<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <title>Internet</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/" />
    <link rel="self" type="application/atom+xml" href="http://cpj.org/internet/atom.xml" />
    <id>tag:cpj.org,2010-08-12:/internet/19</id>
    <updated>2013-05-22T21:46:50Z</updated>
    
    <generator uri="http://www.sixapart.com/movabletype/">Movable Type 4.38</generator>

<entry>
    <title>Facebook joins Global Network Initiative</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/05/facebook-joins-global-network-initiative.php" />
    <id>tag:cpj.org,2013:/internet//19.21773</id>

    <published>2013-05-22T16:00:55Z</published>
    <updated>2013-05-22T21:46:50Z</updated>

    <summary> With more than a billion users, Facebook is not only the biggest global social network but also an increasingly important forum for journalists. In some repressive countries it has even served as a publishing platform for journalists whose newspapers or news websites have been closed down. That is why...</summary>
    <author>
        <name>Robert Mahoney/CPJ Deputy Director</name>
        
    </author>
    
        <category term="Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="facebook" label="Facebook" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="globalnetworkinitiative" label="Global Network Initiative" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="google" label="Google" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="microsoft" label="Microsoft" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="shitao" label="Shi Tao" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="socialmedia" label="Social Media" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="yahoo" label="Yahoo" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<form id="4653" class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/fb3.jpg"> <img alt="" onload="javascript:addCaption(this)" src="/internet/assets_c/2013/05/fb3-thumb-165x177-4653.jpg" width="165" height="177" class="mt-image-left" style="float: left; margin: 0 20px 20px 0;" /> </a></form><p>With more than a billion users, Facebook is not only
the biggest global social network but also an increasingly important forum for
journalists. In some repressive countries it has even served as a publishing
platform for journalists whose newspapers or news websites have been closed
down. That is why journalists and bloggers should note
today's news that after a year of standing on the threshold, Facebook has
decided to step inside the <a href="http://www.globalnetworkinitiative.org/news/facebook-joins-global-network-initiative">Global
Network Initiative</a> tent.</p> ]]>
        <![CDATA[<p>There they'll find competitors Google, Microsoft,
and Yahoo huddled with human rights defenders and ethical investors trying to
work through some of the thorny challenges to freedom of expression and user
privacy posed by powerful political and commercial interests worldwide.</p>

<p>Facebook held nonrenewable "<a href="http://globalnetworkinitiative.org/press_releases/facebook-gains-observer-status-global-network-initiative">observer status</a>" with GNI for the past year and had to decide this month whether to
publicly commit to GNI principles or walk away.</p>

<p>One of the biggest hurdles for any corporation
joining the initiative is the opening up of its inner workings to outside
scrutiny. Companies must agree to allow independent assessors to evaluate
regularly whether they have put in place systems to uphold GNI principles and
whether those systems are working. This would entail, for example, examining how
a company handled a demand from a government for information about a user; did
it simply hand over that information or did it push back? Much of the impetus to
create GNI came after Yahoo provided information to the Chinese authorities
which helped them identify reporter <a href="/awards/2005/shi-tao.php">Shi Tao</a> as the source of a story that led
to his imprisonment.</p>

<p>The three founding companies mentioned above are
already deeply into the <a href="/blog/2012/04/internet-companies-submit-to-external-free-express.php">assessment process</a>. Facebook will not begin it assessment until 2015.</p>

<p>[<i>CPJ is part
of GNI, and Robert Mahoney is a GNI board member</i>.]</p>]]>
    </content>
</entry>

<entry>
    <title>So your Twitter account is hacked? Reset, tweet, pray.</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/04/so-your-twitter-is-hacked-reset-tweet-pray.php" />
    <id>tag:cpj.org,2013:/internet//19.21598</id>

    <published>2013-04-24T19:07:12Z</published>
    <updated>2013-04-24T22:44:01Z</updated>

