Tuesday: Allez Vous F

J’adore Stromae. I’m not in the hip hop demographic, but Stromae — whose real name is Paul Van Haver — pulls me in. This multi-talented born to a Rwandan father and a Belgian mother pulls together multiple genres of music laced with compelling au courant lyrics presented with stunning visual effects — how could I not love him?

This particular song, Papatouai, has a strong psychic undertow. This song asks where Papa is; the lyrics and video suggest an emotionally or physically distant father. Van Haver’s own father was killed in the Rwandan genocide when he was not yet ten years old. Is this song about his own father, or about inaccessible fathers in general? The use of older African jazz rhythms emphasizes retrospection suggesting a look backward rather than forward for the missing father figure(s). More than a third of a billion views for this video say something important about its themes.

Much of Stromae’s work is strongly political, but it conveys the difficulty of youth who are multi-racial/multi-ethnic unsatisfied with the binaries and economic injustices forced on them by oldsters. A favorite among kids I know is AVF (Allez Vous Faire):

“Allez vous faire!”
Toujours les mêmes discours, toujours les mêmes airs,
Hollande, Belgique, France austère.
Gauches, ou libéraux, avant-centres ou centristes,
Ça m’est égal, tous aussi démagos que des artistes.

Go fuck yourselves!
Always the same words, always the same airs.
Holland, Belgium, France, austere.
Right or Left? Moderate or Extremist?
They’re all the same to me – the demagogues and the artists.

Remarquable et pertinent, non? I’m also crazy about Tous Les Mêmes, a trans- and cis-feminist song with a marvelous old school Latin beat simmering with frustration. But there’s not much I don’t like by Stromae; I can’t name a song I wouldn’t listen to again and again.

If you’re ready for more Stromae, try his concert recorded in Montreal this past winter. So good.

Expedition to the Cyber Pass

• UK wireless firm O2 customer data breached and sold (BBC) — O2 customers who were gamers at XSplit had their O2 account data stolen. The approach used, credential stuffing, relies on users who employ the same password at multiple sites. Wonder how Verizon’s recent hiring of O2’s CEO Ronan Dunne will play out during the integration of Yahoo into Verizon’s corporate fold, given Verizon’s data breach? Will Dunne insist on mandatory 2FA policy and insure Verizon and Yahoo accounts can’t use the same passwords?
• Speaking of Yahoo: 200 million credentials for sale (Motherboard) — Yahoo’s Tumblr had already been involved in a massive breach, now there’s Yahoo accounts available on the dark web. Given the Verizon breach already mentioned, it’s just a matter of time before these accounts are cross-matched for criminal use.
• Oracle’s not-so-good-very-bad-too-many 276 vulnerabilities patched (Threatpost) — Whew. Two. Hundred. Seventy. Six. That’s a lot of risk. Good they’re all patched, but wow, how did Oracle end up with so many to begin with? Some of them are in products once owned by Sun Microsystems, including Java. Maybe Oracle ought to rethink Java’s licensing and work with the software community to develop a better approach to patching Java?
• F-35 ready, says USAF — kind of (Bloomberg) — Massively expensive combat jet now up for ‘limited combat use’, except…
  

  The initial aircraft won’t have all the electronic combat, data fusion, weapons capacity or automated maintenance and diagnostics capabilities until the most advanced version of its complex software is fielded by 2018.

  Uh, what the hell did we spend a gazillion-plus bucks on if we don’t have aircraft with competitive working electronics?

Light load today, busy here between getting youngest ready for college and primary day in Michigan. YES, YOU, MICHIGANDER, GO VOTE IN THE PRIMARY! Polls close at 8:00 p.m. EDT, you still have time — check your party for write-in candidates. You can check your registration, precinct, ballot at this MI-SOS link.

The rest of you: check your own state’s primary date and registration deadlines. Scoot!

How Did Booz Employee Analyst-Trainee Edward Snowden Get the Verizon 215 Order?

One thing I’ve been pondering as I’ve been going through the Snowden emails liberated by Jason Leopold is the transition Snowden made just before he left. They show that in August 2012, Snowden was (as we’ve heard) a Dell contractor serving as a SysAdmin in Hawaii.

The training he was taking (and complaining about) in around April 5 – 12, 2013 was in preparation to move into an analyst role with the National Threat Operations Center.

That would mean Snowden would have been analyzing US vulnerabilities to cyberattack in what is a hybrid “best defense is a good offense” mode; given that he was in HI, these attacks would have been launched predominantly from, and countermeasures would be focused on, China. (Before Stewart Baker accuses me of showing no curiosity about this move, as Baker did about the Chinese invitation to Snowden’s girlfriend to a pole dancing competition, I did, but got remarkably little response from anyone on it.)

It’s not clear why Snowden made the switch, but we have certainly seen a number of cybersecurity related documents — see the packet published by Charlie Savage in conjunction with his upstream cyber article. Even the PRISM PowerPoint — the second thing released — actually has a cybersecurity focus (though I think there’s one detail that remains redacted). It’s about using upstream to track known cyberthreat actors.

I suspect, given the inaccuracies and boosterism in this slide deck, that it was something Snowden picked up while at Booz training, when he was back in Maryland in April 2013. Which raises certain questions about what might have been available at Booz that wasn’t available at NSA itself, especially given the fact that all the PRISM providers’ names appear in uncoded fashion.

Incidentally, Snowden’s job changes at NSA also reveal that there are Booz analysts, not NSA direct employees, doing Section 702 analysis. In case that makes you feel any better about the way the NSA runs it warrantless surveillance programs.

