Who's Defending U.S. Military Networks if the NSA and FIS are Breaking Them?

According to Der Spiegel, the NSA has been developing tools to compromise software, hardware, and firmware made by multinational corporations in the U.S. and overseas. U.S. companies affected include Juniper Networks, Cisco, Dell, Western Digital, Seagate, Maxtor plus many others. Unless the company has offered to work with the NSA to create backdoors in their own products, you have a situation where the agency with the primary responsibility of defending U.S. Department of Defense networks from digital attack is also engaged in weakening the very technology used by the DOD on those networks such as Jupiter Network firewalls, Cisco routers, Seagate hard drives, etc.

Perhaps this wouldn't be a problem if foreign intelligence services (FIS) didn't also have the technical capability of finding those same vulnerabilities or others. For example, Xidian University in Xi'an, Shaanxi, China is one of China's top engineering universities. It's State Key Laboratory of Integrated Services Networks conducts research for military-specific and dual use systems including cryptography, offensive network attacks, and systems to be used in confrontational environments.

Here's another example taken from our data base on adversary R&D research. The Chinese Academy of Sciences' State Key Lab of Information Security reports directly to the Ministry of Public Security, among other government agencies. In addition to their primary research area of information security, they develop network attack systems.

Russia has similar educational institutions which focus on information security and electronic warfare for the Ministry of Defense, the FSB, and other relevant agencies. One example is the Voronezh Military Radio-electronics Insititute which is part of the Voronezh Aviation Engineering School. Part of their information warfare research includes breaking the security of automated systems.

Since Dell, Cisco, Juniper, etc. build hardware, firmware, and software that's broadly used around the world and especially on U.S. government networks, it's only logical to conclude that those companies' products are being examined for exploitable vulnerabilities by Russian and Chinese scientists who are at least equal if not superior to those employed by the NSA. Let's remember that unlike the NSA, scientists at Russian and Chinese foreign research laboratories don't have to compete with their respective versions of a Silicon Valley for high paying tech jobs. They can attract and keep their nation's brightest scientists focused on these high priority government military and civilian projects.

Bottom line - if the NSA has found or developed backdoors in critical U.S. technology, so have our adversaries, and by "adversaries", I don't mean Mandiant's version of the bored PLA hacker with sloppy OPSEC. We need as an industry to have more respect for our opponents. And there needs to be a serious discussion about whether the NSA can really defend U.S. military networks while also engaged in exploiting weaknesses in the very technology that those networks rely upon.

UPDATE (JAN 02 2014): Bruce Schneier has begun posting one NSA exploit per day at his blog. The first one called DEITYBOUNCE exploits the motherboard on Dell PowerEdge servers.

Add to Cart View detail

Russian Venture Capital (RVC): A Report on Funding Priorities and RF Government Affiliations

Taia Global regularly produces custom reports on foreign research and development activities in Russia and China. Our most recent report examines Russian Venture Capital (RVC), an Open Joint Stock company (OAO RVC) with initial funding from the Investment Fund of Russia through the Federal Agency for STate Property Management (Rosimuschestvo). It's charter allows RVC to invest both domestically and overseas. RVC's Board of Directors limited investments by RVC to companies with products on the Russian government's critical technologies list.

This report is 17 pages long with graphics and two appendices, including the above-mentioned critical technologies list. We examined the background of RVC's executives as well as the firm's investments and its U.S. affiliations.

We are offering this report for a limited time to non-subscribers for $225. Interested parties may order via this link or by calling (855) 877-8242.

Add to Cart View detail

Russia's Federal Security Service (FSB) Hacks Facebook Servers

On June 18th, the Moscow trial of ChronoPay owner Paul Wroblewski revealed that the Federal Security Service of Russia (FSB Russia) hacked into Facebookservers to collect information used in Wroblewski’s trial.  Wroblewski is currently on trial for conducting Distributed Denial of Service (DDoS) attacks on the servers of a rival online payment system in 2010.  The backstory of the trial is rife with the usual Russian allegations of corruption and security service malfeasance.  Indeed, on June 18th Wroblewski’s lawyer Pavel Zaitsev protested the inclusion of correspondence that the FSB obtained by hacking Wroblewski’s Facebook account.  According to a letter presented to the court, the FSB first requested the information through official channels.  The FSB then hacked into the Facebook account as part of“Operational Search Measures” when the request was denied.  The court acknowledged that the FSB bypassed international conventions and treaties, however, the information was allowed as evidence.

The FSB Information Security Center—also known as Military Unit (Vch) 64829—conducted the Facebook intrusion.  The Information Security Center is located in the FSB Counterintelligence Directorate—the 2nd Directorate—and monitors the Russian Internet.  Taia Global analysis, however, long assessed the Information Security Center capable of offensive operations.  Indeed, President Putin’s Edict No. 31 of 15 February 2013 tasked the FSB with establishing a nationwide system for protecting Russia’s critical information infrastructure.  The mission included handling the exchange of information with foreign governments and authorities.  Russian press speculates that the FSB Information Security Center—and other FSB components such as Scientific Research Center No. 3—will form the basis for the new structure. 

Sources: http://lenta.ru/news/2013/06/19/fsb/; http://cyberwarzone.com/fsb-illegally-obtained-conversation-facebook-between-vrublevsky-and-kurochkina

Add to Cart View detail

Russian Security Services lab tied to U.S. industrial espionage case in Texas

Taia Global publishes a subscription-only monthly report for our customers which is normally not available to the public. However in this case I thought that the content merited wide-spread release so an edited version of our report which identifies the name of the FSB lab that was part of a Russian industrial espionage ring operating out of a front company in Texas can be read at SOFREP.com.