    <summary>That is a bogus @ap tweet.-- AP CorpComm (@AP_CorpComm) April 23, 2013 More than a quarter million Twitter accounts have been hacked worldwide, the social media company disclosed in February, but Tuesday&apos;s attack on The Associated Press&apos;s verified account, @AP, had unusual effect. The Dow Jones industrial average fell 143...</summary>
    <author>
        <name>Frank Smyth and Kamal Singh Masuta/CPJ Staff </name>
        <uri>http://cpj.org/security/</uri>
    </author>
    
        <category term="Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="associatedpress" label="Associated Press" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="hacking" label="Hacking" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="twitter" label="Twitter" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<blockquote class="twitter-tweet"><p>That is a bogus @<a href="https://twitter.com/ap">ap</a> tweet.</p>-- AP CorpComm (@AP_CorpComm) <a href="https://twitter.com/AP_CorpComm/status/326745628535300096">April 23, 2013</a></blockquote>
<script src="//platform.twitter.com/widgets.js" charset="utf-8"></script><p>More than a quarter million Twitter accounts have been <a href="http://blog.twitter.com/2013/02/keeping-our-users-secure.html">hacked
worldwide</a>, the social media company disclosed in February, but Tuesday's attack
on The Associated Press's verified account, @AP, had unusual effect. The Dow
Jones industrial average fell 143 points after someone hijacked the AP's account
to <a href="http://bigstory.ap.org/article/hackers-compromise-ap-twitter-account">falsely
tweet</a> that two explosions at the White House had wounded President Barack
Obama. The market recovered, but the hacking--just the latest in a series of attacks
on news organizations--sent shudders through a profession that's grown accustomed
to breaking its news on Twitter.</p> ]]>
        <![CDATA[<p>So what to do if your Twitter account is hacked? The best
advice is not to let it happen in the first place; the AP said the attack on its
Twitter account was preceded by a phishing expedition--an attempt to extract
usernames and passwords--that was launched against its corporate network.</p>

<p>We'll work backward in this piece. If your account has already
been hacked, a first step is to request a password reset from Twitter by going
to this Twitter page, "<a href="https://support.twitter.com/articles/185703-my-account-has-been-hacked">My
account has been hacked</a>," and then using the password reset form and
following instructions.</p>

<p>If you still see unauthorized Tweets indicating the account
remains hijacked, the next step is to check the external applications accessing
your account. Steve Hill, an Indiana-based, internet technology blogger, <a href="http://stevenahill.com/2011/08/what-to-do-if-your-twitter-account-gets-hacked/">recommends</a>
going into your Twitter account's settings and clicking on applications to see
the list of apps, such as Facebook or TweetDeck, that are being allowed access
to your account. "Identify the applications you don't recognize or are not
comfortable allowing access," adds Hill, "and click 'Revoke Access.'" Then try
resetting your Twitter password again.</p>

<p>If you still can't recover the account on your own, you can
send Twitter a "<a href="https://support.twitter.com/forms">Support request</a>,"
and click on "<a href="https://support.twitter.com/forms/hacked">Hacked account</a>."</p>

<p>Beginning Tuesday evening, CPJ sought out the advice of analysts
and fellow journalists, a collection that we've <a href="http://storify.com/pressfreedom/your-twitter-is-hacked">Storified</a>. Several
followers suggested some good preventive steps, while others expressed bewilderment
about what they might do in case of an attack.</p>

<p>Alex Howard, <a href="http://radar.oreilly.com/alexh">Government
2.0 Washington correspondent</a> for O'Reilly Media, offered this suggestion
for follow-up messages to Twitter (and a higher power):</p>

<blockquote class="twitter-tweet"><p>@<a href="https://twitter.com/7skiestech">7skiestech</a> @<a href="https://twitter.com/acarvin">acarvin</a> file a ticket with @<a href="https://twitter.com/safety">safety</a>, tweet at @<a href="https://twitter.com/twitter">twitter</a> staff, pray.</p>-- Alex Howard (@digiphile) <a href="https://twitter.com/digiphile/status/326774352743907328">April 23, 2013</a></blockquote>
<script async="" src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<p>The goal of this tactic is to get your message heard by a
human being who can respond. In that vein, you could also tweet at individual
Twitter staff members you know or who might be receptive to your problem.</p>

