News Corp. Settles With Victims Over Hacking Scandal

Jude Law, one of those who were victims of the hacking scandal, apparently settled with News Corporation for roughly $200,000:

The actor Jude Law received the highest disclosed payout of £130,000 damages plus costs as payments totalling £640,000 were made in 15 cases where the amount of amounts were made public.

The former deputy prime minister, John Prescott, received £40,000, Labour MP Chris Bryant received £30,000; Sadie Frost, Jude Law's former wife, received £50,000; and Gavin Henson, the Welsh rugby international £40,000. However, with damages from the other settlements and costs factored in, lawyers estimated that News International's bill could hit £10m.

That's an appallingly low sum considering what was going on here. It should also be sufficient to get further criminal charges going against all those involved in the scandal, particularly in the way some of the admissions were made.

Then again, the News Corp lawyers did their job too:

NGN made no admission as part of these settlements that directors or senior employees knew about the wrongdoing by NGN or sought to conceal it. However, for the purpose of reaching these settlements only, NGN agreed that the damages to be paid to claimants should be assessed as if this was the case."

They made sure that they limited liability and somehow managed to insulate key executives, made no further admissions, etc., but those admissions already made are pretty damning as it is.

Still, there are compelling reasons for a settlement by both sides. It would have been extremely costly and time consuming to the victims to pursue this in court while the bad press of delaying tactics would have harmed News Corp. Even if you're Jude Law, you don't have infinitely deep pockets to sustain a fight of this kind, despite the possibility of a jackpot verdict. News Corporation had every reason to delay and deny, but after a while that works against the company and they too want to limit the damage and potential of a massive verdict. It just came down to how much the sides were willing to forgo.

For News Corporation, it shows that they'll consider this as a cost of doing business and I wouldn't be surprised to see them engage in similarly disgusting behavior down the road. Heck, some of those involved in the scandal have ended up on their feet; one editor of News of the World landed on his feet at the New York Daily News as its editor-in-chief.

New Troubles For News Corp; Emails Show Top Execs Knew of Hacking

The smoking gun may have emerged that would strike at the heart of News Corporation as it continues to push back against allegations that top executives didn't know of the hacking work done by staffers at its various news outlets in the United Kingdom. Turns out that they did know, and they have the emails to prove it:

Clive Goodman, the former royal reporter jailed for his role in phone hacking, wrote a letter in 2007 claiming that phone hacking was "widely discussed" at editorial meetings, and that former editor Andy Coulson offered to let him keep his job if he agreed to say in court that he was a rogue element within the paper.

The claims are deeply damaging to Coulson, who has always maintained that he did not know about the hacking going on at his paper. They are also politically perilous for Cameron, who took Coulson on even as evidence mounted against him. Moreover, they raise fresh danger for James and Rupert Murdoch, both of whom claimed to know nothing about hacking. Before the documents were released, the select committee for the Department for Culture, Media and Sport announced that it is "likely" to recall James Murdoch when Parliament resumes in September.

The letter was one of several documents published by a parliamentary committee on Tuesday afternoon.
Goodman's letter is from March 2, 2007, after he was released from prison. In the letter, Goodman says he is appealing his firing from the News of the World specifically because he carried out his duties with the "full knowledge and support" of top journalists on the paper, and because the practice was so widespread at the paper.

The letter claims that hacking was so frequently talked about that Coulson—who went on to become David Cameron's top spin doctor—eventually was forced to ban mention of the practice. Goodman also says that he was repeatedly promised to be kept on, even after he was arrested. He further claims that the paper continued to pay and consult him on stories, even after it was known that he would plead guilty.

"[The paper's top lawyer] Tom Crone and the editor promised on many occasions that I could come back to a job at the newspaper if I did not implicate the paper or any of its staff in my mitigation plea," Goodman writes. "I did not, and I expect the paper to honour its promise to me."

