Dark Cloud: Inside The Pentagon's Leaked Internet Surveillance Archive

["Dave Farber" <farber () gmail com>]

Begin forwarded message:

> From: Dewayne Hendricks <dewayne () warpspeed com>
> Date: November 17, 2017 at 10:43:57 PM EST
> To: Multiple recipients of Dewayne-Net <dewayne-net () warpspeed com>
> Subject: [Dewayne-Net] Dark Cloud: Inside The Pentagon's Leaked Internet Surveillance Archive
> Reply-To: dewayne-net () warpspeed com
>
> [Note:  This item comes from friend David Rosenthal.  DLH]
>
> Dark Cloud: Inside The Pentagon's Leaked Internet Surveillance Archive
> By Dan O’Sullivan
> Nov 17 2017
> <https://www.upguard.com/breaches/cloud-leak-centcom>
>
> The UpGuard Cyber Risk Team can now disclose that three publicly downloadable cloud-based storage servers exposed a 
> massive amount of data collected in apparent Department of Defense intelligence-gathering operations. The 
> repositories appear to contain billions of public internet posts and news commentary scraped from the writings of 
> many individuals from a broad array of countries, including the United States, by CENTCOM and PACOM, two Pentagon 
> unified combatant commands charged with US military operations across the Middle East, Asia, and the South Pacific.
>
> The data exposed in one of the three buckets is estimated to contain at least 1.8 billion posts of scraped internet 
> content over the past 8 years, including content captured from news sites, comment sections, web forums, and social 
> media sites like Facebook, featuring multiple languages and originating from countries around the world. Among those 
> are many apparently benign public internet and social media posts by Americans, collected in an apparent Pentagon 
> intelligence-gathering operation, raising serious questions of privacy and civil liberties.
>
> While a cursory examination of the data reveals loose correlations of some of the scraped data to regional US 
> security concerns, such as with posts concerning Iraqi and Pakistani politics, the apparently benign nature of the 
> vast number of captured global posts, as well as the origination of many of them from within the US, raises serious 
> concerns about the extent and legality of known Pentagon surveillance against US citizens. In addition, it remains 
> unclear why and for what reasons the data was accumulated, presenting the overwhelming likelihood that the majority 
> of posts captured originate from law-abiding civilians across the world.
>
> With evidence that the software employed to create these data stores was built and operated by an apparently defunct 
> private-sector government contractor named VendorX, this cloud leak is a striking illustration of just how damaging 
> third-party vendor risk can be, capable of affecting even the highest echelons of the Pentagon. The poor CSTAR cyber 
> risk scores of CENTCOM and PACOM - 542 and 409, respectively, out of a maximum of 950 - is a further indication that 
> even the most sensitive intelligence organizations are not immune to sizable cyber risk. Finally, the collection of 
> billions of internet posts in several unsecured data repositories raises further questions about online privacy, as 
> well as regarding the right to freely express your beliefs online.
>
> The Discovery
>
> On September 6th, 2017, UpGuard Director of Cyber Risk Research Chris Vickery discovered three Amazon Web Services S3 
> cloud storage buckets configured to allow any AWS global authenticated user to browse and download the contents; AWS 
> accounts of this type can be acquired with a free sign-up. The buckets’ AWS subdomain names - “centcom-backup,” 
> “centcom-archive,” and “pacom-archive” - provide an immediate indication of the data repositories’ significance. 
> CENTCOM refers to the US Central Command, based in Tampa, Fla. and responsible for US military operations from East 
> Africa to Central Asia, including the Iraq and Afghan Wars. PACOM is the US Pacific Command, headquartered in Aiea, 
> HI and covering East, South, and Southeast Asia, as well as Australia and Pacific Oceania.
>
> [snip]
>
> Dewayne-Net RSS Feed: http://dewaynenet.wordpress.com/feed/
> Twitter: https://twitter.com/wa8dzp



-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/18849915-ae8fa580
Modify Your Subscription: https://www.listbox.com/member/?member_id=18849915&id_secret=18849915-aa268125
Unsubscribe Now: 
https://www.listbox.com/unsubscribe/?member_id=18849915&id_secret=18849915-32545cb4&post_id=20171118125111:0E54D5EC-CC89-11E7-B034-9011E7533343
Powered by Listbox: http://www.listbox.com