UMbRA, which stands for Unique Mission to Build Records and Arrests, is a tool focused on security and surveillance professionals, law enforcement officials and investigators
LAS VEGAS, NV, September 20, 2017: On Wednesday, Biometrica Systems, Inc., a Las Vegas-based SaaS company that uses biometrics — including facial recognition systems and databases, encrypted information networks and incident management tools — to track crime and criminals, announced the release of UMbRA, a 100% law-enforcement-sourced database of people that have been arrested, convicted of a crime, or are wanted by law enforcement in connection with one.
UMbRA, the Unique Mission to Build Records and Arrests, allows subscribers to run a search on a person in one of two ways. They could upload an image of an unknown subject, run it against Biometrica’s Advanced Facial Recognition (AFR) system, and sift through the options the system provides, or they could run a text-only search against a database of millions of law enforcement-verified records. UMbRA returns results in real-time, from between 30 seconds to two minutes.
“The release of UMbRA has been two years in the making, and there was a need for a product like this,” said Biometrica CEO Wyly Wade. “In today’s world, crime travels, but information on the people behind the crimes doesn’t travel as easily or isn’t accessible very easily, even to those that need the information. UMbRA helps solve that problem.”
He added, “We spoke to several security and surveillance professionals from the private sector, and law enforcement officers from different jurisdictions, and realized one of the big issues they had was an inability to get access to cross-jurisdictional data in near real-time, that is, when it mattered. We provide that ability in seconds, including on mobile devices, so the person on the frontlines knows what they’re dealing with.”
“UMbRA would be useful in multiple situations,” said Biometrica’s Vice President of Business Development, Kevin Parker. “You may have a local beat cop walking into a domestic violence situation in North Carolina, without knowing one of the parties has a prior conviction for aggravated assault in North Dakota. There might be a situation where a hotel guest with no kids is spending all his time near a children’s play area. With UMbRA, the security officers could run a scan in seconds, and find he’s a convicted pedophile. The hotel could let him stay, but would, logically, want to redirect him from the children’s area.”
The release of UMbRA fits into Biometrica’s long-term strategy, which is concentrated around a planned expansion into different markets. “UMbRA also fits in with our existing powerful suite of security products,” said Wade. “It uses the AFR system, you can pass information or alerts across SSIN, our encrypted Security & Surveillance Information System so as to not compromise PII, you can create local level blacklists or whitelists through X-LST and you can manage incidents across LOGiT, our incident management tool, which creates a digital audit trail of events.”
About Biometrica
Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.
To this purpose, the company’s cyber-physical products and modules, and range of biometric-enabled tools — including private, encrypted information networks, facial recognition systems and databases, and incident management software — enable the recording of criminal occurrences, recognize threats, track individuals or groups that have either committed a misdemeanor or felony or contributed to breaking the law, protect PII, help organizations know their customers and their employees, and allow security and surveillance teams to link all of the above.
We have a problem — there’s just not enough comprehensive, substantive data. But depending on various accounts, between 100,000 to 1.5 million children are trafficked for sex every year in the United States. From risk factors to technology, this FAQ tries to address why trafficking happens, and details the factors that make runaway/throwaway youth most at risk for being targeted.
The sex trafficking of minors is an American epidemic. Despite an increase in legislative efforts, community awareness campaigns, the creation of task forces, and the provision of funding for victim services to address this issue, missing children who are believed to have run away of their own free will, with no solid evidence of coercion, being lured, or being forcefully removed from their homes or last known location, ultimately become the lowest of our collective priorities.
Why? Possibly because the data is hard to collate and capture, and many runaway youth return to/from their homes without reporting their experiences while on the streets.
Take, for example, the case of Sandra*. Sandra, a 16-year-old girl, was raised by her grandmother until the age of eight. She was placed in the foster care system upon her grandmother’s passing. At the age of 13, Sandra began running away from her placement home due to unwanted sexual attention by a caregiver in the home. During her time away, a man named Darryl* befriended Sandra. She confided in Darryl about her grandmother’s passing and the discomfort she felt in her foster home. He sympathized with her and promised he would protect her. He offered Sandra the opportunity to live with him. Sandra met with Darryl several times before running away from home for good. Darryl told Sandra that she had to repay him for living expenses by exchanging sex for money with his friends and neighbors in the building.
What is the prevalence of sex trafficking in the United States?
There has yet to be a comprehensive study done to determine an accurate number of children that are victims, but the statistics currently available put that number at anywhere from 100,000 to 1.5 million children per year.
The numbers do not give us a clear perspective on this issue, but if we look at this only from the number of Runaway/Thrownaway children in the United States [NISMART-2, 2002], an estimated 1,682,900 youth had a runaway/thrownaway episode in 1999, and an estimated 1,190,900 could have been endangered by factors such as substance abuse, sexual or physical abuse, the presence of criminal activity in their environment, or being 13 or even younger. All of these issues put our children at risk of being trafficked.
Part of the issue with obtaining accurate statistics can be shown in the following numbers:
In 2016, the FBI reported that 465,676 children were reported missing and entered into the National Crime Information Center (NCIC).
Only 20,500 of those were reported to the National Center for Missing and Exploited Children (NCMEC).
18,500 (approx. 90%) of those children were endangered runaways and one in six were likely victims of sex trafficking (over 3,000).
What we don’t know is how many of the others reported missing in the NCIC are endangered runaways. We also don’t have a number for children that were never reported missing because they were either thrown away by their caregivers, or because their caregivers didn’t go to the trouble of reporting them missing.
What are common risk factors?
The factors most likely to cause youth to run away overlap with the factors at put them at risk for sex trafficking. These may include prior physical, sexual, or emotional abuse, exposure to violence, family conflict or lack of familial acceptance, mental health concerns, substance abuse, school problems/truancy, and deviant peers. Regardless of the circumstances that cause youth to leave home, we know that youth who wander away, run away, or who are lured from their homes are a definite risk for victimization, exploitation, and homelessness.
What is the average age of sex-trafficked youth?
The most quoted statistic about the average age of entry into sex trafficking is 12-14 years old. Like other statistics, however, we simply don’t have enough information because the only source of real information comes from survivors that are willing to share their stories. The victims of this crime do range from very young children to adolescents, and represent a wide variety of ethnic and socio-economic backgrounds.
Are female youth more likely to be trafficked?
Yes. Girls are the predominant victims of sex trafficking, but it is important to know that about 20% of sex trafficking victims are male. This is “an issue that cuts across class, race, and even gender. Both boys and girls are exploited in this way.” [Trafficking in Persons Report June 2005 and June 2017]
How are minors lured into sex trafficking?
There are many ways that children become victims of sex trafficking. Victims are trafficked by family, friends or acquaintances, and individuals who were once unknown to them. The recruiting or luring of victims may start at an early age with a caregiver who sells the child for drugs, to pay a debt, or for any number of reasons. As children get older, traffickers outside the home will look to target vulnerable children.
The most common methods involve the use of both psychological and physical manipulation. For instance, a trafficker will pretend to be a responsive, considerate, attentive, and loving boyfriend or girlfriend. If a child is having problems with their caregiver(s), traffickers will also play the role of rescuer, providing that child with the kindness and compassion they are missing, and promising a potentially safe place for that child to go to. Traffickers also use “sextortion” when they are able to convince a young person to send sexually explicit photos or videos of themselves, and then use those as blackmail against that child. Other lures can involve “survival” (food, a place to stay, or other basic necessities) and violence.
Any child may be vulnerable to a person who promises to meet his or her emotional and physical needs. Traffickers know that they need to build trust and allegiance to ensure the minor will remain loyal even in the face of severe victimization.
Traffickers find victims in everyday locations — at the bus stop, the mall, schools, group homes, foster care homes, and shelters, to name a few. Promises of jobs, freedom, love, jewelry, electronics, and other things all children want, make our most vulnerable easy targets.
How is technology being used to target victims?
It is important to note that many of these relationships may begin online before they meet in person. Traffickers have said they will take up to a year or more to groom a child online, in order to gain that child’s trust, before suggesting a meeting in person. Some pretend to be school-aged children themselves, or perhaps just slightly older, use fake profiles to lure children in, and always lie about their intentions, making it impossible for a vulnerable child online to recognize they are being targeted.
Traffickers use social media (Facebook, SnapChat, Instagram, etc.) to target potential victims, some claiming to send out hundreds or thousands of friend requests, and then beginning the process of building loyalty with the ones that accept that request.
How do traffickers use technology to exploit children?
