Government officials around the globe targeted for hacking through WhatsApp

November 1, 2019  02H44  GMT/ZULU

by Tamara Kachelmeier and Biodun Iginla, BBC News and Reuters Technology reporters, WASHINGTON

WASHINGTON - Senior government officials in multiple U.S.-allied countries were targeted earlier this year with hacking software that used Facebook Inc’s WhatsApp to take over users’ phones, according to people familiar with the messaging company’s investigation.

FILE PHOTO: The WhatsApp messaging application is seen on a phone screen August 3, 2017. REUTERS/Thomas White/File Photo

Sources familiar with WhatsApp’s internal investigation into the breach said a “significant” portion of the known victims are high-profile government and military officials spread across at least 20 countries on five continents. Many of the nations are U.S. allies, they said.

The hacking of a wider group of top government officials’ smartphones than previously reported suggests the WhatsApp cyber intrusion could have broad political and diplomatic consequences.

WhatsApp filed a lawsuit on Tuesday against Israeli hacking tool developer NSO Group. The Facebook-owned software giant alleges that NSO Group built and sold a hacking platform that exploited a flaw in WhatsApp-owned servers to help clients hack into the cellphones of at least 1,400 users between April 29, 2019, and May 10, 2019.

The total number of WhatsApp users hacked could be even higher. A London-based human rights lawyer, who was among the targets, sent Reuters photographs showing attempts to break into his phone dating back to April 1.

While it is not clear who used the software to hack officials’ phones, NSO has said it sells its spyware exclusively to government customers.

ADVERTISEMENT

Some victims are in the United States, United Arab Emirates, Bahrain, Mexico, Pakistan and India, said people familiar with the investigation. Reuters could not verify whether the government officials were from those countries or elsewhere.

Some Indian nationals have gone public with allegations they were among the targets over the past couple of days; they include journalists, academics, lawyers and defenders of India’s Dalit community.

NSO said in a statement that it was “not able to disclose who is or is not a client or discuss specific uses of its technology.” Previously it has denied any wrongdoing, saying its products are only meant to help governments catch terrorists and criminals.

Cybersecurity researchers have cast doubt on those claims over the years, saying NSO products were used against a wide range of targets, including protesters in countries under authoritarian rule.

Citizen Lab, an independent watchdog group that worked with WhatsApp to identify the hacking targets, said on Tuesday at least 100 of the victims were civil society figures such as journalists and dissidents, not criminals.

John Scott-Railton, a senior researcher at Citizen Lab, said it was not surprising that foreign officials would be targeted as well.

ADVERTISEMENT

“It is an open secret that many technologies branded for law enforcement investigations are used for state-on-state and political espionage,” Scott-Railton said.

Prior to notifying victims, WhatsApp checked the target list against existing law enforcement requests for information relating to criminal investigations, such as terrorism or child exploitation cases. But the company found no overlap, said a person familiar with the matter. Governments can submit such requests for information to WhatsApp through an online portal the company maintains.

WhatsApp has said it sent warning notifications to affected users earlier this week. The company has declined to comment on the identities of NSO Group’s clients, who ultimately chose the targets.

In tech 'awakening,' U.S. workers at Google, Amazon join climate protests

September 21, 2019  06H:31  GMT/ZULU

by Tamara Kachelmeier and Biodun Iginla, BBC News and Reuters Technology reporters, San Francisco

SAN FRANCISCO - Hundreds of workers from Google, Amazon and other technology companies on Friday joined climate-change marches in San Francisco and Seattle, saying their employers had been too slow to tackle global warming and needed to take more drastic action.

People protest during a Climate Strike march in San Francisco, U.S. September 20, 2019. REUTERS/Kate Munsch

While students set the global agenda and led local marches, U.S. West Coast tech workers said they turned out in support and called on makers of software and hardware as well as providers of services such as cloud data storage to do more.

The marches cap a week in which Alphabet Inc’s Google said it had increased its wind and solar energy deals by more than 40%, and Amazon.com Inc pledged to use only renewable energy by 2030.

“We’re out on the streets because we want them to do more,” said Danilo Quilaton, 34, a product designer for Amazon’s video streaming subsidiary Twitch. He called Thursday’s pledge by his company a big win.

“Amazon promised some things, but we still have to hold them liable,” said Quilaton, who held a sign that read, “I work at Amazon. I want zero deals with oil & gas” companies.

The number of people carrying signs referring to tech companies and shouting tech-related slogans on the streets of San Francisco and Seattle numbered in the hundreds or low thousands, a fraction of the tech workforce. But their presence was bigger than in past protests and represented a change in an industry whose engineers have often focused on their work, rather than social issues.

“Amazon, let’s raise the bar not the temperature,” read one protester’s sign outside the glass domes at Amazon’s headquarters in Seattle known as the Spheres, local symbols of the industry’s wealth.

ADVERTISEMENT

“Tech is having an awakening,” said Google business analyst Marie Collins in San Francisco. “Tech workers are realizing they have to take collective action.”

