Darktrace: He Said, She Said, and Probably They Said Too
January 20, 2022
The high flying cyber security sector suffered a headache when the SolarWinds’ misstep was disclosed. Since that time, the mass media have started paying attention to what a year or two ago was the content discussed at cyber security conferences and workshops. Now, everyone including most US government agencies, hundreds of start ups, and probably a grandmother or two in a Golden Years Long Term Care facility are talking about cyber security, ransomware, bad actors, the Dark Web, the Deep Web, bots, smart malware, and the equivalent of Crime as a Service or CaaS, the on demand resource for stealing financial data.
I read “Short Seller says Darktrace Targets Are a Pipe Dream”. The back and forth between the UK financial firm and the Darktrace cyber services firm is interesting.(Keep in mind that years ago I did some small project for Autonomy, but my experience was pretty good. Nevertheless, before some research-minded 20 something tweets about my consulting, you have been alerted.)
The write up hits three interesting points. I am not interested in Darktrace, however. I think these points apply to a large number of the companies closing deals, often for Palantir-scale invoices, for threat intelligence, cyber defenses, digital canaries, smart perimeters, yada yada.
What are those points?
- Projections are extremely optimistic. What cyber security firm thinks about running out of clients for six and seven figure license fees? Hint: Think of a number between minus one and one.
- Headcounts move around, change, and are disconnected from an old school GraybaR (circa 1869) organization chart
- Customers sign on and then bail out. Does this sound like a Theranos-type observation.
The write up states:
ShadowFall says Darktrace’s business is driven by “an aggressive, promotional, sales focus” and is unlikely to stand the test of time. British hedge fund ShadowFall has taken a short position against cybersecurity specialist Darktrace, calling its business “watery-thin”. The hedge fund is known in the City as the ‘dark destroyer’ for its practices of unpicking corporate reports and devaluing shares. While the fund paints its work as a public service, as a short seller its own business model relies on driving down the prices of companies it bets against.
What’s up here? I think Darktrace is like many cyber security vendors. Consequently, ShadowFall is probably getting the curling stone close to the scoring circle in the game of full body contact investment curling. However, the specific issues like the three I identified above are part of the Silicon Valley territory. I call this phenomenon of overstatement, misdirection, and management management magical misdirection part of the behavior I described a decade ago in my monograph “The Google Legacy.”
The cyber security sector is not doing a Tom Brady grade job protecting an organization’s data. Why? Breaches occur because careless or indifferent employees click on links which invite bad actors to come in and have a seat in the engineering meeting. Bad actors prowl message boards for an unhappy employee, pay that employee to insert a USB stick into a laptop, or exfiltrate log on credentials. Finally, giant companies don’t build software with security as Job One. Every day I learn about another flaw in either commercial software or open source libraries. Bad actors don’t have to worry too much. There are quite a few bright bad actors and an expanding pool of oligarchs responding to a business opportunity.
No cyber vendor can keep up. In fact, best of class outfits are selling to those outside of the cyber security National Honor Society and Phi Beta Kappa stratum. (Example: Recorded Future to a general service outfit.) There are too few top flight cyber security engineers to staff the companies building or needing these specialists. Yep, a people shortage exists.
The net net is that ShadowFall has diagnosed an industry wide problem. The write up, however, focuses on ShadowFall’s analysis of a single company. A more useful and fair analysis would take a good, hard look at other cyber security firms. A spectrum or league table of behaviors can be generated. Then a company in the cyber security business can be put into a performance context. I understand that in the UK Darktrace is news. That’s okay with me. There is a far more significant analysis job to do. Darktrace becomes a data point, and my experience suggests there are outfits which warrant a similar analysis and commercial enterprises for which there is more data available.
Where is this type of analysis? I have not seen one. The reason may be, “Who wants to kill the gold goose laying cyber threat eggs filled with money?”
Stephen E Arnold, January 20, 2022
NSO Group: How about That Debt?
December 14, 2021
The NSO Group continues to make headlines and chisel worry lines in the faces of the many companies in Israel which create specialized software and systems for law enforcement and intelligence professionals. You can read the somewhat unpleasant news in Bloomberg’s report, the Financial Times’ article, and Gizmodo’s Silicon Valley-esque write up. Gizmodo said:
the company’s cumbersome mixture of unpaid debts and growing international scrutiny have made NSO a bloated pariah and is forcing its leadership to consider shutting down its Pegasus spyware unit. Selling the entire company is also reportedly on the table.
