organization:national counterterrorism center

Uber Paid Hackers to Delete Stolen Data on 57 Million People - Bloomberg
▻https://www.bloomberg.com/news/articles/2017-11-21/uber-concealed-cyberattack-that-exposed-57-million-people-s-data

https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iAY_gIX_taEE/v0/1200x813.jpg

Hackers stole the personal data of 57 million customers and drivers from Uber Technologies Inc., a massive breach that the company concealed for more than a year. This week, the ride-hailing firm ousted its chief security officer and one of his deputies for their roles in keeping the hack under wraps, which included a $100,000 payment to the attackers.

Compromised data from the October 2016 attack included names, email addresses and phone numbers of 50 million Uber riders around the world, the company told Bloomberg on Tuesday. The personal information of about 7 million drivers was accessed as well, including some 600,000 U.S. driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken, Uber said.

“None of this should have happened, and I will not make excuses for it.”
At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers to delete the data and keep the breach quiet. Uber said it believes the information was never used but declined to disclose the identities of the attackers.

Dara KhosrowshahiPhotographer: Matthew Lloyd/Bloomberg
“None of this should have happened, and I will not make excuses for it,” Dara Khosrowshahi, who took over as chief executive officer in September, said in an emailed statement. “We are changing the way we do business.”

After Uber’s disclosure Tuesday, New York Attorney General Eric Schneiderman launched an investigation into the hack, his spokeswoman Amy Spitalnick said. The company was also sued for negligence over the breach by a customer seeking class-action status.

Hackers have successfully infiltrated numerous companies in recent years. The Uber breach, while large, is dwarfed by those at Yahoo, MySpace, Target Corp., Anthem Inc. and Equifax Inc. What’s more alarming are the extreme measures Uber took to hide the attack. The breach is the latest scandal Khosrowshahi inherits from his predecessor, Travis Kalanick.

Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. Uber had just settled a lawsuit with the New York attorney general over data security disclosures and was in the process of negotiating with the Federal Trade Commission over the handling of consumer data. Kalanick declined to comment on the hack.

Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year, a spokesman told Bloomberg. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc., has been at the center of much of the decision-making that has come back to bite Uber this year. Bloomberg reported last month that the board commissioned an investigation into the activities of Sullivan’s security team. This project, conducted by an outside law firm, discovered the hack and the failure to disclose, Uber said.

Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company.

A patchwork of state and federal laws require companies to alert people and government agencies when sensitive data breaches occur. Uber said it was obligated to report the hack of driver’s license information and failed to do so.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said. “We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.”

Uber has earned a reputation for flouting regulations in areas where it has operated since its founding in 2009. The U.S. has opened at least five criminal probes into possible bribes, illicit software, questionable pricing schemes and theft of a competitor’s intellectual property, people familiar with the matters have said. The San Francisco-based company also faces dozens of civil suits.

U.K. regulators including the National Crime Agency are also looking into the scale of the breach. London and other governments have previously taken steps toward banning the service, citing what they say is reckless behavior by Uber.

In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach, Uber said. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack.

The new CEO said his goal is to change Uber’s ways. Uber said it informed New York’s attorney general and the FTC about the October 2016 hack for the first time on Tuesday. Khosrowshahi asked for the resignation of Sullivan and fired Craig Clark, a senior lawyer who reported to Sullivan. The men didn’t immediately respond to requests for comment.

Khosrowshahi said in his emailed statement: “While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes.”

The company said its investigation found that Salle Yoo, the outgoing chief legal officer who has been scrutinized for her responses to other matters, hadn’t been told about the incident. Her replacement, Tony West, will start at Uber on Wednesday and has been briefed on the cyberattack.

Kalanick was ousted as CEO in June under pressure from investors, who said he put the company at legal risk. He remains on the board and recently filled two seats he controlled.

Uber said it has hired Matt Olsen, a former general counsel at the National Security Agency and director of the National Counterterrorism Center, as an adviser. He will help the company restructure its security teams. Uber hired Mandiant, a cybersecurity firm owned by FireEye Inc., to investigate the hack.

The company plans to release a statement to customers saying it has seen “no evidence of fraud or misuse tied to the incident.” Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.

