<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: barry]]></title>
    <link>http://securityratty.com/tag/barry</link>
    <description></description>
    <pubDate>Mon, 28 Jan 2008 08:26:35 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Extremism in defense of security is no vice]]></title>
      <link>http://securityratty.com/article/833ca0b56cb572826821838ff01100cf</link>
      <guid>http://securityratty.com/article/833ca0b56cb572826821838ff01100cf</guid>
      <description><![CDATA[During his acceptance speech for the 1964 Republican presidential nomination, Barry Goldwater proclaimed &quot;extremism in the defense of liberty is no vice.&quot; As a supporter of a strong defense during a...]]></description>
      <content:encoded><![CDATA[During his acceptance speech for the 1964 Republican presidential nomination, Barry Goldwater proclaimed "…extremism in the defense of liberty is no vice." As a supporter of a strong defense during a time when the Vietnam peace movement was gathering momentum, Goldwater was portrayed as an extremist by his political rivals. Even though this image of a hawkish warmonger would be used to the Democrat's advantage during the presidential campaign, Goldwater stood by his principles.]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/goldwater">goldwater</category>
      <category domain="http://securityratty.com/tag/goldwater stood">goldwater stood</category>
      <category domain="http://securityratty.com/tag/barry goldwater">barry goldwater</category>
      <category domain="http://securityratty.com/tag/strong defense">strong defense</category>
      <category domain="http://securityratty.com/tag/republican presidential nomination">republican presidential nomination</category>
      <category domain="http://securityratty.com/tag/vietnam peace movement">vietnam peace movement</category>
      <category domain="http://securityratty.com/tag/acceptance speech">acceptance speech</category>
      <category domain="http://securityratty.com/tag/vice">vice</category>
      <source url="http://www.networkworld.com/columnists/2008/090408-oped.html?fsrc=rss-security">Extremism in defense of security is no vice</source>
    </item>
    <item>
      <title><![CDATA[Q&A with Barry Cummings, InteropNet Help Desk Lead]]></title>
      <link>http://securityratty.com/article/360604bd9ff6c3eb687cb330af7e6f66</link>
      <guid>http://securityratty.com/article/360604bd9ff6c3eb687cb330af7e6f66</guid>
      <description><![CDATA[During Interop New York 2008 Hot Stage I had the opportunity to sit down with Barry Cummings, the team lead for the InteropNet Help Desk to talk to him about his experiences with Interop and EM7...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/07/barry-205x3001.jpg" border="0" alt="barry-205x300" width="168" height="244" align="left" /> During Interop New York 2008 Hot Stage I had the opportunity to sit down with Barry Cummings, the team lead for the InteropNet Help Desk to talk to him about his experiences with Interop and EM7.</p>
<p><strong>ScienceLogic:</strong> What&#8217;s your real job when you&#8217;re not here?</p>
<p><strong>Cummings:</strong> I&#8217;m a consultant. I have a networking services company through which I offer services all the way from Layer 1 to desktop support.</p>
<p><strong>ScienceLogic:</strong> How long have you been involved with Interop?</p>
<p><strong>Cummings:</strong> I attended my first show in <a href="http://www.thevarguy.com/2006/09/19/interop-2006-vs-interop/">1996</a>. I volunteered for my first shown in <a href="http://www.highbeam.com/doc/1G1-54672240.html">1999</a> and haven&#8217;t missed a year since.</p>
<p><strong>ScienceLogic: </strong>What makes you want to come back each year for the additional punishment?</p>
<p><strong>Cummings:</strong> Working with <a href="http://farm4.static.flickr.com/3009/2454750176_812e3a5522_o.jpg">the team</a>, which are long-term established friendships at this point. That and the excitement of working with the new technologies as they or even before they come out.</p>
<p><strong>ScienceLogic: </strong>In <a href="http://farm3.static.flickr.com/2128/2453915813_6f2f63f8b9_o.jpg">Las Vegas</a> you were Team Lead for Help Desk. What are you going be doing in NY?</p>