Add to Cart View detail

Has a Foreign Intelligence Service Been Targeting Russian Embassies?

Yesterday I posed the theory that the Russian Business Network (RBN) was behind the Red October attacks however in the interest of alternative analysis, I'd like to propose a different theory that also fits the facts contained in Kaspersky's report; that a Foreign Intelligence Service has been targeting Russian and CIS embassies.

Kaspersky's FAQ on ROCRA says that it was brought to their attention by a "partner" who prefers to remain anonymous. Considering that the primary target of ROCRA were Russian embassies and government agencies, that un-named partner was most likely the FSB. After all, Kaspersky Labs does significant business with the Russian government according to Noah Shachtman's Wired profile on Eugene Kaspersky:

One of GREAT’s frequent partners in fighting cybercrime, however, is the FSB. Kaspersky staffers serve as an outsourced, unofficial geek squad to Russia’s security service. They’ve trained FSB agents in digital forensic techniques, and they’re sometimes asked to assist on important cases.

The Red October report listed many embassies in multiple countries as victims but didn't identify whether those were Russian embassies or those of other nation states. Since the malware was looking for Cyrillic characters in documents, it makes sense to assume that the target was Russia's embassies in foreign countries. It would be nice if GREAT would confirm or deny whether that was the case.

Many of ROCRA's command and control servers were registered with Russian registrars. However, Russian law and regulations require the registrant to provide accurate contact information and to confirm that information with an authoritative document (something that we in the U.S. should also require, but don't).  Normally this would be a Russian citizen’s internal passport. So the perpetrator was either using compromised documents (Russian passport numbers and tax IDs have been posted on Runet) to obtain domain names or the websites themselves were compromised bots.

As far as which FIS might be responsible, there's no way to say but there's certainly no lack of suspects. The use of Acid Cryptofiler suggests that it might be a NATO or EU member country. 

Add to Cart View detail

An Inconvenient Truth: LadyPHP "Cleans" Eugene Kaspersky's Wikipedia Page

Wired's Noah Shachtman wrote a thorough, fact-checked, balanced article about Eugene Kaspersky and his company Kaspersky Labs which properly identified Kaspersky's relationships (business and personal) with the Russian government. I know this because (a) I provided some background research on Kaspersky Labs' Russian activities to Noah and (b) I was contacted by Wired's fact checkers before the article was published. In fact, so was Kaspersky Labs.

Noah's article came out on July 23. Kaspersky posted his criticism of the article on July 25. At some point, the Wired article was added to Eugene Kaspersky's Wikipedia page. On August 3 and August 7, someone with the newly created alias of "LadyPHP" removed all mention of the article as an "un-neutral and un-proven link"- but it's neither. I agree that biographies of living persons should be as accurate and unbiased as possible and Eugene Kaspersky deserves credit for creating a prosperous and successful business in the Russian Federation. However part and parcel of that includes owning the facts about his business relationships with the Russian government. Whoever deleted that reference is only making it appear like Eugene Kaspersky has something to hide.

Add to Cart View detail

2012 Russian Federation Information Security Reference

This book is an updated version of the 2011 Russian Federation Information Security Reference. It consists of original research conducted by Taia Global’s intelligence analysts who’ve recently retired from the U.S. intelligence community. The information was acquired through open sources on the Russian Internet (Runet) over a period of 8 months. Analysis was conducted by Taia Global’s veteran intelligence analysts who’ve recently retired from the U.S. intelligence community. This book is the culmination of many hundreds of hours of work. It contains findings that will be of use to corporate executives and their boards, law enforcement, intelligence agencies, and the military. It is unique in the marketplace and has been priced accordingly.
This book contains indepth reports on the following key agencies and one private company:

• The Russia Federal Security Service (FSB) Center for Electronic Surveillance of Communications (TSRRSS) is responsible for the interception, decryption, and processing of electronic communications.  The Center—also known as the 16th Center (Directorate) FSB and Military Unit (Vch) 71330—is directly subordinate to the FSB Director.
• Federal State Unitary Enterprises(FGUP) supervised by the Federal Security Service (FSB).  The list included the Orion Research and Development Center located in Moscow. Orion provides a range of information technology services including research, development, testing, consulting and certification of software and hardware.
• FGUP STC Atlas is responsible for developing and certifying information technology (IT) security and cryptographic systems for the Russian government.
• FGUP Center-Inform is the leading Russian state owned systems integration company for information technology (IT) and information security.
• The Russian firm OOO Speech Technology Company (STC) provides surveillance and monitoring equipment.
• Kaspersky Labs is licensed to provide classified work for the FSB and Defense Ministry.

To Order: US$159.00

Add to Cart View detail

BREACH ALERT: Putin Makes Unmanned Aerial Systems Development a National Priority

“Intelligence ... aims at supporting the process of modernization of our country and

creating the optimal conditions for the development of its science and technology.”

- Mikhail Fradkov, Director, SVR, December 2010

Source: Moscow Times

One of the easiest ways to determine what data is at risk is to know what the strategic imperatives are of  those countries who engage in "technology transfer" and industrial espionage. Russian president Vladimir Putin has made it clear that he's a supporter of espionage as a tool to be used in Russian technology development. A recent article in RIA Novosti discussed Putin's call for long range bombers and Unmanned Aerial Systems. Russia plans to spend US$13B on UAS development over the next eight years. Part of that technology development strategy is almost certainly going to be acquiring intellectual property on related technology from foreign firms.