As mentioned above, technology, as a tool, is a tried and true modern-day method of gaining the trust of young people, and is often the modus operandi used in children ultimately becoming victims of sex trafficking. Once a victim is lured in, the most common way for a child to be sold for sex is online. Many websites, like Backpage.com, host content that advertise minors as prostitutes.
According to the US Department of State Fact Sheet on the Online Sexual Exploitation of Children, “the low financial cost of this criminal enterprise (an Internet connection and a mobile device or computer-linked webcam), coupled with its low risk nature (as seen by the relatively small number of convictions globally) and high profitability are driving the rapid growth of online sexual exploitation of children.”
How can law enforcement determine if a reported runaway is at risk for sex trafficking?
From whatever statistics are available, we know that children who run away from home are at tremendous risk of becoming victims of sex trafficking. There are a number of indicators that can help confirm if a runaway might be a victim of trafficking, and typically, there will also be a number of indicators to help lead law enforcement in that direction. Some of these include significant behavioral changes, new friends or a new, possibly older, boyfriend, deleting, erasing, or locking all social media accounts, and a history of being a repeat runaway, among others.
At the Missing and Unidentified Persons Conference, September 19 – 21, 2017, the Polly Klaas Foundation will take a closer look at these indicators, provide specifics on how law enforcement may use runaway reports to initiate sex trafficking investigations, and work within a department to implement new investigative tools. Here, Jenni Thompson, Director of Legislation and Education at the Polly Klaas Foundation, shares more about her presentation at the conference and speaks of how the Foundation is leading the way in supporting law enforcement investigations of sex trafficking.
Chris Young, Chair of the Bay Area Search and Rescue Council, will also participate in the conference and provide a discussion about how local organizations can support law enforcement investigations of missing persons. Learn more about Chris’s presentation here.
Note: *Sandra and Darryl are pseudonyms. Sandra’s story is like that of many at-risk youth, lured away from home by acquaintances and/or strangers who gain their trust.
About the Polly Klaas Foundation: Since 1993, the Polly Klaas Foundation (PKF) has been a national nonprofit dedicated to the safety of all children, the recovery of missing children, and public policies that keep children safe in their communities. They have helped more than 10,000 families of missing children with a 97% recovery rate and have become sought-after experts, especially in the area of the sex trafficking of endangered runaways. They provide training to law enforcement professionals, social service agencies, and to 7th – 9th grade students to ensure that issues relating to both the quick recovery of our missing and trafficked children and the prevention of trafficking are addressed. The PKF also works closely with state and national lawmakers to address issues of child safety, missing children, and human trafficking.
The heartbreaking stories of multiple victim events, including human trafficking and homicide, and their implications for investigators and first responders, among others, will be the focus of the 2017 Annual National Missing and Unidentified Person’s Conference (MUPC) in Atlanta in September. We give you a broad overview on America’s hidden victims, some of the issues faced in investigating these complex cases, and a look at what this year’s conference will be about.By the National Criminal Justice Training Center (NCJTC)
Missing persons investigations are complex and multilayered. While the attention of the media is often focused on victims that are kidnapped by a stranger, these cases actually constitute only a small fraction of those that are reported; most involve individuals that wander off, are lured away by known perpetrators, run away, or are homeless because of a number of other stressors. As law enforcement, service providers and communities struggle to identify these individuals as “missing,” their cases often do not receive adequate resources. These missing individuals are our nation’s hidden victims. The 2016 Missing Person and Unidentified Person Statistics report from the
(NCIC), the country’s primary database for tracking crime, indicates that there were more than 645,000 missing person records entered into their database last year, of which 88,040 were still considered active missing persons cases at year’s end. Of these, 33,706 were of children under the age of 18, and 42,807 of persons below the age of 21. There were also 8,431 active unidentified persons records in the system on Dec. 31, 2016. Of these, 894 cases were entered in 2016. The NCIC was established in 1967 and their Missing Persons File was established in 1975. The numbers above include adults and minors, males and females, people of various ethnicities, as well as individuals of all ages. They also include people with a proven physical or mental disability that were reported missing, under circumstances that suggest that they were in danger, those that went missing after a catastrophic event, and persons that were absent under circumstances that might not have been voluntary. All of this serves to remind us of a tragic truth — abduction, victimization, and exploitation are not discriminatory crimes, they could happen to anyone, anywhere, anytime. Despite the haste and the tireless efforts of various stakeholders, many missing person cases remain unresolved. It’s important to note that even though the NCIC database classifies more than 88,000 as “active” as of December 2016, this, unfortunately, doesn’t mean that all the rest of the cases in their system were resolved. Cases are “purged” from the database (contributing to their removal from active status), for any number of reasons: A case could be canceled/cleared, a person could be located by another agency, or a record could be removed by the agency that made the original entry because they determined that the record was invalid. The cases purged in any given year could have had an initial entry date of many years ago. Thus, the numbers do not add up, and it’s very difficult, if not impossible, to get a definite number on actual active cases across the country.
The Big Bad Data Problem
One of the major issues, as it relates to missing persons, is the lack of consistency and information-sharing across data sets. As a result, according to the U.S. Government Accountability Office’s 2016 report on
, persons who rely on just one source may miss information that could be instrumental in solving missing persons’ cases. For instance, there are differences in the data available on the FBI-run NCIC database, and NamUS, which is the
. NamUS, a national centralized repository and resource center for missing persons and unidentified decedent records, is supported by the National Institute of Justice — the research, development and evaluation agency of the U.S. Department of Justice. While both databases are operated by Department of Justice agencies, the accessibility and user-ability of the databases varies; therefore creating discrepancies in the way data is entered and validated. Additionally, there are classification issues. NamUS classifies an unidentified person as a deceased person whose body is as yet unidentified, while the FBI’s 2016 Missing Person and Unidentified Person report defines “unidentified persons” under two categories, EUL (living unable to be identified), and EUV (unidentified catastrophe victims). Over and above all this, states may code their missing persons entries differently, incomplete entries are often added, and there is a lack of hard data/research related to the issue. These cases are often wrought with other challenges too — a lack of resources, legal hurdles, and complex technology or coordination issues. Cases that result in closure, identification, and recovery are often due to the rapid coordinated response of law enforcement, emergency management, search and rescue professionals, and their partners. And, while there is no one best approach or solution to resolving these cases, professionals agree that collaboration and the leveraging of all possible resources — including those from the community, geospatial and surveillance technology, telecommunications and social media — are crucial to the effectiveness of search and recovery of all missing persons, irrespective of the circumstances involved.
Atlanta: What We Could Do
It is with all of this in mind that experts from various fields and disciplines across the country are converging in Atlanta to discuss the application of new techniques, technologies and resources to resolve missing persons cases, at the annual National Missing and Unidentified Person’s Conference (MUPC). This year’s event, entitled “Multiple Victim Events: Implications for Investigation, Search, Rescue, and Recovery,” will feature presentations on effective strategies for responding to mass incidents and missing persons’ reports, including those involving human trafficking and serial homicide. The conference is the first of its kind to provide law enforcement with a forum to discuss the complex nature of missing persons’ cases, and to develop strategies to improve the responses to victims and families. Among the many experts participating in the discussion are Jason Moran from the Cook County Sheriff’s Police Department, who applied various forensic and DNA techniques to
CEO Wyly Wade, who will explore how facial recognition technology can aid in the identification and recovery of missing persons and in tracking crime: John Beck from
(BASARC), who will speak about critical collaborations in the search for missing persons, to name just a few. There’s more. Bill Kearney, Co-founder of
, shares more on what we will learn from a panel of experts that will explore the art of possibilities in the missing and unidentified persons realm. Also hear from Amanda Pick, the CEO of the
, on how to leverage technology to increase information sharing and collaboration among law enforcement, key stakeholders, and the community.
This piece is courtesy the National Criminal Justice Training Center (NCJTC) of Fox Valley Technical College, which recognizes that the factors that put adults and children most at risk for harm are often complex and misunderstood. For more than 20 years, NCJTC has provided national training and technical assistance to agencies, organizations, and individuals in the criminal justice field on a multitude public safety issues. Through its National Conference on Responding to Missing & Unidentified Persons, NCJTC offers innovative approaches, techniques, and technologies to more effectively investigate the tragic circumstances surrounding missing person’s reports.
The lines between our physical and virtual worlds continue to blur, and the words, “you’ve been hacked,” continue to take on all sorts of ominous connotations across these blurred lines, especially after a mega attack like last week’s WannaCry. With this in mind, we decided to ask an offensive security specialist and bug hunter to break it all down for us.