<p><strong>Cummings: </strong>Same thing. That position incorporates some management over the show floor and off-show floor area. That&#8217;s kinda where they put me and I&#8217;ve been doing it solidly for about 5 years.</p>
<p><strong>ScienceLogic:</strong> What are the biggest changes you&#8217;ve seen in the show over the years, what sticks out?</p>
<p><strong>Cummings: </strong>The amount of monitoring that we have and what we do with it has really been changing. We went from more, to almost none and now back to more. We&#8217;ve been through numerous vendors and apps over the years and until recently weren&#8217;t overly happy.</p>
<p><strong>ScienceLogic: </strong>Did the integration between Service Desk and Monitoring that ScienceLogic created help streamline things in a meaningful manner?</p>
<p><strong>Cummings:</strong> Absolutely. In the short time that we have to get things setup there&#8217;s no way to integrate multiple products in this area. Having things pre-integrated allowed us to quickly link network events and the related tickets together in the management system [EM7].</p>
<p><strong>ScienceLogic: </strong>Moving forward on the Service Desk, do you think you can move away from your current paper driven process to a completely paperless process?</p>
<p><strong>Cummings</strong>: I could potentially see it changing as we get the process down and fine tune it. We might be able to get an electronic interface for people. It&#8217;s tough. There&#8217;s always going to be an aspect of the shows we have to hand off on paper and get to legacy people such as electricians and movers.</p>
<p><strong>ScienceLogic: </strong>If there was one thing you could improve that you think would make the overall show or help desk operate better, what would it be?</p>
<p><strong>Cummings: </strong>We need to keep refining processes down to get information into EM7. Better for using the integration and automation that already exists in EM7.</p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Q%26%23038%3BA+with+Barry+Cummings%2C+InteropNet+Help+Desk+Lead&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fqa-with-barry-cummings-interopnet-help-desk-lead%2F07%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 09:31:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/barry cummings">barry cummings</category>
      <category domain="http://securityratty.com/tag/cummings">cummings</category>
      <category domain="http://securityratty.com/tag/desk">desk</category>
      <category domain="http://securityratty.com/tag/sciencelogic">sciencelogic</category>
      <category domain="http://securityratty.com/tag/service desk">service desk</category>
      <category domain="http://securityratty.com/tag/management system em7">management system em7</category>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/em7">em7</category>
      <category domain="http://securityratty.com/tag/team lead">team lead</category>
      <source url="http://blog.sciencelogic.com/qa-with-barry-cummings-interopnet-help-desk-lead/07/2008">Q&amp;A with Barry Cummings, InteropNet Help Desk Lead</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[Nigerian 419 scam on LinkedIn]]></title>
      <link>http://securityratty.com/article/f9623fd36c4654eb8a82f3e8999046e9</link>
      <guid>http://securityratty.com/article/f9623fd36c4654eb8a82f3e8999046e9</guid>
      <description><![CDATA[Researchers from BitDefender have detected that social networks are the newest medium for Nigerian &quot;4-1-9&quot; scams...In the most recent outbreak of the Nigerian scam -- an advance fee fraud that is...]]></description>
      <content:encoded><![CDATA[
      Researchers from BitDefender have detected that social networks are the newest medium for Nigerian "4-1-9" scams...In the most recent outbreak of the Nigerian scam -- an advance fee fraud that is estimated to gross hundreds of millions of dollars annually -- the scam letter is sent as a LinkedIn or other social networking sites' invite to join the user's network. A profile page is established with the social networking site, to make the claims in the scam letter appear legitimate. Since the scams are only delivered to the social networking site's user accounts, they completely bypass antispam filters...

