Skating on Stilts

Europe’s antiterror message to US: Sure sucks to be you

As the threat of major terror attacks rises, the European Commission has chosen to take action.  Of a sort.  It’s about to violate its existing antiterror agreement with the United States – and in a way that will make the current threat worse.

Al-Qaeda is apparently planning Mumbai-style commando attacks on European, and the US has reportedly launched drone strikes in an effort to break up the plot.  There have been many reports in recent years that al Qaeda has been training Europeans and Americans for terror attacks, because their passports allow them to travel easily through the West, and the current plot reportedly relies on this cadre: “The captured German reportedly said several teams of attackers, all with European passports, had been trained and dispatched from training camps in Waziristan and Pakistan.” (emphasis added)

US authorities are understandably concerned that the same terrorists may also be targeting this country, since visa-free travel allows European passport holders to come to the United States on short notice. 

One way to keep these terrorists out of the country is to heighten border scrutiny of Europeans and Americans who’ve traveled to Pakistan and spent months there without visible means of support.  To do that, of course, border authorities need to know who’s been traveling in and out of Pakistan.  Then they can use that information to flag visitors for additional questioning. 

So how is the European Commission helping the US get the information it needs to protect itself from European terrorists trained in Pakistan? 

It’s not.  In fact, it’s campaigning to make sure we never get it.

The European Commission has announced that it will negotiate deals to prevent countries like Pakistan from providing travel data to the United States -- except when the US already suspects a particular traveler or is otherwise investigating a particular case.  In other words, the European Commission wants to bar the kind of wholesale data exchange that’s needed to spot at the border terrorists who have successfully disguised themselves as tourists.  And it plans to withhold all European travel reservation data from Pakistan unless the Pakistanis agree to join a data boycott of the United States.

Remarkably, Brussels is pursuing this data boycott despite a solemn promise to the United States that it would not take such action.

Here’s the back story.  Travel reservation data is a crucial tool in the fight against terrorism.  (Access to information in airline reservation systems, sometimes known as PNR or passenger name record data, reveals the travelers who are most likely to need careful scrutiny as they enter the United States or other countries.  For more background, see Skating on Stilts.)

Since 2003, privacy zealots in the European Union have been fighting – so far unsuccessfully -- to keep the US from fully using that data to screen air passengers.  Under pressure from the European Parliament, this month the European Commission launched its fourth attack in seven years on US use of such data.  The first salvo set forth the principles the Commission will insist upon in negotiations with the United States and other countries that gather travel data.  These new negotiating principles include a demand that third countries supply data to the US and other third countries “only on a case-by-case basis.”  This would seem to prevent exactly the kind of sharing of information that the Caribbean countries have relied upon successfully for years.  It would also prevent Pakistan from giving the US information about Europeans who traveled to that country for long stays. 

Interestingly, the principles wouldn’t prevent Pakistan from giving the same information to European countries.  Quite the contrary.  The EU’s new principles for negotiation will require such sharing: “Information about terrorism and serious transnational crime resulting from the analysis of PNR data by third countries should be shared with EUROPOL, EUROJUST and EU Member States.” 

So, in the current threat, the European Union’s principles would work this way: European countries would get the data from Pakistan that they need to protect themselves from returning terrorists, and the United States, well, the United States wouldn’t. 

That’s bad enough.  What’s worse is that all this violates a promise the European Union made to the United States in writing just three years ago. 

Here’s the story.  In 2007, when I was negotiating the last agreement over travel data with the EU, a rogue EU official tried to interfere with a travel data agreement between the US and several Caribbean countries.  The US was helping these countries keep track of international travelers during the Cricket World Cup.  The Caribbean nations had the authority to obtain travel data from arriving flights but not the ability to process it quickly.  The US, meanwhile, had a readymade capability for screening passengers – and a strong interest in identifying risky travelers before they arrived in a region that is sometimes called the United States’s “third border.” 

So cooperating to collect and analyze travel data made sense to everyone.  Until an EU official barged in, threatening trade sanctions against Caribbean countries if their datasharing with the US did not meet with European approval. 

