All posts by Lawrence Christopher Skufca, J.D.

My name is Lawrence Christopher Skufca. I am a civil rights activist and community organizer in the Camden, New Jersey area. I hold a Juris Doctor from Rutgers School of Law; a B.A. in Political Science from Furman University; and an A.A. in the Social Sciences from Tri-County Technical College.

Rape Victims Don’t Trust The Fixers Colleges Hire To Help Them

A pair of prosecutors known for helping schools accused of mishandling sexual assault cases is under fire from victims and activists. Do Title IX consultants work for students or the administrators that hire them?

The longtime friends and colleagues, now partners at Pepper Hamilton, a storied Philadelphia law firm led by a former FBI director, advertise themselves as victim advocates with big hearts in addition to legal know-how. Although none of the more than 50 colleges and universities they’ve worked with would freely admit it, they also offer schools struggling with PR crises a speedy way to send a message that they’re on the case.

In a 2013 profile, The American Lawyer called Smith a “guru for colleges and universities looking to reform sexual assault culture on campus” who helped institutions “avoid the courtroom” by conducting investigations and advising administrators on how to comply with gender equity law Title IX and the Clery Act, which requires schools to accurately report campus violence. The article also called Smith “part of the scandal cleanup crew” for her most “high-profile engagements,” including Occidental College, Amherst College, the University of North Carolina at Chapel Hill, and the University of California at Berkeley, all schools currently under investigation by the United States Department of Education for allegedly violating federal law regarding on-campus sexual assault.

But while college presidents love Smith and Gomez, many of the women who forced their universities to hire consultants in the first place loathe them. Complainants across the country told BuzzFeed that they believed their institutions were paying Smith and Gomez to clean up messes by paying lip service to federal compliance.

Although some students and faculty members praised their work, others said the retention of Smith and Gomez — who acknowledged that they’ve never read a student complaint — encourage their schools to crack down on activists instead of rapists and to adopt boilerplate policies instead of calling out inept administrators.

Since the schools pay the consultants’ bills, their allegiance is a regular source of tension and complaints from students who see their lives, not the universities’ brands, at the heart of the matter.

“It isn’t my rape that’s the problem now,” said Andrea Pino, who clashed with the consultants at the University of North Carolina at Chapel Hill, where she is currently a senior. “The rape was nothing compared to the way my school has treated me.”

Pino is one of five complainants who filed federal complaints against UNC last year alleging the administration dismissed the reports of sexual assault survivors, underreported rape statistics, and failed to train employees in offering support services. Soon after, the school denied the charges and hired Smith and Gomez.

Pino said she immediately resented Smith for insisting the university cared about her well-being when an academic advisor had called her “lazy” for seeking medical withdrawal from classes due to assault-related post-traumatic stress disorder. Still, she met with Smith for what she says was billed as a completely confidential meeting and told her that she had never received training on mandatory reporting, which is required by Title IX, while a resident adviser. Soon after, Smith reported her to the Department of Housing for underreporting alleged rapes.

“I’m so glad my complaint gave Smith a salary,” Pino said.

Wonderlane / Via Flickr: wonderlane

A lucrative cottage industry of college sexual misconduct consultants started booming in 2011, after the Department of Education sent a “Dear Colleague” letter warning educators that it was cracking down on Title IX, which prohibits sex-based discrimination, including sexual violence. Thanks to activist groups that help students file and publicize federal complaints, the industry has continued to grow. Last year, the Department of Education’s Office for Civil Rights received 30 sexual violence-related complaints against colleges and universities, almost double the previous year’s 17. The White House’s decision earlier this year to launch a task force to help prevent and prosecute campus sexual assaults likely means the numbers will continue to rise.

Schools in crisis — or hoping to prevent one — can call Margolis Healy & Associates, a firm founded by two former police chiefs, or the NCHERM Group, which bills itself as one of the “largest higher education-specific law practices” in the country. But Smith and Gomez stand out because they have decades of experience as prosecutors on terrible crimes (child abuse, domestic violence), an understanding of complicated federal and local laws, and come highly recommended by preeminent schools.

Occidental spokesperson James Tranquada said the college interviewed two other firms but were most impressed by Smith and Gomez’s extensive experience handling sex crimes and their work at peer institutions. “Their approach is not merely one of legal compliance — they passionately believe in what they are doing.” he wrote.

Smith is a pioneer in the field; she coined the now widely used term “institutional response to sexual misconduct” when she left her job as a Philadelphia assistant district attorney in 2006 and launched her new career at Ballard Spahr LLC. The practice was “sleepy” then compared to today, Smith said in an interview, adding that she was “dedicated to changing the conversation” before “it was in vogue to do so in the legal field.”

She and Gomez are both as warmly reassuring as teachers at a Quaker elementary school and so comfortable with each other that they finish each other’s sentences.
They’ve known each other since Gomez was an intern in the DA’s office; Smith, already an established prosecutor in the Family Violence Sexual Assault unit, soon became Gomez’s “life mentor.” Still, Gomez said, it took months for Smith to convince Gomez to join her at Ballard Spahr, which she finally did in 2011.

“I never set out to be a partner in a law firm — I’m really just a simple country girl with a strong core of common sense and responsibility,” Gomez said. “Gina convinced me that we could be proactive and could share our knowledge nationally — that was intriguing. But in the end, I joined the practice because I believed in Gina and I trusted her vision of how we could make a difference. It’s a choice I have never regretted.”

Jeffrey Beall / Via Flickr: denverjeffrey

Pepper Hamilton, which snapped up the pair in 2013, probably doesn’t regret it, either. In a Feb. 14 press release announcing the previous year’s record fee income of $373 million, up 5.4% over the prior year, CEO Scott Green noted that the White Collar and Investigations practice group had more than doubled its revenue from 2012, partially in thanks to Smith and Gomez’s “thriving practice.”

Students can’t expect consultants who are brought in to review policy and procedure to fix larger cultural issues, said S. Daniel Carter, who runs the 32 National Campus Safety Initiative at the VTV Family Outreach Foundation, a nonprofit created by families and survivors of 2007’s Virginia Tech shooting.

“Students have broader interests,” he said. “They want allies. And they’re owed that, but people coming in from the outside to provide an objective review aren’t there to fill that role.”

But Gomez and Smith are successful because they do promise more than compliance — both are adamant that institutional liability isn’t their focus. “Our view starts with the students, and our goal is to listen with an earnest intent to understand their lens,” Gomez said. Many experts who know their work agree: Alison Kiss, the executive director of The Clery Center for Security on Campus, said she understands why students and faculty might mistrust for-profit consultants but that Smith and Gomez, whom she knows from the national conference circuit, aren’t just high-powered lawyers. “Beyond the knowledge of regulatory framework, you can see the care for victims shine through,” she said.

Without Smith and Gomez’s help, UNC couldn’t have launched the Title IX Task Force that is currently reworking the school’s approach to sexual misconduct, said Christi Hurt, UNC’s Interim Title IX coordinator. “They gave us a bird’s eye view of what the law required balanced with our needs as an individual university,” she said, adding that it was absolutely worth the money — a flat fee of $160,000 for eight months paid for by state taxpayer funds. Critics “obviously haven’t taken the time to get to know them,” said Sarah-Kathryn Bryan, a student on the task force who says she considers the women “good feminists” and her friends.

But many of the most prominent survivor activists in the country said that while they were initially optimistic about Smith and Gomez, they now warn each other in advance when the pair shows up on a new campus.

“Everyone in our inner circle of national student activists knows not to trust them or waste your time working with them because they’re just going to run you in circles anyway,” said Sofie Karasek, lead complainant in the federal complaints against the University of California at Berkeley. A UC Berkeley spokesperson confirmed that the school hired Smith and Gomez last fall to review and strengthen campus policies, but Karasek says she has no idea what they’re up to and that they’ve never tried to get in touch, a sentiment echoed by complainants across the country.

Although Smith and Gomez have publicly invited all interested members of theOccidental community to contact them via an anonymous suggestion box, Caroline Heldman and Danielle Dirks, two professors who are lead complainants in the federal complaints against their college, said that was an empty promise.

“We offered three times to set up individual and group meetings with survivors who were part of the federal complaint, and all three times they seemed interested but never took us up on the offer,” said Heldman, who, along with Dirks, has long advocated for sexual assault reform on campus. “After repeated offers that were ignored, we stopped asking. It was as if they were trying hard to not speak to survivors.”

Dirks and Heldman were dumbfounded by the price tag: They claim Smith and Gomez, who have been working with Occidental for more than a year, told them they were making $585 and $511 an hour, respectively. (Smith and Gomez declined to comment on their fees and would only say that they are consistent with the rates of other national law firms.) In exchange, Dirks said, the school has received a handful of ineffective “community forums” where the lawyers took few questions, some poorly planned training sessions, and a revised — and, in her view, “watered-down” — sexual assault policy.