Two good examples of companies at risk are Boeing and General Atomics. Boeing, which has a defense, space and security division alongside its civil aircraft division, has 170,000 employees in over 70 countries, including Russia. General Atomics, who makes the Predator drone, has an affiliate office in Moscow. In fact, GA was recently praised by Russian military analyst Konstantin Makiyenko.


Any foreign business operating inside of Russia which holds technology vital to Russia's national security interest will be contacted by the Russian Security Service (FSB). Under article 15 of the FSB law, those companies are obliged to provide assistance to the Federal Security Service in carrying out their assigned duties which could include a wide range of possibilities including the examination of source code. All communications emanating from those companies including landline, VOiP, mobile, and satellite will certainly be harvested electronically and entirely legally by the FSB.


While I'm using Russia and these two U.S. companies who do business there as examples, this same problem exists in many other nations which have active industrial espionage operations. It is a major part of a company's threat landscape and one that is frequently being ignored because (a) it doesn't involve a spear phishing email or a piece of malware and therefore doesn't fit the business model of most cyber security companies and (b) defending against it requires a specialized skill set.

Add to Cart View detail

Flame, Russia and the ITU: A Geopolitical Agenda?

Both the ITU and the Russian government have been united in their interest to secure a global cyber warfare treaty since at least 2010. In recent weeks, Evgeniy (Eugene) Kaspersky has been increasing his rhetoric regarding a future cyber catastrophe and most recently his company was chosen by the ITU to investigate the Flame attack. That attack prompted today's press release by the ITU calling for "greater international collaboration" on cyber security matters at their upcoming conference in Dubai; a conference sponsored by Kaspersky Labs and where CEO Kaspersky will deliver the keynote:

Cybersecurity will be a major agenda theme at ITU Telecom World 2012 (Dubai, 14-18 October 2012), supported by key partners, one of whom is Kaspersky Lab. This agenda will explore issues such as mitigating risks posed by major coordinated cyber-attacks at the national level, the threats posed by malware such as Flame, and strengthening international cooperation. Kaspersky Lab CEO Eugene Kaspersky will deliver a Visionary Keynote speech at the event, outlining the magnitude and global nature of cyberthreats today.

 The Russian government has long been an advocate of an Information Warfare treaty limiting the use of cyber weapons and other acts of IW because it serves the interests of the Russian government (which has other means of conducting IW) while restricting cyber weapons development in the West. An excellent overview of the ramifications of such a treaty is Tom Gjelton's "Shadow Wars: Debating Cyber Disarmament".

Evgeniy Kaspersky, Kaspersky Labs, and the Russian Security Service

In November 2009, the Duma Committee on Security met on “the legislative, organizational and technical security aspects of the national info-communications infrastructure.”  The meeting included the Experts Council and several additional experts.  The invited experts were primarily senior government officials—including two from the FSB--with two from industry.  One was the President of MFI-Soft—the company that provides internet intercept systems to the FSB ISC—and the other was Evgeniy Kaspersky, Director of JSC Kaspersky Labs.

The President of MFI-Soft Alexander Ivanov is a former senior military communications officer.  MFI-Soft’s bread and butter are lawful intercept systems including SORM-1, SORM-2, and SORM-3.  MFI-Soft holds numerous licenses from the FSB and FSTEC for work on state secret information and encryption systems.  JSC Kaspersky Labs does as well.  While the Duma Security Committee did not post the meetings minutes, both companies are now involved in pushing Russian standards for the Commonwealth of Independent States (CIS).

Kaspersky Labs holds numerous security clearances authorizing work on projects involving state secret information (current list is posted at http://www.kaspersky.ru/license). The FSB only licenses two antivirus companies for work with state secret information; JSC Kaspersky Labs and Dr. Web. The licensing requirements effectively give JSC Kaspersky Labs and Dr. Web a monopoly on the Russian market since the IT market is dominated by the Russian Government and large industry closely aligned with the government.  Indeed, in 2009, the Russian Federal Antimonopoly Service (FAS) initiated proceedings against Kaspersky for possible violations of Russian antitrust laws, but no action appears to have been taken. Russian government tenders posted at zakpuki.gov.ru frequently specify JSC Kaspersky Labs products as required based on their FSB/FSTEC licenses.  The licenses are almost certainly critical to Kaspersky’s future.  According to Interfax, Kaspersky sales totaled $538 million in 2010 (last year for full data).  However, the revenue breakdown was stated in such a way that it is impossible to identify specific sources.

Summary

Kaspersky's elevation of Flame to a status that it doesn't deserve (a "highly sophisticated cyber weapon") takes on a new meaning when you examine the close relationship between Kaspersky Labs and the Russian government along with their relationship with the ITU and their parallel interests in promoting international cyber security agreements and cyber warfare treaties. Is Flame a means to a geopolitical end that favors those players interests? I think it is.

RELATED:
"Kaspersky's Problematic Flame Analysis"

Add to Cart View detail

Intelligence on Russian Information Warfare Activities

Threat Intelligence and Cyber Intelligence are phrases that are tossed around both frequently and casually these days. Threat intelligence as it's used by the information security community has to do with malware and malicious IPs. Cyber intelligence is used even more loosely and may cover everything from Threat Intelligence to discovering who the members of Anonymous are. My company Taia Global Inc. has been providing highly targeted open source intelligence reports on foreign corporations' government connections as well as the information warfare activities of individual nation states since 2009. Since most of our foreign government clients are interested in the IW activities of the Russian Federation, we focus a lot of attention there. Here is what we've produced in the last few months alone:

• Center for Computer Emergency Response of the Russian Federation (RU-CERT)
• Roskomnadzor and the Cyber Vigilantes
• Russian Federal Security Service Center for Electronic Surveillance of Communications - Military Unit (Vch) 71330
• Russian Federation Security Council and the Evolution of Russia’s Information Security Doctrine
• Federal State Unitary Enterprise Scientific Research Institute Kvant (Federal Security Service)
• Federal Security Service (FSB) Internet Monitoring Vendors
• Federal Security Service (FSB) Administrative Centers for Information Security

Apart from these specialized reports, we also produced the 2011 Russian Federation Information Security Reference.

