Ethiopia Anti-Terror Law: Journalists jailed for 11 years

Two journalists from Sweden illegally entered the eastern region of Ethiopia by crossing the border from Somalia. This has not been disputed.

What happened next is now the center of a brewing controversy over whether a journalist should be considered a terrorist if he is reporting on one.

The two journalists, Martin Schibbye and Johan Persson, apparently met with the ONLF (Ogaden National Liberation Front), a group of Oromo classified by the Ethiopian government as a terrorist organization, to enter Ethiopia and investigate claims that civilians are being forcibly removed from PetroTrans Exploration Areas. Here is a video from them as they prepare for the trip.

The journalists, as they traveled with the ONLF this past July, were caught in battle with the Ethiopian military. They were then captured (as you can see at the end of the video above). Now they have just been sentenced to 11 years in jail under recently passed anti-terrorism laws.

Amnesty International says Ethiopian authorities have been using anti-terror laws as a pretext to arrest and silence politicians and journalists who criticize government policies.

In a report released Friday, the human rights group said at least 114 opposition politicians and six journalists have been arrested since March.

Amnesty said, in many cases, calls for peaceful protests or attempts to conduct investigative journalism have been interpreted as acts of terrorism or other criminal wrongdoing.

While journalists and politicians in Ethiopia have been subject to arrests in the past, the report said the recent increase in terror charges represents “a new level of repression” in the government’s efforts to stifle political dissent.

Amnesty also criticized several senior Ethiopian government officials, including Prime Minister Meles Zenawi, for making public comments that imply that all terror suspects are guilty.

The Oromo liberation movements in Ethiopia are as old as the Eritrean and Tigrean ones. However, they have not achieved the same results and so they stand out as the ethnic group most at risk of government anti-terror campaigns.

While the Eritreans were able to create an independent state and the Trigreans have taken power in Ethiopia under Meles Zenawi, the Oromo movement has been less effective. Perhaps because of the Oromo population being the largest in Ethiopia it lacks the unified effort like the Eritreans and Tigreans; it is fractured by internal social/language, political and religious differences. The ONLF thus is just one of several Oromo groups still active and considered terrorists.

The arrest by the Ethiopian government of independent journalists who claim to be working on human rights issues (documenting ethnic-based mistreatment) could thus be based on fear that their work could bring the Oromo factions closer together; the larger population of Oromo might react to reports and turn against any minority group in power. But this is merely speculation. On the flip side the Oromo factions also could be closer together when they see journalists being arrested.

In any case the bottom line is that no real proof or explanation of a link to terrorism so far has been demonstrated for these two journalists yet they face 11 years in prison. The closest seems to be a video of them with guns while in presence of the ONLF, which does not seem like a normal standard of proof.

During the 6 September hearing, the prosecutor screened a propaganda video in support of the charges. The video, which showed the two journalists holding guns, had been posted on the pro-government Caakara News website a few days after their arrest. The defence strongly objected to the fact that sounds of shooting had been added to the soundtrack.

After the trial opened on 18 October, the charge of “participating in terrorism” was dropped on 3 November but the other two charges, supporting a terrorist group and entering the country illegally, were maintained.

It appears that conviction through any association is what Ethiopia intends to do with their new anti-terrorism laws. Digital Journal points out the judge used reverse logic in his harsh ruling and demanded journalists have to prove they are not helping terrorists.

…Judge Shemsu Sirgaga said the two “have not been able to prove that they did not support terrorism.” International media groups called attention to Judge Sirgaga’s remarks as a symptom of a deeper problem in the region. “Instead of proving their guilt, the judge accuses them of failing to prove their innocence. This is back-to-front,” wrote the secretary general of Reporters without Borders, Jean-Francois Julliard.

Digital Journal goes on to point out that the prime minister of Ethiopia has publicly stated a similar line of reasoning, that a distinction between journalists and their subjects has not been proven.

“Why would a journalist be involved with a terrorist organization and enter the country with a terrorist organization, escorted by armed terrorists, participating in fighting in which a terrorist organization was involved? If that is journalism, I don’t know what terrorism is,” [Meles Zenawi] said.

Note that he is quoted saying “participating in fighting” although the charges were merely “supporting” a group. In related news Ethiopia could again require (i.e. like the days of the Red Terror) all citizens to prove they are not going to overthrow the government.

AWS Object Expiration

Amazon has announced that you can schedule the deletion of objects in Simple Storage Service (S3); it also warns that there can be a delay between a scheduled expiration and an actual deletion, and that if you leave an empty prefix in an expiration rule then it will expire all your objects.

Some objects that you store in an S3 bucket might have a well-defined lifetime. For example, you might be uploading periodic logs to your bucket. After a period of time, you might not need to retain those log objects. In the past, you were responsible for deleting such objects when you no longer needed them. Now you can use Object Expiration to specify a lifetime for objects in your bucket.

With Object Expiration, when an object reaches the end of its lifetime, Amazon S3 queues it for removal and removes it asynchronously. There may be a small lag between the expiration date and the date at which Amazon S3 removes an object. You are not charged for storage time associated with an object that has expired.

It begs the question whether an expiration action is reversible, since the object technically has not been deleted. This is not just important from a forensics point of view but also for sneakily avoiding charges.

Final ATSB Report on 2008 Qantas flight QF72

The Australian Transportation Safety Bureau has released a comprehensive set of reports with an impressive amount of detail on the “In-flight upset – Airbus A330-303, VH-QPA, 154 km west of Learmonth, WA, 7 October 2008

Although the FCPC [flight control primary computer] algorithm for processing AOA [angle of attack] data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU [air data inertial reference unit] that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.

Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU’s central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer’s request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.

The failure caused the aircraft to take two abrupt “pitch-down” moves as depicted in a (5MB AVI) report video below. The sudden dive injured over 100 passengers and 75% of the crew; 39 were treated in hospital.

The simple explanation is that frequent data spikes had not been anticipated in the ADIRU. Now that the FCPC algorithms to process AOA have been updated for this rare issue the report is classified as complete.

However, the report leaves open the possibilities of a “rare type of…trigger event”. It does not, for example, completely rule out speculation about interference from Naval Communication Station Harold E. Holt — “the most powerful [kilohertz] transmission station in the Southern hemisphere” — near Learmonth Airport. Note the locations of the three similar spike issues.

The closest the report comes to final word on a trigger event is to say possibilities were “found to be unlikely”

…the failure mode was probably initiated by a single, rare type of trigger event combined with a marginal susceptibility to that type of event within the CPU module’s hardware. The key components of the two affected units were very similar, and overall it was considered likely that only a small number of units exhibited a similar susceptibility.

Some of the potential triggering events examined by the investigation included a software ‘bug’, software corruption, a hardware fault, physical environment factors (such as temperature or vibration), and electromagnetic interference (EMI) from other aircraft systems, other on-board sources, or external sources (such as a naval communication station located near Learmonth). Each of these possibilities was found to be unlikely based on multiple sources of evidence. The other potential triggering event was a single event effect (SEE) resulting from a high-energy atmospheric particle striking one of the integrated circuits within the CPU module. There was insufficient evidence available to determine if an SEE was involved, but the investigation identified SEE as an ongoing risk for airborne equipment.

Although the threat may continue to be unknown, the ATSB report is complete based on confidence that the vulnerability has been resolved by changes to the FCPC algorithms. It’s a good counter-example to my occasional point that to be secure is to be vulnerable. Here is a case where the risk from a vulnerability is so high, while the cost of a fix is so low, it had to be patched.

BSI Study: Vblock Threats and Countermeasures

The Bundesamts für Sicherheit in der Informationstechnik (BSI) in Germany has announced the release of a new cloud security study

Unter Mitwirkung des Bundesamts für Sicherheit in der Informationstechnik (BSI) hat die VCE-Koalition (Virtual Computing Environment Coalition, gebildet von Cisco und EMC mit Investitionen von VMware und Intel) eine Studie zum Thema “Gefährdungen und Gegenmaßnahmen beim Einsatz von VCE Vblock” erstellt. Die Studie beschreibt ausführlich die Gefährdungen, die sich aus Betrieb und Nutzung eines VCE Vblocks ergeben und zeigt in Anlehnung an die IT-Grundschutz-Kataloge des BSI Maßnahmen zum sicheren Betrieb eines Vblocks auf. Hierbei wurde der Fokus auf Cloud-spezifische Aspekte gelegt. Gefährdungen und Maßnahmen, die bereits heute in den IT-Grundschutz-Katalogen aufgeführt sind, werden in der vorliegenden Studie nicht betrachtet. Der VCE Vblock ist ein Infrastrukturpaket, in dem Blade-Server, Virtualisierung, Netzwerk- und Speichertechnologien, Sicherheitskomponenten sowie Funktionalitäten zum Management der IT-Infrastruktur in einer Komplettlösung vereint sind.

Auf Basis der im Mai 2011 veröffentlichten “Sicherheitsempfehlungen für Cloud Computing Anbieter” des BSI ist dies die erste einer Reihe von Studien zum Thema Private Cloud Computing, an denen das BSI zusammen mit verschiedenen Technologieanbietern arbeitet. Ziel der Studien ist es, die Sicherheitsempfehlungen des BSI um detailliertere und tiefergehende Sicherheitsanalysen von Cloud Computing Systemen mit besonderem Fokus auf Private Clouds zu erweitern. Zielgruppe der Studien sind in erster Linie IT-Verantwortliche in Unternehmen, Behörden und Institutionen, Administratoren sowie IT-Architekten für Virtualisierung und Informationssicherheit.

I couldn’t find a translation, so here’s mine:

The German Federal Office for Information Security has published a study on “threats and countermeasures in the use of VCE Vblock“. The VCE (Virtual Computing Environment) coalition was formed by Cisco and EMC with investments from VMware and Intel. The study describes risks of VCE Vblock; it shows, based on the IT Baseline Protection Manual from BSI, the appropriate measures for safe operation. The study is focused on specific aspects of cloud; risks and controls already listed in the IT Baseline Protection catalog are not included in the study. The VCE Vblock is an infrastructure package, which is made up of virtualization servers, networking and storage technologies, as well as security components and functionality to manage IT infrastructure in one complete solution.

Based on the BSI “Safety Recommendations for Cloud Computing Providers” published in May 2011, this is the first of a series of studies of private cloud computing by BSI in collaboration with various technology providers. The study aims to extend BSI security recommendations to more detailed and in-depth security analysis of cloud computing systems with particular emphasis on private clouds. Target groups of the studies are IT managers, administrators and IT architects for virtualization and information security.

Although the document text is in German many of the diagrams are still in English. A few use both languages and real-world examples, such as this one, which shows the risk of an Ost VLAN invading a West VLAN. I’m kidding. Not really