Smith and Gomez “are great at making parents and students feel like something is being done because they are using big legal words, but words can’t take the place of legal action,” Dirks said. “They have had an absolute negative effect on our reform.”

Aaron Landry / Via flic.kr

Students and professors at other schools described similar experiences. Smith “just talked at us while the administrators sat silently behind her, sort of quivering, at this so-called public meeting,” said Altha Cravey, an assistant professor at UNC who attended a forum billed on Facebook as an open dialogue with the Chancellor. “It was supposed to be this ongoing public conversation, but instead we heard from a lawyer who reduced everything to technicalities. It was really offensive and awful.”

Other complaints about Smith’s and Gomez’s work concerned their external reviews. The University of Colorado at Boulder, which cheerily announced earlier this year that an external review by Smith and Gomez had found the school in compliance with Title IX, angered some students who were quick to note that the official federal complaint that spurred the review was still ongoing. The Amherst report Smith and Gomez helped conduct failed to identify “the underlying causes of sexual violence,” student survivor Dana Bolger wrote: The report found “no need to name specific student groups” that intimidate victims into staying silent about sexual assault, but went into detail about a “large and seasonally permanent” tent with a sound system that could host “large-scale poetry slams, small concerts, outdoor movies, recitals, dance lessons, and the like,” in hopes that students will “evolve and sustain new and more creative modes of play” and “escape the Amherst Awkward feeling” instead of assaulting their peers.

Pino isn’t the only complainant frustrated by Smith’s insistence on hardline mandatory reporting compliance. At Swarthmore, which employs Pepper Hamilton as its general counsel, Mia Ferguson was denied a job as a dormitory resident advisor after she filed a Title IX complaint because she wouldn’t provide authorities with details concerning an alleged rape. Under Title IX, resident advisors are “mandatory reporters,” meaning they are obligated to report all aware sexual misconduct to higher-ups.

But, as Ferguson pointed out in her complaint, Swarthmore was hardly fully compliant — she said she hadn’t even been properly trained on the duties of a mandatory reporter — and the information in question pertained to an incident that took place before Ferguson signed her RA contract. Was it really necessary to fire her as an example? In a New York Times article about the controversy, Smith said yes and defended the college’s decision.

“We love our schools, and we want them to succeed,” Ferguson said. “But [Smith] isn’t interested in helping schools push back against an antiquated law. She’s interested in helping schools comply so they stay out of court.”

Smith and Gomez told BuzzFeed they understand why survivors would be skeptical; institutional betrayal cuts deep, and sometimes there is “such a breakdown in trust that it can be difficult to transcend the past.” But although the pair stresses their experience working with victims of sex crimes, they’re also aggressive former prosecutors. Smith, in particular, drew criticism from public defenders in Philadelphia whom she went up against in sex crimes cases, and in at least one case, her office settled charges that she had crossed the line.

In 2005, Smith was sued by Nicole Schneyder, a reluctant witness in one of Smith’s first murder trials, for allegedly jailing Schneyder to force her to testify and then leaving her there for 48 days after the case was postponed against a judge’s order. While Schneyder was in jail, the man she called her father died. It was only when her sister appealed to the Public Defender’s Office to see if Schneyder could attend the funeral that an official realized she was being held for a trial that was still months away.

The Philadelphia District Attorney’s Office settled with Schneyder for $255,000 in 2011. “Whether to keep Schneyder in jail should have been the court’s decision, and Smith knew it,” the three-judge panel wrote, calling her alleged conduct “outrageous” and unconstitutional.

Daniel Silverman, Schneyder’s attorney, accused her of “acting as though she could disregard her professional and ethical obligations all in the service of winning her case.”

“That she had actual notice that my client was languishing in jail and ignored the pleas of her family to release her so she could say her final goodbyes to the dying man who raised her speak to her seeming belief that she did not need to play within the rules,” he said.

Smith said in response that she was dealing with a brutal case of rape and murder, and stressed that the case was “a settlement before any fact-finding and thus there was no admission or finding of fault.”

“As a prosecutor, my obligation was to seek justice with integrity — in this case, I followed a lawful process, supported by witnesses and documentary evidence, to advocate on behalf of a victim who had been raped and murdered,” she said.

It’s a long way from the courtroom to the campus, but sex crimes prosecutors have always needed to show more than one side. They’re expected to be both compassionate advocates for victims and hard-edged instruments of vengeance on perpetrators.

Smith’s and Gomez’s success is rooted in that balance, but as their legion of critics makes clear, it’s a tough one to maintain.

The two are “highly tuned weapons of legal warfare,” said Peter Lake, a higher education consultant and law professor who questions whether the prosecutorial approach is best for schools, given victims’ mistrust of the legal system and the confusion surrounding Title IX, which he believes “pits students against their institutions.”

“I’m a lawyer, but it scares me to death that we are lawyering up higher ed,” he said. “We’re legalizing this field very quickly with little attention being paid to how it will affect victims.”

Katie Baker is a national reporter for BuzzFeed News and is based in New York.
Contact Katie J.M. Baker at katie.baker@buzzfeed.com.

Lisa Jones, Girlfriend of Undercover Policeman Mark Kennedy: ‘I thought I Knew Him Better than Anyone’

 

The most traumatising time of Lisa Jones’s life began when she agonised for months over the true identity of her boyfriend. They had been together for six years and she loved him “totally, completely, more than anyone”.

“He was the closest person in the world to me,” she says. “The person who knew me better than anybody else. I thought I knew him better than anyone else knew him.” But she had begun to suspect that he was lying about who he really was.

This is the first interview “Lisa”, who wants to retain her anonymity, has given to the media. Only now, five years later, does she feel ready to describe how she has been devastated by the deception. She speaks eloquently, though the pain is still evident. Her boyfriend, Mark, always had a slightly mysterious side to him. In their last few months together his behaviour was, at times, erratic; but at other times, their relationship was blissful.

In what she describes as a “constant see-saw from one state to another”, she oscillated between “desperately, desperately” wanting to believe the story he had told her about himself, and wondering whether he had completely deceived her about a fundamental part of his life.

Reduced to a “very fragile” state, she struggled with her dilemma: “Am I fighting to save this relationship or am I trying to figure out who he is? I am either putting my energies into this relationship or I am investigating him – I can’t do both.”

The truth was not disclosed to her by him. Instead she and her friends found out through their own detective work and a chance discovery.

Assistant commissioner Martin Hewitt apologises for undercover officers’ relationships

They established that he was Mark Kennedy, an undercover policeman who had been sent to spy on her circle of activist friends. For seven years, he had adopted a fake persona to infiltrate environmental groups. Their unmasking of him five years ago kickstarted a chain of events that has exposed one of the state’s most deeply concealed secrets.

Back then, the public knew little about a covert operation that had been running since 1968. Only a limited number of senior police officers knew about it. Kennedy was one of more than 100 undercover officers who, over the previous four decades, had transformed themselves into fake campaigners for years at a time, assimilating themselves into political groups and hoovering up information about protests that they had helped to organise.

More than 10 women have discovered that they had relationships with undercover policemen, some lasting years, without being told their true identity.

On Friday it was announced that police had agreed to give a full apology and pay compensation to Lisa and six other women for the trauma they suffered after being deceived into forming intimate relationships with police spies.

Lisa, for her part, welcomed the apology. But it comes more than a decade after Kennedy’s mission began. “No amount of money or ‘sorry’ will make up for the lack of answers about the extent to which I was spied upon in every aspect of my most personal and intimate moments,” she says.

Kennedy first infiltrated a group of environmental campaigners in Nottingham in 2003. The fake persona he chose was that of a long-haired, tattooed professional climber by the name of Mark Stone. Among campaigners, he earned the nickname “Flash” as he always seemed to have a lot of money.

In the autumn of 2003, Lisa met Kennedy when he visited Leeds, where she was living. Then in her early 30s, she had for some years been active in environmental, anti-capitalist, and anti-nuclear campaigns. Her first impressions were that he was “very charming, very friendly and familiar in a way that was quite disarming”.

Mark Kennedy at Glastonbury festival in 2008, in a picture taken by Lisa Jones
Mark Kennedy at Glastonbury Festival in 2008, in a picture taken by Lisa Jones

Kennedy had a number of sexual relationships while undercover. The longest was with Lisa. “During his deployment, he spent more time with me than anybody else, and probably more time than everyone else together,” she says. He “slotted very easily” into her group of friends, who went climbing in their spare time. He got to know her family. When her father died, Kennedy was in the mourners’ car with her. “He was the one who held me as I cried through the night, and helped me pick myself up again after that,” Lisa says.