One sign with the hashtag #techwontbuildit called for zero emissions by 2030, no deals to provide technology to oil and gas companies and zero corporate sponsorships of groups that deny climate change, echoing internal petitions at the big companies.

The coordination across various companies paralleled recent joint efforts by staff to oppose work on military contracts, support immigrants and other issues.

Tech workers by late morning joined youth-led marches, which filled a dozen blocks of San Francisco’s Market Street. In Seattle, hundreds of tech workers gathered at Amazon’s headquarters and marched to join bigger groups.

The companies have signaled sympathy with workers on addressing climate change. But Amazon Chief Executive Jeff Bezos on Thursday said it would be a bad idea to leave the cloud company’s oil and gas customers with outdated tools as they are trying to evolve their businesses.

‘HOLD THEM ACCOUNTABLE’

An Amazon spokeswoman on Friday said the company understands that some employees feel strongly about climate change and so does Amazon. Google, which on Thursday announced its clean energy deals, did not immediately return a request for comment.

ADVERTISEMENT

Though much of the public thinks of technology as a clean industry, unlike transportation or mainstream manufacturing, the employees said soaring electricity consumption for the data centers used in cloud computing was a major problem.

“We are the ones who build the products,” said an organizer who asked to be identified only as Steven. “We are the ones who have the power to hold them accountable.”

Microsoft expands political security service to 12 European countries

February 20, 2019  08H:32  GMT/ZULU

by Tamara Kachelmeier and Biodun Iginla, BBC News and Reuters Technology reporters, Seattle

Microsoft Corp on Wednesday said it will offer its cyber security service AccountGuard to 12 new markets in Europe including Germany, France and Spain, to close security gaps and protect customers in political space from hacking.

ADVERTISEMENT

ADVERTISING

Microsoft had recently detected attacks, which occurred between September and December 2018, targeting employees of the German Council on Foreign Relations and European offices of The Aspen Institute and The German Marshall Fund, the company said here in a blog post.

ADVERTISEMENT

The attacks, which targeted 104 employee accounts in Belgium, France, Germany, Poland, Romania, and Serbia, are believed to have originated from a group called Strontium, the company added.

The AccountGuard service will also be available in Sweden, Denmark, Netherlands, Finland, Estonia, Latvia, Lithuania, Portugal and Slovakia.

Ahead of a critical European Parliament election in May, German officials are trying to bolster cyber security after a far-reaching data breach by a 20-year-old student laid bare the vulnerability of Europe’s largest economy.

Analysis: Internet addiction

January 8, 2019  02H30  GMT/UTC/ZULU

by Tamara Kachelmeier and Biodun Iginla, BBC News and Reuters Technology Analysts, San Francisco

SAN FRANCISCO  - When Danny Reagan was 13, he began exhibiting signs of what doctors usually associate with drug addiction. He became agitated, secretive and withdrew from friends. He had quit baseball and Boy Scouts, and he stopped doing homework and showering.

Danny Reagan, a former patient of the Lindner Center of Hope's "Reboot" program, the first of its kind to admit only children who suffer from compulsion or obsession with their use of technology, sits in a common room at the center in Mason, Ohio, U.S., January 23, 2019. REUTERS/Maddie McGarvey

But he was not using drugs. He was hooked on YouTube and video games, to the point where he could do nothing else. As doctors would confirm, he was addicted to his electronics.

“After I got my console, I kind of fell in love with it,” Danny, now 16 and a junior in a Cincinnati high school, said. “I liked being able to kind of shut everything out and just relax.”

Danny was different from typical plugged-in American teenagers. Psychiatrists say internet addiction, characterized by a loss of control over internet use and disregard for the consequences of it, affects up to 8 percent of Americans and is becoming more common around the world.

“We’re all mildly addicted. I think that’s obvious to see in our behavior,” said psychiatrist Kimberly Young, who has led the field of research since founding the Center for Internet Addiction in 1995. “It becomes a public health concern obviously as health is influenced by the behavior.”

Psychiatrists such as Young who have studied compulsive internet behavior for decades are now seeing more cases, prompting a wave of new treatment programs to open across the United States. Mental health centers in Florida, New Hampshire, Pennsylvania and other states are adding inpatient internet addiction treatment to their line of services.

SPONSORED

Some skeptics view internet addiction as a false condition, contrived by teenagers who refuse to put away their smartphones, and the Reagans say they have had trouble explaining it to extended family.

Anthony Bean, a psychologist and author of a clinician’s guide to video game therapy, said that excessive gaming and internet use might indicate other mental illnesses but should not be labeled independent disorders.

“It’s kind of like pathologizing a behavior without actually understanding what’s going on,” he said.

‘REBOOT’

At first, Danny’s parents took him to doctors and made him sign contracts pledging to limit his internet use. Nothing worked, until they discovered a pioneering residential therapy center in Mason, Ohio, about 22 miles (35 km) south of Cincinnati.

The “Reboot” program at the Lindner Center for Hope offers inpatient treatment for 11 to 17-year-olds who, like Danny, have addictions including online gaming, gambling, social media, pornography and sexting, often to escape from symptoms of mental illnesses such as depression and anxiety.

