Overnight Cybersecurity: DHS detects possible foreign spying devices in DC | Judge hands down first sentence in Mueller probe | Panera Bread website leaked customer data

Welcome to OVERNIGHT CYBERSECURITY, your daily rundown of the biggest news in the world of hacking and data privacy. We’re here to connect the dots as leaders in government, policy and industry try to counter the rise in cyber threats. What lies ahead for Congress, the administration and the latest company under siege? Whether you’re a consumer, a techie or a D.C. lifer, we’re here to give you …

 

THE BIG STORIES:

–DHS ACKNOWLEDGES POTENTIAL PHONE SPYING: The Department of Homeland Security (DHS) is acknowledging for the first time that foreign actors or criminals are using eavesdropping devices to track cellphone activity in the Washington D.C. area, according to a letter obtained by The Hill. DHS in a letter to Sen. Ron Wyden (D-Ore.) last Monday said they came across unauthorized cell-site simulators in the Washington D.C. area last year. Such devices, also known as “stingrays,” can track a user’s location data through their mobile phones cellphones, and can intercept cellphone calls and messages. “[T]he National Protection and Programs Directorate (NPPD) has observed anomalous activity in the National Capital Region that appears to be consistent with International Mobile Subscriber Identity (IMSI) catchers,” DHS wrote in response to specific questions Wyden sent them last November. It said it is also aware of IMSI use outside the Beltway. DHS official Christopher Krebs, the top official leading the NPPD, added in a separate letter accompanying his response that such use “of IMSI catchers by malicious actors to track and monitor cellular users is unlawful and threatens the security of communications, resulting in safety, economic and privacy risks.” DHS said they have not determined the users behind such eavesdropping devices, nor the type of devices being used. The agency also did not elaborate on how many devices it unearthed, nor where authorities located them. The eavesdropping devices impersonate a legitimate cell tower that can then trick nearby cellphone users into connecting to them, giving away one’s location data as well as their international mobile subscriber identity (IMSI) number. The use of eavesdropping tools like the IMSI devices pose a threat to national security, the agency told Wyden, a privacy hawk. “NPPD agrees that the use of IMSI catchers by foreign governments may threaten U.S. national and economic security,” the agency wrote in response. The Associated Press first reported the letter on Tuesday. The D.C. area is a hub for the U.S. intelligence community and others involved with the national-security apparatus, including CIA, FBI and NSA personnel. Individuals who have failed to take steps to encrypt their phones could have their communications sent to such eavesdropping simulators.

To read more from our piece, click here.

 

{mosads}

–JUDGE HANDS DOWN FIRST SENTENCE IN MUELLER INVESTIGATION: A federal judge on Tuesday sentenced Dutch lawyer Alex van der Zwaan to 30 days in prison for lying to federal investigators, according to multiple reports, in the first criminal sentence to result from special counsel Robert Mueller’s investigation. Van der Zwaan, who was also ordered to pay $20,000 in fines, pleaded guilty in late February to making “materially false, fictitious, and fraudulent statements and representations” to the special counsel’s office and FBI agents. According to the indictment, van der Zwaan lied about his contacts with Trump campaign official Richard Gates and a Ukraine-based business associate of both Gates and former Trump campaign chairman Paul Manafort. He then tried to cover his tracks by deleting emails that the special counsel’s office had requested. Press reports have identified the businessman as Konstantin Kilimnik, a former Russian intelligence officer and a longtime associate of Gates and Manafort. The London-based lawyer has no known ties to the Trump campaign, but in a court filing last week, prosecutors allege that van der Zwaan and Gates knowingly had discussions with Kilimnik during the final months of the election. Prosecutors said the communication “was pertinent to the investigation.”  Kilimnik has denied involvement with Russian intelligence. In a court filing on Monday, prosecutor Andrew Weissman said van der Zwaan, the son-in-law of a Russian oligarch, is in “an unusual position of having information related” to the Russia probe that “is not widely known — including information that he knows first-hand due to his role in the conduct the Office is investigating.” Several other Trump campaign associates have also pleaded guilty to various charges stemming from the special counsel investigation, including Gates, former Trump campaign adviser George Papadopoulos and former White House national security adviser Michael Flynn. They are all cooperating with prosecutors.