If Russia is an important piece of your organization's business or security plans and you'd like more information about our intelligence services for the Russian Federation or other countries in Asia, the EU or elsewhere, you can contact us via the Taia Global website.

Add to Cart View detail

Google's Finland Data Center Was A Security-Savvy Move

One of the biggest security issues with cloud computing is the location of data centers in high risk countries like Russia, China, India, Brazil, etc. If the country has laws which allow their security services to demand access to the foreign-owned data center, you've got a problem. If the country's own ICT infrastructure is "pwned", you've got a problem. Unlike other large cloud providers, Google made a smart move by building its data center in Finland, just a few hours away from the Russian Federation. My company regularly provides due diligence research on foreign supply chains and state security issues and here's a brief summary of our analysis on Google Russia.

Summary
OOO Google (Общество с ограниченной ответственностью Гугл) is Google’s Russian subsidiary.  Google’s activity is Russia is consistent with a desire to expand the Russian market and exploit Russia’s reservoir of IT professionals while minimizing Google’s vulnerability to the Russian government.  OOO Google employees listed on Russian social networking sites are usually graduates of Russia’s elite universities.  Google’s largest capital investment pertinent to the Russian market, however, is an approximately $500 million datacenter in Finland.  The datacenter enjoys excellent communication links with Russia enabling Google to service and support expanding Russian activity without giving the Russian government leverage over Google.  In sum, Google is approaching the Russian market with its eyes open.

OOO Google

According to Google.ru, all sales and engineering activity are conducted from the Moscow and St. Petersburg offices.  However, press and Google.com cover the opening of a major new datacenter in Finland (appendix for articles) in 2011.  The capital cost of the land and building are listed as $260 million before the installation of servers.  Similar Google datacenters are listed as approximately $500 million when complete.  Google uses an innovative design with servers located in standardized containers enabling rapid construction and easy expansion by adding additional containers.  Google servers run on Linux.  Russia is particularly strong in Linux developers since it is the Russian government’s preferred operating system.

The new datacenter enjoys excellent communications with Russia.  However, Russian press frequently contains accusations of Google colluding with foreign intelligence services against Russia.  As a result, Google is probably wise to locate the new facility outside Russia to prevent the Russian government using the facility as a hostage.

Google Vulnerabilities in Russia
Google’s primary vulnerability at this point is probably penetration by Russian intelligence services through a recruited asset.  Placing the new datacenter is Finland shows Google is sensitive to the baggage that comes with making a significant capital investment in Russia.  However, Russian press shows Russia’s intelligence services view Google as a threat.  As a result, penetrating Google’s Russia activities would be a priority.  Indeed, the Google circle on moikrug.ru shows five employees with previous experience at Luxoft, a Russian software firm with excellent Federal Security Service connections.

Add to Cart View detail

Russian Federation Sets New Science Priorities As 5 US Labs Are Breached

image of accelerator at Large Hadron Collidor

2011 may be the worst year on record for cybersecurity breaches at U.S. national labs and related facilities: 5 breaches in 6 months:
April 11:
- Oak Ridge National Laboratory (managed by Battelle)
- Method of attack - spear phishing w/ 0day payload
June 11:
- Y-12 National Security Complex (managed by BWX, a member of the Battelle Energy Alliance)
- Method of attack: SQL injection
July 1:
- Battelle Memorial Institute
- Pacific Northwest National Laboratory (managed by Battelle)
- Thomas Jefferson National Accelerator Facility (managed by CSC via Jefferson Science Associates)
- Method of attack: un-specified but spokespersons referred to it as "sophisticated" and all three labs stopped email and internet services for several days.


In the meantime, today President Medvedev signed into law a decree establishing the priority areas and critical technologies of the Russian Federation:

Priority Areas:

1. Security and counter-terrorism
2. Nanotechnology
3. Information and Telecommunication Systems
4. Life Sciences
5. Advanced Weapons
6. Biotechnology
7. Transportation and Space Systems
8. Clean energy technology including nuclear power

List of Critical Technologies:

1. Basic and critical military and industrial technology for the development of advanced weapons, military and special equipment
2. Basic technologies of power electronics
3. Biocatalytic, biosynthetic and biosensor technology
4. Biomedical and veterinary technology
5. Genomic, proteomic and post-genome technologies
6. Cell technologies
7. Computer modeling of nanomaterials, nanodevices and nanotechnology
8. Nano-, bio-, information and cognitive technologies
9. Technology of nuclear energy, nuclear fuel cycle, safety of radioactive waste and spent nuclear fuel
10. Technology Bioengineering
11. Diagnostic technologies of nanomaterials and nanodevices
12. Access technology to broadband multimedia services
13. Information technology, control and navigation systems
14. Technology nanodevices and microsystems engineering
15. Technology of new and renewable sources of energy, including hydrogen energy
16. Technology acquisition and processing of structural nanomaterials
17. Technology acquisition and processing of functional nanomaterials
18. Technology and software and distributed high performance computing systems
19. Technologies for monitoring and forecasting of the environment, prevent and eliminate pollution
20. Search technology, exploration and development, mining
21. Technology in disaster situations - natural and manmade
22. Technologies to reduce losses caused by social diseases
23. Technology creating high-speed vehicles and intelligent control systems with new modes of transport
24. Technology of creation of space-rocket and transport equipment of new generation
25. Imaging technology electronic components and energy-efficient lighting devices
26. Technologies create energy efficient transportation, distribution and use of energy
27. Energy efficiency of production and conversion of energy to fossil fuels

The draft decree was sent out for approval to the State bodies on 20 May, 2011. It was signed into law on 07 July 2011. The above language is a machine translation from Russian to English.