By Matthew Maley
For the record, I’d like to make one thing clear: I hate the word “cyber.” When it’s used to describe anything with regard to computers, technology, security, or “hacking,” it casts this aura of inaccessibility over anything associated with it. As someone who works in cybersecurity, my field is full of terms that effectively tell the general public that they need not bother trying to comprehend our dark arts, for these are beyond their understanding.
I’m here to tell you that this isn’t the case. People like me aren’t wizards or part of an enlightened techno-cult that can bend computers to our will. Let’s pull back the curtain a bit to understand what really goes on during a “hack,” “breach,” “cyber-attack,” or “offensive cyber-operation.”
We see these terms appear in the news almost constantly. Last year, they were so prevalent that TheGuardian even suggested calling 2016 “the year of the hack.” As I write this, Twitter and global news organizations are all abuzz that the National Health Services (NHS) in England were hit by a cyber-attack (this was just the tip of the iceberg… seriously, Google WannaCry). These are issues that affect most of us personally as individuals, as citizens of developed nations that heavily depend on technology, and as members of organizations whose prosperity is decidedly dependent on computer systems.
Since these terms are used interchangeably and this post is supposed to be about Offensive “Cyber” Operations, let’s start there. What does this phrase really mean? The DoD has a detailed, long-winded definition for this exact term. A simpler definition might be something like this:
“An effort by a person or group to gain access to a computer system that is not theirs and for some purpose.”
If we break this out into its components, we can begin building a picture of what exactly is going on here. We start at the very basic level.
The Whos
The Attacker — the person or group executing the attack.
The Victim — who or what is the target of the attack.
The Whats
The Computer System(s).
The Attack itself — purposeful action taken to access that computer system without the consent of the owner.
Whenever something untoward happens, in the physical world or the virtual, the first question people ask is “What happened?” The second is invariably, “Who’s behind it?” When you think about it that makes sense, because it isn’t until people know the “who” that they can really start to understand the “why.”
Unfortunately, when it comes to hacks and breaches, figuring out the “who” is typically the last piece of the puzzle to come together, if it ever does.
But let’s not get bogged down here — we still have a long way to go. Now, I could show you some crazy matrix or spectrum graphics on this but again, the official sources on this stuff are tedious at best. Let’s keep it simple.
Attackers generally fall into a couple basic categories: Nation states (a.k.a Advanced Persistent Threats or APTs), cyber-criminals, hacktivists, and some dude in a basement. The biggest difference that sets these groups apart are 1) motive, and 2) resources. By resources I mean both the money and manpower they have to put toward accomplishing whatever objective they set for themselves. In a more real sense, this translates to how functionally capable they are at conducting operations.
Nation-States or APTs: Mission Matters
These aren’t the APTs you hear about in the news, this threat is far more real. These guys are typically pros; this is their day job and they often work with what’s called a black budget. They’re well funded and have a distinct mission. That mission typically means that the last place they want to be is in the news. This makes them more likely to take targeted action to gain information over the long term than to break stuff (but they do allegedly break stuff too).
These professional mission-oriented groups are one of the few attacker groups willing to bridge the real and virtual or cyber worlds and use one to enable the other. They’ve also been thought to employ disinformation tactics to mask their actions as each other or another class of attacker with different motives (see Sony hack). If one were to believe that magic exists in the cyber world, these are some of the few that can be part of the conjuring. However, not all nations that play at what’s commonly called cyber-warfare fall into this group.
Simply put, this is organized crime taken online. Money is the name of their game and they employ cyber-twists on otherwise standard crime to get there: fraud, theft, scams, money laundering, ransom, extortion, etc. These groups are clever, resourceful, indiscriminate, and always opportunistic. They aren’t afraid to borrow and steal capabilities that are available to the public and use them to great effect (e.g. WannaCry). The weaponization of recently disclosed and patched vulnerabilities is common with this band of cybercriminals.
It’s typically easier to derive a vulnerability from a patch or disclosure than invest in discovering a new vulnerability. It’s also very effective. It can literally take years for some organizations to apply security updates. In certain parts of the world, these groups seem to be given tacit approval to operate by governments, potentially in exchange for use of their services.
Hacktivism: Public Pickings
These are basically loosely organized hacker groups that want the spotlight. Whether it’s to bring attention to a cause or to stoke their own egos, their actions always play out in the public eye. The capability of these groups doesn’t go far beyond the basics (read this as “what you can find on Google with a bit of practice”). They tend to pick soft targets and sometimes opt for disruption over taking anything of value. And no, before you ask, a denial of service is not hacktivism.
Dude In A Basement: Much Ado About Nothing?
As this guy, typically a lone ranger, is the least likely to affect any of us and the least likely to end up on the news channels, we’re going to leave this misunderstood soul to tinker around in peace.
Of course, the above examples are just generalization and there are outliers in each group. The leading (economically advanced) nation states are widely accepted to have the most capable attacker groups as compared to others, a perhaps natural by-product of the superior resources they have available.
Think of it this way: A Ferrari, for certain purposes, is more capable than a budget sedan or hobbyist special built from spare parts in a garage (or basement). That’s not to say some hobbyist can’t get his buddies together and build something that’ll outrun a Ferrari, but the quality in engineering and testing, combined with backend support and infrastructure, make the Ferrari a more capable and reliable tool to win a race. On the other side, there’s a better than 50/50 chance of the hobby car failing catastrophically. It’s exactly the same for tools that enable cyber-attacks.
Why Do They Do It?
Almost always, the motive is the easy part. As with most things, the end goal is generally power in some form or another. In this case it’s typically information (e.g. intelligence collection or corporate espionage), money, or fame/notoriety for oneself or a cause.
When an organization is targeted to gain access to clearance records of government employees and contractors? Intelligence collection.
When the payment system within a large retailer is compromised? Money.
When there’s a smash and grab where nothing of real value is taken but user credentials get dropped to the Internet? Notoriety.
These might sound simplistic and at one level, things do get more complex when you consider groups that use misinformation to cover their tracks, but that’s a different story. The common thread here is that the “why,” the motive, defines the objective, or the “what.” And interestingly enough, how all these groups achieve their objectives is very similar.
Before we move on, let’s talk about the elephant in the room: Terminology. While there are working definitions for some of this stuff out there, all of it is so open to individual interpretation it makes conversation difficult, even to those of us that work in the field. People taking heat after a successful attack specifically throw around the term APT pretty indiscriminately.
I don’t know if they think the APT aura somehow absolves them of responsibility, but we’ve seen that card played often enough to be rightfully skeptical. I’ve personally experienced occasions where the actions of my teams have been investigated and categorized as that of an APT-level actor; I knew for a fact though, that we were just a handful of guys, professionals, but far from top-tier or APT in any way!
Who Done What?
When it comes to executing an attack, everyone puts their pants on one leg at a time. It all starts with a foothold, just like if you were storming a beach. You need that initial point of access to get past the crunchy outer security shell of most networks and into the soft, gooey center.
How does this happen? Well the most common way for attackers to get their “foothold” is human error. Yes, that’s right: A user is either going to voluntarily give up access (phishing), reuse their password from something else that was hacked previously, give away their credentials, or an admin is going to neglect to properly secure some part of an application that’s available to the internet. Done. There are multiple ways of gaining a reliable foothold in a network, and there’s no magic required; just an imperfect person on the other side of the equation.
Let’s provide some added context to this password reuse bit to drive this home. Do you have a standard password you use everywhere or a couple of passwords you alternate between? If that’s not you, does it describe anyone you know at work? I think we all either are, were at one time, or know someone like I’m describing. That’s important because some site or service that you or that person has subscribed to has been compromised. I’m talking about things that we all recognize and are familiar with (e.g. LinkedIn, Yahoo, Adobe, Dropbox, Tumblr).
There’s a site, https://haveibeenpwned.com, that’s cataloged 3,752,347,222 sets of credentials from 215 sites through public breach disclosures (like attackers dropping database dumps to Pastebin or sites with similar functionalities). Now, thankfully, that site is just providing a service to let people potentially affected confirm if their account is at risk without having to go to the source material. For someone who knows where to look, this stuff is readily available and offers an avenue for an easy win.
Magicked? No, But Exploited
There’s also another way, called exploits. From an attacker’s point of view, this whole process of attacking a network or application is a lot like navigating a maze, at some point there just won’t be a wall blocking the path. What if I told you there is (sometimes) a way to walk through walls? I know, you’re thinking, “Now you’re being dramatic,” and “You already said magic doesn’t exist.” Well… it’s complicated.
