US spy court didn’t reject a single government surveillance request in 2015

(Image: file photo)

A secret court that oversees the US government’s surveillance requests accepted every warrant that was submitted last year, according to new figures.

The Washington DC.-based Foreign Intelligence Surveillance Court received 1,457 requests from the National Security Agency and the Federal Bureau of Investigation to intercept phone calls and emails.

In long-standing fashion, the court did not reject a single warrant, entirely or in part.

The FBI also issued 48,642 national security letters, a subpoena-like power that compels a company to turn over data on national security grounds without informing the subject of the letter.

The memo said the majority of these demands sought data on foreigners, but almost one-in-five were requests for data on Americans.

The figures are reported annually by the Justice Dept. to members of Congress, but have yet to be formally released. Reuters first reported the soon-to-be-released figures.

The work of the court is shrouded in secrecy. Founded in 1978, the so-called FISA Court was tasked with processing government requests for surveillance against foreign targets. It was this court that approved a number of controversial programs, such as PRISM and the phone records collection program, which were later leaked by whistleblower Edward Snowden to journalists.

Because the court only hears the government’s case, that’s led to accusations that there aren’t enough checks and balances and that it’s a “kangaroo court with a rubber stamp.”

Since 1979 through to 2015, the last round of reporting figures, the court has approved 38,365 warrants but only rejected a dozen. That’s a rejection rate of 0.031 percent.

But only in recent years has there been a push back against the government’s one-sided authority.

Last year, the court appointed five lawyers and attorneys with national security clearance — including Marc Zwillinger, a lawyer who’s represented both Apple and Yahoo at the court — to act as pushback against the government’s requests.

The move was a provisions in the Freedom Act, which passed mid-2015, as an intelligence community reform effort in the wake of the Snowden revelations.

Security week-in-review: Mobile phone thief thwarted by “Theftie”

Screen Shot 2016-04-29 at 2.24.06 PM

It’s hard to keep up with the hundreds of security-specific headlines published every week.

So, we’re rounding up the top news that affect you, your business, and the security and technology industry overall. This week we explore a thefties, Firefox vulns, and a warning: don’t upload your Slack credentials to Github! Check back every Friday to learn about the latest in security news.

Phone thief’s “selfie” leads to his arrest

A Lookout Theft Alert “theftie” helped police arrest a man in Florida after he allegedly stole two smartphones. Theft Alerts will trigger the camera to take a front-facing picture based on a certain set of actions Lookout anticipated thieves take after they steal a device. “It’s so nice when technology works with us,” Sheriff Grady Judd explained after the arrest had been made.

Watch the segment here and learn more about Theft Alerts here.

Mozilla patches 14 holes in Firefox, plugging 2 potential Android attacks

Mozilla released a patch for 14 vulnerabilities this week, a number of them sealing up critical holes in the company’s FireFox browser. One of these holes, found by researchers at Newcastle University, could have allowed an attacker on Android to “deduce touch actions,” or monitor what was being typed into the browser, according to Securityweek. Another hole, found by Ken Okuyama, would have allowed an attacker to use a malicious application to read locally stored passwords and browser history.

Get more information about the patches here.

Trend: Developers storing Slack tokens on Github

Researchers at Detectify found that thousands of Slack tokens are searchable on Github. This is because a number of developers are, perhaps unknowingly, uploading their code for Slack API projects, including these tokens to Github. Slack’s API allows people to create robots that can complete tasks on their behalf and developers are sharing their creations. The researchers write, “The problem is that many developers tend to include Slack tokens – credentials tied to their personal Slack account – directly in the code when building Slack bots. … the developer is actually giving anyone – that finds the token – access to the developer’s company’s internal chats and files on Slack.”

Read more about the problem here.

Survey: How do you secure your mobile devices in the enterprise?

Image: iStock/Trifonenko

Companies of all sizes and in every industry are implementing mobile applications because of the agility in business operations that mobile devices provide, yet the increased use of mobile computing also brings a new set of security risks that organizations must address.

Take Tech Pro Research’s survey on mobile device security and share your input.

These devices are used externally as well as internally within companies. With the amount of time that mobile device are used off premises, risks of device loss, data loss or security breaches escalate. So, too, does the risk of devices being misused by those who are both authorized and unauthorized to use them.

Tech Pro Research is conducting a survey to examine which mobile devices companies are using, and how they are securing those devices. Respondents will be able to request a free copy of the resulting research report when it publishes in July.

Going forward, companies will move beyond mobile devices and begin to implement Internet of Things (IoT) devices and applications that demand greater security on the edges where computing occurs. This is in contrast to the centralized network security model that companies have used in the past.

As mobile computing advances, IT will be called upon to safeguard equipment, data and applications that employees will be operating at any time and from anywhere. To accomplish this, IT must implement security systems for mobile and IoT applications that must be agile, robust and able to function within, at and beyond the edge of the enterprise network. Equally important will be aggressive policy development and training of employees, who can often be a leading source of mobile computing security abuse.

So, share your thoughts on the subject in Tech Pro Research’s survey and you can be part of the next special feature report on this topic.

6 Steps for Responding to a Disruptive Attack

Today’s threat landscape dictates that companies must have a workable incident response plan.

Previous

1 of 7

Next

Image Source: ddosattackprotection.org

Disruptive attacks have become a disturbing trend that IT departments must consider when analyzing the ongoing threat landscape.

In its M-Trends 2016 report, FireEye’s Mandiant Consulting says these disruptive attacks are very different and require a different response than the “low and slow” attacks in which threat actors gain access to the victim’s network and steal information on the network for days, weeks and months before launching a full attack.

Senior Vice President Jurgen Kutscher adds that the most common disruptive attacks are attempts to extract a ransom, destroying critical business systems or publishing sensitive data on the Internet to embarrass or blackmail the victimized company.

Kutscher says attacks that result in the public release of confidential data cause great embarrassment and reputational damage to companies. In some cases, companies even lose the ability to function as a business because mission-critical systems are taken down. Side effects include executive resignations, costly ransoms, and expensive system rebuilds. High profile cases run from the JP Morgan hack of two years ago to the recent wave of ransomware attacks on hospitals.

The following six slides were developed following interviews with FireEye’s Kutscher and Gunter Ollmann, CSO for Vectra Networks.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous

1 of 7

Next

More Insights