NSA Aftermath in Germany

October 19, 2016

When it was revealed not too long ago that the United States was actively spying on Germany, the country decided it was time to investigate.  Netzpolitik wrote an update on Germany’s investigation in “Snowden’s Legacy: Hearing In The Parliament Committee.”  The German parliament launched a committee to head the investigation, which included many hearings.  At recent hearing in Germany, five USA experts spoke to the committee, including ACLU technologist Charles Soghoian, Watson Institute’s Timothy H. Edgar, ACLU attorney Ashley Gorski, Open Society Foundation senior advisor Morton H. Halperin, and US Access Now policy manager Amie Stepanovich.

The experts met with the committee as a way to ease tensions between the US and Germany, but also share their knowledge about legal issues related to surveillance and individual’s privacy rights.  The overall agreement was that current legal framework for handling these issues is outdated and needs to be revamped.  There should not be a difference between technical and legal protection when it comes to privacy.  As for surveillance and anonymity, there currently is not a legal checks and balances system to rein in intelligence organizations’ power.  The bigger problem is not governmental spying, but how the tools are used:

Nevertheless, Christopher Soghoian noted that the real scandal was not that government agencies were spying on their people, but that technology was so poorly secured that it could have been exploited. Historically, encryption and security have had a very low priority for big Internet companies like Google. Snowden turned the discussion upside-down, his disclosures radicalised the very people who design the software the NSA had privately exploited. Therefore, the most important post-Snowden changes were not made in Government hallways but in the technological community, according to Soghoian.

German surveillance technology manufacturers Gamma Group and Trovicor were also mentioned.  As the committee was investigating how the NSA violated Germany’s civil rights, of course, a reference was made to the World Wars.  What we can pull from this meeting is we need change and technology needs to beef up its security capabilities.

Whitney Grace, October 19, 2016
Sponsored by ArnoldIT.com, publisher of the CyberOSINT monograph

Palantir Technologies: An Overview of What Looks Like a Muliti Front War

October 18, 2016

I read “Conservatives See Political Reprisal As Obama Administration Sues Peter Thiel’s Palantir.” Here in Harrod’s Creek “political reprisal” gets translated as blood feud. The source for the “reprisal” allegation is a real journalistic outfit, The Washington Times. The story appeared on October 16, 2016, when most of the movers and shakers in DC and other US power centers were gearing up to watch NFL football.

Let’s assume that the information in the write up is rock solid, built on verifiable “factoids”, and objective. This suspension of disbelief is helpful for me; otherwise, I would have some research to do. I prefer to let the article about political reprisal speak for itself.

The hook for the write up is the legal action taken by Palantir Technologies against the US Army. On June 30, 2016, Palantir filed legal documents to air the matter of the US Army’s reluctance to license the Palantir Gotham system instead of the Army’s DCGS or Distributed Common Ground System.

The write up points out that eight weeks after Palantir’s legal eagles dropped their payload on the US Court of Claims, the US Department of Labor pointed out that Palantir was discriminating against Asians. For Federal contractors, discrimination, if proven, is bad news. Loss of contracts and road blocks for future US government work are more than speed bumps for fast growing companies.

The article explains that Palantir perceives that it is not being given a fair shake; specifically:

The US Army “illegally prevented Palantir from bidding” when regulations required the armed service to seek already developed commercial products.

The write up draws a connection between a Palantir founder (Peter Thiel), who supports Donald Trump, and the alleged “political reprisal” by the Department of Labor.

The write up reports that Palantir’s legal eagles:

forced a number of Army intelligence czars to undergo sworn depositions by lawyers from the firm of Boies, Schiller & Flexner. While much of their testimony is under seal, some surprising snippets have emerged in follow-up legal motions asking the judge to rule based on the existing record of evidence.

The article asserts that a decision from the court may come as soon as the end of October 2016, which is pretty zippy based on my experience with US government processes.