He would go away every few weeks – the longest time was three months – working, but kept in regular contact through phone calls, emails and texts. They went abroad together, sometimes just the two of them, cycling or climbing, and sometimes for protests. Over time, he gained a reputation as a committed environmental activist. But secretly, he was passing back to his police handlers information about the protesters and their political activities.

His covert mission was terminated in October 2009 when he was summoned by his handlers to a meeting at an anonymous truckstop. That month, he disappeared abruptly from his house in Nottingham. In the weeks before his disappearance, he had been agitated and distant with his friends. Lisa recalls: “He had quite an emotional crash, it seems. Some days he would not get out of bed – that was very, very out of character. He was usually quite bright and chirpy, an early riser type, an energetic person, but he was upset quite a lot of the time. I would comfort him. It really felt to me that I was seeing him through a difficult time, and a breakdown. He leant on me very heavily.”

 

He appeared to be very paranoid. The police had raided his house after he was arrested at a protest, and he said he was worried they were delving into his background and income. He said he needed a break and was going to go to the US to stay with his brother for a while. Lisa says that the day before he flew, he “was behaving very, very strangely”, claiming that he was being followed.

“When he went, I was really, really worried about his sanity. I thought he had properly lost it. I kept saying to him that this looks to me as if you are not coming back. He had sold his car, apparently left his job and half-cleared out his house. The other half I had to do.”

In January 2010, he mysteriously reappeared. What Lisa and the other campaigners did not know at that time was that Kennedy was quitting the police to avoid being assigned to a humdrum desk job. But he had not discarded his fictional persona of “Mark Stone”, and continued to be involved in political campaigns. He has admitted that he was employed by a clandestine private security firm that was paid by commercial firms to monitor protesters.

To Lisa, however, he was “different, volatile, up and down a lot of the time. Obviously he was being much less supervised, much less directed, and I just don’t think he knew what he was doing at that time. He was rudderless. I was still so bruised from him losing his marbles and disappearing that I was in some ways waiting for an explanation, somehow trying to figure out what was going on with him, and whether he was alright.

“I always knew that Mark had a slight air of mystery. I knew there was something that one day he might open up about – something that had happened.”

The key discovery that eventually led to Kennedy’s exposure was made by Lisa when the two of them were on holiday in a van in July 2010.

Mark Kennedy on holiday in Italy in 2010
Kennedy on Holiday in Italy in 2010

“We were having this really blissful holiday in Italy. We were up in the mountains, just the two of us. He had gone off for a cycle ride, and I was looking in the glove box for some sunglasses. I guess that there was maybe a bit of me that was a little unsure about what was going on with him. I was rooting around and I saw his passport.”

The old passport was in the unfamiliar name of Mark Kennedy. But there was something even more chilling in there: “The thing that made my stomach come into my mouth was seeing that he had a child. The character of Mark Stone wasn’t one that would have had a child. That’s such a big thing to have happened, and to have known somebody that long and have them not mention that they had a child, that’s enormous.”

She found a mobile phone that he did not seem to use much, and found emails from two children, calling him dad. “I did not know what to think. I remember feeling that the world was suddenly a really long way away. I just remember that the mountains were pulsating and swimming around me.”

It was the first time she considered that he might be an undercover cop, but quickly dismissed it as something she thought only existed in films. When Kennedy came back from his cycle ride, “I really did not know what to say to him. I was terrified about what the answer would be, and what it would mean. I just did not say anything for about two days. He knew there was something wrong. He was trying to be very nice to me and figure out what was upsetting me. I did not sleep. He slept and I paced. I remember watching the sunrise and being sick.”

She confronted him in a bar on what was his real birthday. She demanded to know about his son. “He visibly crumpled. He said, ‘I can tell you, but not here’, and we went off.”

Back in their van, he recounted a story it seems he had tucked away for years, to be used if his fictional persona was ever challenged. He said he had been a drug runner, that his close associate had been shot in front of him, and that he had promised to look after the dead man’s children, who had come to think Kennedy was their real father.

“I was desperate for an explanation that sounded plausible. Fantastical as it now sounds in the retelling, one of the reasons it seemed plausible was the amount of emotion that poured out of him when he told me,” Lisa says. It seemed as if he had finally opened up, after all the hints of a dodgy past.

“I held him as he cried for about eight hours, through the night. We sat up and talked. He cried and I cried. It felt like we had really shared something, so I really did not analyse the facts at that point particularly strongly.”

But for the rest of the summer, she had nagging feelings that his story did not add up. She challenged him but he always had an answer. She swung between believing their relationship was “better than ever, and thinking something still is not right”.

In September, they had another happy holiday in Italy. “I was floating on air when we came back.” A week later, she was visiting a friend who was, by chance, doing ancestry research online. She did not know what came over her, but she asked the friend to look up Mark Stone’s birth certificate. Nothing came back.

With her friends’ help, she started to dig into his life. She still could not believe he was a policeman, thinking: “He has been with me for so long – there’s absolutely no way they would put a cop in for that long.”

She yearned to find some new piece of information that would provide an explanation and clear her suspicions about him. For a few weeks, she went about her life, talking regularly on the phone to Kennedy but feeling she was “in this little bubble where nothing was real”. Eventually they found a birth certificate for Kennedy’s son, which recorded Kennedy’s occupation as being a police officer.

Now she wanted him to explain. He was pretending to be in the US, but she had found out that he was actually in Ireland with his children and estranged wife. At her insistence, he returned late one night to a house in Nottingham, where she and a group of friends began to question him.

For what felt like hours, he refused to admit anything. Then one of the group asked him directly when he had joined the police. He confessed, and later cried. The others left Lisa alone with him. She was shocked. “I wanted him to stay. I knew that the moment he left, the whole world was going to change. I was just trying to delay the moment.”

Mark Kennedy in 2011, after he had left the police force
Mark Kennedy in 2011, after he had left the police force. Photograph: Phillip Ebeling for the Guardian

Kennedy went on to sell his story to the media and to work for a US security firm after he was unmasked in October 2010. Lisa set about trying to put her life back together. Her experience with Kennedy “made her feel very small”, but the other women in the legal action have been a valuable source of support.

Lisa, who comes across as warm-hearted and thoughtful, rejects suggestions that she could have unmasked Kennedy earlier or that his deception was no different from those of many other cheating husbands.

The difference, she says, is that his deception was supported by the resources of the state. Undercover officers who infiltrated political groups were issued with fake documents, such as passports, driving licences and bank records that would help to fortify their fabricated alter egos. “I had no chance of seeing through that kind of training and infrastructure.”

But he was rumbled, she points out, after he quit the police and no longer had their support. He had had to hand back the paperwork – including the passport bearing his fake identity of Mark Stone.

Lisa has found it difficult to come to terms with the feeling that she had no free will during her relationship with Kennedy. A “faceless backroom of cops” controlled his movements, deciding when he could go away with her, or which demonstrations they could go on. “I just have this feeling that someone else made all the decisions, and it was not me, and it was not even him.”

A series of revelations has persuaded the home secretary Theresa May to order a public inquiry into the conduct of the police spies. This inquiry could reveal far more of the police’s secrets when it starts to hear evidence in public next year. It is expected to examine how, for example, the undercover officers spied on the family of murdered teenager Stephen Lawrence and stole the identities of dead children.

Lisa does not want to pin too much hope on the inquiry uncovering the truth of Kennedy’s espionage and his relationship with her. “There are so many more questions than answers in this whole thing that I don’t think I am ever going to be in a position where I feel like I know what went on and what it all meant, and that there’s nothing more to wonder about.”

She asks herself how much he genuinely loved her. “It is an endless, endless question that I will always be wondering about. That will always keep me awake at night.”

She has been left with a “crushing disappointment and sadness”, feeling that her ability to trust others and form relationships has been shattered. “I have lost a lot of optimism about all kinds of things,” she says. “Just the idea that the world is a good place, that love exists, that love is possible for me.”

Related

 

Hackers Remotely Kill a Jeep on the Highway – With Me in It

by Andy Greenberg  I   Security  I  07.21.15.07.21.15  I  6:00 AM

If consumers don’t realize this is an issue, they should, and they should start complaining to carmakers. This might be the kind of software bug most likely to kill someone. – CHARLIE MILLER

 

I WAS DRIVING 70 mph on the edge of downtown St. Louis when the exploit began to take hold.

Though I hadn’t touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass.