My objective for this post is not to accuse the Russian government of being responsible for one or more of the breaches at the 5 national labs listed above, however when attribution is considered, the RF must be included in the group of state suspects. They provide extensive training to their security services in Information Security TTPs. They have a long history of conducting industrial espionage. And they have a critical need for some of the research that's being conducted at the targeted labs. That's not enough to "convict" anyone, but its certainly enough to make the Russian Federation and its Eastern European hacker crews "persons of interest".

Related Posts:
Three U.S. National Labs Attacked On July 1
The 2011 Russian Federation Information Security Reference

Add to Cart View detail

Announcing the 2011 Russian Federation InfoSec Reference Book

THE 2011 RUSSIAN FEDERATION INFORMATION SECURITY REFERENCE

This book is a collection of special reports prepared by my company on the information security framework, training, techniques, and procedures of the Russian Federation Federal Security Service (FSB), as well as key labs and elite universities. We also provide coverage on key provisions of the FSB law and how it may be interpreted. The information was acquired through open sources on the Russian Internet (Runet) over a period of 12 months. Analysis was conducted by Taia Global’s veteran intelligence analysts who’ve recently retired from the U.S. intelligence community. This book is the culmination of many hundreds of hours of work. It contains findings that will be of use to corporate executives and their boards, law enforcement, intelligence agencies, and the military. It is unique in the marketplace and has been priced accordingly.


TABLE OF CONTENTS:

1. RUSSIAN INFORMATION SECURITY STANDARDS AND SPECIALTIES 
2. VORONEZH HACKING SCHOOL
3. RUSSIAN INTERIOR MINISTRY CYBER CRIMES DIRECTORATE (DEPT K)
4. RUSSIA STATE HUMANITIES UNIVERSITY (FACULTY OF INFORMATION SECURITY)
5. MOSCOW STATE INSTITUTE OF ELECTRONICS AND MATHEMATICS (MIEM) (DEPT OF APPLIED MATHEMATICS) 
6. MOSCOW ENGINEERING PHYSICS INSTITUTE (FACULTY OF INFORMATION SECURITY)
7. MOSCOW STATE INSTITUTE OF RADIO ENGINEERING, ELECTRONICS, AND AUTOMATION (MIREA) (FACULTY OF INFORMATION TECHNOLOGY - FACULTY OF CYBERNETICS)
8. MOSCOW STATE TECHNICAL UNIVERSITY (BAUMAN) (SCHOOL OF INFORMATICS AND CONTROL SYSTEMS)
9. THE ACADEMY OF THE FEDERAL SECURITY SERVICE RUSSIA (FSB) (INSTITUTE OF CRYPTOLOGY, TELECOMMUNICATIONS AND INFORMATICS - IKSI)
10. FEDERAL SECURITY SERVICE (FSB) ADMINISTRATIVE CENTERS FOR INFORMATION SECURITY
11. FEDERAL SECURITY SERVICE INFORMATION SECURITY CENTER (FSB RF / VCH 64829 )
12. FEDERAL SECURITY SERVICE CENTER FOR ELECTRONIC SURVEILLANCE OF COMMUNICATIONS (16TH CENTER FSB / VCH 71330)
13. FEDERAL LAW: ON THE FEDERAL SECURITY SERVICE (FSB)

This reference book is 76 pages long with written analysis accompanied by maps, table data, and screen shots of supporting documentation. When ordering, remember to include your email address in the space provided for a message to the seller. A personalized copy of the book in .pdf format will be sent to the address provided within a few minutes of receipt of your order. Feel free to contact me with any questions or for quantity pricing.

To Order:

US$149.00

(Be sure to provide your email address for delivery of your .pdf book)

Add to Cart View detail

7 Reasons Why China Isn't The World's Biggest Cyber Threat (And Who Is)

When it comes to threats in cyberspace, conventional wisdom and expert commentary assign the number one slot to the country with the most failed operations. A failed operation is defined within the intelligence agencies of most countries as a compromised operation; i.e., one whose existence was discovered. It's important to note that the attribution of any specific country to any specific attack is an untrustworthy mix of art and science based upon IP address, who was victimized, technical evidence in the code, and what "feels right" to the person or team investigating. Based upon this formula, China has been ceded the top position as the number 1 cyber threat in the world.


Instead, I propose that you put aside the marketing hype, the questionable attribution methods, and the upside-down formula of # of failed ops = greatest threat and re-evaluate the cyber threat landscape through a more rational lens. To that end and in the hopes of stimulating some informed discussion on the topic, here are 7 reasons why the Russian Federation should replace the Peoples Republic of China as the world's most dangerous cyber adversary.

1. Russia is the only nation that has engaged in a military action with a cyber warfare component: The Russia-Georgia War of August, 2008.
2. Russia is the only nation that has engaged in a cyber attack which crippled components of an entire nation's critical infrastructure sporadically over a three week period: The Estonia Cyber Attacks 2007
3. Russia's Prime Minister formerly ran industrial espionage operations for the KGB and still considers such operations an asset to the country.
4. Russia has built a parallel military and civilian information warfare infrastructure that it actively uses against internal and external adversaries. For example, the Federal Security Service's 16th Directorate which is responsible for the interception, decryption, and processing of communications has been recently been identified as Military unit (VCH) 71330.
5. The Russian government funds organizations like the Nashi which engage in cyber attacks and other malicious acts.
6. Individuals closely aligned with the Russian government are prominent venture capitalists who invest in the world's largest social network companies and in U.S. technology startups as a self-funding open source intelligence operation.
7. Unlike China, Russian cyber operations are rarely discovered, which is the true measure of a successful op.