The article then shifts to a discussion of the multi year, multi billion dollar DCGS system itself. Among the points in the write up I highlighted is this statement from the Washington Times’s write up:

Depositions also show that the Army misled lawmakers when it circulated a white paper on Palantir. The paper said the Army had conducted an extensive evaluation of Palantir when, in fact, it had not. “We did not do any formal evaluation or determination of whether or not the tools could live inside [the common ground system],” an Army official said.

I also noted this comment, which—if on the money—may make some of the big players in the DCGS contracting game nervous:

“This case has the potential to dramatically change not just DCGS as a program, for the better, but also the way the Army goes about contracting commercial solutions already in the marketplace,” said Joe Kasper, Mr. Hunter’s chief of staff. “From the beginning, utilizing Palantir has always been a win-win for the Army and the taxpayer. And if it takes a court decision to make the Army see it, then that’s just the way it is.”

The article then digs into the history of DCGS. The article reveals:

A confidential Army email reveals one reason Palantir never gained favor inside the halls of the Pentagon: Ms. Schnurr hated the system.

Okay, the article pinpoints Lynn Schnurr, once the US Army’s senior information officer, as the source of the burr under the saddle. Ms. Schnurr, the write up says:

appears to have an entrenched animosity towards Palantir, which has been spread and inculcated into the DA staff,” the [an unidentified US Army] officer wrote.

Ms Schnurr has an interesting background. She joined General Dynamics in February 2013. She left her job at the US Army in January 2013 after a 17 year career. She was a 1975 graduate of Virginia Polytechnic Institute (Blacksburg, Virginia) with a BS in education.

Several observations crossed my mind as I thought about this interesting example of “real” journalism:

  1. The sources for the write up remain a bit fuzzy. That’s not uncommon in some “real” journalism today. I find it annoying to read a reference to an email without a link to that source document.
  2. The write up laser dots Lynn Schnurr. I find it interesting that an individual is responsible for the behavior of procurement procedures. When I worked at Booz, Allen & Hamilton, it was unusual to find one person who could be identified as the “cause” of a particular event. The bureaucracy works in predictable ways because committees have to do the real work with assorted contractors lending a hand. I am confident that Ms. Schnurr is and was  a force with which to be reckoned, but when I bumped into one government project and was hired by a sitting president, I was told: “Not even the president can pay you. Fill out these forms first.”
  3. Other issues affecting Palantir are not far to seek. The Washington Times did not explore such issues as: [a] Possible resistance to Palantir after the legal dust up about Palantir’s alleged improper use of i2 Group Analyst’s Notebook intellectual property, [b] Palantir’s providing some US Army personnel with access to Gotham without going through the US Army’s often Byzantine procedures, and [c] the clash of the Silicon Valley culture with the Beltway Bandit culture, among others.

If you are following the Palantir US Army legal matter, you will want to read the Washington Times’s article. However, there may be more information germane to the subject than putting Ms. Schnurr in the spotlight. Why identify a person no longer working at the Pentagon as a full time employee as the primum mobile? That triggers me to look for other factors.

In the back of my mind, I continue to consider the consequences of the i2 Group (now owned by IBM, a company with DCGS aspirations). I recall the shock of Sergey Brin’s visit to Washington when he chose to wear sneakers and a T shirt as he called on officials before Google embraced traditional lobbying and revolving doors. I understand the so-called “arrogance” of the start up culture when it encounters individuals who are not as “clued in” to  the ins and outs of the Clue Train Railroad. I understand the connection between selling work and following government procedures and protocols.

I surmise that Palantir is facing down a bureaucracy which wants what it wants when it wants it. Outfits which light up the radar screens of numerous individuals in the bureaucracy find themselves burdened with tar balls at every turn. Palantir faces not a singleton issue like the legacy of Ms. Schnurr. Palantir finds itself dealing with the consequences of its actions since the company took CIA – In-Q-Tel funds and received the smiles of a powerful intel outfit.