The Guardian's Nick Davies also reports that Les Hinton, the former Dow Jones chief who resigned amidst allegations about his role in the scandal, received a copy of Goodman's letter but failed to pass it to the police. He then told Parliament that Coulson was completely unaware of the hacking going on.

Expect to see the Murdoch's hauled back before the British Parliament to deal with the new revelations, particularly because their earlier statements now look more and more like a coverup.

News Corp. Subsidiary Involved in NJ Hacking Case?

New Jersey Senator Frank Lautenberg is calling on the FBI to investigate claims that a New Jersey company was hacked by a subsidiary of News Corporation, which is already under scrutiny for hacking allegations and admissions of wrongdoing in the UK. The allegations go back to 2005 and Lautenberg is now asking the FBI to look at this case in light of the more recent allegations and admissions:

Lautenberg initially wrote to U.S. Attorney General Alberto Gonzales in 2005 asking him to look into a claim by Hamilton Township-based FLOORgraphics that its computers were hacked by News Corp. subsidiary News America Marketing on 11 occasions over a two-year period.

FLOORgraphics later sued the company for the computer hacking and other questionable competitive practices.

"News employed numerous illicit tactics in a prolonged and concerted effort to destroy (FLOORgraphics)," said a complaint filed by the company in 2006.

FLOORgraphics settled with News America Marketing and was later bought out for $29.5 million.

"At the time of my letter in 2005, I was informed by FLOORgraphics that the U.S. Attorney’s Office for the District of New Jersey, the FBI and the U.S. Secret Service initiated an investigation into allegations that News America illegally gained access to FLOORgraphics’s password-protected computer system and obtained FLOORgraphics’s confidential data," Lautenberg wrote today.

He also wrote that the Department of Justice and FBI should consider the case as it may be relevant to the current investigation of News Corp. subsidiaries.

Bloomberg News reported today that an attorney for News America Marketing conceded a computer there had been used to access the FLOORgraphics site.

That story reported that an investigation by New Jersey's Divison of Criminal Justice ended without charges being filed, according to Rachel Goemat, a spokeswoman for Division of Criminal Justice.

A 2009 trial included revelations that News America Marketing hacked into FLOORgraphics on several occasions in an effort to gain market share. That case was settled when the company was bought out by News America Marketing for $29.5 million. Apparently, the hacking began after the company refused to sell itself to News America.

Murdoch's Get Grilled By British Parliament; NY Post Silent

Rupert Murdoch, his son James, and Rebekah Brooks are all facing angry British Members of Parliament over the hacking scandal that has resulted in the shuttering of the News of the World and multiple resignations and arrests, including Brooks.

So why is it that the NY Post doesn't have a single link on the front page to the big news of the day - that the Murdoch's are being grilled by the MPs in the UK.

I wonder.

At least the Wall Street Journal is carrying the hearings live (it's another Murdoch-owned paper).

For more coverage, see the NY Times or Memeorandum.

Gawker Security Breach Shows Password Security Remains Huge Concern

A computer system is only as secure as its least secure access point. Password systems are the main defense, and frequently users pick passwords that are so ridiculously easy to break that hackers don't even have to break a sweat.

Of course, that assumes that the systems being defended are up to snuff. Gawker's system was not. Hackers not only broke into the Gawker systems and stole all manner of password data and other confidential materials that Gawker stored on its servers, but an analysis of what the hackers posted online shows just how badly people deal with password protection.

Analysis of almost 200,000 of the stolen passwords shows that the most common were “123456” and “password”. These passwords are easy for hackers to guess and they also pose a wider security risk because many people use the same password for every website they visit. Soon after the data was hacked, thousands of Gawker users - visitors to sites like gadget blog Gizmodo and video game website Kotaku - had their Twitter accounts hijacked because they had used the same password there.

Around one third of people use the same password for every website they visit, according to research by security analysts Sophos. Graham Cluley, senior technology consultant at Sophos, said: “You should use a different password on every website.”

Using different passwords on different sites makes a lot of sense, but people have a hard time remembering passwords, which is why they resort to easily cracked passwords like 123456 or password.

