CyberWire Daily - Daily: NSA contract worker arrested with classified material. TalkTalk gets a record data breach fine. Yahoo! surveillance story's still murky. Thoughts from AUSA on cyber innovation and information warfare.

Episode Date: October 6, 2016

In today's podcast we learn about the FBIs' arrest of an NSA contract worker—classified material was found in his home and vehicle. TalkTalk gets a record fine—£400,000, which comes to a hundred thousand hackerweight—for its 2015 data breach. Yahoo! email surveillance allegations amount to a story that's still murky and anonymously sourced. The Johns Hopkins University's Joe Carrigan stops by to discuss local vs cloud storage. Peder Muller from Novetta previews his upcoming presentation on Bitcoin and Blockchain. And the AUSA Meeting and Exposition closed yesterday with a look at 2030, warnings of Russian information operations, and considerations of how the US Government can keep pace with industry innovation. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

The FBI has arrested an NSA contract worker. TalkTalk gets a record fine for its 2015 data breach, 400,000 pounds, which comes to 100,000 hackerweight. Yahoo email surveillance allegations amount to a story that's still murky and anonymously sourced. And the AUSA meeting and exposition closed yesterday with a look at 2013, warnings of Russian information operations, and considerations of how the U.S. government can keep pace with industry innovation. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Thursday, October 6, 2016. Today seems to be a day of crime and punishment.

The FBI has arrested an NSA contract employee and entered a criminal complaint against him for theft of government property and unauthorized removal and retention of classified documents or material. The man arrested, Harold Thomas Martin, was employed by Booz Allen Hamilton. He goes by the nickname Hal, and he's been fired. The Bureau executed a search warrant against Martin's home and vehicle where they found documents and material that was either highly classified, reports say that some was top-secret SCI, that is, sensitive compartmented information, which, if the reports are borne out, would make the material very highly classified indeed, or that were marked as government property. Observers point out, amid the inevitable widespread speculation surrounding the case,

that taking this kind of stuff home isn't something one does inadvertently, property. Observers point out, amid the inevitable widespread speculation surrounding the case, that taking this kind of stuff home isn't something one does inadvertently, in, say, a fit of abstraction. They also observe that doing this sort of thing usually represents a pattern of behavior and not a one-off, one-time act. The complaint the FBI filed with the United States Court for the District of Maryland states states that when the Bureau searched Martin's vehicle in residence in Glen Burnie, Maryland, on August 27th of this year, they found classified material in both hard copy and digital forms. The digital information was found stored, the complaint says, on a variety of removable media.

At the time the complaint was filed, at least six of the documents were found to contain matter properly classified at the top secret level, and that was apparently obtained from sensitive intelligence produced in 2014. Disclosure of the documents are said to risk compromising intelligence sources, methods, and capabilities. Reports in the New York Times and elsewhere mentioned the possibility that among the classified material the FBI found in Martin's possession was software. There's much speculation that Martin had been working for Russia's SVR as a mole, and that he may have been connected with the shadow broker's compromise of equation group tools, but the story is still developing and these conclusions are premature. It's also important to note that Martin is entitled to the legal presumption of innocence,

even though the complaint says he admitted knowing that he'd done something wrong. A statement from Martin's lawyers reported in the New York Times seems to foreshadow his likely defense. Quote, we have not seen any evidence, but what we know is that Hal Martin loves his family and his country. There is no evidence that he intended to betray his country, end quote. Thus, no intent. The markets regard the arrest, of course, as a black eye for Booz Allen Hamilton. The company's stock closed down 3.78% yesterday. In the UK, it's also courts, but in this case, torts. TalkTalk has received a record fine, £400,000, for what Her Majesty's Government regards as negligent security practices that led to a significant breach.

High-tech bridge CEO Ilya Kolechenko believes the fine, while a record, may be relatively minor compared to other consequences of the breach for the British telecom company. He told the Cyber Wire that, quote, £400, pounds is a very small amount in comparison to other financial losses for TalkTalk caused by the breach, end quote. He noted that one of the most expensive aspects of the incident may be a dramatic cost increase in new customer acquisition. Companies find the reputational damage of a major breach makes it more expensive to attract and hold new customers. The story of Yahoo's alleged complicity with government surveillance now seems more complex than earlier reports would have suggested. After initially responding to inquiries

concerning the allegation with bland assertions of being law-abiding, Yahoo has denied giving up customer emails in bulk to the U.S. government. It's unclear exactly what Yahoo did beyond compliance with court orders, and many note that Reuters sources' anonymity isn't helping. The story continues to develop, and observers are calling for more details before they're willing to move to judgment. Bitcoin and the blockchain technology that it's built on are a hot topic in cybersecurity. Security. Peter Mueller is an analyst at Novetta, and they're teaming up with Chainalysis to host a special event at the Jailbreak Brewery in Laurel, Maryland, coming up on October 17th. The Cyber Wire is a media sponsor for the event, and we spoke with Peter Mueller to get a preview of his presentation. People are hearing the buzz. They're hearing blockchain and what does that mean, and

they certainly have heard Bitcoin. And even more certain is, I don't think they realize the link between Bitcoin and blockchain. And that link is that, you know, blockchain is, as I believe, a revolution, a whole new paradigm shift in the way we move data and store data, and the way we think about IT and coding in general. But we will make people know that around here locally, there's definitely a market for it. And there are larger companies that are interested in tackling that. And it's not just about building stuff, but it's about educating the locals about what's happening in tech. And blockchain is definitely something that is happening in tech. So what are some of the areas where blockchain is happening?

that is happening in tech. So what are some of the areas where blockchain is happening? Well, obviously in finance. I mean, Bitcoin, as people will see in my presentation, Bitcoin is probably the most famous example of blockchain or infamous, depending on who you're talking to. But blockchain has a lot of other implications, like, for instance, in voting, in healthcare, perhaps in logistics, assets tracking.