First, the reports suggest, without much back up, that NSO Group has about a half a billion US in debt. This is important because it underscores what is the number one flaw in the jazzy business plans of companies making sense of data and providing specialized services to law enforcement, intelligence, and war fighting entities. Here’s my take:
Point 1. What was secret is now open and easily available information.
Since Snowden, the systems and methods informing NSO Group and dozens of similar firms are easy to grasp. Former intelligence professionals can blend what Snowden revealed with whatever these individuals picked up in their service to their country, create a “baby” or “similar” solution and market it. This means that there are more surveillance, penetration, intercept, and analysis options available than at any other time in my 50 year career in online information and systems. Toss in what’s in the wild from dumps of FinFisher and Hacking Team techniques and the gold mine of open source code, and it should be no surprise that the NSO Group’s problem is just the tip of an iceberg, a favorite metaphor in the world of surveillance. None of the newsy reports grasp the magnitude of the NSO Group problem.
Point 2. There’s a lot of “smart” money chasing a big pay day from software purpose built for law enforcement, intelligence, and military operations. VC cows in herds, however, are not that smart or full of wisdom.
There are many investors who buy the line “cyber crime and terrorism” drive big, lucrative sales of specialized software and systems. That’s partially correct. But what’s happened is that the flood of cash has generated a number of commercial enterprisers trying to covert those dollars into highly reliable, easy to use systems. The presentations at off the radar trade shows promise functionality that is almost science fiction. The situation today is that there is a lot of hyper marketing going on because there’s money to apply some very expensive computational methods to what used to be largely secret and manual work. A good case for the travails of selling and keeping customers is the Palantir Technologies’ journey which is more than a decade long and still underway. The marketing is seeping from conferences open only to government agencies and those with clearances to advertising trade shows. I think you can see the risk of moving from low profile or secret government solutions to services for Madison Avenue. I sure can.
Point 3. Too few customers to go around.
There are not enough government customers with deep pockets for the abundant specialized services and systems which are on offer. In this week’s DarkCyber at this link, you can learn about the vendors at conferences where surveillance and applied information collection and analysis explain their products and services. You can also learn that the Brennan Center has revealed documents obtained via FOIA about Voyager Labs, a company which is also engaged in the specialized software and services business. Our DarkCyber report makes clear that license fees are in six figures and include more special add ins than a deal from a flea market vendor selling at the Clignancourt flea market. Competition means prices are falling, and quite effective systems are available for as little as a few hundred dollars per month and sometimes even less. Plus, commercial enterprises are often nervous when the potential customer realizes the power of specialized software and services. Stalking made easy? Yep. Spying on competitors facilitated? Yep. Open source intelligence makes it possible to perform specialized work at a quite attractive price point: Free or a few hundred a month.
What’s next?
Financial wizards may be able to swizzle the NSO Group’s financial pickles into a sweet relish for a ball park frank. There will be other companies in this sector which will face comparable money challenges in the future. From my perspective, it is not possible to put the spilled oil back in the tanker and clean the gunk off the birds now coated in crude.
Policeware and intelware vendors have operated out of sight and out of mind in their bubble since i2 Ltd. in the late 19909s rolled out the Analysts Notebook solution and launched the market for specialized software. The NSO Group’s situation could be or has already shoved a hat pin in that big, fat balloon.
More significantly, formerly blind and indifferent news organizations, government agencies, and potential investors can see what issues specialized software and services pose. More reporting will be forthcoming, including books that purport to reveal how data aggregators are spying on hapless Instagram and TikTok users. Like most of the downstream consequences of the so called digital revolution, NSO Group’s troubles are the tip of an information iceberg drifting into equatorial waters.
Stephen E Arnold, December 14, 2021
Silicon Valley: Fraud or Fake Is an Incorrect Characterization
September 10, 2021
I read “Elizabeth Holmes: Has the Theranos Scandal Changed Silicon Valley?” The write up contains a passage I found interesting; to wit:
In Silicon Valley, hyping up your product – over-promising – isn’t unusual…
Marketing is more important than the technology sold by the cash hype artists. Notice that I don’t use the word “entrepreneur,” “innovator,” “programmer,” or the new moniker “AIOps” (that’s artificial intelligence operations).
