“In the world of Fox News, an African name alone is disqualifying.”

The idea of a worse future due to AI is rooted in understanding how automation of bad things happened in the past (e.g. philosophy, politics, economics), and how that will mean even more bad things ahead.

Ifeoma Ajunwa has written an amazing article giving exactly the kind of example we all should study.

He points out what any intelligent human operator would key in on: known qualifications.

…as Sen. Amy Klobuchar helpfully shared on the first day of hearings for Judge Jackson’s confirmation, the nominee has more judicial experience than “four people who are already on the Supreme Court.”

And before that, he points out what un-intelligent (e.g. dumb robot) operators get stuck on: fear based on the unfamiliar or unknown (e.g. racism).

If there were any doubt that this social discrimination still exists, just consider the minimally veiled racist remarks Tucker Carlson made about Judge Jackson’s African name while questioning her credentials. “So, is Ketanji Brown Jackson—a name that even Joe Biden has trouble pronouncing—one of the top legal minds in the entire country?” he asked. In the world of Fox News, an African name alone is disqualifying.

So true. So well said.

But it gets even better. Ifeoma links his analysis to a history of systemic racism in America.

In 2004, Marianne Bertrand and Sendhil Mullainathan published a now-famous field experiment they conducted to test racial discrimination in hiring. They responded with fictitious résumés to help-wanted ads in Boston and Chicago newspapers. They assigned each résumé either a very African American–sounding name (think Lakisha and Jamal) or a very White-sounding name (think Emily or Greg). One result: In general, résumés with White (read European) names received 50 percent more callbacks for interviews. Bertrand and Mullainathan also found that the amount of discrimination was the same across occupations and industries.

The employers did not know for certain that the job applicants were Black Americans—they were making the conclusion based on how they perceived the name.

How our brains perceive a name can be actively manipulated by “deliberately misleading” partisan extremists like Tucker “gas chamber” Carlson.

For weeks, Fox News host Tucker Carlson’s prime-time show has featured racist attacks…

The fact that an alleged asset of foreign military intelligence (Russia) can poison information so openly in America is disappointing on its own, of course. Even worse is when automation technology gives them far more impact.

Fox “news” is basically this:

…open-ended endorsement of white supremacist ideology…

Recognize that Fox is a past form of automation and therefore foreshadowing of the ugly side to AI. The ability to move racism faster and wider, to create more harm more quickly than before, will be the outcome of “open-ended” use of technology for hate.

Google Chrome CVE-2022-1096 Emergency Patch

Shortly after announcing a CRITICAL security patch for CVE-2022-0971 Google is at it once again, dropping a HIGH security patch as an emergency yesterday.

Google is aware that an exploit for CVE-2022-1096 exists in the wild.

There is only one CVE listed in the update announcement, which hints towards a higher severity than just HIGH not to mention exploits exist in the wild.

The Stable channel has been updated to 99.0.4844.84… This update includes 1 security fix.

It also follows news of attribution for an exploit circulating at the start of 2022, which claims North Korea hunted Americans on Google Chrome with CVE-2022-0609 to steal crypto coin and intelligence.

FCC Declares Kaspersky “threat to U.S. national security”

Remember when Kaspersky in 2018 lost an obviously stupid lawsuit that claimed the U.S. government shouldn’t be able to prohibit products harmful to society?

U.S. District Court Judge Colleen Kollar-Kotelly wrote in her May 30 opinion that U.S. networks and computer systems are “extremely important strategic national assets” whose security depends on the government’s ability to act swiftly against potential threats, even if such actions cause adverse affects for third-party providers like Kaspersky Labs. “These defensive actions may very well have adverse consequences for some third-parties. But that does not make them unconstitutional,” Kollar-Kotelly wrote.

On a related note, Americans I know personally who foolishly agreed to attend Kaspersky CEO’s invite-only security “bash” on a tropical island… ended up with food poisoning and severe illness. Projectile vomit.

True story.

Well, the big news today is that under a 2019 law the FCC has just formally added AO Kaspersky Lab along with China Telecom and China Mobile to a national security threat list.

Kaspersky earlier this year was also in the news when the German government issued a warning, and again when their CEO gave a rather tone-deaf message about Russia invading Ukraine.

“Better to have stayed silent than to have called an invasion a ‘situation’ that requires a ‘compromise’,” Rik Ferguson, of rival cyber-security company TrendMicro, tweeted.

That makes me like TrendMicro.

Think of Kaspersky in terms of a security software vendor telling customers that a serious breach is a situation needing compromise when attackers are Russian. Who would really want to use that vendor versus one that actually defended against being breached?

Some also may remember Kaspersky’s handling of the infamously traitorous General Michael Flynn by giving him large cash payments.

Flynn also received $US11,250 ($14,667) from Kaspersky Government Security Solutions, Inc., described as the US subsidiary of Kaspersky Lab, a Russian cybersecurity firm, according to the documents.