Exploits are, at least in my opinion, the closest thing to magic in the “cyber” world. The “best” ones can send even the most prepared organizations scrambling to figure out how to effectively defend themselves. They can allow an attacker to bypass layers of defenses that would otherwise effectively block avenues that an attacker could use to gain a foothold or access a system. Do note that when I say, “exploits,” that’s actually wrong; I’m really referring to vulnerabilities that have been weaponized, not the exploit itself.
Vulnerabilities themselves are actually a really interesting topic. At their core, vulnerabilities in software systems are really just unintended pieces of functionality within these systems. It’s not that an application is “broken into” per se but that someone, through countless hours of research, discovered something that was already there, waiting to be found, unknown even to whoever wrote the code.
Two of the best known examples to date are MS08-067 and MS17-010, the vulnerabilities that resulted in Conficker nine years ago and WannaCry last week, respectively (two of the most impactful examples of malware (a catch-all phrase for malicious software) that have come to exist to date). These are vulnerabilities within Microsoft Windows that resulted in full control over a windows computer just by being able to communicate with a universally present Windows service over a network.
Yes, it was almost a decade between disclosures of vulnerabilities in Windows of this magnitude, and no, it didn’t make it hurt any less. The actual exploit is the easy part, weaponizing the vulnerability to do something specific and controllable (typically execute code) is more complex. And it’s finding some of these things that really borders on the inexplicable. Check out @taviso and @tiraniddo on Twitter, you’ll see what I mean.
The World Of Virtual Weaponry: How An Attack Unfolds
So what happens in an attack? What “payload” are we delivering with our phishing attack or exploit? What is facilitating access into these systems? That facilitator goes by many names; RAT (remote access/administration tool), implant, agent, trojan, virus, backdoor, malware, etc. In the simplest terms, the facilitator is a computer program that allows an attacker to remotely access a computer and carry out other actions through it. In practice, these can be flexible and robust toolkits that put powerful capabilities within easy reach of an attacker operating inside a network.
Okay, so we’re in, now what? Well we’ve gone through all this trouble to get this far, let’s make sure we can stay to have some fun. The first order of business, after an attacker figures out where they just landed, is to give themselves a reliable way to keep a foothold. This typically involves leveraging functionality within the operating system to make sure the agent or RAT will restart itself automatically if it were to stop running, or give the attacker a means to cause an agent to run at will.
These techniques, as they’re called, are a really good example of the creativity that goes into being an effective attacker. Changing default programs, changing modules that load by default, scheduling recurring jobs, triggering execution on certain events are all basic examples of what are called “persistence” techniques (you could read more about this here). The balance that has to be struck here is reliability versus stealth. Some of the more apparent methods are incredibly reliable, but will also get caught.
A good attacker won’t stop there. They’ll use multiple techniques on different systems set strategically through the network or system they’re operating in, perhaps in different physical locations, business units, or types of systems. They’ll also make sure they vary how they’re communicating into and out of the network, trying to blend in with what should be “normal” traffic as much as possible.
Techniques leveraging third party services offered by trusted providers (like Google or Dropbox) and something called “domain fronting” (a method that leverages a fundamental component of how cloud-based/distributed systems work today) effectively allow an attacker to become, not just look like, a service that we already know and trust. A couple of years ago, colleagues of mine (@sixdub and @harmj0y) put a lot of effort into this layering of offensive and evasive techniques, referring to it as: “offense in depth.” It’s the idea that having “multiple options in case you hit a snag at some step in your attack chain” increases your effectiveness as an attacker, by giving you something to fall back on if things go wrong.
Unfortunately, in a majority of environments I’ve seen, it isn’t even necessary to go to those lengths to be effective. Assuming we’re fastidious attackers, we’ll go the extra mile to not get caught. With our contingencies in place, we can now get down to whatever our objective was for being here in the first place. You typically don’t risk international incidents, extradition, and jail time for nothing.
Getting from your initial foothold to your final objective often takes a lot of patience, a little luck, and the ability to understand how to use the administrative functionality of computer systems within the systems you’re accessing, sometimes just a bit better than the guy who does the admin work normally.
By compromising some legitimate user accounts, carefully figuring out what we can access, and rummaging through a few file shares, we can typically work our way to the level of access we need for our objective. All the while, we blend in with the everyday happenings on the network; no exploits, no magic, just living off the land.
What happens next? Well, that depends. If you’re after information, you collect and exfiltrate it through whatever means to get it out efficiently. If you plan on sticking around, you’re more aware about the need to do this without compromising your access in the network. Maybe that means using a third party service instead of the same method you’re using to control your agents. If your objective is something else, it just takes creativity and some awareness of the environment you’re in, and you’ve gotten all the access that you need. In the case of WannaCry, whoever released it didn’t appear to have an particular objective, apart from causing mayhem as far and as wide as they could. Perhaps for some people, that’s an objective in itself.
And that’s really why, in the end, the motive itself isn’t what matters, except in terms of how it’s useful to prevent or stop any ensuing mayhem.
(The writer is a bug hunter, or more specifically, an Offensive Security Certified Professional, a GIAC Certified Web Application Penetration Tester and currently a manager with Gotham Digital Science. You could reach him here.)
For far too long, too many soldiers, paramilitary forces, and other security personnel have died because of a lack of planning or foresight. While there are any number of things beyond a commander’s control, there are details they need to keep in mind from their end too, to avoid what they can of the casualties of war.
Leadership isn’t easy in any case, but for military commanders sworn to protect their countries, there’s another heavy responsibility — that of sending those that serve under them into battle. Here’s a glimpse of what goes into giving those that serve every advantage they can get, especially in hostile territory.
By Sushil Kumar Singh
Lokut Bangas sits right on the always fraught India-Pakistan border, about seven miles from the town of Khanbal, in the Indian state of Jammu & Kashmir’s Kupwara district. It is about 10 miles from Naugam sector, also close to the disputed India-Pakistan Line of Control in the Kashmir Valley. It is a line that is not a recognized international boundary, but a border between two hostile neighbors, for all practical purposes. In a not-so-distant past, Lokut Bangas (which means “small valley” in Kashmiri) also used to be a major infiltration route for militants from across the border.
In 2003, I was posted in Delhi during a fidayeen attack in Lokut Bangas, in which an Indian Army battalion (not mine, but we had several in the area) lost seven men. The fidayeen of South Asia, also referred to as fedayeen in the Middle East, are small bands of highly trained men, specializing in guerrilla warfare, trained to inflict maximum damage on a specific target before they are (typically) taken out. In this case, the target was a company-occupied post, a post that, we later knew with the luxury of hindsight, had been poorly sited. That company post, incidentally, was vacated after this particular attack.
But the problem remained. Three years later, in 2006, I was tasked to set up base there again and begin what we called “seek and destroy” missions, to plug infiltration gaps within the area my particular company had charge of. Militants in The Valley (Kashmir) had begun to frequent the area for infiltration into Indian territory.
Listen, Ask, See
A depiction of the disputed areas of Kashmir, courtesy Wikipedia. In the public domain, from the CIA World Factbook.
Like most unit commanders going into battle, I spent some time thinking about my mission, specifically taking the time to learn about the history of the area, to anticipate any roadblocks. You can’t always foresee everything, but it would be foolish and counter-productive to go into what is known hostile territory, even on your side of that metaphorical red line, without getting all the information you possibly can.
I also spoke to a batch mate who happened to be in the battalion that had lost those men in the 2003 attack, and after several more conversations with people familiar with the area, and a detailed briefing of my men, we moved into location in the dead of night.
I visited the above-mentioned campsite, which had once been an ill-fated company post. God bless those souls, but they were sitting ducks. Quite frankly, even while sincerely feeling for him at one level, I was appalled that the previous company commander could have not seen the tactical limitations that were so visibly inherent in the location.
Why did he pick that spot? I haven’t a clue. Perhaps he was confident, complacent, or possibly, he loved the view of the valley that the location offered. It was undoubtedly a beautiful place, offering a panoramic view of one of the most beautiful regions on the planet. However, it was also disastrous, from a tactical perspective.
The Devil Really Is In The Details
After a detailed reconnaissance, I selected a knoll for my campsite. The following factors dictated my selection in this case, but these would be what any trained commander should keep in mind in a similar situation.
The campsite has to be on dominant ground that offers the ability to observe everything around and gives you the advantage in case of an attack.