The Theranos story went wrong because there was not a “good enough” method provided. The fact that Theranos could not cook up a marginally better way of testing blood is less interesting than the fact about the money. She had plenty of money, and her failure is what I call the transition from PowerPoint to “good enough.”
Why not pull a me-too and change the packaging? Why not license a method from Eastern Europe or Thailand and rebrand it? Why not white label a system known to work, offer a discount, and convince the almost clueless Walgreen’s-type operation that the Zirconia was dug out of a hole in a far-off country.
Each of these methods has been used to allow an exit strategy with honor and not a career-ending Tesla-like electric battery fire which burns for days.
The write up explains:
Particularly at an early stage, when a start-up is in its infancy, investors are often looking at people and ideas rather than substantive technology anyway. General wisdom holds that the technology will come with the right concept – and the right people to make it work. Ms Holmes was brilliant at selling that dream, exercising a very Silicon Valley practice: ‘fake it until you make it’. Her problem was she couldn’t make it work.
The transgression, in my opinion, was a failure to use a me-too model. That points to what I call a denial of reality.
Here are some examples of how a not-so-good solution has delivered to users a disappointing product or service yet flourished. How many of these have entered your personal ionosphere?
- Proprietary app stores which offer mobile software which is malware? The purpose of the proprietary app store is to prevent malfeasance, right?
- Operating systems which cannot provide security? My newsfeed is stuffed full of breaches, intrusions, phishing scams, and cloud vulnerabilities. How about that Microsoft Exchange and Azure security or the booming business of NSO Group-types of surveillance functionality?
- Self-driving vehicles anyone? Sorry, not for me.
- Smart software which is tuned to deliver irrelevant advertising despite a service’s access to browser history, user location, and email mail? If I see one more ad for Grammarly or Ke Chava when I watch a Thomas Gast French Foreign Legion video in German, I may have a stroke. (Smart software is great, isn’t it? Just like ad-supported Web search results!)
- Palantir-type systems are the business intelligence solutions for everyone with a question and deep pockets.
The article is interesting, but it sidesteps the principal reason why Theranos has become a touchstone for some people. The primum movens from my vantage point is:
There are no meaningful consequences: For the funders. For the educational institutions. For the “innovators.”
The people who get hurt are not part of the technology club. Maybe Ms. Holmes, the “face” of Theranos will go to jail, be slapped with a digital scarlet A, and end up begging in Berkeley?
I can’t predict the future, but I can visualize a Michael Milkin-type or Kevin Mitnick-type of phoenixing after walking out of jail.
Theranos is a consequence of the have and have not technology social construct. Technology is a tool. Ms. Holmes cut off her finger in woodworking class. That’s sort of embarrassing. Repurposing is so darned obvious and easy.
More adept pioneers have done the marketing thing and made a me-too approach to innovation work. But it does not matter. This year has been a good one for start ups. Get your digital currency. Embrace AIOps. Lease a self driving vehicle. Use TikTok. No problem.
Stephen E Arnold, September 10. 2021
Recorded Future: Poking Googzilla?
May 26, 2021
Google and In-Q-Tel were among the first to embrace the start up Recorded Future. Over the years, Recorded Future beavered away in specialist markets. There were some important successes; for example, helpful insights about the Paris Terrorist bombing. But Recorded Future was not a headline grabber. Predictive analytics is not the sort of thing that inflames the real journalists at many “real news” publications. The Googley part of Recorded Future faded over time, and it seems to me that most of the analysts forgot it was around in the first place. Then came the sale of Recorded Future to Insight Partners for about $800 million. From start up to exit in 12 years and another home run for the founders. Now the work begins. The company has to generate more revenue, which has been a challenge for similar companies.
Recorded Future does do search, but it does not do online advertising as a revenue generator. The company has a broad array of services, and it is finding that established competitors like IBM i2, Palantir Technologies, and Verint are also chasing available projects for specialized software. To add a twist to the story, start ups like Trendalyze (an outfit focused on real time analytics) and DataWalk (a better Palantir in my opinion) are snagging work in some rarified niches.