Anyway, thus far, all that makes sense: Snowden got into a cybersecurity role, and some of the latest documents he took was a document that included a cybersecurity function (though presumably he could have gotten most of the ones that had already been completed as a SysAdmin before that).

But one of the most sensitive documents he got — the Verizon Section 215 primary order — has nothing to do with cybersecurity. The Section 215 dragnet was supposed to be used exclusively for counterterrorism .(And as I understand it, there are almost no documents, of any type, listing provider names in the Snowden stash, and not all that many listing encoded provider names). But the Verizon dragnet order it is dated April 23, 2013, several weeks into the time Snowden had moved into a cybersecurity analytical role.

There’s probably an easy explanation: That even though NSA is supposed to shift people’s credentials as they move from job to job, it hadn’t happened for Snowden yet. That would say whoever was responsible for downgrading Snowden’s access from SysAdmin to analyst had not yet done so (there have been at least some cases of credentials not being adjusted since Snowden too, so they haven’t entirely addressed what would have to be regarded as a major fuck-up if that’s how this happened).

Interestingly, however, the declassification stamp on the document suggests it was classified on April 12, not April 23. On April 12, 2013, Snowden was still at Fort Meade.

Whatever the underlying explanation, it should be noted that the most sensitive document Snowden leaked — the one that revealed that the government aspired to collect phone records from every single Verizon customer (and, significantly, the one that made court challenges possible) — had to have been obtained after Snowden formally left his SysAdmin, privileged user, position.

Friday Morning: Far Over Yonder

It was rough road this week, but we made it to Friday again for more jazz. Today’s genre is ska jazz, which will feel like an old friend to many of you.

The artist Tommy McCook was one of the earliest artists in this genre. Just listen to his work and you’ll understand why he has had such a deep and long-lasting influence on contemporary Jamaican music.

Let’s get cooking.

Apple pan dowdy

• Need a hashtag for NotAlliPhones after FBI says hack only works on “narrow slice” (Reuters) — The method offered by a third party to open San Bernardino shooter’s iPhone 5c won’t work on later phones like the iPhone 5s in the Brooklyn case, according to FBI director Jim Comey. While it may be assumed newer technology is the barrier, this could be a simple line in the sand drawn by the FBI so as to limit potential risk.
• Yet another pearl-clutching essay asking us if Apple went too far protecting privacy (MIT Technology Review) — This is the second such POS in this outlet in the last couple of months. Oh, by all means, let’s risk exposing hundreds of millions of iOS users to any surveillance because law enforcement needs access to information they didn’t have 20 years ago.
• Apple has complied with government requests to crack iPhones 70 times, beginning in 2008 (Mac Rumors) — The first request, believed to have occurred while George Bush was stil in office, arose from a child abuse and pornography case. In a case like this where children may have been endangered, one can understand the impetus for the request. But maybe, just maybe, Apple was so firm about the San Bernardino iPhone 5c is that Apple knows the government has gone too far after nearly eight years of compliance.
• And for a change of pace, a recipe for Apple Pan Dowdy. Don’t fret over the pastry flour; just use all-purpose and not bread flour.

Leftovers

• Yahoo up for bids, Verizon interested (Reuters) — The same telecom once in trouble for using persistent cookies is interested in a search engine-portal business which may offer them access to non-Verizon customers. Plan ahead for the next level of consumer tracking if Verizon’s bid wins. Bidding deadline has been extended from April 11 to the 18th.
• Households at bottom income levels can’t afford food, housing (Vox) — Can’t understand why the rise of angry white man candidates? This is one big reason — things are getting much worse for those who can afford it least. And nobody working in Capitol Hill or the White House seems to give a rat’s whisker.
• Banksters blame Hollywood for lack of interest in dodgy subprime automotive bonds (Indiewire) — Investment banking firm Morgan Stanley credits the film The Big Short, based on Michael Lewis’ book about the 2000s housing bubble and the subprime mortgage crisis, with spooking investors away from subprime automotive bonds. By all means, let’s not look in the mirror, banksters, or at the inability of working poor to make ends meet, increasing likely uptick in automotive loan defaults.
• Venezuela makes every Friday a holiday (Bloomberg) — The deep El Nino cycle caused drought conditions, substantively lowering reservoir levels. President Maduro is asking large customers to make their electricity in addition to declaring every Friday for the next two months a work holiday to conserve energy. Clearly Venezuela needed investment in solar energy before this El Nino began.
• Researchers found people do stupid stuff when they find a flash drive (Naked Security) — After sprinkling a campus with prepared USB flash drives, a study found nearly half the people who found them plugged them into a computer, ostensibly to find the owner. DON’T DO IT. If you find one, destroy it. If you lost one, consider it a lost cause — and before you lose one, make sure you’ve encrypted it just in case somebody is stupid enough to try and find the owner/look at the contents.

HIGHLY EDITORIAL COMMENT: Bill, STFU.
Just because a single African American author called you “The First Black President” doesn’t mean you are literally a black man (and the label wasn’t meant as a compliment). Your massive white/male/former-elected privilege is getting in the way of listening to people you helped marginalize. You cannot fake feeling their pain or triangulate this away. Just shut up and listen, if for no other reason than you’re hurting your wife yet again. (Sorry, I had to get that off my chest. This opinion may differ from those of other contributors at this site. YMMV.)

Phew. Hope you have a quiet, calm weekend planned. We could use one. See you Monday morning!