-------------
For full disclosure, my company provides this type of research to corporate clients so that they can better gauge their risk among the world's threat actors.

Add to Cart View detail

The Yandex IPO: Economic and Political Risks

On April 28, 2011 Yandex N.V.—a Netherlands based company—filed a Form F-1 with the United States Security and Exchange Commission (SEC) in preparation for an initial public offering (IPO) for Yandex, the dominant Russian web portal.  According to the Form F-1, the IPO could be worth approximately one billion dollars.  The Yandex IPO is the second significant IPO for Russian internet companies following last year’s offering from Mail.Ru Group that raised approximately one billion dollars on the London Exchange.

The successful Mail.RU IPO shows investor’s confidence in the Russian internet’s future prospects despite the somewhat problematic Russian business environment.  For example, in Transparency International’s most recent 2010 report, Russia received a score of 2.1.  The 2.1 score ties Russia with Cambodia, Central African Republic, and Laos among others.  Russia just nosed out the Democratic Republic of the Congo while losing nicely to Egypt’s 3.1 score where the population recently rose in rebellion with government corruption a major issue.  By contrast, most European countries score from eight to nine.  The US, even with the corporate problems revealed by the ongoing economic crisis, managed a 7.1.

As a result, potential Russian internet investors might profit from a close examination of the risks associated with investing in Russia.  The political and economic risks imposed by Yandex’s interaction with the Russian government warrant close scrutiny.


Economic Risks

The SEC Form F-1 includes Yandex analysis on the potential impact of Russian Government regulation.  The impact of the Strategic Companies Law—that covers investment in firms deemed critical to national defense and state security--is particularly important.  The section in the Form F-1 states:

In accordance with the Federal Law "On the Procedure for Foreign Investments in Companies which are Strategically Important for the State Defense and National Security" adopted in May 2008 (the "Strategic Companies Law"), there are restrictions on the foreign ownership of companies involved in certain strategically important activities. Although the internet is not an industry specifically covered by the Strategic Companies Law, companies that hold licenses to use encryption technologies are covered by this law. Our Yandex.Money subsidiary recently received encryption licenses and therefore this subsidiary is now covered by the Strategic Companies Law. As a result, our parent company, Yandex N.V., is likely covered by the Strategic Companies Law.

Under the provisions of the Strategic Companies Law, the direct or indirect acquisition of more than 25% of the voting power of a strategically important company by a foreign state, foreign governmental organization, international organization or entity controlled by a foreign government or international organization, or the acquisition of shares representing more than 50% of the voting power of such a company by any other foreign investor or any of its affiliated companies requires the prior approval of a Russian government committee chaired by the Prime Minister. In addition, foreign investors or their group companies that are controlled by a foreign state or a foreign government or international organization are prohibited from owning shares representing more than 50% by voting power of a strategically important company. Moreover, the acquisition of 5% or more of the shares of a strategically important company triggers a notification requirement to the FAS. Failure to obtain the required governmental approval prior to an acquisition would render the acquisition null and void.

Article Six of the Strategic Companies Law lists the industries covered.  Number 14 specifically states that any entity performing data encryption services falls under the law.  As a result, Yandex’s assessment that it is “likely’ covered is a slight hedge, Yandex is covered.

Political Risk

Encryption use placed Yandex under the Strategic Companies Law.  Encryption use also imposes other requirements as set out in the Form F-1:

Encryption activities in Russia are covered by the Federal Law "On Licensing Certain Activities" of August 8, 2001 (as amended), which requires special licenses for the provision of services with the help of cryptographic (encryption) equipment and software, as well as for the production, distribution and maintenance of such cryptographic equipment. The procedure for licensing encryption services is set out in the Government Resolution "On approving the provisions for licensing certain activities related to cryptographic means" of December 29, 2007 (as amended).

Licenses under these provisions are granted by the Federal Security Service (the "FSB"), subject to the criteria which license holder must, and must continue to, comply with. Our Yandex.Money subsidiary, which uses encryption algorithms for the protection of transfers performed by its customers, received four licenses from the FSB in October 2010 in relation to its encryption activities. However, the requirement for licenses as set out in these laws is very broad and unclear, leaving the regulator with much discretion in applying and enforcing these laws.

The Federal Law is straight forward and lists the activities requiring licenses. Article 11.2 of the Federal Law on the Federal Security Service is the article establishing FSB authorities over encryption.  Article 13—entitled The Rights of the Federal Security Service—is somewhat threatening and several pages long.  Essentially, under article 13, the FSB can penetrate and exploit entities in support of any FSB responsibility.  FSB responsibilities include counterintelligence, intelligence, fighting crime and terrorism, border security and information security.  Article 13 states FSB rights are exercised “in institutions and organizations irrespective of ownership.”

The implications for Yandex, and Yandex investors, are fairly obvious.  The FSB can penetrate Yandex—through human and/or technical means—if the FSB determines it is necessary.

According to a 2008 Russian tender document, the FSB already sees Yandex as an important target.  The tender was for a new monitoring center for the FSB Information Security Center.  The FSB’s Information Security Center (FSB ISC) is the FSB’s primary structure for counterintelligence operations involving Russia’s internet infrastructure.  FSB ISC operations include monitoring the Russian Internet and analyzing Internet content to identify threats.  According to archived directives posted on the FSB web site (www.fsb.ru), FSB ISC is also designated as an FSB expert investigative center performing forensic investigations for criminal prosecution.