It should be out of range for enemy small arms’ fire.
Look for any natural obstacles. In our case, we had this in the form of fast-flowing nullahs in three directions.
It was away from usual areas frequented by the shepherds and goatherds in the area. Why was this important? Unfortunately, some of the local herders were known to be informers and guides, not always for our side. In a land of man-made borders, where families often live on either side of those artificially generated lines, the lines are often blurred by emotion, anger, and angst.
All we — who make protecting the sanctity of that line our bounden duty — can do is keep that in mind and do what we’ve sworn to risk our lives to do. But to make our lives a little easier, I ensured that the herders reported to my camp everyday for a head count, and earmarked the area beyond which they couldn’t take their animals for grazing.
The selection of the campsite done, my next focus was fortification. We did the following things.
— All the stray dogs in the area were rounded up and given a taste of our communal food, and quickly became dependent on that. The idea here was that these strays would be our first line of defense, and alert us to any unknown movement in the dark.
— Sentries were placed in what we call “buddy pairs” on all approach routes, of which there were basically three. Each pair would be in visual and radio communication.
— We placed barbed wire fencing all around, and placed tins and bottles along the fence too, so they would rattle in case someone attempted a breach.
— We also placed what were low wire entanglements in the gaps between the sentries, as a physical barrier to entry, and had trip wires to further augment those gaps.
— Finally, we also placed shards of glass bottles in the grass in front of the fencing.
At last, I was as satisfied as I could be under the circumstances, and was fairly confident that if any terrorist felt he could attack us, he was welcome to try. We’d be ready and waiting.
Go Forth And Conquer
Once those defenses were fortified, we were now ready for my primary task, which was plugging the gaps and sniffing out any militants that had gotten through and were biding their time on our side of the border. Over the next six months, we did as tasked, cut down infiltration and knocked out three terrorists down in aggressive ambushes. I was fortunate to be awarded both my Army Chief Commendations during this period.
The writer, with his Army commendations. This picture is the only one available. Picture courtesy S.K Singh.
More importantly though, I’m very proud of the fact that the site chosen by me remains, more than 10 years on, the campsite for units that have patrolled the area. There hasn’t been a breach in that site since.
There have been others though, elsewhere, like the one in Uri, in Jammu & Kashmir’s Baramulla district, in September 2016, when four heavily armed fidayeen attacked an Indian Army unit in a pre-dawn ambush, lobbying grenades into the tents that temporarily housed a unit that was relieving another. Nineteen soldiers died, 17 on the spot, and two later. All four attackers were killed after a prolonged gun battle.
The terrorists were believed to have been part of the Jaish-e-Mohammed, an organization whose primary mission is to separate Kashmir from India and make it part of Pakistan. Jaish-e-Mohammed, incidentally, has been designated a terrorist group by several countries, including by the United States in December 2001. More than six months later, several questions remain about things that could have been done to anticipate the attack, or at least, prevent the loss of life that occurred.
Abraham Lincoln said this so beautifully: “Nearly all men can stand adversity, but if you want to test a man’s character, give him power.” I’ll add that with power, comes the responsibility to protect those that you have power over. One of the hardest things to do as a commander is to send people that serve under you into battle. The least you can do is take every precaution you can to give them every possible advantage.
(The writer, a former colonel with the Indian Army, has specialized in counterterrorism operations. He raised the Hyderabad Hub of India’s National Security Guard in the aftermath of the Mumbai Terror Attacks)
Everybody gets email, all the time. Copyright Vkraskouski | Dreamstime.com
By Kevin King
According to reports, people across the world will send and receive 269 billion emails in 2017. Internet Live Stats, which is the accepted global standard for such matters, and part of the Real Time Statistics Project, an effort by an international team of developers, researchers, and analysts aiming to make statistics relevant in real time, tells me that at the second of glancing at the website before writing this sentence, at 06:00:11 hours, Eastern United States time, on April 11, 2,579,875 were being sent, and a large percentage of those emails were spam. And yes, this two million-plus per second number is only expected to grow. So given how much email we use, why is our email hygiene so bad, and can we make it better?
Most people probably already know that email isn’t exactly a very secure mode of communication, but most people also probably push that thought to somewhere in the furthest recesses of their memories. After all, email is very convenient. So they send all kinds of incredibly sensitive information, like passwords, social security numbers, and other Personally Identifiable Information (PII) over email every single day.
The truth is that the human in the loop is often the weakest link when it comes to keeping information secure. We make poor choices about passwords, accessing the Internet, and trusting companies to protect our data every single day.
Email is particularly vulnerable to exploitation, and unfortunately, it’s incredibly difficult for the end user to know if any specific message exchange is secure. There are things that both your email provider and you can do to make your email more secure, but they all come with a cost.
While most people now know (or should know) enough not to use an email account that doesn’t provide secure communications at the front end — that little green padlock next to the website name — it is doubtful whether most ever consider how mail providers interact with other mail providers. Some of this is the stuff nightmares are made of.
As recently as 2014, only about 60 percent of notification emails sent by Facebook, for instance, were sent with encryption during transport. Google’s transparency report shows that you have a 1 in 10 chance of sending or receiving an email to a non-Google provided account that is not secure when exchanged with the other mail provider. Things are apparently better now, but still indicate that there’s a long road ahead for everyone before the state of email security is improved.
An Unfair Playing Field
One big failing of email is that it’s hard to prove who sent an email. This may seem unintuitive since there’s a field in email that is supposed to tell you whom the message is from, but, due to how email works, there’s no guarantee that this field is correct. In fact, bad actors will often put incorrect information in this field in order to fool the recipient into opening a dangerous email.
There are additional tools at the disposal of mail providers like the Sender Policy Framework, Domain Keys Identified Mail, and Domain-based Message Authentication, Reporting & Conformance, but the sender must implement them and the recipient must check them in order for these protections to help. And no, you can’t do them! These are checks that your email provider performs, so you have little control over how these extra security steps get implemented. But what are they?
Sender Policy Framework (SPF)
SPF is designed to address the problem of address spoofing. This is a technique where a sender puts the wrong information in the “from” header in an email, in an attempt to trick the recipient into opening the message. For instance, if I’m a known sender to you, and the sender puts in my email address in the from header, and at first glance, it appears to be from me. However, if you were to investigate the origin of the email and compare it to other ones that I have sent, you would find that the spoofed email was sent from a completely different place on the internet. SPF is a list of authorized senders for your domain as well as a suggestion for how recipients should treat mail that originates from locations not listed in the SPF.
Domain Keys Identified Mail (DKIM)
DKIM is another tool to reduce mail abuse and address spoofing. DKIM utilizes public key cryptography to add electronic signatures to an email, which allows a recipient to know if certain elements of a message have been forged or changed in transit (e.g. that “from” header).
DMARC builds on the ideas of SPF and DKIM to prevent direct domain spoofing. DMARC adds layers of reporting to SPF and DKIM so that domain owners can learn about legitimate and forged emails associated with their domain, as well as publish a policy surrounding how to handle messages that fail authentication.
End-to-End Email Encryption
All of the above security techniques are ones that your email provider and your recipient’s email provider have to implement in order for them to be useful. If either side doesn’t implement these protections, your security is significantly reduced. Fortunately, you have an alternative — end-to-end encryption or E2EE. Unfortunately, implementing it is hard.
End-to-end email encryption has existed for decades, yet you’ve probably never used it. Why? Here’s the short version.
You can create a certificate to receive encrypted emails, but you’ve got to tell all the people that send you email to use encryption too.
That encryption being used by senders and receivers has to be compatible.
And all recipients have to know how to send all other recipients encrypted emails, or there is no point to using the encryption.
As it’s unlikely that you’re sending or receiving emails only from people you know personally, this makes it almost impossible to use and rather pointless.
But you could still do it though, for critical emails, and the two most commonly accepted ways to encrypt email are Pretty Good Privacy (PGP) and Secure Multipurpose Internet Mail Extensions (S/MIME).
Pretty Good Privacy
PGP was developed in 1991 by Phil Zimmerman, and utilizes public key cryptography to sign and secure text-based communications. Here’s what he used. A PGP user (Alice) creates a public and private key pair. Alice distributes the public key to everyone so that they can send her encrypted messages. Another PGP user (Bob) does the same thing. When Alice and Bob send each other encrypted messages, they use the public key of the recipient to encrypt the message, and use their own private key to sign the message.