As I tried to cope with all this, a picture of the two hackers performing these stunts appeared on the car’s digital display: Charlie Miller and Chris Valasek, wearing their trademark track suits. A nice touch, I thought.

The Jeep’s strange behavior wasn’t entirely unexpected. I’d come to St. Louis to be Miller and Valasek’s digital crash-test dummy, a willing subject on whom they could test the car-hacking research they’d been doing over the past year. The result of their work was a hacking technique—what the security industry calls a zero-day exploit—that can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. Their code is an automaker’s nightmare: software that lets hackers send commands through the Jeep’s entertainment system to its dashboard functions, steering, brakes, and transmission, all from a laptop that may be across the country.

To better simulate the experience of driving a vehicle while it’s being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Miller’s laptop in his house 10 miles west. Instead, they merely assured me that they wouldn’t do anything life-threatening. Then they told me to drive the Jeep onto the highway. “Remember, Andy,” Miller had said through my iPhone’s speaker just before I pulled onto the Interstate 64 on-ramp, “no matter what happens, don’t panic.”1

Charlie Miller (left) and Chris Valasek hacking into a Jeep Cherokee from Miller's basement as I drove the SUV on a highway ten miles away.
Charlie Miller (left) and Chris Valasek (right) hacking into a Jeep Cherokee from Miller’s basement as I drove the SUV on a highway ten miles away. Whitney Curtis for WIRED

As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission.

Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.

At that point, the interstate began to slope upward, so the Jeep lost more momentum and barely crept forward. Cars lined up behind my bumper before passing me, honking. I could see an 18-wheeler approaching in my rearview mirror. I hoped its driver saw me, too, and could tell I was paralyzed on the highway.

“You’re doomed!” Valasek shouted, but I couldn’t make out his heckling over the blast of the radio, now pumping Kanye West. The semi loomed in the mirror, bearing down on my immobilized Jeep.
I followed Miller’s advice: I didn’t panic. I did, however, drop any semblance of bravery, grab my iPhone with a clammy fist, and beg the hackers to make it stop.

Wireless Carjackers

This wasn’t the first time Miller and Valasek had put me behind the wheel of a compromised car. In the summer of 2013, I drove a Ford Escape and a Toyota Prius around a South Bend, Indiana, parking lot while they sat in the backseat with their laptops, cackling as they disabled my brakes, honked the horn, jerked the seat belt, and commandeered the steering wheel. “When you lose faith that a car will do what you tell it to do,” Miller observed at the time, “it really changes your whole view of how the thing works.” Back then, however, their hacks had a comforting limitation: The attacker’s PC had been wired into the vehicles’ onboard diagnostic port, a feature that normally gives repair technicians access to information about the car’s electronically controlled systems.

A mere two years later, that carjacking has gone wireless. Miller and Valasek plan to publish a portion of their exploit on the Internet, timed to a talk they’re giving at the Black Hat security conference in Las Vegas next month. It’s the latest in a series of revelations from the two hackers that have spooked the automotive industry and even helped to inspire legislation; WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks, first sparked when Markey took note of Miller and Valasek’s work in 2013.

As an auto-hacking antidote, the bill couldn’t be timelier. The attack tools Miller and Valasek developed can remotely trigger more than the dashboard and transmission tricks they used against me on the highway. They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment.

Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say they’re working on perfecting their steering control—for now they can only hijack the wheel when the Jeep is in reverse. Their hack enables surveillance too: They can track a targeted Jeep’s GPS coordinates, measure its speed, and even drop pins on a map to trace its route.

Miller attempts to rescue the Jeep after its brakes were remotely disabled, sending it into a ditch.
Miller attempts to rescue the Jeep after its brakes were remotely disabled, sending it into a ditch. Photo:  Andy Greenberg WIRED

All of this is possible only because Chrysler, like practically all carmakers, is doing its best to turn the modern automobile into a smartphone. Uconnect, an Internet-connected computer feature in hundreds of thousands of Fiat Chrysler cars, SUVs, and trucks, controls the vehicle’s entertainment and navigation, enables phone calls, and even offers a Wi-Fi hot spot. And thanks to one vulnerable element, which Miller and Valasek won’t identify until their Black Hat talk, Uconnect’s cellular connection also lets anyone who knows the car’s IP address gain access from anywhere in the country. “From an attacker’s perspective, it’s a super nice vulnerability,” Miller says.

 

From that entry point, Miller and Valasek’s attack pivots to an adjacent chip in the car’s head unit—the hardware for its entertainment system—silently rewriting the chip’s firmware to plant their code. That rewritten firmware is capable of sending commands through the car’s internal computer network, known as a CAN bus, to its physical components like the engine and wheels. Miller and Valasek say the attack on the entertainment system seems to work on any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015. They’ve only tested their full set of physical hacks, including ones targeting transmission and braking systems, on a Jeep Cherokee, though they believe that most of their attacks could be tweaked to work on any Chrysler vehicle with the vulnerable Uconnect head unit. They have yet to try remotely hacking into other makes and models of cars.

After the researchers reveal the details of their work in Vegas, only two things will prevent their tool from enabling a wave of attacks on Jeeps around the world. First, they plan to leave out the part of the attack that rewrites the chip’s firmware; hackers following in their footsteps will have to reverse-engineer that element, a process that took Miller and Valasek months. But the code they publish will enable many of the dashboard hijinks they demonstrated on me as well as GPS tracking.

Second, Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference. On July 16, owners of vehicles with the Uconnect feature were notified of the patch in a post on Chrysler’s website that didn’t offer any details or acknowledge Miller and Valasek’s research. “[Fiat Chrysler Automobiles] has a program in place to continuously test vehicles systems to identify vulnerabilities and develop solutions,” reads a statement a Chrysler spokesperson sent to WIRED. “FCA is committed to providing customers with the latest software updates to secure vehicles against any potential vulnerability.”

Unfortunately, Chrysler’s patch must be manually implemented via a USB stick or by a dealership mechanic. (Download the update here.) That means many—if not most—of the vulnerable Jeeps will likely stay vulnerable.

Chrysler stated in a response to questions from WIRED that it “appreciates” Miller and Valasek’s work. But the company also seemed leery of their decision to publish part of their exploit. “Under no circumstances does FCA condone or believe it’s appropriate to disclose ‘how-to information’ that would potentially encourage, or help enable hackers to gain unauthorized and unlawful access to vehicle systems,” the company’s statement reads. “We appreciate the contributions of cybersecurity advocates to augment the industry’s understanding of potential vulnerabilities. However, we caution advocates that in the pursuit of improved public safety they not, in fact, compromise public safety.”

The two researchers say that even if their code makes it easier for malicious hackers to attack unpatched Jeeps, the release is nonetheless warranted because it allows their work to be proven through peer review. It also sends a message: Automakers need to be held accountable for their vehicles’ digital security. “If consumers don’t realize this is an issue, they should, and they should start complaining to carmakers,” Miller says. “This might be the kind of software bug most likely to kill someone.”

In fact, Miller and Valasek aren’t the first to hack a car over the Internet. In 2011 a team of researchers from the University of Washington and the University of California at San Diego showed that they could wirelessly disable the locks and brakes on a sedan. But those academics took a more discreet approach, keeping the identity of the hacked car secret and sharing the details of the exploit only with carmakers.
Miller and Valasek represent the second act in a good-cop/bad-cop routine. Carmakers who failed to heed polite warnings in 2011 now face the possibility of a public dump of their vehicles’ security flaws. The result could be product recalls or even civil suits, says UCSD computer science professor Stefan Savage, who worked on the 2011 study. “Imagine going up against a class-action lawyer after Anonymous decides it would be fun to brick all the Jeep Cherokees in California,” Savage says.2

For the auto industry and its watchdogs, in other words, Miller and Valasek’s release may be the last warning before they see a full-blown zero-day attack. “The regulators and the industry can no longer count on the idea that exploit code won’t be in the wild,” Savage says. “They’ve been thinking it wasn’t an imminent danger you needed to deal with. That implicit assumption is now dead.”

471,000 Hackable Automobiles

Miller and Vasalek’s exploit uses a burner phone’s cellular connection to attack the Jeep’s internet-connected entertainment system. Photo: Whitney Curtis for WIRED

Sitting on a leather couch in Miller’s living room as a summer storm thunders outside, the two researchers scan the Internet for victims.

Uconnect computers are linked to the Internet by Sprint’s cellular network, and only other Sprint devices can talk to them. So Miller has a cheap Kyocera Android phone connected to his battered MacBook. He’s using the burner phone as a Wi-Fi hot spot, scouring for targets using its thin 3G bandwidth.