The tender specified that the center would include remote, and non-attributable, tasking of monitoring sensors.  The center desired extensive automated initial processing and classification—including geo-location—of detected data for transfer to offline databases for further processing.  The tender included detailed specification of the desired equipment by specifying that performance would at least equal the performance of well know western technical systems and software.  In sum, the project would provide FSB ISC with a state-of-the-art monitoring/analytic center operating on the Russian Internet without attribution.

- Prepared by Taia Global's Russia analysts for the Digital Dao blog -

Add to Cart View detail

Why Yuri Milner Doesn't Want You To Know About His Business

On February 11, 2011, I wrote an article for my former Forbes.com blog "Facebook Investor Leads New Russian Internet Police". It was based in part upon an article published by reputable Russian news portal InFox.ru entitled"Yuri Milner Will Clean Up The Internet" (a translated version can be found at the end of this post). The fact that Yuriy Milner personally called Forbes San Francisco Bureau Chief Eric Savitz to complain about my article and had his lawyer send a letter to Lewis Dvorkin and Tom Post threatening to sue if Forbes didn't kill it (which Eric did post-haste) underscored for me that Milner didn't want anyone outside of Russia to know of  his work for the Russian government.


I can understand Yuriy's reluctance at having that information known in the West. After all, this is where his company DST-Global is making huge profits from their investments in Facebook, Groupon, Zynga, and many other social networking companies. It's also where people hate to hear about government monitoring of the Internet. Then to find out that the CEO of DST-Global, the single largest corporate investor in Facebook, is helping the Russian government identify individuals of interest through an online investigation might complicate things for he and his partners, especially now as they launch DST Global 2, and open it to Western investors.

Here are the facts on Milner's role, as well as the role of Directorate K which I pulled from my company's weekly intelligence briefing archives.

Milner volunteered for the job according to Alexander Zharov: Deputy Minister of Communication and Mass Media of the Russian Federation:

"The ministry of communicationa and information has charged the president of Digital Sky Technologies Yuri Miller with the task to analyze the scale of distribution of illegal content in the Russian segment of the Internet and to define Internet resources that support or distribute illegal content on the web." (human translation of the InFox.ru article referenced above)


What is the MVD and Directorate K
The Directorate for Combating Crimes in the High Technology Sphere (Directorate K) of the Russian Federation Ministry of Internal Affairs (MVD RF) investigates cyber crimes and other illegal activity related to information technology in Russia.  Directorate K works closely with Russia’s Federal Security Service (FSB)—the lead agency for information security—and with foreign law enforcement agencies.  However, Directorate K—like MVD Center E and the FSB—also works to suppress domestic dissent.

Directorate K’s current head is Lt. Gen. Boris Miroshnikov.  General Miroshnikov maintains a high profile speaking frequently to domestic and foreign press on cyber crime.  General Miroshnikov travels frequently, attending foreign conference on cyber crime and meeting with foreign law enforcement officials.  Prior to heading Directorate K, General Miroshnikov headed the FSB Information Security Center after serving as deputy head of FSB Counterintelligence Operations.


Directorate K Cooperation with the FSB
Russian Law assigns the Federal Security Service (FSB) the lead role for ensuring Russia’s information security.  The FSB also has broad authority against crime, especially organized crime, and also cooperates with international law enforcement.  Potential conflicts, however, appear minimal since the FSB is clearly the senior partner.  The FSB runs the overall system for internet monitoring and Russian press frequently mentions FSB and MVD cooperation in criminal investigations.  The news section of the MVD website stresses Directorate K successes against credit card fraud, phone fraud, child pornography, and other fairly routine criminal activity.

Russian press, however, shows Directorate K working with the FSB, and MVD Center E, to suppress domestic political dissent.  In December 2007, Novaya Gazeta wrote that major Russian hosting service Masterhost blocked access to opposition websites after receiving a letter from Directorate K.  Sergey Kopylov, head of Masterhost’s; legal department confirmed receiving a letter from the MVD about suspending service.  Novaya Gazeta wrote to Directorate K’s press service—normally eager to place stories concerning Directorate K activity—without receiving a reply.  Leaders of opposition parties also detailed denial of service attacks on their websites and disruptions in cell phone service.  Opposition leaders complained that the authorities displayed little interest in their problems and stated they would probably move internet activity to foreign servers.  In March 2010, Solidarity member Olga Kurnosova told Ekho Moskvy Radio that Directorate K shut down the 20 March website as extremist.  According to Ms. Kurnosova, opposition activists used the site for communication and coordination of protests.

Russian officials are concerned that opposition forces will move internet activity aboard, using social networking sites to coordinate their activity.  In fact, Deputy Minister of Information Technologies and Communications Dmitriy Milovantsev told Dagestanskaya Pravda in 2005 that this acted as a brake on government actions despite concern over opposition domestic internet activity.

Since 2005, major Russian social networking sites VKontakte and Odnoklassniki have come under financial control of pro-Kremlin oligarchs including DST Global’s Yuriy Milner.  According to Moscow Vedomosti Online, in November 2010 Russian social networking activity was shifting to Facebook and Twitter.  As a result, Russian telecommunication companies MTS and Vympelkom reached agreement with Facebook and provide free Facebook access for their subscribers.  Facebook, with Russia’s DST Global owning approximately 10 percent of Facebook, anticipates continued strong growth in Russia and is developing a Russian interface.  Some analysts anticipate a strategic merger between Milner’s VKontakte and Facebook.  The Russian search engine Yandex is also indexing Facebook internal pages.