Gawker's "security" was so poor so as to be nonexistent. It used an outdated encryption system that was easily broken using widely available tools. Moreover, it knew about the intrusion but didn't alert users for weeks. Gawker is now in damage control mode and its commenting system is requiring all users to provide new passwords. You can check to see if your email is among those hacked via Slate.

Heads should roll at Gawker. It looks like everything Gawker has worked on is potentially in the hands of the hackers who broke into the site. Gawker's security experts are likely in for a real rude awakening (if they even have security experts on staff) - and I wouldn't be surprised if a bunch get fired for their incompetence/failure to contain the problems.

Nick Denton and everyone else involved should also be held responsible. Email transcripts among personnel trying to wrap their heads around the security breach show a complete lack of understanding of the situation and a disregard for the commenters - the very people that give Gawker its value to advertisers. I wont be surprised when the lawsuits start rolling in demanding compensation for any economic damage done to users who had their information stolen in the hack.

It also raises additional questions about their security and confidentiality of information shared with third party sites. If they care so little about their customers personal data knowing that a hack is underway, what makes anyone think that their data protection on day to day ops is any better?

Gawker may have financial liabilities if the work being done on other contracted sites gets out in violation of confidentiality agreements. Gawker (the entire company, not just the singular website) is in for a world of hurt. And justly deserved.

In sum, it's a huge mess for the Gawker organization and those emails show a disregard for the customer security.

At the same time, it should raise further questions about the security at other sites, including Facebook. Facebook just asked users to provide still more information, including phone numbers. I'm sorry, but there's absolutely no reason that Facebook needs that kind of information and if hackers manage to access Facebook to cull personal information, the fallout could be severe, no matter if Time calls Facebook founder Mark Zuckerberg its person of the year.

Since users frequently use one password across multiple sites, tracing users across to other widely used sites will give hackers the ability to break into other accounts - and potentially exploit holes in security around the Internet. It's a ripple effect.

UPDATE:
Amazon has reset its users' passwords because people frequently reuse passwords across multiple sites and that this protects the company and user from unauthorized access.

Meanwhile, Gawker's internal emails, which were hacked along with all that password information, may turn into a mini-wikileaks as Gawker's confidential sources and other information may soon be outed.

Arrest of Malaysian Hacker Again Highlights Nation's Cybersecurity Problems

The arrest of a Malaysian hacker has shed light on serious weaknesses in the nation's security of vital computer systems, and raises new concerns over concerted efforts to crack the nation's security systems.

Those are among the puzzling questions raised by allegations against Lin Mun Poo, a 32-year-old Malaysia native whose case illustrates the mounting national secrets threats posed by overseas cyberattacks, U.S. law enforcement and intelligence officials tell NBC News.

The U.S. government’s case against Poo, who is slated to be arraigned in federal court in Brooklyn on Monday, has so far gotten little attention. But many of the allegations against him seem alarming on their face, according to cybercrime experts. "This is scary stuff," said one U.S. law enforcement official.

Poo was arrested by Secret Service agents last month shortly after flying into New York's John F. Kennedy airport with a "heavily encrypted" laptop computer containing a "massive quantity of stolen financial account data," including more than 400,000 credit card, debit card and bank account numbers, according to a letter filed by federal prosecutors last week laying out a "factual proffer" of their evidence against Poo. [ Click here to read the prosecutors' letter in PDF format.]

He later confessed to federal agents that he had gotten the credit and bank card data by tapping into the computer networks of "several major international banks" and companies, and that he expected to use the data for personal profit, either by selling it or trading it, according to the prosecutors' letter.

Poo's court-appointed lawyer did not respond to a request from NBC News for comment.

'Impressive level of criminal activity'
But far more disturbing, according to U.S. intelligence officials and computer crime experts, was his penetration of both a Federal Reserve network of 10 computers in Cleveland as well as the secure networks of a "major" Defense Department contractor. According to the prosecutors' letter, the Pentagon contractor, which has not been identified, provides system management for military transport and other "highly-sensitive military operations."

