On Gag Orders and Swedish Law

Recently we have all, thanks to Edward Snowden, become aware of the security issues inherent in software from US companies. The Government of the United States of America have legal instruments to force vendors to comply with state orders, e.g. install back doors, and make it illegal for them to reveal this to their customers.

In practice, any government can try to persuade any company to do anything by using bribes or threats, but only in a few countries can the government legally prevent companies and their employees from talking publicly about it. The USA is one such country, and from the leaked information available it seems that they employ it liberally.

Take for example Lavabit, a US company that provided encrypted email services to its customers. It, supposedly like many others, was approached by US authorities and required to install a back door for them. Unlike most other companies, the owner of the company, Ladar Levison, chose to close down Lavabit rather than betray his customers, and he may now face prosecution for this decision. We know about this only because Levison took great personal loss and risk instead of complying. We do not know about all the other companies that simply complied, and they all risk prosecution if they resist or go public. Levison says that he would “strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” [infoworld.com]

In Sweden it works differently. Here the government is also involved in massspying through the FRA and the Swedish police demands automated access to all telecommunication data, but we know this, not through anonymous leaks or heroic whistle-blowing, but by the government passing overt legislation permitting it, or from the people involved raising their voices and speaking out, e.g. by recording private talks with the security police and releasing it to the public. However, when this happens there are no legal instruments the government can use to retaliate. This allows Swedish companies to uphold their customers’ privacy without risk. If approached by government agencies, Swedish companies risk nothing by refusing to comply and/or going public.

Protect your data
If you have data that needs protection, you can rest assured that products from BlockMaster will contain no back doors. It is not in our interest, and our government cannot force us. We offer managed hardware-encrypted USB devices that will protect your data on the go, and ShieldShare that will allow you to securely share files with end-to-end encryption where only the clients hold the encryption keys.

Regular USB Drives - A Spy’s Best Friend

News in the Nordic countries have featured heads of military and policy intelligence issuing stark warnings on the usage of unknown unsecure USB drives used for industrial espionage and foreign intelligence services.

Both PST in Norway and MUST in Sweden have on separate occasions in 2013 highlighted the threat of these dangerous USB drives. The data and warnings correlate both with our own surveys here at BlockMaster and also with the famous drop test that Homeland Security did in the US.

The current threat that is highlighted is giveaway USB drives or simply USB drives found on the street or laying around. Several incidents have been reported in Sweden and Norway where these drives have been plugged into computers and infected networks using malicious software. At the Swedish military intelligence branch, Klas Eklund also points out that a regular USB drives can load more data than used to be stored in one of the old secure data centers back in the day.

But when it comes to the drop-and-infect, the method to make someone plug the infected drives follows is simply to give a free USB drive to and employee or to drop it outside their office. Human curiosity takes care of the rest. BlockMaster’s survey showed that 76% would plug and unknown device in. And in the Homeland Security droptest in the parking lot of the Pentagon they achieved a 90% plug in rate by having an official looking logo printed on the device.

Given that the Homeland Security test is from 2011 little has changed in user behaviour, it is simply not a problem that will be solved without a technical solution. The solution is to lock down the network and not allow unknown USB drives and instead rely on secure USB drives for data transport. The SafeConsoleReady secure USB drives that we at BlockMaster power are all hardened against infections. Furthermore BlockMaster offers a low-price USB port control that locks out the dangerous drives.

Sources:

http://www.expressen.se/nyheter/dokument/spionchefen-som-jagar-usb-stickor/

http://www.gsnmagazine.com/article/23705/usb_ploy_dhs_exposes_curiosity_security_flaw

Curiosity is the real killer, and puts your data at major risk

What we should really learn from recent USB ‘drive-by dropping’ episodes is that people with piqued curiosities – even good, honest, tax-paying folks – will not hesitate to commandeer, inspect and thereby compromise the security of your confidential data if it can be easily accessed via a USB flash drive… Read more →

Survey: USB Drives are the Greatest Breach Risk at the Workplace - Women are 25% less of an Insider Threat

A new survey shows that when given the choice of a tool to perform a data breach, 60% of employees opt for the USB Flash drive. It also showed that over 25% of men in a management position think that it is OK to take information with you when you end employment. Women have a higher sense of morality when it comes to company data and are less likely offenders.
Read more →

Massive 500.000+ USB Data Breach Records Rocks Mobile Giant

Telecom provider T-Mobile has been hit by a massive data breach from an insider attack.  The attacker relied on a USB drive to steal information that he then resold to a competing firm. Read more →