I have not worked in Washington’s corridors of power for years, but I know that friction can exist between Executive Branch agencies and other US government units. Palantir may be caught of a multi front war here in the USA. Write ups like the one in the Washington Times may only provide a glimpse of a larger, more variegated scene and raise other questions; for example, fund raising, taxes, etc.

Stephen E Arnold, October 18, 2016

Demand for British Passports Surge on Dark Web Post Brexit

October 17, 2016

Freedom of Information Act request submitted by British general insurer Esure reveals that 270,000 British passports have been reported missing so far in 2016. A tiny percentage of these passports are for sale on Dark Web for a premium.

In an article by Jennifer Baker titled Dark Web awash with pricey British passports after UK vote for Brexitstates:

The value of a fake British passport has increased by six percent since the vote in favor of Brexit, and is predicted to rise further if rules on European Union freedom of movement change

Each passport is being sold for around $3,360 and upwards in Bitcoin or its equivalent. Restriction of movement across borders from the European Union to the United Kingdom is considered to be the primary reason for the surge in demand for British passports.

While the asking price for smaller EU nation passports remains tepid on Dark Web, experts are warning that instances of British passport thefts will increase by 20 percent next year.

The offline and online black market for British passports is estimated to be around $57 million a year. According to Ms Baker:

The most common hotspots for passport theft included bars and restaurants (14 percent), the beach (14 percent), busy streets (14 percent) and hotel rooms (13 percent). However, it isn’t just overseas as one in five (19 percent) of people reported a passport being stolen from their own homes.

A stolen passport can be used without any hassles till it is reported lost or stolen, and Brexit rules come into force. Even after being reported, the passport can still be used for identity theft and other online scams. Can there be a better way to curb this practice of identity theft, Brexit or not?

Vishal Ingole, October 17, 2016
Sponsored by ArnoldIT.com, publisher of the CyberOSINT monograph

Palantir Technologies: Pushing Back at Labor

October 15, 2016

Goodness gracious. Palantir Technologies is becoming a public outfit despite its penchant for secrecy. The company was featured in a Fortune Magazine write up called “Palantir Responds to Labor Department’s Discrimination Lawsuit.” Too bad Fortune’s online site did not include a link to the Palantirians’ response. The main point is that the US Department of Labor did not reflect reality. The main point of the Fortune write up struck me as this statement:

Palantir’s aim? To clear its name and move on.

Yeah. My hunch is that the “aim” is to continue to get US government contracts and not lose the work already underway. The notion that Palantir’s reputation is fueling the hassle with Labor is interesting. My view from rural Kentucky is that Palantir sued the US Army and the wheels of government often turn in eccentric ways. I am surprised that the IRS and SEC have not raised questions. In the current political climate, fooling around with government bureaucracy can be interesting.

Stephen E Arnold, October 15, 2016

Palantir Technologies to Square Off Against Skadden, Arps

October 14, 2016

Palantir Technologies asserted that an investor in Palantir of taking information from the Shire. Armed with the treasure trove of secret Hobbit lore, the investor in Palantir filed patents using the seeing stone-type information.

Sound like a Netflix or Amazon binge watcher?

My hunch is that the legal dust up between Palantir Technologies and Marc Abramowitz may be almost as much fun as the Google-Oracle dispute or an El Chapo extradition hearing.

Mr. Abramowitz has hired Skadden, Arps, which is shorthand for Skadden, Arps, Slate, Meagher & Flom or SASMF. Fascinating acronym to decode if one does not know the full name of the the outfit which has been named America’s best corporate law firm for more than a decade. The 2,000 lawyers are supported by more than 2500 others. This is better than most cruise ships’ passenger to staff ratios.