A set of GPS coordinates, along with a vehicle identification number, make, model, and IP address, appears on the laptop screen. It’s a Dodge Ram. Miller plugs its GPS coordinates into Google Maps to reveal that it’s cruising down a highway in Texarkana, Texas. He keeps scanning, and the next vehicle to appear on his screen is a Jeep Cherokee driving around a highway cloverleaf between San Diego and Anaheim, California. Then he locates a Dodge Durango, moving along a rural road somewhere in the Upper Peninsula of Michigan. When I ask him to keep scanning, he hesitates. Seeing the actual, mapped locations of these unwitting strangers’ vehicles—and knowing that each one is vulnerable to their remote attack—unsettles him.

When Miller and Valasek first found the Uconnect flaw, they thought it might only enable attacks over a direct Wi-Fi link, confining its range to a few dozen yards. When they discovered the Uconnect’s cellular vulnerability earlier this summer, they still thought it might work only on vehicles on the same cell tower as their scanning phone, restricting the range of the attack to a few dozen miles. But they quickly found even that wasn’t the limit. “When I saw we could do it anywhere, over the Internet, I freaked out,” Valasek says. “I was frightened. It was like, holy fuck, that’s a vehicle on a highway in the middle of the country. Car hacking got real, right then.”

That moment was the culmination of almost three years of work. In the fall of 2012, Miller, a security researcher for Twitter and a former NSA hacker, and Valasek, the director of vehicle security research at the consultancy IOActive, were inspired by the UCSD and University of Washington study to apply for a car-hacking research grant from Darpa. With the resulting $80,000, they bought a Toyota Prius and a Ford Escape. They spent the next year tearing the vehicles apart digitally and physically, mapping out their electronic control units, or ECUs—the computers that run practically every component of a modern car—and learning to speak the CAN network protocol that controls them.

When they demonstrated a wired-in attack on those vehicles at the DefCon hacker conference in 2013, though, Toyota, Ford, and others in the automotive industry downplayed the significance of their work, pointing out that the hack had required physical access to the vehicles. Toyota, in particular, argued that its systems were “robust and secure” against wireless attacks. “We didn’t have the impact with the manufacturers that we wanted,” Miller says. To get their attention, they’d need to find a way to hack a vehicle remotely.

Charlie Miller.
Charlie Miller. Photo: Whitney Curtis for WIRED
Chris Valasek.
Chris Valasek. Photo: Whitney Curtis for WIRED

Congress Takes on the
So the next year, they signed up for mechanic’s accounts on the websites of every major automaker and downloaded dozens of vehicles’ technical manuals and wiring diagrams. Using those specs, they rated 24 cars, SUVs, and trucks on three factors they thought might determine their vulnerability to hackers: How many and what types of radios connected the vehicle’s systems to the Internet; whether the Internet-connected computers were properly isolated from critical driving systems, and whether those critical systems had “cyberphysical” components—whether digital commands could trigger physical actions like turning the wheel or activating brakes.

Based on that study, they rated Jeep Cherokee the most hackable model. Cadillac’s Escalade and Infiniti’s Q50 didn’t fare much better; Miller and Valasek ranked them second- and third-most vulnerable. When WIRED told Infiniti that at least one of Miller and Valasek’s warnings had been borne out, the company responded in a statement that its engineers “look forward to the findings of this [new] study” and will “continue to integrate security features into our vehicles to protect against cyberattacks.” Cadillac emphasized in a written statement that the company has released a new Escalade since Miller and Valasek’s last study, but that cybersecurity is “an emerging area in which we are devoting more resources and tools,” including the recent hire of a chief product cybersecurity officer.

After Miller and Valasek decided to focus on the Jeep Cherokee in 2014, it took them another year of hunting for hackable bugs and reverse-engineering to prove their educated guess. It wasn’t until June that Valasek issued a command from his laptop in Pittsburgh and turned on the windshield wipers of the Jeep in Miller’s St. Louis driveway.

Since then, Miller has scanned Sprint’s network multiple times for vulnerable vehicles and recorded their vehicle identification numbers. Plugging that data into an algorithm sometimes used for tagging and tracking wild animals to estimate their population size, he estimated that there are as many as 471,000 vehicles with vulnerable Uconnect systems on the road.

Pinpointing a vehicle belonging to a specific person isn’t easy. Miller and Valasek’s scans reveal random VINs, IP addresses, and GPS coordinates. Finding a particular victim’s vehicle out of thousands is unlikely through the slow and random probing of one Sprint-enabled phone. But enough phones scanning together, Miller says, could allow an individual to be found and targeted. Worse, he suggests, a skilled hacker could take over a group of Uconnect head units and use them to perform more scans—as with any collection of hijacked computers—worming from one dashboard to the next over Sprint’s network. The result would be a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.

“For all the critics in 2013 who said our work didn’t count because we were plugged into the dashboard,” Valasek says, “well, now what?”

Chris Valasek.
Chris Vasalek. Photo: Whitney Curtis for WIRED

Congress Takes on Car Hacking

Now the auto industry needs to do the unglamorous, ongoing work of actually protecting cars from hackers. And Washington may be about to force the issue.

Later today, senators Markey and Blumenthal intend to reveal new legislation designed to tighten cars’ protections against hackers. The bill (which a Markey spokesperson insists wasn’t timed to this story) will call on the National Highway Traffic Safety Administration and the Federal Trade Commission to set new security standards and create a privacy and security rating system for consumers. “Controlled demonstrations show how frightening it would be to have a hacker take over controls of a car,” Markey wrote in a statement to WIRED. “Drivers shouldn’t have to choose between being connected and being protected…We need clear rules of the road that protect cars from hackers and American families from data trackers.”

Markey has keenly followed Miller and Valasek’s research for years. Citing their 2013 Darpa-funded research and hacking demo, he sent a letter to 20 automakers, asking them to answer a series of questions about their security practices. The answers, released in February, show what Markey describes as “a clear lack of appropriate security measures to protect drivers against hackers who may be able to take control of a vehicle.” Of the 16 automakers who responded, all confirmed that virtually every vehicle they sell has some sort of wireless connection, including Bluetooth, Wi-Fi, cellular service, and radios. (Markey didn’t reveal the automakers’ individual responses.) Only seven of the companies said they hired independent security firms to test their vehicles’ digital security. Only two said their vehicles had monitoring systems that checked their CAN networks for malicious digital commands.

UCSD’s Savage says the lesson of Miller and Valasek’s research isn’t that Jeeps or any other vehicle are particularly vulnerable, but that practically any modern vehicle could be vulnerable. “I don’t think there are qualitative differences in security between vehicles today,” he says. “The Europeans are a little bit ahead. The Japanese are a little bit behind. But broadly writ, this is something everyone’s still getting their hands around.”

Miller (left) and Valasek demonstrated the rest of their attacks on the Jeep while I drove it around an empty parking lot.
Miller (left) and Vasalek demonstrated the rest of their attacks on the Jeep while I drove it around an empty parking lot. Photo: Whitney Curtis

Aside from wireless hacks used by thieves to open car doors, only one malicious car-hacking attack has been documented: In 2010 a disgruntled employee in Austin, Texas, used a remote shutdown system meant for enforcing timely car payments to brick more than 100 vehicles. But the opportunities for real-world car hacking have only grown, as automakers add wireless connections to vehicles’ internal networks. Uconnect is just one of a dozen telematics systems, including GM Onstar, Lexus Enform, Toyota Safety Connect, Hyundai Bluelink, and Infiniti Connection.

In fact, automakers are thinking about their digital security more than ever before, says Josh Corman, the cofounder of I Am the Cavalry, a security industry organization devoted to protecting future Internet-of-things targets like automobiles and medical devices. Thanks to Markey’s letter, and another set of questions sent to automakers by the House Energy and Commerce Committee in May, Corman says, Detroit has known for months that car security regulations are coming.

But Corman cautions that the same automakers have been more focused on competing with each other to install new Internet-connected cellular services for entertainment, navigation, and safety. (Payments for those services also provide a nice monthly revenue stream.) The result is that the companies have an incentive to add Internet-enabled features—but not to secure them from digital attacks. “They’re getting worse faster than they’re getting better,” he says. “If it takes a year to introduce a new hackable feature, then it takes them four to five years to protect it.”

Corman’s group has been visiting auto industry events to push five recommendations: safer design to reduce attack points, third-party testing, internal monitoring systems, segmented architecture to limit the damage from any successful penetration, and the same Internet-enabled security software updates that PCs now receive. The last of those in particular is already catching on; Ford announced a switch to over-the-air updates in March, and BMW used wireless updates to patch a hackable security flaw in door locks in January.
Corman says carmakers need to befriend hackers who expose flaws, rather than fear or antagonize them—just as companies like Microsoft have evolved from threatening hackers with lawsuits to inviting them to security conferences and paying them “bug bounties” for disclosing security vulnerabilities. For tech companies, Corman says, “that enlightenment took 15 to 20 years.” The auto industry can’t afford to take that long. “Given that my car can hurt me and my family,” he says, “I want to see that enlightenment happen in three to five years, especially since the consequences for failure are flesh and blood.”