Read the full article <a href="http://www.net-security.org/secworld.php?id=6061">here</a>.

Social networking sites have their place and I've seen enough demonstrations of what a powerful tool they can be to have become convinced of their value and potential for being a source of revenue. However, I'll repeat my <a href="http://www.computerweekly.com/blogs/stuart_king/2008/03/consumer-networks-for-business.html">earlier message</a> that we need to  get a good handle on the risks before we jump in for the corporate long haul. The issue of identity on social networking sites is, in my opinion, the one thing that will see them either succeed or fail. If you can't ascertain that the person pertaining to be Ingrid from Stockholm is really Barry from Bath then you can't do business.







      
   ]]></content:encoded>
      <pubDate>Thu, 24 Apr 2008 14:41:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/social networks">social networks</category>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/nigerian">nigerian</category>
      <category domain="http://securityratty.com/tag/scam letter">scam letter</category>
      <category domain="http://securityratty.com/tag/user">user</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/nigerian scam">nigerian scam</category>
      <category domain="http://securityratty.com/tag/advance fee fraud">advance fee fraud</category>
      <category domain="http://securityratty.com/tag/user accounts">user accounts</category>
      <source url="http://www.computerweekly.com/blogs/stuart_king/2008/04/nigerian-419-scam-on-linkedin.html">Nigerian 419 scam on LinkedIn</source>
    </item>
    <item>
      <title><![CDATA[NSA's Domestic Spying]]></title>
      <link>http://securityratty.com/article/734e5469777f8c865fcfcd19215b61f8</link>
      <guid>http://securityratty.com/article/734e5469777f8c865fcfcd19215b61f8</guid>
      <description><![CDATA[This article from The Wall Street Journal outlines how the NSA is increasingly engaging in domestic surveillance, data collection, and data mining. The result is essentially the same as Total...]]></description>
      <content:encoded><![CDATA[<p><a href="http://online.wsj.com/article/SB120511973377523845.html?mod=todays_us_page_one">This article</a> from <i>The Wall Street Journal</i> outlines how the NSA is increasingly engaging in domestic surveillance, data collection, and data mining.  The result is essentially the same as Total Information Awareness.</p>

<blockquote>According to current and former intelligence officials, the spy agency now monitors huge volumes of records of domestic emails and Internet searches as well as bank transfers, credit-card transactions, travel and telephone records. The NSA receives this so-called "transactional" data from other agencies or private companies, and its sophisticated software programs analyze the various transactions for suspicious patterns. Then they spit out leads to be explored by counterterrorism programs across the U.S. government, such as the NSA's own Terrorist Surveillance Program, formed to intercept phone calls and emails between the U.S. and overseas without a judge's approval when a link to al Qaeda is suspected.

<p>[...]</p>

<p>Two former officials familiar with the data-sifting efforts said they work by starting with some sort of lead, like a phone number or Internet address. In partnership with the FBI, the systems then can track all domestic and foreign transactions of people associated with that item -- and then the people who associated with them, and so on, casting a gradually wider net. An intelligence official described more of a rapid-response effect: If a person suspected of terrorist connections is believed to be in a U.S. city -- for instance, Detroit, a community with a high concentration of Muslim Americans -- the government's spy systems may be directed to collect and analyze all electronic communications into and out of the city.</p>

<p>The haul can include records of phone calls, email headers and destinations, data on financial transactions and records of Internet browsing. The system also would collect information about other people, including those in the U.S., who communicated with people in Detroit.</p>

<p>The information doesn't generally include the contents of conversations or emails. But it can give such transactional information as a cellphone's location, whom a person is calling, and what Web sites he or she is visiting. For an email, the data haul can include the identities of the sender and recipient and the subject line, but not the content of the message.</p>

<p>Intelligence agencies have used administrative subpoenas issued by the FBI -- which don't need a judge's signature -- to collect and analyze such data, current and former intelligence officials said. If that data provided "reasonable suspicion" that a person, whether foreign or from the U.S., was linked to al Qaeda, intelligence officers could eavesdrop under the NSA's Terrorist Surveillance Program.</p>

<p>[...]</p>

<p>The NSA uses its own high-powered version of social-network analysis to search for possible new patterns and links to terrorism. The Pentagon's experimental Total Information Awareness program, later renamed Terrorism Information Awareness, was an early research effort on the same concept, designed to bring together and analyze as much and as many varied kinds of data as possible. Congress eliminated funding for the program in 2003 before it began operating. But it permitted some of the research to continue and TIA technology to be used for foreign surveillance.</p>

<p>Some of it was shifted to the NSA -- which also is funded by the Pentagon -- and put in the so-called black budget, where it would receive less scrutiny and bolster other data-sifting efforts, current and former intelligence officials said. "When it got taken apart, it didn't get thrown away," says a former top government official familiar with the TIA program.</p>