This comes on the heels of revelations that state-owned China Telecom instructed U.S. and other foreign Internet traffic to go through Chinese servers during an 18-minute stretch on April 8, which included Pentagon sites and other vital information.

Iranian Mullahs Continue With Threats; Ahmadinejad's Website Hacked?

The New York Times reports that Mahmoud Ahmadinejad's website was apparently hacked by people sympathetic to the opposition.

Although the Web site appears to be down now, Mr. Heap wrote that people trying to access it last night were redirected to this page, which contains the following message:

Dear God, In 2009 you took my favorite singer - Michael Jackson, my favorite actress - Farrah Fawcett, my favorite actor - Patrick Swayze, my favorite voice - Neda. Please, please, don’t forget my favorite politician - Ahmadinejad and my favorite dictator - Khamenei in the year 2010. Thank you.

Someone apparently hacked Ahmadinejad's website and sent a redirect to that page. It's now down possibly because of traffic overload, or because the Iranians are trying to figure out the hack.

The regime continues menacing the Iranian people and branding those who oppose the regime to be nothing less than traitors and terrorists. The regime continues to warn that those responsible for the demonstrations will be executed.

"After Ashura, anyone who takes part in riots will be considered as 'mohareb' (waging war on God) and an opponent of national security," Najjar said, according to the official IRNA news agency.

Despite such warnings, the opposition has shown no inclination to back down and street protests have continued sporadically in the six months since the vote.

Thousands of protesters were arrested after the election. Most have since been released but more than 80 reformists have received jail terms of up to 15 years. Five people have been sentenced to death but none has been executed so far.

More than 300 have been incarcerated by the regime since protests resumed during the Shi'ite observance of Ashura in December. The regime also has announced that those who use the Internet to post what it calls "false information" about the regime will be arrested.

Hackers Expose Global Warming Chicanery?

Overnight, reports indicated that hackers managed to access tons of email and other data from a premier British climate research group, the Hadley Climate Research Group University of East Anglia Climatic Research Unit, and exposes issues relating to fudging the data.

This morning the Hadley group has confirmed that the emails that were published as a result of the hacking appears to be genuine, as based on this report.

There is speculation that this wasn't necessarily the work of a hacker, but an insider blowing the whistle, claiming that Hadley cancelled all existing passwords. That could simply be a precaution to institute stronger password protection, such as requiring longer passwords and requiring multiple numbers and case-sensitivity, and not necessarily the result of leaning towards an inside job.

If these emails are indeed genuine, they throw into question analysis and data collection techniques used at the center. The security breach was first uncovered by the folks at Real Climate, who passed on the information to the Hadley group.

Watts Up With That has some of the jucier tidbits, including emails purportedly claiming that they would hide declines in global temps by overlaying different data.

Data collection and analysis is at the heart of the global warming theory. If someone is fudging data and/or clearly trying to massage the data to fit a theory, it's grounds for serious repercussions seeing how nations all over the world are looking to spend and/or tax carbon emissions into the ground (literally and figuratively). It's literally a trillion dollar question, and if the data was indeed fudged, it throws into question the accuracy of the data.

UPDATE:
University of East Anglia Climatic Research Unit is the name of the entity involved, not Hadley. I've corrected above.

North Korea Behind Cyberattack On US and South Korean Gov't Websites

Several major US and South Korean government websites were disabled by a North Korean denial of service attack beginning on July 4.

Others familiar with the U.S. outage, which is called a denial of service attack, said that the fact that the government Web sites were still being affected three days after it began signaled an unusually lengthy and sophisticated attack. The officials spoke to The Associated Press on condition of anonymity because they were not authorized to speak on the matter.

"It certainly seems to be a well-organized attack," an anonymous government official told The Washington Post. "There are a lot of computers involved. What we don't know is who is orchestrating it."