How will Skadden, Arps deal with the allegations of making patents out of Hobbit labor? According to “Palantir Investor Taps Skadden in Trade Secrets Feud,” Skadden, Arp legal maestro said:

“Though artfully pled as a series of putative state-law claims, the operative complaint seeks to have plaintiff Palantir Technologies Inc. declared the sole inventor of three separate technologies that were in fact invented and developed by Mr. Abramowitz as the sole or joint inventor. Palantir’s claims necessarily raise substantial questions of federal patent law that can be resolved only by a federal court.”

Palantir seeks remediation under California law. Skadden, Arps is going to pop up a level. The Palantir legal eagles at Perkins Coie may have to tap into the Palantir seeing stone to foretell what the trajectory of a federal level patent case will be.

I don’t have a seeing stone. I am not even a Hobbit. I don’t work in the Shire. I labor in rural Kentucky. I consulted the fellow at the gasoline station and asked, “What’s the likely outcome of the Palantir-Abramowitz legal matter?”

He replied without looking up from his brown paper sack stuffed with a greenish bottle, “Expensive.” Bingo.

Stephen E Arnold, October 14, 2016

Busted Black Marketplace Pops Back Up

October 5, 2016

In June, a vendor of access to hacked servers, xDedic, was taken down. Now, reports intelligence firm Digital Shadows, it has resurrected itself as a Tor domain. Why am I suddenly reminded of the mythical hydra? We learn of the resurgence from SecurityWeek’s article, “Hacked Server Marketplace Returns as a Tor Domain.” The article tells us:

After Kaspersky Lab researchers revealed in mid-June that they counted over 70,000 hacked servers made available for purchase on xDedic, some for as low as just $6, the marketplace operators closed the virtual shop on June 16. However, with roughly 30,000 users a month, the storefront was too popular to disappear for good, and intelligence firm Digital Shadows saw it re-emerge only a week later, but as a Tor domain now.

In an incident report shared with SecurityWeek, Digital Shadows reveals that a user named xDedic posted on 24 Jun 2016 a link to the new site on the criminal forum exploit[.]in. The user, who ‘had an established reputation on the forum and has been previously identified as associated with the site,’ posted the link on a Russian language forum thread titled ‘xDedic ???????’ (xDedic burned).

We’re told that, though the new site looks just like the old site, the user accounts did not tag along. The now-shuttered site was attracting about 30,000 users monthly, so it should not take long to re-build their client list. Researchers are not able to assess the sites traffic, since it is now a Tor domain, but both Digital Shadows and Kaspersky Lab, another security firm, are “monitoring the situation.” We can rest assured they will inform law enforcement when they have more information.

Cynthia Murrell, October 5, 2016
Sponsored by ArnoldIT.com, publisher of the CyberOSINT monograph

World-Check Database Leaked by Third Party

October 4, 2016

This is the problem with sensitive data—it likes to wander from its confines. Motherboard reports, “Terrorism Database Used by Governments and Banks Leaked Online.” Security researcher Chris Vickery reported stumbling upon a copy of the World-Check intelligence database from mid-2014 that was made available by a third party. The database maintained by Thomson Reuters for use by governments, intelligence agencies, banks, and law firms to guard against risks. Reporter Joseph Cox specifies:

Described by Thomson Reuters as a ‘global screening solution,’ the World-Check service, which relies on information from all over the world, is designed to give deep insight into financial crime and the people potentially behind it.

We monitor over 530 sanctions, including watch and regulatory law and enforcement lists, and hundreds of thousands of information sources, often identifying heightened-risk entities months or years before they are listed. In fact, in 2012 alone we identified more than 180 entities before they appeared on the US Treasury Office of Foreign Assets Control (OFAC) list based on reputable sources identifying relevant risks,’ the Thomson Reuters website reads.

A compilation of sensitive data like the World-Check database, though built on publicly available info, is subject to strict European privacy laws. As a result, it is (normally) only used by carefully vetted organizations. The article notes that much the U.S.’s No Fly List, World-Check has been known to flag the innocent on occasion.