This allows Alice and Bob to know who sent the message and be sure that only the person they sent it to can read it. The message is usually sent as all text using ASCII armor, which, as techopedia so simply puts it, basically involves encasing encrypted messaging in ASCII, so they can be sent in a standard messaging format such as email. Otherwise, that message would be gibberish to you.
S/MIME
S/MIME is most often implemented using what’s called an X.509 hierarchical public and private key structure, in which the key pairs are issued by an organization instead of being individually generated by a user. These keys are then used when creating a message, using something called Cryptographic Message Syntax, which is used to digitally sign, digest, authenticate or encrypt forms of digital data. The resulting encrypted data is then placed in the email using the MIME format. Key and message exchange using S/MIME occurs in the same way as with PGP.
If all of this sounds complicated, it is. If it sounds difficult or even impossible to achieve, it probably is, at least at the moment. This is why, even today, end-to-end encryption is rarely used for a commonly used mode of communication like email.
Where do we go from here?
You could go back to faxing or physically mailing sensitive information to your peers —both of those are point-to-point communications and provide more security than email. You’d still run into problems. Fax communications are not encrypted, and the USPS et al can always open things you send.
Another option is to use a communication platform like Silent Circle (which comes at a cost), or an encrypted chat program such as Signal or WhatsApp. These privacy-focused communications applications usually attempt to implement a concept known as Forward Secrecy. The idea is that, even if someone that has bad intent cracks a specific message, it does not risk the contents of any other message. The disadvantage of a system like this is that communications often gets bound to a single device, making access to the information more difficult. These applications also often lack the proper auditing that a corporate environment might desire, which makes them problematic in legal disputes.
But there is hope. Recently, providers like ProtonMail have made an appearance, hoping to offer easier ways to send and receive encrypted emails, but these often force people to abandon their existing mail provider, making them not ideal solutions for adding encryption to email.
The reason to care about this is not just at the individual level, and any embarrassment or damage you might suffer if your email was leaked, but also because there are regulations in the US regarding the sharing or transmission of Personally Identifiable Information or PII, especially by organizations.
We have a comprehensive whitepaper on it here. Have a look, it tells you exactly what you can send or not send over an unsecured system like email, and what laws you are violating if you do send someone else’s PII over email, and whether you’re putting your company and yourself at risk every time you send this kind of information.
So what should you do? Well, until things like SPF, DKIM, and Secure Transport are 100 percent adopted, or you have access to an end-to-end encrypted information system like Biometrica’s SSIN, the Security & Surveillance Information Network, if you’re transmitting critically sensitive data over email, walk it over, take a chance with snail mail or a fax, remember to wipe that PII data off the fax (otherwise, you might probably end up breaking the law in multiple states), or just avoid it.
(The author is Biometrica’s Director of Project Architecture, he has an engineering Masters in communication networks)
The TGPN, A National Indian Gaming Association Initiative, Was Set Up To Provide Resources To Protect Native American Tribes From Internal And External Threats. Parker to help them navigate threat landscape.
LAS VEGAS, NV: On Thursday, Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company that uses biometrics, including facial recognition systems and encrypted information networks, to prevent crime and track criminals, announced that its Vice President, Business Development, Kevin Parker, had joined the Tribal Gaming Protection Network (TGPN) Board as an Associate Board Member.
An initiative of the National Indian Gaming Association (NIGA) Chairman, Ernest Stevens, Jr., the TGPN’s focus is on the education, training, networking and sharing of information that would protect Native American tribes from multilayered threats.
“We’ve been expanding the scope of what we’ve been looking at doing,” said TGPN Chairman Andrew Hofstetter. “We’re looking at more than just cheats and scams. We’re looking at health and safety issues, risk and liability, public protection, regulatory issues, and to a certain degree, casino operations. Kevin brings a vast background in tribal gaming to the table, and will be an incredible asset to the Tribal Gaming Protection Network. The TGPN is vested in education and sharing information to protect tribal gaming for future generations, and I feel Kevin is also vested in that sentiment and endeavor.”
In 2014, the year for which the most current data is available, 243 Native American tribes operated more than 350,000 gaming machines and just under 8,000 table games at 489 gaming establishments across 28 U.S. states. According to Casino City’s Indian Gaming Industry Report, gaming revenue for 2014 almost touched $29 billion, accounting for more than 40 percent of all U.S. gaming revenue for the year.
Parker, a former intelligence analyst and paratrooper in the 82nd Airborne Division and the 7th Special Forces Group of the U.S. Army, and a member of the Chippewa-Cree Tribe of the Rocky Boy Reservation in Montana, said that the exponential growth of Indian gaming, while very positive, had also adversely impacted the threat environment for Tribes.
“It’s an exciting time for Indian gaming, but it’s also a time to be prepared to pre-empt certain issues. Advances in technology and communication, and the security and humanitarian challenges of today, have changed the threat landscape, and made it more treacherous than that of a decade ago. I hope my experience with tribal gaming and gaming protection, combined with the technology and resources Biometrica can offer the TGPN on the security, technology, training, and regulatory side, will help them tackle some of the more urgent issues of the day.”
About Biometrica
Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.
To this purpose, the company’s cyber-physical products and modules, and range of biometric-enabled tools — including private, encrypted information networks and facial recognition systems and databases — enable the recording of criminal occurrences, recognize threats, track individuals or groups that have either committed a misdemeanor or felony or contributed to breaking the law, help organizations know their customers and their employees, and allow security and surveillance teams to link all of the above.
Forewarned, forearmed; to be prepared is half the victory. – Miguel de Cervantes
If someone tells you they felt no fear or unease when faced with a terrifying situation, they’re almost certainly feeding you BS, or perhaps, being very foolish. Even if you’ve faced danger before, and have managed to face it down, it probably makes sense to recognize that that danger existed.
Courage isn’t about not being anxious, apprehensive, or afraid. It’s about being all of those and still doing what you have to do because it’s the right thing to do, or because it’s required of you — it’s your conscience, or your training, or the only chance you’ve got.
I was thinking all of this while watching events unfold in London on Thursday. As I watched, it took me back to other incidents in the recent past. Paris, Orlando, Kashmir, Dhaka, San Bernardino. This time, it wasn’t a man with a gun, but it was terrifying for people on the ground. I wondered what went through their heads in these situations, and thought, perhaps, it might be better for them to have some sort of real advice — we live in an uncertain world.
But I still thought long and hard about writing this, about offering some advice. Not because I didn’t think it made sense, but because it’s always somewhat iffy writing about what you should do when facing something like a terror attack, as situations themselves are never the same.
Yet, as military personnel, we’re trained to analyze an active situation, weigh the odds, plan on the fly, make and take the best decision we can under the circumstances. That training helps us react in certain ways even in non-battlefield-like situations. My own training, and the commands I held, in addition, have been focused on anti-terror ops, so I thought I’d go ahead and share some of what I know.
Dash, Down, Crawl
It’s the small things that matter, and you’ve got to keep the basics in mind. The first thing you should do if bullets are flying around is lie down. Hit the ground. Or if you can, take cover behind anything concrete; a pillar, a wall, a tree, even a bush; look for anything that could potentially obscure the vision of a man with a gun (I’m going to focus on guns, as knife-wielding attack are tackled differently).
In most cases, and this includes men trained for battle, a gunman likes a clear vision of his target. They always fire with barrel of the gun straight, it is never pointed downward and that’s pretty much the natural order of things.
To counter this, there is a very basic military drill: DASH, DOWN, CRAWL. The effectiveness of this drill can be verified from innumerable men (or women, I’m just using “men” generically here) that have come under fire. That is probably the day every one of us realizes why all military personnel, whether enlisted man or officer-to-be, is made to undergo this strenuous drill in every military academy of the world. No one really enjoys that process of getting down and dirty, but some day, that intensive training will probably save your posterior.
Observe, Observe, Observe
If you’re still alive a few seconds after getting down or taking cover, take a deep breath — your survival instinct then comes into its own. What you should do next is try and find the direction from where the sound of the bullets is coming. That’s really important. It’ll give you some idea of the location of the gunman. A quick glimpse with movement kept to the bare minimum should also give you the direction you need to keep in mind while attempting an escape.
Try and remember that your short-term goal is to ensure that the gunman (or gunmen) doesn’t see you, or doesn’t have a clear line of sight to you. There are two things you can or must do now. First, look for the exits, windows and doors. You typically should have some exit option, especially in an enclosed area that is open to the public. Second, look to see if there’s a way you can use the cover of tables, walls etc. and sprint in short bursts, from cover to cover, while making your way out.