<p>Two current officials also said the NSA's current combination of programs now largely mirrors the former TIA project. But the NSA offers less privacy protection. TIA developers researched ways to limit the use of the system for broad searches of individuals' data, such as requiring intelligence officers to get leads from other sources first. The NSA effort lacks those controls, as well as controls that it developed in the 1990s for an earlier data-sweeping attempt.</blockquote></p>

<p>Barry Steinhardt of the ACLU <a href="http://www.dailykos.com/storyonly/2008/3/11/14380/5939/606/474351">comments</a>:</p>

<blockquote>I mean, <a href="http://www.aclu.org/clock">when we warn</a> about a "<a href="http://www.aclu.org/monster">surveillance society</a>," <i>this</i> is what we're talking about. This is it, this is the ballgame. Mass data from a wide variety of sources -- including the private sector -- is being collected and scanned by a secretive military spy agency. This represents nothing less than a major change in American life -- and unless stopped the consequences of this system for everybody will grow in magnitude along with the rivers of data that are collected about each of us -- and that's more and more every day.</blockquote>

<p>More <a href="http://blogs.zdnet.com/Ratcliffe/?p=334&tag=nl.e622">commentary</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=PyU02RF"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=PyU02RF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=BepJt2F"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=BepJt2F" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 26 Mar 2008 03:02:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nsa">nsa</category>
      <category domain="http://securityratty.com/tag/data haul">data haul</category>
      <category domain="http://securityratty.com/tag/haul">haul</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/transactional information">transactional information</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/nsa receives">nsa receives</category>
      <category domain="http://securityratty.com/tag/mass data">mass data</category>
      <category domain="http://securityratty.com/tag/terrorism information awareness">terrorism information awareness</category>
      <source url="http://www.schneier.com/blog/archives/2008/03/nsas_domestic_s.html">NSA's Domestic Spying</source>
    </item>
    <item>
      <title><![CDATA[OmniAmerican Bank targeted by cyber criminals]]></title>
      <link>http://securityratty.com/article/726c4a052fe955720d99ad62680b2d66</link>
      <guid>http://securityratty.com/article/726c4a052fe955720d99ad62680b2d66</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
1/24/08