<p>But whatever you do, don't bother calling Twitter on the
phone. The firm's San Francisco line answers with a recording saying, "For
customer support, press 1." After you press 1, another recorded voice says, "Unfortunately,
Twitter does not provide user support over the telephone."&nbsp;</p>

<p>The voice on the recording goes on to suggest that you try
Twitter's Help Center at <a href="https://support.twitter.com/">support.twitter.com</a>.
The voice continues: "Our help center contains information about contacting our
team via email." But any such email addresses on the Help Center page are
either missing or very hard to find, which may explain why @digiphile concluded
his Tweet by suggesting that you add a dose of prayer to your efforts.</p>

<p>The AP is hardly alone in facing attack. <a href="http://www.cbsnews.com/8301-205_162-57581160/security-pro-on-twitter-hacks-no-patch-for-human-error/">CBS
News</a> reported that the Twitter accounts of&nbsp;its news programs, "60
Minutes" and "48 Hours," were compromised over the weekend. On Monday,
hackers accessed two <a href="http://sports.ndtv.com/football/news/206709-fifa-twitter-accounts-hacked-by-assad-sympathisers">International
Federation of Association Football's Twitter accounts</a> to send a flurry of false
tweets alleging corruption by FIFA leadership.</p>

<p>Twitter has been criticized for
failing to deploy two-step (or two-factor) authentication,
which would make it harder for hackers to gain access to an account. Providers
such as Google, Microsoft, and Facebook already offer this. <a href="http://www.wired.com/threatlevel/2013/04/twitter-authentication/"><i>Wired</i> reported Tuesday</a> that Twitter is now testing
a two-step process with hopes of releasing it incrementally to users. Wired
describes the two-step process:</p>

<blockquote><p>When
logging in from a new location, it requires users to enter a password and a
randomly generated code sent to a device, typically via a text message or
smartphone application. In other words, accessing an account requires having
two things: something you know (the password) and something you have (a
previously registered device).</p></blockquote><p></p>

<p>But for now, security is
mainly in your own hands. Some basic steps can help limit your exposure. Avoid
clicking on any strange links that come to you within either your Twitter feed
or Direct Messages on Twitter. "Think before you click!" <a href="http://www.andreavahl.com/twitter/what-to-do-if-your-twitter-account-has-been-hacked.php">advises
Andrea Vahl,</a> a social media consultant, author, and community manager of
the online magazine <i><a href="http://www.socialmediaexaminer.com/about/">Social Media Examiner</a></i>.</p>

<p>Change your password regularly and make sure it is a strong
password involving multiple types of characters like r7#. The <i><a href="/reports/2012/04/journalist-security-guide.php">CPJ
Journalist Security Guide</a></i> recommends creating <a href="/reports/2012/04/information-security.php#5">a
passphrase</a> using different character types that you will remember and that
is unique to you. Something like, Icbm#&amp;!Tawh, for "I can't believe my
#&amp;! Twitter account was hacked."</p>

<p>Make sure you are on Twitter's actual site before logging on,
Vahl notes. A website can be made to look like Twitter so check the URL to be sure
that it says: <a href="https://twitter.com/">https://twitter.com</a>. Twitter
automatically loads an https address, which provides more security than the
simple http. Vahl also recommends adding your mobile number to your account. "Twitter
can verify your account if it's been hacked through your mobile phone and
restore your access quicker," she notes.</p>

<p>Twitter has a page, "<a href="https://support.twitter.com/articles/76036">Keeping your account secure</a>,"
that explains preventive measures in detail. The page also reminds users to
keep their computer and operating systems updated with the most recent security
patches and anti-virus software. This is important. Many journalists and human
rights activists working in less developed nations can attest to the risk of
having one's devices infected through the use of pirated or outdated software.</p>