It’s vital to plan your “route” before making a move. No man, other than in the movies, is such a crack shot that he could easily kill you, firing from a hip position, or aiming straight at you, if you’re moving zigzag across an area. And if it’s a terror incident and a gunman’s aim is to inflict maximum damage, he’s under pressure to go for maximum impact, which means he’ll be focused on getting obvious or easier targets first. He will almost certainly not waste time chasing you around if you’re trying to play hard to get.
A Choice Of One
I can almost hear you saying, “What happens if I don’t have any real escape options?” Well, still get down on the ground to give yourself a shot. But in case you’re stuck, and can’t see any way out, you might as well go out blazing. When in doubt, said Gen. Patton, ATTACK. Stay behind cover or get down on the ground, and try recollecting or counting the number of bullets fired. If you’re dealing with a well-trained militant, he will probably be firing in single shot mode and not in burst or automatic mode, because he’s trying to pick off people. If someone’s trained, single shot is preferred because he’s got to be economical as far as expending his bullets goes.
Now here’s the important thing: No gun fires forever, a magazine has a maximum capacity of 30 rounds. If it is a pistol, then that number is ten. It will empty at some point. What you have to do is listen, observe and act when he goes for a change of magazine. This this takes 5-10 seconds if he’s trained, and longer if he’s not, that’s the point to charge him. Use something pointed if you can, try anything to attack his face if you manage to get near.
Do also keep in mind that a weapon often jams on account of different things: An empty magazine, faulty ammunition, low gas etc. My understanding is that that’s what happened in the Orlando shooting, when the gunman’s assault weapon reportedly jammed momentarily, and he moved toward the rest rooms to rectify the issue. Alas, people weren’t aware of this, or if they did, unfortunately weren’t trained to react at that moment.
For the most though, unless you’re out of options, don’t try and be a hero; try and leave that to trained professionals and help them get him instead.
A Bullet Isn’t The End
In case you’ve been hit, of course it’s going to hurt, but do remember you can probably survive if the bullet isn’t lodged in the “waist to shoulder” region. It’s not the bullet itself that will kill you at that point, it’s the loss of blood, so you’ve got to try and prevent that. If you can, find the will to rip your clothing and press it down on the wound to stem blood loss.
Your Work’s Not Done
Your role, if you get out, is then vitally important. You then have to assist professionals when they arrive, and do it without panicking. Any information they gain from you — the number of gunmen, where they are located, the weapons being used, dress, appearance, the number of potential hostages, and the layout of the place will not only save other lives but also expedite counterterrorism operations.
Don’t Go In Blind
Finally, it probably makes sense to be aware of your surroundings wherever you go. Take the time to look around, pause a moment to observe what’s around you. Know where the nearest exit is, where the windows are, what kind of cover is around, pillars, doors, tables, bars, anything that would give you cover from the vision of a potential gunman. If you try doing this every time for a while, it will probably become a habit, and that habit could well save your life at some point in the future.
If you think that’s paranoid, well, I give you Hunter S. Thompson: “There is no such thing as paranoia. Your worst fears can come true at any moment.” And in today’s rather fragile environment, it’s just better being prepared.
(The writer, a former colonel with the Indian Army, has specialized in counterterrorism operations, and raised the Hyderabad Hub of India’s National Security Guard, in the aftermath of the Mumbai terror attacks)
Did your business lease photocopy machines for work and then return them without wiping other people’s personal data from the machine?
Have you ever sent someone else’s personally identifiable information, including their name and address, or name and date of birth, or photograph, or driver’s license information or photograph to someone else over an end-to-end unencrypted system even if you were verifying identity?
Did your security or surveillance team put up a printout of a watchlist with people’s information on the wall of your room or did your store distribute flyers with that information?
Has your organization suffered a data breach, and did you make it a point to quickly inform everyone whose data was compromised that their data was compromised?
Do you understand what encrypted email is, and know that most email systems are not encrypted? Or that just because you need a password to access it, it doesn’t make your system encrypted.
Or, just because your email is encrypted and the person you’re sending to also has an encrypted email address, your system might not have end-to-end encryption because they’re connected by an unencrypted telecom or internet service provider?
And did you know you shouldn’t do that in most states while sending PII — unless you had an agreement with that third-party provider specifically covering sending sensitive personal information?
Did you know that 47 states, D.C. Puerto Rico, Guam and the U.S. Virgin Islands, and several federal agencies, including the FTC, SEC, and FCC have strong data breach laws to protect people’s identity from theft?
And were you aware that even if you’re in New Mexico, which doesn’t have data breach laws, but are sending information to Wisconsin, which does, or sending it from Alabama to South Dakota (the other two states that don’t have specific laws) but over a server sitting in Pennsylvania or via an email service provider based in California, you have a problem?
If you’re in banking or the healthcare industry, you almost certainly have a bunch of stringent rules you’re supposed to follow when it comes to transmitting sensitive personal information. But in our experience, many other businesses in the United States, including in the casino, hotel, and retail sectors, are remarkably casual, or perhaps, unaware, about the sharing of PII data, whether on customers or on employees, and that information could cause serious financial, legal and reputational harm.
Matters are complicated by the fact that there are multiple jurisdictional and multi-agency laws you need to follow, and some of them can be confusing.
This FREE downloadable guide is intended to clear up that confusion, and explain the concept of personally identifiable information: What It Is. Why It Matters, And Why Not Knowing Everything About It And Not Taking All Reasonable Measures To Protect It, Could Land You And Your Organization In Big, Big Trouble.
The document covers the transmission of sensitive personal information data through different means, details why communication systems like email are inherently insecure and could leave you and your organization open to civil and criminal penalties — if PII is transmitted unencrypted, shared, stored or read on insecure devices — provide clarity on the statutes governing the viewing and sharing of consumer PII for businesses, including casinos, explain security breaches and the compliance requirements mandated by law, and provide examples of non-compliance and some of the penalties imposed for non-compliance and security breaches under state and federal laws, including the laws of Nevada.
[A simulated image of a 1,700-year-old supply chain, in this case of the Roman Empire, which received most of its wheat and a large portion of its olive oil from its provinces in North Africa. Picture credit: Michael Hugos/SCM Globe]
If your body’s immunity is low, a virus or other invader that attacks one part of your body will affect other organs or systems sooner or later, unless it’s met with a strong response from your immune system. The complex adaptive system that is a supply chain needs a similarly responsive cyber “immune system” to protect itself.
By Michael Hugos
A supply chain is what is called a “Complex Adaptive System.” At a very basic level, it is a network of many different companies working together to move products from the producers or manufacturers through storage systems, transportation systems, distributors and retailers, on to the final consumer. This network of companies is always changing and adjusting its operations in response to changes in the markets and customers it serves.
The complexity and continuous changes of a supply chain make securing its integrity, especially across diverse but interconnected and interdependent platforms and systems, a unique and demanding challenge. Cybersecurity in supply chains calls for a systemic response to the whole supply chain, not just to a single company within that supply chain. Think of it in terms of another complex adaptive system — the human body.
The function of T-Helper Cells. Pic Courtesy: By Mikael Häggström, used with permission, via Wikipedia.
The human immune system employs a series of steps, called an “immune response,” to detect and attack harmful organisms or substances that invade our bodies. Here’s what typically happens when your body is attacked.
An immune system cell (a lymphocyte) detects an invader by sensing certain protein molecule signatures on the invader and sends out messages.
A non-immune system cell detects an invader and sends out messages.
Coordinator cells embedded in immune system organs, such as the lymph nodes and spleen, receive these messages.
Antigens to counter the invader are manufactured and carried by “B-Cells” to the sites where invaders are reported — antigens are protein molecules designed to attach to and then destroy the protein molecule combinations originally detected on an invader.
Local white blood cells, assisted by “helper T-Cells,” attack and destroy the invader.
Medical science defines three basic categories of immune system capabilities:
INNATE: The built-in immunity that comes from entry barriers like the skin and mucus membranes, as well as the natural immunity and adaptability that comes with our individual genetic structures.
ADAPTIVE or ACQUIRED: The ever-evolving immune response that emerges from the interaction of specific immune system cells with invading organisms and substances (as described in the five immune response steps above).
PASSIVE/SOCIAL: The immunity that comes from borrowing capabilities or delivery mechanisms of other humans, such as the antibodies in mother’s milk. (In a supply chain, think of support systems like roadways or rail).
