The FBI laughs last

Episode 380 of the Cyberlaw Podcast

We begin this episode with Michael Ellis taking a close look at the U.S. government's takedown of the REvil ransomware gang. It's a good story for the good guys, as REvil seems to have been brought down by the same tool it used against so many of its victims – malware that lingered in the backup data needed to restore the network. I note that this seems to be a continuation of efforts that were interrupted in the early summer – amid criticism that the FBI had prioritized its planned takedown over giving victims the decryption key. Now that the takedown has happened, it looks like the FBI is getting the last laugh.

The U.S. is trying. Michael thinks that the effort to hold Putin responsible for stopping Russian ransomware gangs is set back by recent statements in which the Pentagon raised doubts about whether Putin actually has the ability to stop the attacks.

One technology where Russia's does have more capability than expected is, naturally, its ability to censor and suppress criticism, both on domestic and Western platforms. David Kris discusses the kinds of hostages Russia has learned to take, and its success in bringing Western social media to heel.

The U.S. Commerce Department has released a complex new rule for the export of network intrusion tools. Meredith Rathbone, from Steptoe's trade regulation practice, boils the rule down to a few soundbites. The short version? Commerce has done a pretty good job of protecting legitimate distributors of intrusion software, but even the good guys are going to have to save a lot more receipts.

Michael and Paul Rosenzweig reprise the latest news about content moderation, particularly Twitter's own study showing that its algorithms benefit more conservative than left-wing content. That raises the question whether right-leaning commentary and news is more popular because more people want it. If so, the employees at Facebook are determined to keep it from them; recent leaks show aggressive internal efforts to squash Breitbart's reach on the platform.

David and I unpack Ian Bremmer's Foreign Affairs article on "How Big Tech Will Reshape the Global Order." David sees more in the piece than I do.

Paul and Michael kick off a discussion of US negotiations with the EU over transatlantic data flows. But in no time, all four of us join in. We offer some solutions, and plenty of criticism for the EU. (Okay, maybe "the continent that invented hypocrisy" was a little harsh.)

David notes that NSA is pursuing more collaboration with the private sector. How well that will work out is still TBD, we agree.

In quick hits and updates:

• I note with irony that Frances Haugen has discovered the limits of criticizing Facebook.  Whatever you do, you can't criticize WhatsApp's growing use of end2end encryption, even if it does allow the service to ignore foreign cyberespionage.
• Trump and TRUTH are together at last, and Paul has the details. Bottom line: it feels like a typical Donald Trump production: great hype, plenty of controversy, and weak execution.
• Hackback, isn't dead, it turns out, yet. I discuss the political and business advocates for a kinder, gentler version of private hackback, modeled on private investigators.

Download the 380th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [e-mail]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Comments

[DaivdBehar]

The lawyer rich FBI is in utter failure, allowing billions of federal crime, 100 million/year in the US. Millions of those crimes are by the platforms, in overstating viewerships to defraud advertisers.

[Gandydancer]

The linked admission by the Pentagon that it cannot attribute the actions of REvil to Russia puts the final kibosh on the three-agency "assessment" that it was Russia that stole the Podesta emails, etc., to elect Trump, but we already knew that that was partisan crap, right?

[jb]

REvil wasn't a player in the Podesta hack, so no.

That's like saying because the US can't control Anonymous therefore stuff the NSA does shouldn't be attributed to the US.

[M L]

Even so, note that there's no good evidence Russia was behind the Podesta email hack. Mueller used the word "apparently" because they're just assuming that a Russian bread crumb supposedly left behind means it's Russia. Basically, assuming that a pirate ship flying a Russian flag is Russian. The entire narrative was very important and premised on this but ultimately bull shit.

[jb]

Well, two different discussions here:

1) Does the recent admission about REvil tell us anything about whether or not Russia was behind the Podesta hacks? I think the answer is clearly no. We're talking about different hacking groups and no one has ever attempted to link REvil to the DNC hacks.