What’s the non Googley Recorded Future doing?
After reading “Thousands of Chrome Extensions Are Tampering with Security Headers,” I think the Insight owned outfit is poking a stick into the zoological park in which Googzilla hunts. My hunch is that Google continues taking off-the-radar actions to ensure that its revenues flow and glow. (No, that’s not on any Google T shirt I possess.) The new Recorded Future is revealing a Google method, and I think some in the Googleplex will not be happy.
The write up does not get into Google’s business strategy. But someone will read the Recorded Future post and do a bit of digging.
Several thoughts:
- Has Recorded Future broken an unwritten rule regarding the explanation of Google’s more interesting methods?
- Will the Google respond in a way that tweaks the nose of the Recorded Future team?
- Will Recorded Future escalate its revelations about the GOOG to get clicks, generate traffic, and possibly make sales?
I have no answers. I think the write up is interesting and probably long overdue. I think this is an important shift which has taken place with a new owner overseeing the once Googley predictive analytics company. Insight probably used the Recorded Future methods to predict the probabilities for upsides and downsides of this type of article. There are margins of error, however.
Stephen E Arnold, May 26, 2021
Specialized Technology: Why Processing Talk Can Be Helpful to Anyone
May 7, 2021
Some specialized services companies have provided cheat sheets for audio and video intercepts. I heard that this technology was under wraps and available only to those with certain privileges. Not any longer.
An outfit at Wordcab.com can perform what once was an intelligence function for anyone with Internet access, content, and a way to pay. Navigate to Wordcab.com and sign up. The company says:
Automagically summarize all your internal meetings. Wordcab creates detailed, natural-language summaries of all your meetings and sales calls. So you can focus on people, not paper.
Thumbtypers will thrill with the use of the word “automagically.” The service can ingest a Zoom recording and generate a summary. The outputs can be tweaked, but keep in mind, this is smart software, not Maxwell Perkins reincarnated as your blue pencil toting digital servant. There’s an API so the service can be connected to whizzy distributed services and, if you have a copy of Palantir Gotham-type software, you can do some creative analysis.
The idea is that the smart software can make an iPhone toting bro or bro-ette more efficient.
The key point is that once was a secret capability is now available to anyone with an Internet connection. And to those who don’t think there is useful information in TikTok-type services. Maybe think again?
Stephen E Arnold, May 7, 2021
Did You Know You Had a LexID? No. Worth Checking Maybe
April 22, 2021
With ICE’s contract with Thomson Reuters’ CLEAR expiring, The Intercept reports, “LexisNexis to Provide Giant Database of Personal Information to ICE.” Apparently the company could not resist the $16.8 million contract despite downplaying its ties to the agency in the past. Once focused on providing data to legal researchers and law firms, reduced sales compelled LexisNexis to branch into serving law enforcement. The firm will be supplying Homeland Security agents with billions of records that aggregate data from sources both public and private, like credit histories, bankruptcy records, license plate photos, and cell phone subscriber info. Naturally, these profiles also come with analytics tools. Reporter Sam Biddle writes:
“It’s hard to wrap one’s head around the enormity of the dossiers LexisNexis creates about citizens and undocumented persons alike. While you can at least attempt to use countermeasures against surveillance technologies like facial recognition or phone tracking, it’s exceedingly difficult to participate in modern society without generating computerized records of the sort that LexisNexis obtains and packages for resale. The company’s databases offer an oceanic computerized view of a person’s existence; by consolidating records of where you’ve lived, where you’ve worked, what you’ve purchased, your debts, run-ins with the law, family members, driving history, and thousands of other types of breadcrumbs, even people particularly diligent about their privacy can be identified and tracked through this sort of digital mosaic. LexisNexis has gone even further than merely aggregating all this data: The company claims it holds 283 million distinct individual dossiers of 99.99% accuracy tied to ‘LexIDs,’ unique identification codes that make pulling all the material collected about a person that much easier. For an undocumented immigrant in the United States, the hazard of such a database is clear.”