As I drove the Jeep back toward Miller’s house from downtown St. Louis, however, the notion of car hacking hardly seemed like a threat that will wait three to five years to emerge. In fact, it seemed more like a matter of seconds; I felt the vehicle’s vulnerability, the nagging possibility that Miller and Valasek could cut the puppet’s strings again at any time.

The hackers holding the scissors agree. “We shut down your engine—a big rig was honking up on you because of something we did on our couch,” Miller says, as if I needed the reminder. “This is what everyone who thinks about car security has worried about for years. This is a reality.”

Update 3:30 7/24/2015: Chrysler has issued a recall for 1.4 million vehicles as a result of Miller and Valasek’s research. The company has also blocked their wireless attack on Sprint’s network to protect vehicles with the vulnerable software.

1Correction 10:45 7/21/2015: An earlier version of the story stated that the hacking demonstration took place on Interstate 40, when in fact it was Route 40, which coincides in St. Louis with Interstate 64.

2Correction 1:00pm 7/27/2015: An earlier version of this story referenced a Range Rover recall due to a hackable software bug that could unlock the vehicles’ doors. While the software bug did lead to doors unlocking, it wasn’t publicly determined to exploitable by hackers.

Phreaked Out: Car Hacking

In this episode of “Phreaked Out,” top security researchers in the the field of car hacking highlight security holes in automobile technology. In the simplest terms, hackers have discovered how to unlock a vehicles doors and to relieve you of documents or valuables. However, the researchers show how an experienced hacker can access your vehicles main computer system and take remote access of the automobile, including steering, accelerating, braking and cutting the ignition.  These exploits have gone unaddressed by American  auto manufacturers who are becoming increasingly aware of the threat.

Counterintelligence: Elicitation Techniques

Download print version (pdf)

This brochure is an introduction to elicitation and elicitation techniques. Understanding the techniques and the threat may help you detect and deflect elicitation attempts.

Elicitation is a technique used to discreetly gather information. It is a conversation with a specific purpose: collect information that is not readily available and do so without raising suspicion that specific facts are being sought. It is usually non-threatening, easy to disguise, deniable, and effective. The conversation can be in person, over the phone, or in writing.

Conducted by a skilled collector, elicitation will appear to be normal social or professional conversation. A person may never realize she was the target of elicitation or that she provided meaningful information.

elicitation techniques brochure cover graphic: people talking outdoors.

Many competitive business intelligence collectors and foreign intelligence officers are trained in elicitation tactics. Their job is to obtain non-public information. A business competitor may want information in order to out-compete your company, or a foreign intelligence officer may want insider information or details on US defense technologies.

Elicitation Defined

The strategic use of conversation to extract information from people without giving them the feeling they are being interrogated.

Elicitation attempts can be simple, and sometimes are obvious. If they are obvious, it is easier to detect and deflect. On the other hand, elicitation may be imaginative, persistent, involve extensive planning, and may employ a co-conspirator. Elicitors may use a cover story to account for the conversation topic and why they ask certain questions.

Elicitors may collect information about you or your colleagues that could facilitate future targeting attempts.

Elicitation can occur anywhere— at social gatherings, at conferences, over the phone, on the street, on the Internet, or in someone’s home.

Elicitation is Not Rare

men talking

It is not uncommon for people to discover information about a person without letting on the purpose. For example, have you ever planned a surprise party for someone and needed to know their schedule, wish list, food likes and dislikes or other information without that person finding out you were collecting the information or for what purpose? The problem comes when a skilled elicitor is able to obtain valuable information from you, which you did not intend to share, because you did not recognize and divert the elicitation.

Why Elicitation Works

A trained elicitor understands certain human or cultural predispositions and uses techniques to exploit those. Natural tendencies an elicitor may try to exploit include:

  • A desire to be polite and helpful, even to strangers or new acquaintances
  • A desire to appear well informed, especially about our profession
  • A desire to feel appreciated and believe we are contributing to something important
  • A tendency to expand on a topic when given praise or encouragement; to show off
  • A tendency to gossip
  • A tendency to correct others
  • A tendency to underestimate the value of the information being sought or given, especially if we are unfamiliar with how else that information could be used
  • A tendency to believe others are honest; a disinclination to be suspicious of others
  • A tendency to answer truthfully when asked an “honest” question
  • A desire to convert someone to our opinion

For example, you meet someone at a public function and the natural getting-to-know-you questions eventually turn to your work. You never mention the name of your organization. The new person asks questions about job satisfaction at your company, perhaps while complaining about his job. You may think, “He has no idea where I work or what I really do. He’s just making idle chat. There’s no harm in answering.” However, he may know exactly what you do but he relies on his anonymity, your desire to be honest and appear knowledgeable, and your disinclination to be suspicious to get the information he wants. He may be hunting for a disgruntled employee who he can entice to give him insider information.

Techniques

There are many elicitation techniques, and multiple techniques may be used in an elicitation attempt. The following are descriptions of some of those techniques.

Assumed Knowledge: Pretend to have knowledge or associations in common with a person. “According to the computer network guys I used to work with…”

Bracketing: Provide a high and low estimate in order to entice a more specific number. “I assume rates will have to go up soon. I’d guess between five and 15 dollars.” Response: “Probably around seven dollars.”

Can you top this? Tell an extreme story in hopes the person will want to top it. “I heard Company M is developing an amazing new product that is capable of …”

Confidential Bait: Pretend to divulge confidential information in hopes of receiving confidential information in return. “Just between you and me…” “Off the record…”

Criticism: Criticize an individual or organization in which the person has an interest in hopes the person will disclose information during a defense. “How did your company get that contract? Everybody knows Company B has better engineers for that type of work.”

people seated at outdoor cafe

Deliberate False Statements / Denial of the Obvious:Say something wrong in the hopes that the person will correct your statement with true information. “Everybody knows that process won’t work—it’s just a DARPA dream project that will never get off the ground.”

Feigned Ignorance: Pretend to be ignorant of a topic in order to exploit the person’s tendency to educate. “I’m new to this field and could use all the help I can get.” “How does this thing work?”

Flattery: Use praise to coax a person into providing information. “I bet you were the key person in designing this new product.”

Good Listener: Exploit the instinct to complain or brag, by listening patiently and validating the person’s feelings (whether positive or negative). If a person feels they have someone to confide in, he/she may share more information.

The Leading Question: Ask a question to which the answer is “yes” or “no,” but which contains at least one presumption. “Did you work with integrated systems testing before you left that company?” (As opposed to: “What were your responsibilities at your prior job?”)

Macro to Micro: Start a conversation on the macro level, and then gradually guide the person toward the topic of actual interest. Start talking about the economy, then government spending, then potential defense budget cuts, then “what will happen to your X program if there are budget cuts?” A good elicitor will then reverse the process taking the conversation back to macro topics.

Mutual Interest: Suggest you are similar to a person based on shared interests, hobbies, or experiences, as a way to obtain information or build a rapport before soliciting information. “Your brother served in the Iraq war? So did mine. Which unit was your brother with?”

Oblique Reference: Discuss one topic that may provide insight into a different topic. A question about the catering of a work party may actually be an attempt to understand the type of access outside vendors have to the facility.

Opposition/Feigned Incredulity: Indicate disbelief or opposition in order to prompt a person to offer information in defense of their position. “There’s no way you could design and produce this that fast!” “That’s good in theory, but…”

Provocative Statement: Entice the person to direct a question toward you, in order to set up the rest of the conversation. “I could kick myself for not taking that job offer.” Response: “Why didn’t you?” Since the other person is asking the question, it makes your part in the subsequent conversation more innocuous.

Questionnaires and Surveys: State a benign purpose for the survey. Surround a few questions you want answered with other logical questions. Or use a survey merely to get people to agree to talk with you.

Quote Reported Facts: Reference real or false information so the person believes that bit of information is in the public domain. “Will you comment on reports that your company is laying off employees?” “Did you read how analysts predict…”

Ruse Interviews: Someone pretending to be a headhunter calls and asks about your experience, qualifications, and recent projects.

finger on a keyboard

Target the Outsider: Ask about an organization that the person does not belong to. Often friends, family, vendors, subsidiaries, or competitors know information but may not be sensitized about what not to share.

