in 2018. By 2024, this figure is expected to hit $267.73bn.
Name of Gabonese Republic’s enforcement unit: SILAM which is allegedly run by French national Jean-Charles Solon. The write up states: “Solon previously worked for the General Directorate for External Security (Direction générale de la sécurité extérieure – DGSE), France’s intelligence agency.” Allegedly Solor is familiar with the ins and outs of wire tapping. The write up asserts without providing a specific source: “According to our sources, Solon is well equipped and handles everything from wiretap transcripts, text message and WhatsApp conversation interceptions, and email and social media surveillance.” Solon is likely to find the write up in This Is GCN worth some special attention, but that’s just DarkCyber hunch.
Entities (governmental and commercial) linked to the Gabonese Republic include: Amesys and its Cerebro tool, SDECE/DGSE, AMES, Nexa Technologies, and Suneris Solutions (Thales).
Current market leaders: The write up reports, “Ercom and Suneris Solutions have a leading position in the African market, especially in the sub-Saharan region.” These two companies are owned by Thales.
What sells and where to buy: The write up notes, ““Clients want to buy something that has a proven track record. They’re not looking for an experimental gadget.” For Africa, the two must-see events are Milipol Paris, held in November, and ISS World Middle East and Africa, held in March in Dubai.”
Israeli companies selling or trying to sell in Africa: The write up identifies these firms as eyeing the African markets –—Thales (includes Ercom and Suneris Solutions), Mer Group and its unit Athena GS3 (Mer Group (Congo, Guinea, Nigeria and DRC), Verint Systems and Elbit Systems (South Africa, Angola, Ethiopia, Nigeria, etc.), AD Consultants, and NSO Group. The write up asserts, “The Israelis are everywhere. They even managed to equip Saudi Arabia! It’s pretty much impossible to bypass them.”
Other companies trying to sell to African markets include: BAE Systems, Gamma Group, Trovicor (now a unit of Nexa), Hacking Team, VasTech, Protei (a Russian firm), Huawei, and ZTE Corporation (described in the article as a compatriot of Huawei).
DarkCyber will leave it to you, gentle reader, to figure out if the write up in This is GCN is fact or fluff. What is known is that most of the named entities in this write up work overtime to avoid big time news coverage, traditional marketing, and noisy public relations. DarkCyber believes that firms providing specialized services should remain low profile.
In closing, if you want information about Sudanese intelligence activities, you may find this thesis by Muhammad Bathily helpful. Its title is “Reform of Senegalese Gendarmerie Intelligence Services.” You can locate the document at this url https://t.co/0cp1CCqiKy. (Verified at 1049 am US Eastern time, 2 20 20)
Stephen E Arnold, February 20, 2020
Belated Recognition: Barn Burned, Intelligence Costco Operating
December 18, 2019
Amnesty International has described the “Architecture of Surveillance.” Quick out of the gate?
Concerns about privacy and the ways in which large tech companies use and profit off user data have been more and more in the news lately. A recent report by Amnesty International goes so far as to say Facebook and Google, in particular, maintain a “surveillance-based business model.” Common Dreams discusses the report in its article, “Unprecedented ‘Architecture of Surveillance’ Created by Facebook and Google Poses Grave Human Rights Threat: Report.” Writer Andrea Germanos summarizes:
“With Facebook controlling not only its eponymous social media platform but also WhatsApp, Messenger, and Instagram, and Google parent company Alphabet in control of YouTube and the Android mobile operating system as well as the search engine, the companies ‘control the primary channels that people rely on to engage with the internet.’ In fact, the report continues, the two companies control ‘an architecture of surveillance that has no basis for comparison in human history.’ … The companies hoover up user data—as well as metadata like email recipients—and ‘they are using that data to infer and create new information about us,’ relying in part on artificial intelligence (AI).The report says that ‘as a default Google stores search history across all of an individual’s devices, information on every app and extension they use, and all of their YouTube history, while Facebook collects data about people even if they don’t have a Facebook account.’ Smart phones also offer the companies a ‘rich source of data,’ but the reach of surveillance doesn’t stop there.”
In fact, the reach now extends into homes via AI assistants like Alexa and devices connected to the internet of things. It also extends through public spaces courtesy of smart city implementations. All of this has crept upon us gradually and, largely, with the full cooperation of the subjects being surveilled (a.k.a. “users”), whether they fully understood what they were signing up for or not. The connections and conclusions algorithms can draw from all this information is mind-boggling even to someone who writes about data and AI for a living. See the article for a more in-depth discussion of the possibilities and repercussions.
Because the big tech companies are not going to stop these lucrative practices on their own, Amnesty International insists governments must step in. Companies must stop requiring users to surrender all rights to their data in order to use their services, for example, and the right to not be tracked must be enshrined into law. Transparency is also to be required, and companies mustn’t be allowed to lobby for weakened protections. Society has gone so far down the digital road that opting out of an online existence is simply not a workable option for most—that’s just not how it works anymore. But will it be possible to hold the big techs’ feet to the fire, or have they become too powerful?
Cynthia Murrell, December 18, 2019
This Snooping Stuff
December 14, 2019
The Economist’s story “Offering Software for Snooping to Governments Is a Booming Business” sounds good. The article is locked behind a paywall so you will have to sign up to read the quite British analysis. There are some interesting comments zipping around about the article. For example, a useful thread appears at this link.
Several observations struck me as informative; for example:
- The Economist does not mention Cisco. This is important because Cisco has an “intelligence” capability with some useful connections to innovators in other countries.
- Palantir, a recipient of another US government contract, is not mentioned in the write up. For information about this new Palantir project, navigate to “Palantir Wins New Pentagon Deal With $111 Million From the Army.” This is paywalled as well.
- There is even a reference to surveillance technology delivering a benefit.
Perhaps those interested in surveillance software will find the interview Robert Steele, a former CIA professional, conducted with me. You can find that information at this link.
Perhaps the Economist will revisit this topic and move beyond NSO Group and colloquial language like snooping?
Stephen E Arnold
-
- Subscribe to Beyond Search
Feature archive
News archive
-