Biddle notes that both LexisNexis and Thomson Reuters are official data partners of Palantir, which insists it is not, itself, a data company. It is, however, a crucial partner to law enforcement agencies at all levels across the US, as well as the security departments at several corporations. The firm supplies its clients, including ICE, with huge datasets, analysis tools, and consultants to help organizations track anyone of interest. Despite these partnerships, both Thomson Reuters and LexisNexis have largely escaped the controversy that has surrounded Palantir.
Biddle has trouble reconciling LexisNexis’ new contract with its insistence it is actually on the side of detainees because it supplies them with access to an e-library of legal materials. For its part, the firm takes pains to note the contract complies with President Biden’s Executive Order 13993, which revised immigration enforcement policies and DHS interim guidelines. We are reminded, though, that despite the new occupant of the Oval Office, those running ICE remain the same. It is their hands into which this astounding trove of personal data is being delivered.
Cynthia Murrell, April 22, 2021
Amazon: Putting Eyes on Humans
February 17, 2021
Amazon may have a new driver at the controls of the Bezos bulldozer, but the big orange machine keeps pushing monitoring technology. “Amazon’s Driver Monitoring App Is an Invasive Nightmare” does not like the system the online bookstore uses to keep an eye on human delivery drivers. The write up states:
Mentor is made by eDriving, which describes the app on its website as a “smartphone-based solution that collects and analyzes driver behaviors most predictive of crash risk and helps remediate risky behavior by providing engaging, interactive micro-training modules delivered directly to the driver in the smartphone app.”
From my tumble down shack in rural Kentucky, the Bezos bulldozer seems to be using technology from an outfit called eDriving. There are several options available to the online bookstore. Amazon can continue to pay eDriving. Amazon can clone the system. Amazon can acquire the company, people, or technology.
Based on my on-going research into Amazon’s surveillance capabilities, the enhanced cameras, the online hook to the AWS mothership, and the use of third-parties to nudge monitoring forward is still in its early days. Amazon moves slowly and in a low profile way. Most law enforcement and intelligence organizations observe Amazon the way a tourist does a turtle in the Galapagos: Check out where the turtle is after breakfast and then note that the darned thing moved behind a rock a few fee away by noon. No big deal. Turtles move, right? Turtles are not gazelles, right?
Several observations:
- Amazon chugs along in a sprightly manner behind the curtain separating public use of a system like Mentor
- Amazon time makes it difficult for some observers to note significant change in a system or technology
- The trick to figuring out where Amazon is headed in surveillance systems is to step back and observe the suite of systems.
What does one learn?
How about Amazon as the plumbing for many of the widely used policeware and intelware systems? Who knew that Palantir Technologies is a good Amazon customer? Maybe not IBM which inked a deal with the chipper Denver based “ride ‘em cowboy” policeware firm.
How useful would Amazon’s monitoring technology be if connected to a Palantir content intake system? My guess is that it would be quite useful, and it would require the Amazon cloud to work. What’s that mean for cloud competitors like Google, IBM, and Microsoft?
Amazon’s policeware and intelware approach is a lock in dream. Where could a Mentor-type system be useful to investigators?
Sorry. I can’t think of a single use case. Ho ho ho.
Stephen E Arnold, February 17, 2021
IBM: Emphasizing the Big in Big Blue Quantum Computing
February 12, 2021
Did you know a small outfit in China is selling a person quantum computer. Discover Magazine reveals this in “A Desktop Quantum Computer for Just $5,000.” This means quantum computers will be crunching Excel spreadsheets for those with terminal spreadsheet fever.
But one must think big. I read “IBM Promises 100x Faster Quantum Computers through New Software Foundations.” The write up explains that Big Blue has gone big, quantumly speaking, of course:
IBM unveiled on Wednesday improvements to quantum computing software that it expects will increase performance of its complex machines by a factor of 100, a development that builds on Big Blue’s progress in making the advanced computing hardware. In a road map, the computing giant targeted the release of quantum computing applications over the next two years that will tackle challenges such as artificial intelligence and complex financial calculations. And it’s opening up lower level programming access that it expects will lead to a better foundation for those applications.
Imagine how much better Watson will perform with more quantum horsepower at its disposal.