Organization
OmniAmerican Bank

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types of Data
Internal bank...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/omni.jpg" align="right" height="45" width="198"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>1/24/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.omniamerican.com/" target="_blank"> OmniAmerican Bank</a><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Internal bank systems and account numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>An "international gang of cyber criminals" breached OmniAmerican bank systems and used a variety of information to create new personal identification numbers (PINs) and fake debit cards.&nbsp; The criminals then used the cards at to make withdrawls at ATMs in Eastern Europe, Russia, Ukraine, Britain, Canada and New York.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.star-telegram.com/business/story/429367.html" target="_blank"> Star-Telegram Story</a> <br><a href="http://www.sacbee.com/103/story/660690.html" target="_blank"> Sacramento Bee Story</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Barry Shlachter, Star-Telegram<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>An international gang of cyber criminals hacked into OmniAmerican Bank's records, the bank's president disclosed Wednesday.<br><br>They stole scores of account numbers, created new PINs, fabricated debit cards, then withdrew cash from ATMs in Eastern Europe, including Russia and Ukraine, as well as in Britain, Canada and New York.<br><span style="font-style: italic;">[Evan] This is either a geographically disperse "gang", or the information was sold to various buyers.</span><br><br>"It was a pretty sophisticated scheme," said Tim Carter, president of the Fort Worth-based bank.<br><span style="font-style: italic;">[Evan] I wonder how sophisticated this attack really was.&nbsp; My first suspicion is a targeted (spear) phishing attack, which isn't very sophisticated.</span><br><br>The amount stolen is not yet known, he said, describing it only as "minimal." No depositors will lose money, he said.<br><br>Fewer than 100 accounts, some of them dormant, were compromised, all with a daily withdrawal limit of less than $1,000, he said.<br><br>After discovering the fraudulent activity Friday afternoon, OmniAmerican placed temporary limits on some ATM and debit-card transactions and suspended some electronic banking services, which were restored Sunday, Carter said. At no time were customer deposits at risk, he stressed. "We reduced by half the dollar amount that could be withdrawn and limited [access] to Texas. We cut out anything outside Texas," Carter said.<br><span style="font-style: italic;">[Evan] Seems like a logical response, but what a hassle for customers.&nbsp; As of Monday morning, the warning below is still posted on OmniAmerican's home page.<br><br><img src="http://images.quickblogcast.com/95781-88451/omninotice.jpg" border="0" width="310"><br></span><br>The unauthorized withdrawals were stopped Friday, and bank employees worked over the weekend to deal with the damage, he said.<br><span style="font-style: italic;">[Evan] The unauthorized withdrawls made on accounts that were known to have been compromised at least.</span><br><br>The bank learned of the breach from customers inquiring about unusual activity in their accounts, from internal monitoring and from a law-enforcement agency, which Carter declined to name.<br><br>Letters alerting check-card holders of the fraudulent activity were mailed Wednesday, the bank said.<br><br>OmniAmerican is also issuing approximately 40,000 new debit cards as a safeguard against future fraudulent activity, Carter said. Each needs a revised personal identification number.<br><br>Martin Carmichael, the Plano-based chief security officer at McAfee, a computer-security firm, said this type of cyber-attack has become "a commonplace occurrence," although some banks are reluctant to admit that their security has been breached.<br><span style="font-style: italic;">[Evan] I agree with Mr. Carmichael.&nbsp; In my work with banks, they all expect to lose a certain amount of money.&nbsp; They say it comes with the territory.&nbsp; If a breach is disclosed to the public, it could negatively affect customer confidence which equates to lost revenue.&nbsp; Lost dollars due to customer confidence usually outweigh the lost dollars from the breach itself.&nbsp; I guess anyway.&nbsp; Banks are attacked and/or compromised every day because they have the one thing everybody wants…money.</span><br><br>Carmichael said OmniAmerican apparently fell victim to one of the more skilled gangs of criminal hackers.<br><span style="font-style: italic;">[Evan] Again, I question how skilled an attacker really needs to be.&nbsp; Many "skilled" attackers go unnoticed and why would skilled attackers stop at "fewer than 100 accounts" before calling attention to themselves?</span><br><br>"If you look at the sophistication of it -- going in, modifying PINs, issuing cards -- this is not a kid out there," he said. "This appears to be something set up. Time was involved in executing it."<br><br>Whoever they are, he said, "they're elite, more elegant, and it's difficult for banks and many enterprises to keep pace with their activities.<br><br>"Banks are under a great amount of pressure to balance risk and shareholder value," said Carmichael, speaking from Las Vegas, where he is attending a conference. "They could do more, [but they] have a hard time justifying the cost until an incident occurs."<br><span style="font-style: italic;">[Evan] Very well put, sad and true.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Maybe this was a sophisticated attack like some are claiming.&nbsp; I just think about how easy it could be to carry out a spear phishing attack either to download and install malware or collect a password of a bank employee (because many people use one password for everything) and proxy the network traffic through compromised systems in other countries.&nbsp; Phishing and other attacks based on human behavior are usually much more successful than high-tech exploits.<br><br>OmniAmerican deserves some credit for a firm and decisive incident response. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/01/28/omni.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 28 Jan 2008 08:26:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/omniamerican bank">omniamerican bank</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/omniamerican bank systems">omniamerican bank systems</category>
      <category domain="http://securityratty.com/tag/omniamerican">omniamerican</category>
      <category domain="http://securityratty.com/tag/internal">internal</category>
      <category domain="http://securityratty.com/tag/internal bank systems">internal bank systems</category>
      <category domain="http://securityratty.com/tag/debit cards">debit cards</category>
      <category domain="http://securityratty.com/tag/cards">cards</category>
      <category domain="http://securityratty.com/tag/bank employees">bank employees</category>
      <source url="http://breachblog.com/2008/01/28/omni.aspx">OmniAmerican Bank targeted by cyber criminals</source>
    </item>
  </channel>
</rss>