Volunteering Information / Quid Pro Quo: Give information in hopes that the person will reciprocate. “Our company’s infrared sensors are only accurate 80% of the time at that distance. Are yours any better?”

Word Repetition: Repeat core words or concepts to encourage a person to expand on what he/she already said. “3,000 meter range, huh? Interesting.”

 

Deflecting Elicitation Attempts

Know what information should not be shared, and be suspicious of people who seek such information. Do not tell people any information they are not authorized to know, to include personal information about you, your family, or your colleagues.

You can politely discourage conversation topics and deflect possible elicitations by:

  • Referring them to public sources (websites, press releases)
  • Ignoring any question or statement you think is improper and changing the topic
  • Deflecting a question with one of your own
  • Responding with “Why do you ask?”
  • Giving a nondescript answer
  • Stating that you do not know
  • Stating that you would have to clear such discussions with your security office
  • Stating that you cannot discuss the matter

If you believe someone has tried to elicit information from you, especially about your work, report it to your security officer.

Happy 2016 from Camden Civil Rights Project!

¡ Feliz año nuevo ! (Spanish)

Bonne Année ! (French)

с новым годом (Written Russian)

s Novym godom ! (Spoken Russian)

Felice Anno Nuovo ! (Italian)

Frohes neues Jahr ! (German)

ευτυχισμένο το νέο έτος (Written Greek)

eftychisméno to néo étos ! (Spoken Greek)

שנה טובה (Hebrew)

mzl niu yar ! (Yiddish)

bhliain nua sásta ! (Irish)

blwyddyn Newydd Dda ! (Welsh)

新年快乐 (Traditional Chinese)

Xīnnián kuàilè ! (Chinese)

Gong Xi Fa Cai ! (Mandarin)

Gong Hey Fat Choy ! (Cantonese)

नया साल मुबारक  (Written Hindi)

naya saal mubaarak (Spoken Hindi)

明けましておめでとうございます(Written Japanese)

Akemashiteomedetōgozaimasu ! (Spoken Japanese)

새해 복 많이 받으세요 (Written Korean)

saehae bog manh-i bad-euseyo ! (Spoken Korean)

Chúc mừng năm mới ! (Vietnamese)

سنة جديدة سعيدة (Arabic)

sunnat jadidat saeida ! (Spoken Arabic)

(Persian) سال نو مبار

(Selamat Tahun Baru ! (Indonesian

(Maligayang Bagong Taon ! (Filipino

(šťastný nový rok ! (Czech

(щасливого Нового року (Written Ukranian

(shchaslyvoho Novoho roku ! (Spoken Ukranian

(з Новым годам (Written Belarusian

(z Novym hodam ! (Spoken Belarusian

(szczęśliwego (Written Polish

(Nowego Roku ! (Spoken Polish

šťastný nový rok ! (Slovak)
mutlu Yıllar ! (Turkish)
¡ Feliz Ano Novo ! (Portegese)
Srečno Novo Leto ! (Slovenian)
Sretna Nova Godina ! (Bosnian/Croation)
Srećna Nova godina (Serbian)
Gëzuar Vitin e Ri ! (Albanian)
an nou fericit ! (Romanian)
Честита Нова Година (Written Bulgarian)
Chestita Nova Godina ! (Spoken Bulgarian)
Gelukkig Nieuwjaar ! (Dutch)
godt nytt år ! (Norwegian)
Onnellista uutta vuotta ! (Finnish)
Gleðilegt nýtt ár ! (Icelandic)
շնորհավոր Նոր Տարի (Written Armenian)
shnorhavor Nor Tari ! (Spoken Armenian)
Laimingų Naujųjų metų (Lithuanian)
გილოცავ ახალ წელს (Written Georgian)
gilots’av akhal tsels (Spoken Georgian)
среќна Нова година (Written Macedonian)
sreḱna Nova godina (Spoken Macedonian)
laimīgu Jauno gadu ! (Latvian)
head uut aastat ! (Estonian)
Соли Нав Муборак (Written Tajik)
Soli Nav Muʙorak ! (Spoken Tajik)
Yangi yilingiz bilan (Uzbek)
শুভ নব বর্ষ (Written Bengali)
Śubha naba barṣa (Spoken Bengali)
สวัสดีปีใหม่ (Written Thai)
S̄wạs̄dī pī h̄ım̀ ! (Spoken Thai)
ສະ​ບາຍ​ດີ​ປີ​ໃຫມ່ (Written Lao)
Sa bai di pi haim ! (Spoken Lao)
selamat tahun Baru ! (Malay)
Kè Kontan Ane Nouvo ! (Haitian)
ਨਵਾ ਸਾਲ ਮੁਬਾਰਕ (Written Punjabi)
Navā sāla mubāraka ! (Spoken Punjabi)
pyawshwinhpwal nhaitsait ! (Burmese)
sanadka cusub ku faraxsan ! (Somali)
ezi afọ ọhụrụ ! (Igbo)
barka da sabon shekara ! (Hausa)
نیا سال مبارک ہو(Urdu)
Heri ya mwaka mpya ! (Swahili)
Wilujeng taun énggal ! (Sudanese)
e ku odun, eku iyedun ! (Yoruba)
Jabulela unyaka omusha ! (Zulu)
gelukkige Nuwe Jaar ! (Afrikaans)
zoo siab xyoo tshiab ! (Hmong)

 

 

 

Turns Out Police Stingray Spy Tools Can Indeed Record Calls

by Kim Zetter   I  Security  I  10.28.15  I  3:00 PM

 

The federal government has been fighting hard for years to hide details about its use of so-called stingray surveillance technology from the public.

The surveillance devices simulate cell phone towers in order to trick nearby mobile phones into connecting to them and revealing the phones’ locations.

Now documents recently obtained by the ACLU confirm long-held suspicions that the controversial devices are also capable of recording numbers for a mobile phone’s incoming and outgoing calls, as well as intercepting the content of voice and text communications. The documents also discuss the possibility of flashing a phone’s firmware “so that you can intercept conversations using a suspect’s cell phone as a bug.”

The information appears in a 2008 guideline prepared by the Justice Department to advise law enforcement agents on when and how the equipment can be legally used.

The Department of Justice ironically acknowledges in the documents that the use of the surveillance technology to locate cellular phones ‘is an issue of some controversy.’

The American Civil Liberties Union of Northern California obtained the documents (.pdf) after a protracted legal battleinvolving a two-year-old public records request. The documents include not only policy guidelines, but also templates for submitting requests to courts to obtain permission to use the technology.

The DoJ ironically acknowledges in the documents that the use of the surveillance technology to locate cellular phones “is an issue of some controversy,” but it doesn’t elaborate on the nature of the controversy. Civil liberties groups have been fighting since 2008 to obtain information about how the government uses the technology, and under what authority.

Local law enforcement agencies have used the equipmentnumerous times in secret without obtaining a warrant and have even deceived courts about the nature of the technology to obtain orders to use it. And they’ve resorted to extreme measures to prevent groups like the ACLU from obtaining documents about the technology.

Stingrays go by a number of different names, including cell-site simulator, triggerfish, IMSI-catcher, Wolfpack, Gossamer, and swamp box, according to the documents. They can be used to determine the location of phones, computers using open wireless networks, and PC wireless data cards, also known as air cards.

The devices, generally the size of a suitcase, work by emitting a stronger signal than nearby towers in order to force a phone or mobile device to connect to them instead of a legitimate tower. Once a mobile device connects, the phone reveals its unique device ID, after which the stingray releases the device so that it can connect to a legitimate cell tower, allowing data and voice calls to go through. Assistance from a cell phone carrier isn’t required to use the technology, unless law enforcement doesn’t know the general location of a suspect and needs to pinpoint a geographical area in which to deploy the stingray. Once a phone’s general location is determined, investigators can use a handheld device that provides more pinpoint precision in the location of a phone or mobile device—this includes being able to pinpoint an exact office or apartment where the device is being used.

In addition to the device ID, the devices can collect additional information.

Investigators also seldom tell judges that the devices collect data from all phones in the vicinity of a stingray—not just a targeted phone—and can disrupt regular cell service.

“If the cellular telephone is used to make or receive a call, the screen of the digital analyzer/cell site simulator/triggerfish would include the cellular telephone number (MIN), the call’s incoming or outgoing status, the telephone number dialed, the cellular telephone’s ESN, the date, time, and duration of the call, and the cell site number/sector (location of the cellular telephone when the call was connected),” the documents note.

In order to use the devices, agents are instructed to obtain a pen register/trap and trace court order. Pen registers are traditionally used to obtain phone numbers called and the “to” field of emails, while trap and trace is used to collect information about received calls and the “from” information of emails.