But there’s more. The write up explains in a content marketing manner:
IBM is working on increasing the number of qubits in its quantum computers, from 27 in today’s “Falcon” to 1,121 in its “Condor” systems due in 2023. IBM expects in 2024 to investigate a key quantum computing technology called error correction that could make qubits much more stable and therefore capable, Jay Gambetta, IBM’s quantum computing vice president, said in a video.
And the source of this revelation? IBM, of course. The future is just two years away. Sounds good. Now how about revenue growth, explaining how the Palantir tie up will work, and when Watson will deliver on that promise of a billion in revenue from cognitive computing?
Stephen E Arnold, January 12, 2021
Open Source Software: The Community Model in 2021
January 25, 2021
I read “Why I Wouldn’t Invest in Open-Source Companies, Even Though I Ran One.” I became interested in open source search when I was assembling the first of three editions of Enterprise Search Report in the early 2000s. I debated whether to include Compass Search, the precursor to Shay Branon’s Elasticsearch reprise. Over the years, I have kept my eye on open source search and retrieval. I prepared a report for an the outfit IDC, which happily published sections of the document and offering my write ups for $3,000 on Amazon. Too bad IDC had no agreement with me, managers who made Daffy Duck look like a model for MBAs, and a keen desire to find a buyer. Ah, the book still resides on one of my back of drives, and it contains a run down of where open source was getting traction. I wrote the report in 2011 before getting the shaft-a-rama from a mid tier consulting firm. Great experience!
The report included a few nuggets which in 2011 not many experts in enterprise search recognized; for instance:
- Large companies were early and enthusiastic adopters of open source search; for example Lucene. Why? Reduce costs and get out of the crazy environment which put Fast Search & Transfer-type executives in prison for violating some rules and regulations. The phrase I heard in some of my interviews was, “We want to get out of the proprietary software handcuffs.” Plus big outfits had plenty of information technology resources to throw at balky open source software.
- Developers saw open source in general and contributing to open source information retrieval projects as a really super duper way to get hired. For example, IBM — an early enthusiast for a search system which mostly worked — used the committers as feedstock. The practice became popular among other outfits as well.
- Venture outfits stuffed with oh-so-technical MBAs realized that consulting services could be wrapped around free software. Sure, there were legal niceties in the open source licenses, but these were not a big deal when Silicon Valley super lawyers were just a text message away.
There were other findings as well, including the initiatives underway to embed open source search, content processing, and related functions into commercial products. Attivio (formed by former super star managers from Fast Search & Transfer), Lucid Works, IBM, and other bright lights adopted open source software to [a] reduce costs, [b] eliminate the R&D required to implement certain new features, and [c] develop expensive, proprietary components, training, and services.
Mobile and Social Media Users: Check Out the Utility of Metadata
January 15, 2021
Policeware vendors once commanded big, big bucks to match a person of interest to a location. Over the last decade prices have come down. Some useful products cost a fraction of the industrial strength, incredibly clumsy tools. If you are thinking about the hassle of manipulating data in IBM or Palantir products, you are in the murky field of prediction. I have not named the products which I think are the winners of this particular race.
Source: https://thepatr10t.github.io/yall-Qaeda/
The focus of this write up is the useful information derived from the deplatformed Parler social media outfit. An enterprising individual named Patri10tic performed the sort of trick which Geofeedia made semi famous. You can check the map placing specific Parler uses in particular locations based on their messages at this link. What’s the time frame? The unusual protest at the US Capitol.
The point of this short post is different. I want to highlight several points:
- Metadata can be more useful than the content of a particular message or voice call
- Metadata can be mapped through time creating a nifty path of an individual’s movements
- Metadata can be cross correlated with other data. (If you attended one of my Amazon policeware lectures, the cross correlation figures prominently.)
- Metadata can be analyzed in more than two dimensions.
To sum up, I want to remind journalists that this type of data detritus has enormous value. That is the reason third parties attempt to bundle data together and provide authorized users with access to them.
What’s this have to do with policeware? From my point of view, almost anyone can replicate what systems costing as much as seven figures a year or more from their laptop at an outdoor table near a coffee shop.
Policeware vendors want to charge a lot. The Parler analysis demonstrates that there are many uses for low or zero cost geo manipulations.
Stephen E Arnold, January 15, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