Yes, he was traitorous. Any U.S. General full well knows how businesses and criminal enterprises in Russia are direct extensions of Russian intelligence whenever the Kremin chooses. It’s really no understatement to call Flynn a traitor.

As I told journalists in 2017 (clumsily, I admit): while Mandiant is close to NSA, Crowdstrike is close to FBI, we can’t compare the collaborations with Russia because Putin’s dictatorial control model is completely different from congressional contracts and hand-outs.

Israeli intelligence had since 2014 sounded the alarm to anyone in the U.S. willing to listen to intelligence.

Source: “How Israel Caught Russian Hackers Scouring the World for U.S. Secrets”, New York Times

Perhaps also worth mentioning here, since we’re talking about remembering things, Facebook around 2014 started to carefully audit anyone who came to their site… and then actively pushed Kaspersky code as “free” help.

The problem with Facebook is thousands of active phishing scams but the social media giant has partnered with popular security software developer firm Kaspersky so that users could identify and remove malware from their computers.

Popular security software developer firm Kaspersky? According to what population?

Let’s be honest here.

The real question is whether users could identify and remove the threat from the relatively unheard of Kaspersky software being pushed upon them by Facebook’s security team? I guarantee the vast majority of users had never heard that name before Facebook made it a required “checkpoint” to login.

Moreover, does having a problem with phishing on Facebook sound anything close to being a relevant reason to push an unfamiliar Russian content scanning tool onto people?

No. No, it does not. Now read this:

In a Facebook post, Facebook’s Software Engineer Threat Infrastructure Team head Trevor Pottinger explained: “To make this programme even more effective, Kaspersky Lab is bringing their expertise… we will offer Kaspersky Malware Scan for Facebook… in the past three months, we have helped [run Kaspersky code on] more than 2 million people’s computers.”

Facebook safety “checkpoint” hit millions of users. Was it Russian surveillance or just Russian code meant “to help”?

Facebook knew exactly who had run the Kaspersky code. They boasted about knowing how many people ran it.

You’ll never guess what happened next.

When called to account for their very precise user tracking and audit practices, Facebook tried to plead total ignorance as if there had been no factual basis to loudly boast “more than 2 million” users had Kaspersky pushed onto them.

Source: CNN

The dubious and forked-tongue of Facebook “help” came not long after they hired an unqualified CSO, and Moscow Times in 2015 ran the headline “Kaspersky Plans Push for Sales to U.S. Government” (link now unreachable)… which was countered by the even more salacious headline “Russian antivirus firm faked malware to harm rivals – Ex-employees“.

Faked malware to harm its own employees and rival companies while pushing into U.S. Government sales. No wonder that now-disgraced Facebook CSO, known for failing to disclose the largest breaches in history, was so welcoming.

For context on why this all might sound so evil the two founders of Kaspersky served as Russian intelligence (KGB). Twice there have been major disagreements at the executive level and its CEO has had major exodus of talent as he consolidated control and refused to be transparent, allow other views, or resolve disputes.

So while it’s really good to see Kaspersky finally being handed the kind of label it has always deserved, I’m disappointed that a heavily Russian-backed Russian-asset like Facebook wasn’t included (as I’ve warned about publicly since at least February 2011 and why I deleted my Facebook account in 2009).

After this FCC explicit ban on Kaspersky should we get to call it the most anti-democratic software ever? Or does that crown remain on Facebook (not least of all for peddling Kaspersky)?

Also, US sales of Kaspersky (under $50m) is tiny compared to the UK (over $500m), so maybe the real question is how much exposure does American national security have to British system compromise.

Cyber War Wide Open as Ukraine Loudly Pwns Russian Assets

In multiple channels I keep getting updates about a “hidden” cyber war, with “little” visibility” and how “quiet” attacks are when they run over networks instead of roads or through forests.

Nothing could be further from the truth.

The Ukraine war is the loudest and most obvious integration of cyber (information technology) into conflict I have ever seen.

To be fair, I have studied war for more than three decades and earned two degrees in the topic before spending all my professional life engaged in many forms of hot and cold power disputes related to technology.

Perhaps I see things differently.

It reminds me, for example, of my post about the Allied troops laughing out loud in 1942 about how incompetent Rommel was, versus people today trying to see Rommel as something more than a failure.

Perhaps someday in the future a historian will read the news that I am reading every day now, like I read the news of the past, and wonder who was paying attention.

Let me give an example.