The Korea Information Security Agency also attributed the attacks to denial of service.

Yang Moo-jin, a professor at Seoul's University of North Korean Studies, said he doubts whether the impoverished North has the capability to knock down the Web sites.

But Hong Hyun-ik, an analyst at the Sejong Institute think tank, said the attack could have been done by either North Korea or China, saying he "heard North Korea has been working hard to hack into" South Korean networks.

North Korea devotes nearly all of its resources to military and nuclear efforts, and cyberspace is simply another battleground. It would be unwise to underestimate the North Korean ability to launch cyberattacks on government websites, particularly DoS attacks, given that there are hacking communities that devote themselves to discussing these very scenarios.

They have their sympathizers as well, and I wouldn't rule out Chinese involvement as well.

That's on the heels of a report saying that US cyberdefense systems don't work. In fact, the latest iteration of the system (Einstein 2), which alerts officials that an attack is underway, isn't going to be ready for another 18 months. The system can't thwart attacks that it isn't familiar with. One of the biggest problems is concerns over privacy, particularly since the system is being rolled out on telecommunications networks operated by various companies, including AT&T. A third iteration of Einstein may be able to thwart attacks, but there's no roll-out date.

Then again, federal authorities aren't doing much better in protecting government buildings as undercover investigators had no problem sneaking bomb materials into federal buildings.

The Government Accountability Office said investigators carried bomb-making materials past security at 10 federal buildings. Security at these buildings and a total of about 9,000 federal buildings around the country is provided by the Federal Protective Service, a target of the probe.

Once GAO investigators got the materials in the buildings, the report said, they constructed explosive devices and carried them around inside. For security reasons, the GAO report did not give the location of the buildings.

The report was made available to The Associated Press in advance of a hearing scheduled Wednesday of the Senate Homeland Security and Governmental Affairs Committee.

Chinese Hackers Behind Massive Northeast Blackout?

One prominent expert told National Journal he believes that China’s People’s Liberation Army played a role in the power outages. Tim Bennett, the former president of the Cyber Security Industry Alliance, a leading trade group, said that U.S. intelligence officials have told him that the PLA in 2003 gained access to a network that controlled electric power systems serving the northeastern United States. The intelligence officials said that forensic analysis had confirmed the source, Bennett said. “They said that, with confidence, it had been traced back to the PLA.” These officials believe that the intrusion may have precipitated the largest blackout in North American history, which occurred in August of that year. A 9,300-square-mile area, touching Michigan, Ohio, New York, and parts of Canada, lost power; an estimated 50 million people were affected.

Officially, the blackout was attributed to a variety of factors, none of which involved foreign intervention. Investigators blamed “overgrown trees” that came into contact with strained high-voltage lines near facilities in Ohio owned by FirstEnergy Corp. More than 100 power plants were shut down during the cascading failure. A computer virus, then in wide circulation, disrupted the communications lines that utility companies use to manage the power grid, and this exacerbated the problem. The blackout prompted President Bush to address the nation the day it happened. Power was mostly restored within 24 hours.

There has never been an official U.S. government assertion of Chinese involvement in the outage, but intelligence and other government officials contacted for this story did not explicitly rule out a Chinese role. One security analyst in the private sector with close ties to the intelligence community said that some senior intelligence officials believe that China played a role in the 2003 blackout that is still not fully understood.

I'm skeptical of the fact that such links were not explored fully, and if that evidence indeed linked Chinese hackers, especially those working for the Chinese government, to the blackout, that the US government would not have taken a position on the matter through various means at their discretion. Such acts could be construed as acts of war since they were an attack on vital infrastructure and affected the national economy and directly and indirectly harmed more than 50 million people.

At the same time, it could be understandable that the power companies wouldn't want to let it be known that their systems were hacked and vulnerable to manipulation in a way that could cause a cascading failure.

The report also claims that the blackout in Florida this year was the result of a Chinese PLA hacker.

This isn't the first time that security companies have warned of hack attacks against energy infrastructure.