When using a stingray to identify the specific phone or mobile device a suspect is using, “collection should be limited to device identifiers,” the DoJ document notes. “It should not encompass dialed digits, as that would entail surveillance on the calling activity of all persons in the vicinity of the subject.”

The documents add, however, that the devices “may be capable of intercepting the contents of communications and, therefore, such devices must be configured to disable the interception function, unless interceptions have been authorized by a Title III order.”

Title III is the federal wiretapping law that allows law enforcement, with a court order, to intercept communications in real time.

Civil liberties groups have long suspected that some stingrays used by law enforcement have the ability to intercept the content of voice calls and text messages. But law enforcement agencies have insisted that the devices they use are not configured to do so. Another controversial capability involves the ability to block mobile communications, such as in war zones to prevent attackers from using a mobile phone to trigger an explosive, or during political demonstrations to prevent activists from organizing by mobile phone. Stingray devices used by police in London have both of these capabilities, but it’s not known how often or in what capacity they have been used.

The documents also note that law enforcement can use the devices without a court order under “exceptional” circumstances. Most surveillance laws include such provisions to give investigators the ability to conduct rapid surveillance under emergency circumstances, such as when lives are at stake. Investigators are then to apply for a court order within 24 hours after the emergency surveillance begins. But according to the documents, the DoJ considers “activity characteristic of organized crime” and “an ongoing attack of a protected computer (one used by a financial institution or U.S. government) where violation is a felony” to be considered an exception, too. In other words, an emergency situation could be a hack involving a financial institution.

“While such crimes are potentially serious, they simply do not justify bypassing the ordinary legal processes that were designed to balance the government’s need to investigate crimes with the public’s right to a government that abides by the law,” Linda Lye, senior staff attorney for the ACLU of Northern California, notes in a blog post about the documents.

Another issue of controversy relates to the language that investigators use to describe the stingray technology. Templates for requesting a court order from judges advise the specific terminology investigators should use and never identify the stingray by name. They simply describe the tool as either a pen register/trap and trace device or a device used “to detect radio signals emitted from wireless cellular telephones in the vicinity of the Subject that identify the telephones.”

The ACLU has long accused the government of misleading judges in using the pen register/trap and trace term—since stingrays are primarily used not to identify phone numbers called and received, but to track the location and movement of a mobile device.

Investigators also seldom tell judges that the devices collect data from all phones in the vicinity of a stingray—not just a targeted phone—and can disrupt regular cell service.

It’s not known how quickly stingrays release devices that connect to them, allowing them to then connect to a legitimate cell tower. During the period that devices are connected to a stingray, disruption can occur for anyone in the vicinity of the technology.

Disruption can also occur from the way stingrays force-downgrade mobile devices from 3G and 4G connectivity to 2G if they are being used to intercept the concept of communications.

In order for the kind of stingray used by law enforcement to work for this purpose, it exploits a vulnerability in the 2G protocol. Phones using 2G don’t authenticate cell towers, which means that a rogue tower can pass itself off as a legitimate cell tower. But because 3G and 4G networks have fixed this vulnerability, the stingray will jam these networks to force nearby phones to downgrade to the vulnerable 2G network to communicate.

“Depending on how long the jamming is taking place, there’s going to be disruption,” Chris Soghoian, chief technology for the ACLU has told WIRED previously. “When your phone goes down to 2G, your data just goes to hell. So at the very least you will have disruption of internet connectivity. And if and when the phones are using the stingray as their only tower, there will likely be an inability to receive or make calls.”

Concerns about the use of stingrays is growing. Last March, Senator Bill Nelson (D—Florida) sent a letter to the FCC calling on the agency to disclose information about its certification process for approving stingrays and any other tools with similar functionality. Nelson asked in particular for information about any oversight put in place to make sure that use of the devices complies with the manufacturer’s representations to the FCC about how the technology works and is used.

Related: http://www.c-span.org/video/standalone/?c4529079

Nelson also raised concerns about their use in a remarkable speech on the Senate floor. The Senator said the technology “poses a grave threat to consumers’ cellphone and Internet privacy,” particularly when law enforcement agencies use them without a warrant.

The increased attention prompted the Justice Department this month to release a new federal policy on the use of stingrays, requiring a warrant any time federal investigators use them. The rules, however, don’t apply to local police departments, which are among the most prolific users of the technology and have been using them for years without obtaining a warrant.

Go Back to Top. Skip To: Start of Article.

FBI Using GPS to Track Activists

An environmental activist contacted Wired Magazine after she discovered a GPS tracking device had been placed under her vehicle, courtesy of the FBI. According to Wired.com, this method is becoming a common way for the feds to track anyone deemed to be suspicious or a “potential threat.” This continues the government’s trend of clamping down on what they perceive to be the most dangerous threat to our nation — the democratic participation of political activists.

Phreaked Out: Real-Time Smartphone Hacks

Smartphones are vulnerable to hacks when connected to a network—whether cellular or wi-fi. In the third and final episode of Phreaked Out, they examine three real-time phone hacks – man-in-the middle attacks, the Snoopy exploit and intercepting cellular call data using an IMSI catcher.

Snoopy Snoops on Unsuspecting Users With Wireless Surveillance System

The National Security Agency isn’t the only group with the technology that can look into wireless data, but there are ways users can protect themselves from Snoopy.

eWeek - Enterprise IT Technology News, Opnion and Reviews

by Michael Kerner

Every day, billions of people around the globe connect wirelessly, leaving a veritable trail of identifiable breadcrumbs that can be followed, tracked and analyzed by security researchers. At the upcoming Black Hat Brazil event in November, researchers from security firm SensePost will debut an updated version of their distributed mobile tracking and analysis project, dubbed Snoopy.Glenn Wilkinson, lead security analyst at SensePost, explained to eWEEK that Snoopy is a distributed tracking, data interception and profiling framework. SensePost researchers first built Snoopy in 2012 as a very rough proof of concept and have now rewritten the framework to be more modular and scalable.The Snoopy system involves endpoint sensor devices that serve as data collection nodes, and then there is a back-end infrastructure that collects and helps make sense of all the collected data. The Snoopy node software, or Drone, can run on small Linux devices, including a BeagleBone Black, and the back end can run on Linux servers.”Snoopy can be run on multiple devices over a large area, say the entire city of London, UK,” Wilkinson said. “The Snoopy framework can then also synchronize all the data in a centralized database.”

The first iteration of Snoopy specifically looked at WiFi signals but is now being expanded to include other types of wireless signals, including Bluetooth and near-field communications (NFC). At a basic level, Snoopy is looking for any kind signal emitted by an electronic device that can then be used to uniquely identify the device and perhaps the individual who owns the device.

Snoopy collects the data by abusing functionality that is part of most WiFi stacks on mobile devices. The way that WiFi works in nearly all cases is the system will always be probing for signals from access points it has previously connected to. As a feature, that means if a user has previously connected to his or her own office access point, then whenever the device is in range of the office access point, the device is connected.

“When your smartphone is looking for all of the access points it has previously connected to, it is revealing your wireless adapter’s MAC (Media Access Control) address,” Wilkinson said. “That’s a unique number for the device, so we can identify the device as being at a particular location at a point in time.”

So in a large-scale Snoopy deployment with nodes over a distributed area, Snoopy could track the movement of a device over time.

Snoopy also includes the Karma attack, a wireless attack that impersonates the name of previously connected access points. In a Karma attack, when the wireless device is looking for its previously connected access points, Karma responds, identifying itself as one of those access points, and tricks the user into connecting. Once the victim has been connected to the rogue access point via Karma, Snoopy can then intercept data and also manipulate the data the user sees.

From an analysis perspective, the new Snoopy Framework makes use of the open-source Maltego data visualization project to provide a graphical front end and tools to understand all the data that the Snoopy node can collect.

Enterprise

Daniel Cuthbert, chief operating officer at SensePost, told eWEEK that from a business standpoint, his company is still figuring out the best license and approach for the Snoopy project. Cuthbert said he would like to emulate the approach taken by the open-source Metasploit penetration testing framework. Metasploit has a core open-source project and then layers enterprise editions with additional reporting functionality and support on top.

There are a number of things individuals can do to limit the risk of being snooped on by Snoopy. Wilkinson suggests that users flush the recently connected networks list on their mobile devices. He noted that the Karma-style attacks only work effectively for recently connected open networks.

Wilkinson also suggests that users keep WiFi turned off until such time as they need to connect.

“People are carrying devices in their pockets that are emitting signals that allow them to be uniquely identified,” Wilkinson said. “So I suspect the bigger message going forward is for people to be aware of what they are carrying that might give away some unique identifier and leak information.”

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter@TechJournalist.