2) How strong is the evidence that Russia was behind the DNC hacks? This is really two questions: how confident are we that the hackers were Russian, and then, are these essentially state actors or are they just criminal gangs that happen to be located in Russia (more like REvil)? While you're correct that the evidence for both claims is circumstantial, I think it's fairly strong. e.g., with the Podesta hack the actual mechanism for the compromise was a Bitly URL paid for by the same account as other Fancy Bear-linked attacks. Similarly, both Fancy Bear and Cozy Bear have long-standing linkages to Russian intelligence agencies and, unlike REvil, tend to target political actors rather than looking for opportunities to generate money through ransomware attacks. I haven't spent a ton of time looking at these claims, but people I know who are experts in the space seem pretty confident about the evidence; I guess that's good enough for me, but I can see how that's not persuasive to others.

[M L]

I haven't spent a ton of time either, so I could be missing something. I remember reading this: https://www.realclearinvestigations.com/articles/2019/07/05/crowdstrikeout_muellers_own_report_undercuts_its_core_russia-meddling_claims.html

Also, The Intercept, "HERE’S THE PUBLIC EVIDENCE RUSSIA HACKED THE DNC — IT’S NOT ENOUGH"

[jb]

That article does not really undercut the argument that Russia hacked Podesta's e-mail. As far as I can tell it boils down to "in the indictment, Muller said that GRU agents 'appeared' to have stolen thousands of e-mails" without actually pushing back on any of the evidence that they did, and "the way the e-mails got from the GRU hackers to Wikileaks is not that clear". I think the second argument is a fair one (that doesn't actually question whether or not Russia did it), but the first one is really grasping at straws. In either case, if you're looking at this in the context of what probably happened vs. a criminal trial, I think there's plenty of support for the proposition that Russia did it.

[M L]

Maybe they did. Maybe they didn't. What's not warranted is the confident assertions that have been repeated for years on end by all the deep state shills and hysterical Trump/Russia conspiracy theorists.

[jb]

Aren't all intelligence assessments just statements of relative confidence? I agree that we should treat all of it with some skepticism given long-term track records of all of these agencies, but there's nothing really different about the the Russian hacking assessments than tying terror attacks to ISIS or understanding the state of Iran's or North Korea's nuclear program, etc.

[M L]

I agree with your sentiment. Ideally and in many circumstances, evidence is more public, so that we don't have to just blindly accept very self-serving assertions made by intelligence agencies with a long track record of brazen lying.

[Gandydancer]

There is no evidence that Fancy Bear, Cozy Bear, etc. (the names were supplied by CrowdStrike, which has other credibility problems, but the conclusionary names are a clue) are operations by Russian equivalents of the NSA. And the reason there is no evidence is the SAME reason REvil can't be tied to the Russian state. They don't actually know shit about who did it.

With that in view, the fact that REvil didn't exist in 2016 is beside the point. What the Pentagon admitted is precisely that at the level of knowledge available for the "assessments" declared by the Obama-apponted agency heads' hand-picked crews of analysts they had no business pretending to know what they didn't know. It's Russia!Russia!Russia hoax all the way.

[jb]

There is no evidence that Fancy Bear, Cozy Bear, etc. (the names were supplied by CrowdStrike, which has other credibility problems, but the conclusionary names are a clue) are operations by Russian equivalents of the NSA.

Dutch intelligence hacked into CozyBear's operations obtained access to security cameras in the spaces they worked in. They were subsequently able to identify Russian intelligence operatives as part of the CozyBear team.

While it's true that for FancyBear there's not such clear evidence (and FancyBear is more clearly linked to the Podesta hack than CozyBear), the major intelligence agencies as well as independent security researchers (not just CrowdStrike) have reasonable confidence that it's linked to the GRU.

The Pentagon's recent statement was specific to ransomware groups and didn't revisit any of the previous assessments about other Russian groups. I guess you can make up whatever inferences you want from that, but it won't have anything to do with what they actually said.

[Gandydancer]

One of the morons inadvertently endorses totalitarians blockage of cross-border internet access: It's ok if WE do that b/c it's retaliation, right?