Blockchain isn't just a matter of coding something to say, you've got a blockchain. Blockchain is a way of thinking. Blockchain can be applied to so many different areas in our world. And especially now with smart contracts, you know, we're talking about Blockchain 2.0, distributed autonomous companies and organizations. These are whole new ways of dealing with things that takes some of the human bias out of our everyday decisions and puts them into code, specifically talking about Ethereum here. These decisions are made in code and that has huge implications for intellectual property and contracts between people. For instance, escrow. All this can be done in code. That saves costs. It saves time. It doesn't require trust.

That's one of the big things with blockchain. It's trustless. There's so many places blockchain can be used. I think the human imagination is really all that blocks it from, no pun intended, blocks it from going into certain areas. If you can think it and apply blockchain, you can probably do it. So who are the people who should come to see this presentation? Who are you targeting? So I am targeting everyone from the what is Bitcoin, have never seen Bitcoin before, all the way up to the Gavin Andreessen types. I would like to have the super pros there to sharpshoot it. We need people to say, yeah, it's great, but. And I'm hoping that we can turn the talk into a discussion. We're going to

have Q&A afterwards. And if that Q&A turns into a little bit of a light argument, that's fine. That's what makes blockchain better. That's what fosters ideas into the blockchain world that we can work on. That's Peter Mueller from Novetta. His presentation on blockchain is coming up at a special event this October 17th at the Jailbreak Brewery in Laurel, Maryland. The Cyber Wire spent the first three days of this week at the Association of the United States Army's 2016 meeting and exposition. You'll find full accounts of what we learned on thecyberwire.com, but we will mention two overarching themes that touch on cyber matters.

Both came from the Institute of Land Warfare Contemporary Military Forum. First, many experts consider Russia and the U.S. to be engaged already in an information war. Peter Singer, a strategist at New America, observed that Russia invented information warfare and that unlike the U.S., Russia doesn't conceive of information warfare in narrowly military terms. Quote, The goal of Russian information operations is not to make people love Russia, but rather to disrupt and create distrust. This feels new to us, but it goes back at least as far as Stalin's day."

To keep pace with threats in cyberspace, the U.S. Army's Cyber Command is trying to build a new culture of innovation so that it won't see what General Frost characterized as a clock speed mismatch between itself and industry. That new culture, Cyber Command Boss General Carden said, would be one that took the formulation and posing of problems as its central task. We should, General Carden said, be in the problem business. Look for more reports on AUSA and cybersecurity in tomorrow's Cyber Wire. And finally, we're happy today to be able to mark a milestone of our own. Our sister publication, the Cyber Wire Daily News Briefing, today published issue number 1,000.

On behalf of all of us at the Cyber Wire, thanks for subscribing and thanks for reading. We're looking forward to our next 1,000 issues. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection

across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely.

Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And I'm joined once again by Joe Kerrigan. He's from the Johns Hopkins University Information Security Institute. Joe, you know, old guys like me, I find that my tendency when it comes to storing my data is that I want to have everything local. I want to have everything on my PC. Right. You like ownership of it.

I like ownership of it. My music, my documents, my pictures. Right. But I'm starting to give in to the allure of the cloud. Right. I'm very much give in to the allure of the cloud. Right. I'm very much the same way as you. My computer at home, I've talked about before, has actually a little RAID array in it, just a RAID 1, which means that it's got two 1-terabyte hard drives that house all my data. And the data is duplicated across those two drives.

Recently, I've actually gone ahead and purchased the Microsoft Office Home and Student Plan. That comes with a terabyte of cloud storage from Microsoft on their product called OneDrive. I have started backing up my data to the cloud, but I don't view this as where my data lives. I still think of this as my data living on my machine and being backed up on first my rate array and second in the cloud. But you were telling me earlier about your son. Right. We were upgrading a computer recently and I was transferring user accounts to a new home computer. And I said to my son, son, you have 350 gigabytes of stuff here on your account. That's too much.

I can't transfer all that over. What do you want me to do? And he said, oh, just get rid of it all. All my stuff's in the cloud. Right. I don't need anything local. And I was like, what? He doesn't think that way, right?

Well, right. And I think that's the paradigm shift, right? Exactly. That people are starting to think of their data as living in the cloud and having somebody else take care of it rather than being responsible for it themselves. But I guess the flip side of that is, and of course this being a cybersecurity show is, when you're putting your stuff in the cloud, it's out there and there's a possibility that other people could have access to it. There is that possibility. So again, the same thing I always say is strong passwords, strong passwords, strong passwords. I can't emphasize that enough. I don't even know what my password is to my OneDrive account.

It's a string of random characters that my password manager generates, and I just copy it and paste it in. And when I have to do it on my phone, yeah, it's a little bit of a task to enter a 20-character random password through the keyboard that comes up on your phone. But I'm willing to make that tradeoff because I don't want somebody to get access to my documents. I don't want somebody to be able to read all of anything I might be working on or thinking about. All right. Good advice. Joe Kerrigan, good talking to you. My pleasure.

And now a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, Thank you. with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact.

Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.