Danny was diagnosed with Attention Deficit Hyperactivity Disorder at age 5 and Anxiety Disorder at 6, and doctors said he developed an internet addiction to cope with those disorders.

“Reboot” patients spend 28 days at a suburban facility equipped with 16 bedrooms, classrooms, a gym and a dining hall. They undergo diagnostic tests, psychotherapy, and learn to moderate their internet use.

Chris Tuell, clinical director of addiction services, started the program in December after seeing several cases, including Danny’s, where young people were using the internet to “self-medicate” instead of drugs and alcohol.

The internet, while not officially recognized as an addictive substance, similarly hijacks the brain’s reward system by triggering the release of pleasure-inducing chemicals and is accessible from an early age, Tuell said.

“The brain really doesn’t care what it is, whether I pour it down my throat or put it in my nose or see it with my eyes or do it with my hands,” Tuell said. “A lot of the same neurochemicals in the brain are occurring.”

Even so, recovering from internet addiction is different from other addictions because it is not about “getting sober,” Tuell said. The internet has become inevitable and essential in schools, at home and in the workplace.

“It’s always there,” Danny said, pulling out his smartphone. “I feel it in my pocket. But I’m better at ignoring it.”

Slideshow (11 Images)

IS IT A REAL DISORDER?

Medical experts have begun taking internet addiction more seriously.

Neither the World Health Organization (WHO) nor the American Psychiatric Association recognize internet addiction as a disorder. Last year, however, the WHO recognized the more specific Gaming Disorder following years of research in China, South Korea and Taiwan, where doctors have called it a public health crisis.

Some online games and console manufacturers have advised gamers against playing to excess. YouTube has created a time monitoring tool to nudge viewers to take breaks from their screens as part of its parent company Google’s “digital wellbeing” initiative.

WHO spokesman Tarik Jasarevic said internet addiction is the subject of “intensive research” and consideration for future classification. The American Psychiatric Association has labeled gaming disorder a “condition for further study.”

“Whether it’s classified or not, people are presenting with these problems,” Tuell said.

Tuell recalled one person whose addiction was so severe that the patient would defecate on himself rather than leave his electronics to use the bathroom.

Research on internet addiction may soon produce empirical results to meet medical classification standards, Tuell said, as psychologists have found evidence of a brain adaptation in teens who compulsively play games and use the internet.

“It’s not a choice, it’s an actual disorder and a disease,” said Danny. “People who joke about it not being serious enough to be super official, it hurts me personally.”

Police probe hoax bitcoin bomb threats across U.S., Canada

December 15, 2018  09H:03  GMT/UTC/ZULU TIME

by Tamara Kachelmeier and Biodun Iginla, BBC News and Reuters Technology reporters, New York

U.S. law enforcement officials on Friday were investigating a wave of hoax emailed bomb threats demanding bitcoin payment that caused worry but no damage in the United States, Canada, Australia and New Zealand.

Passengers stand outside King subway station after a bomb threat was made in Toronto, Ontario, Canada December 13, 2018. REUTERS/Chris Helgren

On Thursday in North America, hundreds of businesses, government offices and schools received awkwardly-worded letters threatening to set off explosives if payments of $20,000 in cryptocurrency were not received.

The threats led to scattered evacuations of schools and transit stations before the Federal Bureau of Investigation and other agencies dismissed them as lacking credibility.

SPONSORED

Hoax threats were received in cities including Washington, New York, Detroit, San Francisco, Los Angeles, Phoenix, Oklahoma City, Grand Rapids, Iowa, Denver, Ottawa and Calgary, Alberta.

Investigators do not yet know who was responsible, two federal officials said on Friday. There is no evidence to suggest that any of the recipients made ransom payments, one of the officials said.

Cisco Systems Inc’s (CSCO.O) Talos cyber security unit said it believes the threats came from a group of fraudsters previously responsible for sending “sextortion” emails that claim to have videos showing the recipients having sex.

The fraudsters threaten to release compromising videos they claim to have obtained with software that recorded people through webcams on their computers.

Some of this week’s bomb threats came from the same internet addresses used in those sextortion campaigns, Talos researcher Jaeson Schultz said in a blog post.

“The criminals conducting these extortion email attacks have demonstrated that they are willing to concoct any threat and story imaginable that they believe would fool the recipient,” the blog said.

“We expect these sorts of attacks to continue as long as there are victims who will believe these threats to be credible, and be scared enough to send money to the attackers,” it said.

Suspect in Strasbourg attack has been killed

A similar series of hoax bomb threats occurred in December 2015, prompting officials in Los Angeles to close the city’s public school system, which national law enforcement officials later criticized as an over-reaction.

Two weeks previously, a married couple inspired by Islamic State had killed 14 people at a California county office building in a shooting rampage.

A teenager with dual Israeli-U.S. citizenship was arrested in Israel in March 2017 for making bomb threats to more than 100 Jewish organizations and Jewish community centers in dozens of U.S. states over several months.