To read more from our piece, click here.

 

–FACEBOOK REMOVES MORE RUSSIA-LINKED ACCOUNTS: Facebook said on Tuesday that it removed over 200 accounts and pages linked to Russian trolls that attempted to influence U.S. politics around the time of the 2016 election. The company’s chief security officer Alex Stamos said in a post that the company removed 70 Facebook and 65 Instagram accounts, as well as 138 Facebook pages linked to the Internet Research Agency (IRA) a Kremlin-linked troll farm whose top employees have been indicted by special counsel Robert Mueller. Stamos said that 95 percent of the accounts that Facebook took down were in Russian and targeted at Russians or Russian speakers in nearby countries like Azerbaijan, Uzbekistan and Ukraine. More than one million Facebook users followed at least one of the now deleted pages and 493,000 Instagram users followed at least one of the now deleted accounts. The pages and accounts collectively spent $167,000 on advertising since Jan. 1 2015, according to numbers provided by Facebook. Facebook CEO Mark Zuckerberg said that unlike other accounts and pages Facebook has found that were linked to the group, this batch was focused on domestic political influence. ”Most of our actions against the IRA to date have been to prevent them from interfering in foreign elections. This update is about taking down their pages targeting people living in Russia,” Zuckerberg said. Pages and accounts set up by the troll farm regularly engage in misinformation campaigns, ranging from spreading potentially false memes to creating Facebook events. In one instance, thousands of people attended a rally in New York City created by the Kremlin-linked group protesting President Donald Trump’s election. Facebook has faced substantial public criticism since it initially disclosed last year that the Russian troll farm had purchased $100,000 worth of ads in its platform. It has since released new information increasing the scope of money spent and reach of Russian influence on its platform. In February, Mueller indicted 13 individuals for interfering in the U.S. including some believed to be staff at the Russian group.

To read more from our piece, click here.

 

A CONGRESSIONAL UPDATE: 

DEMS PRESS GRINDR ON PRIVACY: Two Democratic senators are demanding the gay dating app Grindr explain how it protects privacy following news the company shares self-reported data on users’ HIV status.

“Simply using an app should not give companies a license to carelessly handle, use, or share this type of sensitive information,” Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) wrote in a letter to the company.

The app gives two third-party analytics firms access to its data, including its users’ HIV status, BuzzFeed and independent researchers revealed on Monday.

The discovery sparked criticism from privacy experts over Grindr’s data sharing practices.

“Grindr and those with whom it shares its users’ sensitive information has an obligation to both protect this data and ensure users have meaningful control over it,” the lawmakers wrote.

They pressed the company to answer questions about its data collection and privacy protection policies as well as information on what other third parties get user data.

Markey and Blumenthal also sent letters to the two analytics companies that Grindr shared user HIV status information with: Apptimize and Localytics. They asked them to give details about their data collection practices and policies regarding Grindr users’ HIV status.

Grindr said on Monday that it will stop sharing its users’ HIV status with other companies.

To read more from our piece, click here.

 

A REPORT IN FOCUS:

FAKE NEWS’ IMPACT ON ELECTION: A team of researchers at Ohio State University conclude in a new study that “fake news” stories had a significant effect on voters in the 2016 presidential election and may have impacted the final result.

The study, first reported by The Washington Post on Tuesday, sought to measure the degree to which false news stories dissuaded voters who cast ballots for President Obama in 2012 from voting for Democratic presidential nominee Hillary Clinton in 2016.

While the researchers emphasized that they could not definitively say that fake news “caused” Obama voters to defect from Clinton in 2016, they nevertheless concluded that these stories had a “substantial impact” on voters that may have been sufficient enough to swing the election to Donald Trump.