#Uber #USA

Moon of Alabama à propos de la démission de Saad Hariri (en gros : grosse destabilisation du Liban, qui échouera et finira par renforcer intérêts russes et iraniens) :
▻http://www.moonofalabama.org/2017/11/lebanon-hariris-resignation-the-opening-shot-of-the-saudi-war-on-hizb

The resignation of Hariri is intended to provoke a constitutional crisis in Lebanon and to prevent new parliament elections. The further Saudi plan is likely to evolve around these elements:

– The Trump administration will announce new sanctions against Hizbullah and against Lebanon in general.
– The Saudi government will slip some of its al-Qaeda/ISIS proxy fighters from Syria and Iraq into Lebanon (possibly via Turkey by sea). It will finance local Lebanese terror operations.
– There will be new assassination attempts, terror attacks and general rioting by Sunni extremist elements against Christians and Shia in Lebanon.
– The U.S. will try to press the Lebanese army into a war against Hizbullah.
– Israel will try to provoke and divert Hizbullah’s attention by new shenanigans at the Lebanese and Syrian border. It will NOT start a war.

The plan is unlikely to succeed:

– The Lebanese people as a whole have no interest in a new civil war.
– The Lebanese army will not get involved on any specific side but will try to keep everyone calm.
– Sanctions against Hizbullah will hit all of Lebanon, including Sunni interests.
– A new Sunni prime minister will be found and installed, replacing the resigned Saudi puppet.
– Russian and Iranian economic interests will find a new market in Lebanon. Russian companies will engage in Lebanese gas and oil extraction in the Mediterranean and replace U.S. involvement.

The miscalculated Saudi/U.S./Israeli plan against Hizbullah can be understood as a helpless tantrum after their defeat in Syria and Iraq.

Je vois qu’il y a déjà une traduction en français :
▻http://arretsurinfo.ch/liban-demission-dhariri-premiere-salve-de-la-guerre-saoudienne-contre-l

Why Is It So Difficult for Syrian Refugees to Get Into the U.S.?
▻http://www.nytimes.com/2016/01/24/magazine/why-is-it-so-difficult-for-syrian-refugees-to-get-into-the-us.html

‘‘It’s extremely difficult to get into the United States as a refugee — the odds of winning the Powerball are probably better,’’ says David Miliband, head of the International Rescue Committee, which helps place refugees from 40 countries in American cities. And Syrians are subject to an extra degree of vetting. Although all refugees are screened by the National Counterterrorism Center, the F.B.I., the Defense Department, the State Department and United States Customs and Border Protection, among other intelligence agencies, Syrians must complete what is known as the Enhanced Syrian Review. This is an added screening by caseworkers at U.S. Citizenship and Immigration Services in Washington, which assesses each Syrian case and selects some for processing through the Fraud Detection and National Security Directorate office. This extra step was put in place because of the difficulty of assessing the allegiances of the various rebel groups in Syria’s continuing war — what Barbara Strack, chief of the Refugee Affairs Division at U.S. Citizenship and Immigration Services, describes as ‘‘the myriad actors and dynamic nature of the conflict.’’

#réfugiés #Syrie #Etats-Unis

Is Your Child a Terrorist ? U.S. Government Questionnaire Rates Families at Risk for Extremism
▻https://firstlook.org/theintercept/2015/02/09/government-develops-questionnaire-see-might-become-terrorist

Are you, your family or your community at risk of turning to violent extremism? That’s the premise behind a rating system devised by the National Counterterrorism Center, according to a document marked For Official Use Only and obtained by The Intercept.

The document–and the rating system–is part of a wider strategy for Countering Violent Extremism, which calls for local community and religious leaders to work together with law enforcement and other government agencies. The White House has made this approach a centerpiece of its response to terrorist attacks around the world and in the wake of the Paris attacks, announced plans to host an international summit on Countering Violent Extremism on February 18th.

#surveillance

Barack Obama’s Secret Terrorist-Tracking System, by the Numbers - The InterceptThe Intercept
▻https://firstlook.org/theintercept/article/2014/08/05/watch-commander

Of the 680,000 people caught up in the government’s Terrorist Screening Database—a watchlist of “known or suspected terrorists” that is shared with local law enforcement agencies, private contractors, and foreign governments—more than 40 percent are described by the government as having “no recognized terrorist group affiliation.” That category—280,000 people—dwarfs the number of watchlisted people suspected of ties to al Qaeda, Hamas, and Hezbollah combined.

https://prod01-cdn02.cdn.firstlook.org/wp-uploads/sites/1/2014/08/shrug_chart_final1.jpg

There’s a New Super-Database of Your Information to Hunt Underwear Bombs
►http://www.theatlanticwire.com/technology/2012/12/national-counterterrorism-center-database/59950

Well, this is pretty terrifying: A little known agency called the National Counterterrorism Center has a big ole database of civilian information that it can use to monitor innocent people for suspicious behavior, without probable cause.

#surveillance