Though Vickery remained mum on just how and where he found the data, he did characterize it as a third-party leak, not a hack. Thomson Reuters reports that the leak is now plugged, and they have secured a promise from that party to never leak the database again.

Cynthia Murrell, October 4, 2016
Sponsored by ArnoldIT.com, publisher of the CyberOSINT monograph

Europol Internet Referral Unit Criticized for Methods

October 3, 2016

In July of 2015 Europol launched their Internet Referral Unit (IRU), tasked with identifying extremist propaganda online and asking ISPs to take it down. Now that the group has been operating for a year, it is facing criticism about its methods, we learn from “Europol’s Online Censorship Unit is Haphazard and Unaccountable Says NGO” at ArsTechnica. The NGO referred to in the headline is the international digital rights organization AccessNow.

As of the IRU’s July birthday, the European Commission reports the IRU has examined about 8,000 posts over some 45 platforms and has made about 7,000 removal requests. As of May 2016, the group also has the power to hunt down terrorists; it has begun working with the UK National Counter Terrorism Internet Referral Unit to swiftly pursue those behind dangerous posts.

Not everyone is happy with IRU’s methods. Writer Jennifer Baker reports:

However AccessNow, a global digital rights organization, said Europe’s approach to dealing with online extremism is ‘haphazard, alarming, tone-deaf, and entirely counter-productive.

According to AccessNow, ‘the IRU is outside the rule of law on several grounds. First, illegal content is just that—illegal. If law enforcement encounters illegal activity, be it online or off, it is expected to proceed in dealing with that in a legal, rights-respecting manner.

Second, relegating dealing with this illegal content to a third private party, and leaving analysis and prosecution to their discretion, is both not just lazy—but extremely dangerous. Third, illegal content, if truly illegal, needs to be dealt with that way: with a court order and subsequent removal. The IRU’s blatant circumvention of the rule of law is in direct violation of international human rights standards.

For its part, Europol points to the IRU’s success at removing propaganda, including such worrisome content as bomb-making instructions and inflammatory speeches designed to spur specific acts of violence. Does this mean Europol believes the urgency of the situation calls for discarding the rule of law? Caution is warranted; we’ve been down this road before.

Cynthia Murrell, October 3, 2016
Sponsored by ArnoldIT.com, publisher of the CyberOSINT monograph

Palantir: On the Radar of the Dept of Labor. Yes, Labor

September 27, 2016

I received an email from a friend who works in Washington. He wanted me to read “Palantir Alleged to Have Discriminated against Asian Job Seekers.” I read the article. The main point is that the US Department of Labor

sued data miner Palantir for discriminating against Asian job applicants for software engineering positions, the government…

Palantir is a government contractor. Government contractors have to follow the “rules of the road” where government contracts are concerned. Discrimination, like excessive profits on government work, is not a plus when seeking government contracts.

What is interesting to me is the timeline. Palantir filed suit against the US Army in June 2016. Now nine weeks the Department of Labor is finding fault with the high profile Palantir.

I noted this statement in the article cited above:

If Palantir doesn’t end the practice, the OFCCP will request the cancellation of the company’s contracts, as well as bar it from getting federal contracts in the future.

I no longer work in Washington. Heck, I no longer work. I do recall my experiences, however. I wonder if Palantir may find itself on the radar of the IRS and the Securities & Exchange Commission? What happens if the Office of Personnel Management reviews certain clearances?

I know that many events occur in Washington circles which are just coincidences. Sheer chance. I assume it is possible that Event A could be a trigger for Event B. I do not know. I have to do more thinking.

I do know from my own experiences that lighting up the radar of certain government institutions with enforcement authority can add considerable friction to the normal course of business in Washington.

The author of the article heard radar pings, and I assume Palantir might be able to pick them up as well. Foe me, this ping from the Department of Labor’s radar is like the gentle strumming of acoustic guitar. Other US enforcement agencies’ pings make an amped up Metallica guitar seem subdued. Ah, the legal Pathétique.