DHS hit the roof, and the EU soon disavowed the official’s interference in US security.  But to ensure that it didn’t happen again, US negotiators insisted that the EU add a new promise in the 2007 agreement about travel data – that the EU “will take all necessary steps to discourage international organisations or third countries from interfering with any transfers of EU PNR to the United States.”  (Here’s the EU letter making the promise.) 

But now, in the face of a terror plot that travel data could help to avert, the EU has announced that it intends to breach its promise to the United States.  I suppose there’s some irony in watching the EU do all the things it used to accuse the US of doing – acting unilaterally, ignoring international agreements, and letting domestic politics screw up international cooperation. 

But this is not time for irony.  Europe’s new initiative could easily get Americans killed.  That’s a new low for the European Union’s institutionalized hostility to the United States. 

For years, US authorities have tolerated the EU’s efforts to cripple US antiterror intelligence programs.  Despite Europe’s efforts to cut off US information sources, such as travel and financial data, the US has shared whatever information it had about terror threats against European nations.  And it has allowed European travelers to come to the US without visas – even if they come from countries that refuse to tell us which of their citizens they suspect to be terrorists.

If this latest European attack on US counterterrorism efforts has the effect I fear, though, that absent-minded forbearance is likely to change.  And high time, too.

Skating on Stilts scoops the security pros – by two months

Two months ago, I posted about the malware that is now known as Stuxnet, noting that it was designed to compromise SCADA systems; I thought that was proof that nations are planning a new form of cyberwar that will target electric power grids among other things.  Two months later, security experts parsing Stuxnet have confirmed that assessment:

Cyber security experts say they have identified the world's first known cyber super weapon designed specifically to destroy a real-world target – a factory, a refinery, or just maybe a nuclear power plant.

The cyber worm, called Stuxnet, has been the object of intense study since its detection in June. As more has become known about it, alarm about its capabilities and purpose have grown. Some top cyber security experts now say Stuxnet's arrival heralds something blindingly new: a cyber weapon created to cross from the digital realm to the physical world – to destroy something.

The experts speculate that the malware was designed to jump the usual “air gap” security on thumb drives and then act more or less autonomously to penetrate to a particular SCADA system and override controls:

Langner's analysis also shows, step by step, what happens after Stuxnet finds its target. Once Stuxnet identifies the critical function running on a programmable logic controller, or PLC, made by Siemens, the giant industrial controls company, the malware takes control. One of the last codes Stuxnet sends is an enigmatic “DEADF007.” Then the fireworks begin, although the precise function being overridden is not known, Langner says. It may be that the maximum safety setting for RPMs on a turbine is overridden, or that lubrication is shut off, or some other vital function shut down. Whatever it is, Stuxnet overrides it, Langner’s analysis shows.

"After the original code [on the PLC] is no longer executed, we can expect that something will blow up soon," Langner writes in his analysis. "Something big."

For those worried about a future cyber attack that takes control of critical computerized infrastructure – in a nuclear power plant, for instance – Stuxnet is a big, loud warning shot across the bow, especially for the utility industry and government overseers of the US power grid.

Of course, Stilts readers heard that warning shot two months early.  And the target of DEADFOO7?  Utterly unconfirmed speculation points toward Iran’s nuclear facility.

Microsoft's Response to Russian Scandal

Clever and nimble aren't the first words you think of in connection with Microsoft, but the company's decision to grant blanket IP licenses to targeted Russian human rights groups strikes me as both.  It took less than 24 hours, and it doesn't mumble about reducing cooperation with the authorities -- it takes the Microsoft weapon out of authorities' hands:

The new Microsoft policy was announced by the company’s general counsel, Brad Smith, at its headquarters in Redmond, Wash. He said the company would thwart such piracy inquiries by offering advocacy groups and opposition newspapers a blanket software license that would automatically cover them, without having to apply for it.

In other words, Microsoft would formally declare that the programs on their computers were legal, making it all but impossible for the authorities to charge these groups with stealing Microsoft software.

You knew this was bound to happen sooner or later

Russian government allegedly teams with Microsoft to suppress dissenters using dubious claims of software piracy.  Staggeringly excessive piracy penalties were pioneered by the United States, but it was only a matter of time before authoritarian governments discovered their charm.