<p>Enrique Piraces, a colleague at Human Rights Watch who
specializes in digital security, tells us that preventative steps are especially
important for those who don't work for large organizations. In response to our queries, he said that dealing with a hacking attack on your own poses big challenges.</p>

<blockquote class="twitter-tweet"><p>@<a href="https://twitter.com/pressfreedom">pressfreedom</a> Good/hard question. Unless part of a large org most channels r ad-hoc, reactive. That is why prevention goes a long way.</p>-- epiraces (@epiraces) <a href="https://twitter.com/epiraces/status/326847069295894528">April 23, 2013</a></blockquote>
<script async="" src="//platform.twitter.com/widgets.js" charset="utf-8"></script>]]>
    </content>
</entry>

<entry>
    <title>China decrees use of foreign news must be approved</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/04/china-decrees-use-of-foreign-news-must-be-approved.php" />
    <id>tag:cpj.org,2013:/internet//19.21574</id>

    <published>2013-04-18T20:27:18Z</published>
    <updated>2013-04-18T20:41:12Z</updated>

    <summary><![CDATA[You have to wonder how this will be enforced, but China's State Administration of Press Publication, Radio, Film and Television has issued a "Notice on Strengthening Control of Media Personnel's Online Activities" (关于加强新闻采编人员网络活动管理的通知). Chinese media organizations have been told to stop posting foreign media news without government permission:&nbsp; "Without authorization,&nbsp;no&nbsp;kind...]]></summary>
    <author>
        <name>Bob Dietz/CPJ Asia Program Coordinator</name>
        
    </author>
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="China" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="censored" label="Censored" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="harassed" label="Harassed" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="socialmedia" label="Social Media" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="stateadministrationofpresspublicationradiofilmandtelevision" label="State Administration of Press Publication Radio Film and Television" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="weibo" label="Weibo" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<p>You have to wonder how this will be enforced, but China's
State Administration of Press Publication, Radio, Film and Television has
issued a "Notice on Strengthening Control of Media Personnel's Online
Activities" (<a href="http://news.xinhuanet.com/legal/2013-04/16/c_124588101.htm">关于加强新闻采编人员网络活动管理的通知</a>).
Chinese media organizations have been told to stop posting foreign media news without
government permission:&nbsp; "Without
authorization,&nbsp;no&nbsp;kind of media outlets shall arbitrarily use media
release from overseas media agencies and media websites," is the way <a href="http://english.caijing.com.cn/2013-04-16/112680980.html"><i>Caijing</i> magazine</a> translated it.</p> ]]>
        <![CDATA[<p>The directive also says,&nbsp;"News work units that have
established official weibo accounts must keep records for their managing work
unit and appoint a person to be responsible for posting information." Our
colleagues at the Berkley-based <a href="http://chinadigitaltimes.net/2013/04/netizen-voices-new-agency-muffles-chinese-press/"><i>China Digital Times</i></a> explain that
officially approved social media sites like Sina Weibo and others had "allowed
journalists to skirt press censorship, posting information about the <a href="http://chinadigitaltimes.net/2011/07/after-deadly-train-crash-in-china-critics-claim-state-cover-up/">Wenzhou
train crash</a>, the&nbsp;<a href="http://chinadigitaltimes.net/2013/01/light-shed-on-weibo-censorship-and-southern-weekly/"><i>Southern Weekly</i> protest</a>, and other
major events on their personal accounts.&nbsp;<a href="http://chinadigitaltimes.net/2013/01/beijing-news-defiance-tears-and-porridge/">Media
organizations have even issued&nbsp;weibo&nbsp;in defiance of propaganda
directives.</a>&nbsp;The government has caught on and is now attempting to
stymy this outlet."</p>


<p>To make sure everyone got the message, an article headlined
"SARFT to enhance control over editors' online activities," explaining the new
rules, was apparently published by almost all state-run media at the same time.
You can find an <a href="http://www.abigenoughforest.com/blog/2013/4/16/sarft-to-enhance-control-over-editors-online-activities.html">unofficial
translation here</a> posted by the China-watching website <a href="http://www.abigenoughforest.com/blog/2013/4/16/sarft-to-enhance-control-over-editors-online-activities.html"><i>A Big Enough Forest</i></a>. The directive
comes in an effort "to promote the establishment of a healthy news order" the
official explanation reads. </p>