Taia Global analysts estimate that the growing linkages between Russian companies and Facebook help the FSB and MVD Directorate K prevent possible opposition groups from using Facebook as an organizing mechanism for political dissent.  The FSB can easily monitor internet activity originating in Russia since all outbound traffic passes through gateways controlled by government entities.  MVD Directorate K can exercise authority over Russian telecommunications companies instructing them to cutoff access so embarrassing photos and videos do not appear during internal disturbances.  Day to day monitoring allows both the FSB and MVD Directorate K to identify possible “extremists” for inclusion in MVD Center E’s extremist database.

Security Impact For Facebook Users
Any future merger between VKontakte and Facebook could expand Russian monitoring capabilities dramatically.  Any merger would probably include technical connections between the two networks.  By law, Russian companies are required to cooperate with the FSB if asked.  This also applies to U.S. companies doing business in Russia, like Facebook Russia (who is mentioned in the InFox article). The FSB could manipulate, if not actually direct, the connection to facilitate FSB objectives.  Given Yuriy Milner’s close connections to the current government, cooperation would probably occur quietly.  Taia Global analysts estimate that Russian government objective of preventing the political opposition from using media to organize dissent, especially during a domestic crisis, is one reason for DST Global’s investment in Facebook.

-------------------

A translated version of the Infox.ru article "Yuri Milner Will Clean Up The Internet" follows after the cut.

Yuri Milner will clean up the Internet (13 May 2010, Infox.ru)

The ministry of communication and information has chosen the curator
of content projects in the Russian segment of the Internet. Monitor
internet ressources as for the legality of their content will Yury
Milner, whose DST foundation owns shares in "Odnoklassniki" and
"Vkontakte".

The ministry of communicationa and information has charged the
president of Digital Sky Technologies Yuri Miller with the task to
analyze the scale of distribution of illegal content in the Russian
segment of the Internet and to define Internet-ressources that support
or distribute illegal content on the web. The deputy minister
Alexander Zharov told infox.ru that an analytical report about the
conditions of functioning of these ressourses and their "influence on
the situation in the sector" will be presented in the ministry in the
fall of 2010.

A source close to the ministry has specified that this task was given
to Yury Milner as a result of the session of the Council for Internet
and new mass-media of the ministry in November 2009. The businessmen
was proposed to to present a report on the economic consequences of
illegal activity in the beginning of 2010.

According to the deputy minister Alexander Zharov the delay in the
preparation of the report is due to the complexity of this task.

<<He (Yury Milner. - Infox.ru) has not yet fully finished this work.
Loads of information has to worked through. And the content is
constantly updated, therefore he is still in process. I wait for the
report in August-September>>, - Alexander Zharov has told.

Yury Milner is the coowner of the company Digital Sky Technologies,
which owns ICQ and shares in Mail.ru, as well as social networks
Vkontakte.ru, Odnoklassniki.ru, Facebook and others.

An official representative of DST Leonid Solovev has commented on the
situation as following: <<In November 2009 at the session of the
Council for Internet and new mass-media of the Ministry of
communication and information Yury Milner has suggested to generalize
the position of the largest Internet companies of Russia concerning
the distribution of an illegal content in the Russian segment of the
Internet and to present it at the next session of Council>>. That means
that Milner will present a certain uniform position of the largest
Russian Internet companies on this question, but it does in no way
mean that he was charged with the task to <<to analyse the scales of
distribution of illegal content in the Russian Internet and to define
Internet resources supporting or distributing illegal content on the
web>>.

According to reports of the "K" department of the Russian ministry of
internal affairs in 2009 on the pages of Vkontakte.ru was discovered
more than half of the child pornography available on the Russian
segment of the Internet. "Because of this the problem was fixed fast,
- said the head of the press-service of the social network Vladislav
Tsypluhin. - Vkontakte.ru is now develloping a programm for the fight
against child pornograpy - we support financially child charity
organisations and they provide us with volunteers who search and
delete this kind of content. We give them the rights to delete videos
and other kind of content. And of course we monitor what they do".

Lawyers of the social network deal with pirated content on the social
network says the representative of Vkontakte.ru "The license owners
send official requests with the prove of their rights and then we
remove the content from the side, expains Vladislav Tsypluhin.
"Facebook has its own algorithms to find this kind of content and a
team of moderators who work on this", - adds the head of
representation of Facebook in Russia Ekaterina Skorobogatova.

Alexander Zharov said that "when this topic came up Yury Milner
volunteered to head the process". "I think that he as any responsible
businessman wants the share of illegal content to come down to zero",
- adds Alexander Zharov.

One of the Council for Internet and new mass-media thinks that
independent analytics should be included in the expertise of the
content "to exclude conflict of interests". "It is naiv to think that
owners of social networks want to fill them with illegal content. We
work a lot to categorize it and exclude it and get clean from it", -
responds a top-manager of another popular social network who is not
part of DST.

According to one member of the Council to charge officials with the
monitoring of the market of illegal content would not bring the needed
results. "The work would take to long, and I doubt that companies
would provide the oficial with confidential information. He would have
only data from open sources", - said the souce of Infox.ru

"A person who knows the work of a social network and other services
from within will bring much more results than an oficial who is far
from the Internet", - agrees the CEO of the social network mamba.ru
Andrey Bronetsky. He says that the existing laws do not allow to
absolutely exclude illegal content and a new document is needed which
would make the cooperation between the management of social networks
and law inforcement authorities more effective.

Add to Cart View detail