Budanov and I also spoke about the unseen war that is happening over computer networks, and how hackers are now vigorously involved on both sides. This phase of the war began nine days before the invasion, on February 15, when Russian hackers launched an attack on government agencies and Ukrainian banks (“The key issue for the Russians was the disruption of work and the spread of panic”). Recently, he said, Ukrainian intelligence has monitored phishing attacks on his government’s officials by the Belorussian hacking group Ghostwriters, and the Russia-affiliated Fancy Bear group, which also has been blamed for orchestrating the hack of Democratic party e-mails during the 2016 election. Ukraine, he said, has mobilized a large volunteer force of hackers who are targeting their own attacks on Russia’s digital infrastructure.

“Unseen war that is happening over computer networks” is a lot like saying tanks hidden on forested roads.

Did the packet route if no one sniffed it, did the tree fall if no one was there to see? I mean if you aren’t in that forest or standing on that road why would you consider a tank battle anything more than unseen?

Unseen is a word I would use for what is happening in many countries around the world right now being ignored while a very obvious focus is on Ukraine.

Perhaps one of the best examples of this is the regular updates I see where Russian technology and assets are infiltrated by Ukrainian forces.

…hacking some of Russia’s proudest accomplishments (its space program) and most successful technologies (its nuclear research program), the Ukrainian government is sending Putin a message that your cybersecurity systems cannot keep us out, that even your most valuable technological secrets aren’t safe from us, and that if you push us too far, we can do whatever we want to your networks.

Nobody sending such a message wants that message to be unseen, if you get what I mean.

Here is another one.

Anonymous claims it has hacked Russian state TV and streaming services to air footage highlighting the horrors of the war on Ukraine. The secretive vigilante cyber group late Sunday shared footage of channels that are forced to air pro-Kremlin footage instead showing shocking scenes of missile attacks that killed innocent civilians. A message also told Russians, “This war was waged by Putin’s criminal, authoritarian regime on behalf of ordinary Russian citizens.”

Editing content on Russian state TV. That’s huge.

And of course there have been outages as well.

Confirmed: Various #Russia government websites including the Kremlin, State Duma and Ministry of Defense are again down, with real-time network data showing impact to FSO networks consistent with previous cyberattacks.

Even more interesting, in the most controversial and emerging field of cyber conflict (integrity), is how Ukraine has destroyed propaganda and lies of Russia.

In the Russian world, Chechens have the reputation of being particularly effective soldiers. Throughout the invasion, Kadyrov has released videos on his Telegram channel of bearded Chechen troops in Ukraine engaging in brutal firefights and conducting activities on Ukrainian soil. Some Ukrainians have traced locations in these pictures of Kadyrovtsi, as Kadyrov’s men are known, and highlighted that they are in fact in Belarus, far from the front.

Fact checking as a weapon. Integrity can bring a powerful narrative, using geolocation data like a truth bomb that destroys ground oppressors hope to stand upon.

This is Gordon Parks level stuff.

That [weapon] wasn’t no six-shooter. When Gordon Parks had that camera in his hands, that was a bazooka.

The camera was a weapon in the sense it captured knowledge to be seen more widely. Likewise this war is being fought using information captured and disseminated.

The Chechen narrative again was easily unraveled by Ukraine using geolocation and social proximity data.

Budanov said that his department has tracked a contingent of around 25,000 Chechens since the beginning of the war. “We have many informers inside the Chechen ranks. As soon as they start preparing any operation, we know that from our informants,” he said. “When the war started, Russia underwent lots of casualties, and most of these people didn’t even manage to approach Kyiv.” He pointed out that Ukrainian special forces had engaged with a group of looting Chechens near Kyiv the day before we spoke that was only two strong. “We’ve never seen more 20 or 30 Chechens in one place. The concentration is very low.”

And the reverse also is true. Google Maps disabled detailed information sharing.

In the early days of the invasion, The Washington Post revealed how researchers were using this data to track movements. Road blockages and delays signalled exoduses of people, and potential troop movements. But some fear Google Maps could be used to Russia’s advantage, giving details on how busy certain areas are. Google told Reuters that it had consulted with sources, including “regional authorities”, before making the decision.

This is similar to what we saw last year when Israel was being attacked by Hizbullah, not to mention fifteen years ago.

If anything, Russia is demonstrating to the world that they are ripe for power disruption at every level.

Full of fraud, in-fighting and demoralized looters their troops increasingly are in no position to make sound choices about conflict.

…why would you need a hypersonic missile fired from not that far away to hit a building?

I’ll tell you one good reason Russia would use impractical weapons on a target, I mean besides rank incompetence. Russian systems are being abandoned, going offline or unreliable.

Citing U.S. intelligence, three U.S. officials said the United States estimated that Russia’s failure rate varied day-to-day, depended on the type of missile being launched, and could sometimes exceed 50%. Two of them said it reached as high as 60%.

Nothing about the Ukrainian counter-attacks seem quiet to me. Defense of their country, even using latest technology, is far from being hidden or unseen. I’ve never seen anything louder or more in the open. As much as Russians clearly are incompetent clowns in this war, Ukraine deserves credit for its very loud and successful information warfare.