We could add a fourth category to this — ELASTICITY. The human body can be trained to be incredibly elastic in nature. This elasticity allows for the human body to dramatically increase its innate, adaptive or passive/social responses based on needs. We can see this in immunotherapy, as well as the trained responses of arterial flexibility or expanded lung capacity in high performance athletes.
A screenshot of the Uber website, an example of how demand and supply could work in near perfect harmony.
To visualize elasticity vs. non-elasticity in the business world, think of Uber v. regular cabs. In a traditional cab company, you have the fixed overhead of driver, insurance, fuel and depreciation, regardless of how many cars you have on the road.
With Uber, it really depends on call volume. Fewer calls from customers mean there are fewer drivers around and lower overheads; when it’s busier, more drivers get out and drive as there’s more potential to earn — it is reflective of demand and supply. This balancing of demand v. supply, in the Uber environment, happens to a near perfect equilibrium because of the algorithms in the background. In a traditional cab company, it is never optimized and so it’s always a case of over or under supply.
Given all this, here’s a question: Could we use these different categories of human immune capabilities to figure out the cyber-focused immune responses we’d want in an immune system for a global supply chain, one that links together hundreds of companies engaged in a continuous flow of real-time transactions wit each other? We probably could.
Innate Supply Chain Immunity
The INNATE response to securing a chain is largely based on how companies in that supply chain communicate and interact. It requires a directory of known options and communication methods, as well a dictionary of good and bad terms with specifications.
The directory and dictionary are typically part of a supply chain data interexchange. The new features and new data structures can be automatically updated within both sending and receiving systems using xml or json, along with tools such as the Swagger specification, so a change to one requires no additional software developed by the supply chain ecosystem.
This is a natural offshoot of the way different companies in a supply chain link their various computer systems together.
It comes from the workings of different operating systems used by different companies and is embedded in various machines used by those companies.
Well-defined RESTful APIs built into micro-service environments should be used for all inter-company and inter-device connections. This restricts the data and code that can be passed from one company or device to another.
Adaptive/Acquired Supply Chain Immunity
The ADAPTIVE/ACQUIRED response is essentially when a component of a chain adjusts in real-time, at a specific level, to protect itself from a threat. This happens when each component or subsystem in a supply chain can become an expert in its piece without having to worry about the companies around it, but its own capabilities help it protect the chain itself. This allows for continued improvement and for standards to evolve and improve without disrupting the rest of the system.
This internal improvement also allows for constant testing and retesting to further improve performance, security and scalability. This, however, can only happen if the INNATE APIs and interfaces are well defined and automated for regular updates. In addition, there are:
Real-time scanning of data passing back and forth through RESTful APIs built into micro-services that connect different company systems and devices.
Scanning for specific signatures such as code fragments and bit sequences flowing through the APIs and sending of alerts when these signatures are detected.
Complex Event Processing (CEP) applications used for combining data from multiple sources to detect patterns, predict impending events, and send alerts.
Generating automatic responses (antigens) when previously encountered malware is detected.
Assisting human beings in investigations when new security events are detected and predicted by CEP applications.
Enhancing operating systems in company systems and devices with the addition of a scanning function that scans system software in real-time, and searches for specific code fragments and bit patterns. This is similar to the code scanning applications used in Y2K remediation, where software was scanned for variable names and logic sequences related to date calculations.
As new antigens are created to counter new invaders, adding them to the automatic response capabilities of the adaptive supply chain immune system.
Making and delivering “antigens” to target code and logic found in malware.
Passive/Social Supply Chain Immunity
This refers to the systems a supply chain relies on, which are beyond the direct control of an ecosystem but have a dramatic effect on the rest of the chain when out of sync. These are often events like traffic accidents, adverse weather patterns or labor strikes. Systems need a SOCIAL interface to be able to adjust and communicate with their INNATE and ADAPTIVE systems, in order to respond to these external events and rapidly produce a fix or a re-routing of a path.
Much of cybersecurity and the work done by Computer Emergency Response Teams (CERT) is similar to what happens when a virus is discovered and antigen signals are distributed. Depending on the nature of the event, it can involve only a few people or expand to involve large numbers, as needed. There are some basic steps followed on a regular basis in this regard:
Get verification from authorized people before finalizing those events as events.
Share lists of detected malware and the signatures (code, bit patterns) that can be used to detect this malware.
Share software antigens to counter this malware.
Elasticity in Supply Chain Immune Systems
Major companies like Amazon, YouTube, Facebook and many others rely on ELASTICITY to enable them to constantly deliver the same results around the globe. For instance, much like the ADAPTIVE/ACQUIRED immune response, Facebook cannot predict where emergency resources will be needed or when, so the system itself detects slowdowns or increases in traffic and provides more resources — with no human involvement. As with Uber, this allows for near perfect optimization of resources and costs. The resources are only consumed when they are needed, and released for use by others based on increases in caseloads.
In effect, when structured correctly, this provides for several layers of disaster management. The ecosystem’s data and services are shared across many members of a supply chain, allowing for significant degradation to individual members of the network but still allowing the network overall to continue to run without interruption.
The parts of a typical supply chain. Picture courtesy: Michael Hugos/SCM Globe
The Crux Of The Matter
What we’ve sketched out here is a conceptual framework for viewing a supply chain immune system, and for identifying where needed software and capabilities already exist, and highlighting where new software and capabilities are required to secure that ecosystem. Key concepts of the framework include the following:
RESTful APIs built into micro-services can be developed and provided to companies using a range of common systems and devices. In many cases these APIs are already available.
Adaptive “immunity modules” can be developed for the different operating systems used by the different companies working together in a supply chain. These immunity modules can be attached to the operating systems and provide the real-time monitoring, blocking and alerts needed when malware is detected.
Existing CEP applications can be adapted and put to use to scan the data flowing through the APIs that link company systems together. This CEP capability would be provided by a centralized system serving the whole supply chain.
The social element of cybersecurity can be enhanced and strengthened by further developing alerting algorithms and social interactions between relevant people at the different companies in a supply chain. Social media and email can be harnessed to enhance this interaction.
The use of elastic systems allows for resource optimization, especially in IT or cybersecurity resources. The optimal allocation of resources, in turn, provides the assurance that when the supply chain ecosystem needs additional resources, they are always available on demand.
We live in a real-time economy powered by rapidly expanding cloud computing networks and streaming real-time big data from billions of devices. Billions of customers are participating and interacting online. New supply chains are emerging to serve these rapidly evolving markets. For those supply chains to survive the perils they will inevitably encounter, and for them to thrive in the high change and unpredictable environments where they operate, strong immune systems will be indispensible.
The writer is an author, speaker, and award-winning CIO, who has advised and mentored development teams at Microsoft Xbox, Starbucks Coffee Company, and the U.S. Navy Medical Logistics Command, among others. He works with clients to find elegant solutions to complex problems with a focus on supply chains and business intelligence. You can reach him here.
About the Polly Klaas Foundation: Since 1993, the Polly Klaas Foundation (PKF) has been a national nonprofit dedicated to the safety of all children, the recovery of missing children, and public policies that keep children safe in their communities. They have helped more than 10,000 families of missing children with a 97% recovery rate and have become sought-after experts, especially in the area of the sex trafficking of endangered runaways. They provide training to law enforcement professionals, social service agencies, and to 7th – 9th grade students to ensure that issues relating to both the quick recovery of our missing and trafficked children and the prevention of trafficking are addressed. The PKF also works closely with state and national lawmakers to address issues of child safety, missing children, and human trafficking.
The 2016 Missing Person and Unidentified Person Statistics report from the
The numbers above include adults and minors, males and females, people of various ethnicities, as well as individuals of all ages. They also include people with a proven physical or mental disability that were reported missing, under circumstances that suggest that they were in danger, those that went missing after a catastrophic event, and persons that were absent under circumstances that might not have been voluntary. All of this serves to remind us of a tragic truth — abduction, victimization, and exploitation are not discriminatory crimes, they could happen to anyone, anywhere, anytime. Despite the haste and the tireless efforts of various stakeholders, many missing person cases remain unresolved. It’s important to note that even though the NCIC database classifies more than 88,000 as “active” as of December 2016, this, unfortunately, doesn’t mean that all the rest of the cases in their system were resolved. Cases are “purged” from the database (contributing to their removal from active status), for any number of reasons: A case could be canceled/cleared, a person could be located by another agency, or a record could be removed by the agency that made the original entry because they determined that the record was invalid. The cases purged in any given year could have had an initial entry date of many years ago. Thus, the numbers do not add up, and it’s very difficult, if not impossible, to get a definite number on actual active cases across the country.