Stephen E Arnold. September 27, 2016

Bam! Pow! Zap! Palantir Steps Up Fight with US Army

September 25, 2016

Many moons ago I worked at that fun loving outfit Booz, Allen & Hamilton. I recall one Master of the Universe telling me, “Keep the client happy.” Today an alternative approach has emerged. I term it “Fight with the client.” I assume the tactic works really well.


I read “Palantir Claims Army Misled to Keep It Out of DCGS-A Program.” As I understand the Mixed Martial Arts cage match, the US Army wants to build its own software system. Like many ideas emerging from Washington, DC, the system strikes me as complex and expensive. The program’s funding stretches back a decade. My hunch is that the software system will eventually knit together the digital information required by the US Army to complete its missions. Like many other US government programs, there are numerous vendors involved. Many of these are essentially focused on meeting the needs of the US government.

Palantir Technologies is a Sillycon Valley construct. The company poked its beak though a silicon shell in 2003 and opened for “real” business in 2004. That makes the company 12 years old. Like many disruptive unicorns, Palantir appears to be convinced that its Gotham system can do what the US Army wants done. The Shire and its Hobbits are girding for battle. What are the odds that a high technology company can mount its unicorns and charge into battle and win?

Image result for comic book pow zap

The Palantirians’ reasoning is, by Sillycon Valley standards, logical. Google, by way of comparison, believes that it can solve death and compete with AT&T in high speed fiber. Google may demonstrate that the Sillycon Valley way is more than selling ads, but for now, Google is not gaining traction in some of its endeavors. Palantir wants to activate its four wheel drive and power the US Army to digital nirvana.

The Defense News’s write up is a 1,200 word explanation of Palantir’s locker room planning. I noted this passage:

The Palo Alto-based company has argued the way the Army wrote its requirements in a request for proposals to industry would shut out Silicon Valley companies that provide commercially available products. The company contended that the Army’s plan to award just one contract to a lead systems integrator means commercially available solutions would have to be excluded.
Palantir is seeking to show the court that its data-management product — Palantir Gotham Platform — does exactly what DCGS-A is trying to do and comes at a much lower cost.

I like the idea of demonstrating the capabilities of Gotham to legal eagles. I know that lawyers are among the most technologically sophisticated professionals in the world. In addition, most lawyers are really skilled at technical problem solving and can work math puzzles while waiting for a Teavana Shaken Iced Tea.


The article also references “a chain of emails.” Yep, emails can be an interesting component of a cage match. With some Palantir proprietary information apparently surfacing in Buzzfeed, perhaps more emails will be forthcoming.

I have formulated three hypotheses about this tussle with the US Army:

  1. Palantir Technologies is not making progress with Gotham because of the downstream consequences of the i2 Analyst’s Notebook legal matter. The i2 product is owned by IBM, and IBM is a potentially important vendor to the US Army. IBM also has some chums in other big outfits working on the DCGS project. Palantir wants to be live in the big dogs’ kennel, but no go.
  2. Palantir’s revenue may need the DCGS contracts to make up for sales challenges in other market sectors. Warfighting and related security jobs can more predictable than selling a one off to a hospital chain in Tennessee.
  3. Palantir’s perception of Washington may be somewhat negative. Sillycon Valley companies “know” that their “solutions” are the “logical” ones. When Sillycon Valley logic confronts the reality of government contracting, sparks may become visible.

For me, I think the Booz, Allen & Hamilton truism may be on target. Does one keep a customer happy by fighting a public battle designed to prove the “logic” of the Sillycon Valley way?

I don’t think most of the DCGS contractors are lining up to mud wrestle the US Army. I would enjoy watching how legal eagles react to the Gotham wheel menu and learning how long it takes for a savvy lawyer to move discovery content into the Gotham system.

My seeing stone shows an messy five round battle and a lot of clean up and medical treatment after the fight.

Stephen E Arnold, September 25, 2016

Next Page »