<p>According to the translation, the new directive also
requires that editors "must quickly delete harmful information. News editors
must receive permission from their work units to set up professional Weibo
accounts, and must not post information on Weibo that violates laws,
regulations, or managing rules from their own media organizations. Without
approval, they are not permitted to post any kind of information obtained
through their professional activities."</p>


<p>Other than the day-to-day (and sometimes minute-to-minute)
editorial guidelines flowing out of what used to be called the central propaganda
department, this is the first major censorship directive to be handed down <a href="/reports/2013/03/challenged-china-media-censorship.php">under
the new government</a> of Premier Li Keqiang. If there were any hopes of a liberalized
attitude toward media under the new regime, this part of the official
explanation for the directive, as translated by <i>A Big Enough Forest</i>, should make clear that won't be happening
anytime soon:</p>


<blockquote class="webkit-indent-blockquote"><p>The "Notice" requires that news editors must uphold the
policy of encouraging unity and stability, and promoting positive coverage in
the main, while actively using traditional media, news sites, blogs, Weibo
accounts and other methods of information dissemination to broadcast mainstream
information, guide public opinion, and take the initiative to &nbsp;reject
leaks and broadcasts of harmful information; they must not use or report online
information that has not been verified through official channels, and must not
disseminate or repost online rumors or speculative information.</p></blockquote><p></p>


<p>And, courtesy of <i>China
Digital Times</i>, a point of clarification for China watchers enamored of
state agency acronyms: The State Administration of Press Publication, Radio,
Film and Television is a&nbsp;<a href="http://chinadigitaltimes.net/2013/03/china-unveils-plans-for-streamlined-government/#sarft">new
ministry</a>&nbsp;formed from the merger of the State Administration of Radio,
Film, and Television (<a href="http://chinadigitaltimes.net/china/SARFT/">SARFT</a>)
and the General Administration of Press Publication (GAPP). That should make
handing down censorship directives just that much easier.&nbsp;</p>]]>
    </content>
</entry>

<entry>
    <title>Working with phone companies on free expression</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/03/working-with-phone-companies-on-free-expression-ri.php" />
    <id>tag:cpj.org,2013:/internet//19.21398</id>

    <published>2013-03-12T17:34:24Z</published>
    <updated>2013-03-12T17:41:11Z</updated>

    <summary>For more than six years the Committee to Protect Journalists has been working with freedom of expression advocates, investors, and giant Internet companies to promote online freedoms. Absent from the discussions under the umbrella of the Global Network Initiative have been the telecommunications companies--vital gateways to the Internet for journalists...</summary>
    <author>
        <name>Robert Mahoney/CPJ Deputy Director</name>
        
    </author>
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="CPJ" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="alcatellucent" label="Alcatel-Lucent" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="francetelecomorange" label="France Telecom-Orange" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="globalnetworkinitiative" label="Global Network Initiative" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="millicom" label="Millicom" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="nokiasiemensnetworks" label="Nokia Siemens Networks" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="telefonica" label="Telefonica" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="telenor" label="Telenor" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="teliasonera" label="TeliaSonera" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="vodafone" label="Vodafone" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<p>For more than six years the Committee to Protect Journalists
has been working with freedom of expression advocates, investors, and giant
Internet companies to promote online freedoms. Absent from the discussions
under the umbrella of the <a href="http://www.globalnetworkinitiative.org/">Global
Network Initiative</a> have been the telecommunications companies--vital
gateways to the Internet for journalists and bloggers, particularly in much of
the global South. Today things have changed.</p> ]]>
        <![CDATA[<p>Some telecom companies took part in the early GNI
negotiations, but when it came time to commit in 2008, they said they were not
ready to join. But telecom companies are under increasing public scrutiny
around the world as governments make more and more demands for access to the
treasure troves of information they hold on all of us who go online, send a
text message, or make a phone call. </p>