“Our analysis leads us to the conclusion that fake news most likely did have a substantial impact on the voting decisions of a strategically important set of voters–those who voted for Barack Obama in 2012,” the researchers wrote.

“Indeed, given the very narrow margins of victory by Donald Trump in key battleground states, this impact may have been sufficient to deprive Hillary Clinton of a victory in the Electoral College.”

As part of a broader campaign to influence the 2016 election, Russia used social media trolls and state-run outlets to peddle fake news stories. Special counsel Robert Mueller has indicted 13 Russians over the stories, alleging an elaborate plot to use social media to spread divisive political and cultural content.

The extent to which Russia’s activity influenced the outcome of the election has been a source of fierce debate. The U.S. intelligence community made no such judgment in its unclassified report on Russia’s influence operation.

Trump and members of his administration have insisted that Russia’s efforts did not have any impact on the outcome of the election. Meanwhile, Clinton has blamed Russia, in part, for her loss.

In order to quantify the impact of fake news on the election, Ohio State University researchers Richard Gunther, Paul A. Beck and Erik C. Nisbet conducted a YouGov survey in late 2016 and early 2017 of 585 voters who supported Obama in 2012 out of a total sample of 1,600.

Ten percent of these voters cast ballots for Trump, 4 percent supported minor parties and 8 percent declined to vote; the researchers sought out to determine what accounted for the defections from Clinton.

Specifically, they asked the voters 281 questions that included fake news statements, two of which were negative statements about Clinton and one positive about Trump, and all of which were propagated by traditional and social media. The researchers, for instance, asked voters if they believed the statement, “Hillary Clinton is in very poor health due to a serious illness.”

The researchers found a significant correlation between belief in the fake news statements and vote choice. Specifically, a much larger percentage of those Obama voters who did not believe any of the fake news statements voted for Hillary Clinton in 2016 (89 percent) than those who believed one of the statements (61 percent) and those who believed two or three of them (17 percent).

To read the rest of our piece, click here.

 

A LIGHTER CLICK: 

Researchers have a sweet new way of tracking bumblebees… with QR codes. (Wired)

 

WHAT’S IN THE SPOTLIGHT:

The website for sandwich chain Panera Bread leaked millions of customer records for at least eight months before it was taken offline, cybersecurity blog KrebsOnSecurity revealed late Monday.

The customer records exposed included names, email addresses, physical addresses, and the last four digits of customer credit cards.

The blog learned of the breach from security researcher Dylan Houlihan, who claimed to have notified the company of the data leak back in August of last year. The site was taken offline Monday.

Meanwhile, the company is denying that a large number of records was exposed, and said there is no evidence of payment card information being accessed. Panera Bread Chief Information Officer John Meister said in a statement to Fox Business that the company has resolved the issue with its website.

“Panera takes data security very seriously, and this issue is resolved,” said Meister. “Following reports today of a potential problem on our website, we suspended the functionality to repair the issue. Our investigation is continuing, but there is no evidence of payment card information nor a large number of records being accessed or retrieved.”

Meister continued, “Our investigation to date indicates that fewer than 10,000 consumers have been potentially affected by this issue, and we are working diligently to finalize our investigation and take the appropriate next steps,” he said.

 

IN CASE YOU MISSED IT:

Links from our blog, The Hill, and around the Web.

Poll shows most Facebook users don’t trust site with their data. (The Hill)

Dems question Grindr over sharing of users’ HIV status. (The Hill)

House panel to hold hearing on net neutrality, internet ‘fast lanes.’ (The Hill)

OP-ED: Bitcoin tech could become the future of voting. (The Hill)

DOJ authorized Mueller to probe alleged Manafort-Russia collusion. (CNN)

The Senate Judiciary Committee is working on an encryption bill. (CyberScoop)

Pipeline company Energy Transfer Partners has thwarted a cyberattack. (Houston Chronicle)

Homeland Security’s National Cybersecurity and Communications Integration Center releases its 2017 ‘year in review.’ (DHS)

More on the incoming NSA chief. (Wired)