<p>A <a href="https://globalnetworkinitiative.org/news/key-telecommunications-players-collaborate-global-network-initiative-freedom-expression-and">group
of companies</a> known as the Industry Dialogue, which have been meeting since
2011 to address these concerns, today committed to work with GNI over the next
two years. The companies are: <a href="http://www.alcatel-lucent.com/sustainability">Alcatel-Lucent</a>, <a href="http://www.orange.com/en/responsibility/strategy/human-rights">France
Telecom-Orange</a>, <a href="http://www.millicom.com/">Millicom</a>, <a href="http://www.nokiasiemensnetworks.com/about-us/sustainability/ethics-and-human-rights">Nokia
Siemens Networks</a>, <a href="http://www.crandsustainability.telefonica.com/en/sustainability_telefonica/globalisation.php">Telefonica</a>,
<a href="http://www.telenor.com/corporate-responsibility/privacy-and-freedom-of-expression">Telenor</a>,
<a href="http://www.teliasonera.com/en/about-us/public-policies/#Telecommunications-Industry-Dialogue-1">TeliaSonera</a>,
and <a href="http://www.vodafone.com/content/index/about/sustainability/news_and_case_studies/news/industry_dialogue_announcement.html">Vodafone</a>.
These firms, though based in Europe, have global reach. </p>

<p>Although the telecom companies are not joining GNI, their
willingness to engage is a positive first step. And the <a href="http://www.teliasonera.com/Documents/Public%20policy%20documents/Telecoms_Industry_Dialogue_Principles_Version_1_-_ENGLISH.pdf">Dialogue</a>
remains open for more telecom companies to join.&nbsp;</p>]]>
    </content>
</entry>

<entry>
    <title>As censorship wanes, cyberattacks rise in Burma</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/02/as-censorship-wanes-cyberattacks-rise-in-burma.php" />
    <id>tag:cpj.org,2013:/internet//19.21201</id>

    <published>2013-02-11T16:29:44Z</published>
    <updated>2013-02-11T16:57:15Z</updated>

    <summary> Cyberattacks on news websites and apparent government hacking into journalists&apos; email accounts have raised new questions about the integrity of media reforms in Burma. The New York Times reported on Sunday that several journalists who regularly cover Burma-related news recently received warning messages from Google that their email accounts...</summary>
    <author>
        <name>Shawn W. Crispin/CPJ Southeast Asia Representative</name>
        
    </author>
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Burma" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="ayeayewin" label="Aye Aye Win" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="bertillintner" label="Bertil Lintner" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="cyberattack" label="Cyberattack" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="democraticvoiceofburma" label="Democratic Voice of Burma" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="facebook" label="Facebook" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="google" label="Google" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="irrawaddy" label="Irrawaddy" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="myanmarexpress" label="Myanmar Express" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="nayhtunnaing" label="Nay Htun Naing" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="sawyannaing" label="Saw Yan Naing" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="theassociatedpress" label="The Associated Press" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="thevoice" label="The Voice" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="waiphyo" label="Wai Phyo" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="weeklyelevennewsjournal" label="Weekly Eleven News Journal" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[ <span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/blog.burma.2.11.ap.jpg"> <img alt="Kachin Independence Army soldiers guard an outpost in Northern Burma's Kachin-controlled region on January 31. Journalists who cover the conflict have been subject to email hacking attacks. (AP/Alexander F. Yuan)" onload="javascript:addCaption(this)" src="/internet/assets_c/2013/02/blog.burma.2.11.ap-thumb-400x267-4389.jpg" width="400" height="267" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" /> </a> </span><p class="MsoNormal">Cyberattacks on news websites and apparent government
hacking into journalists' email accounts have raised new questions about the
integrity of media reforms in Burma. <i style="mso-bidi-font-style:normal"><a href="http://www.nytimes.com/2013/02/11/world/asia/journalists-e-mail-accounts-targeted-in-myanmar.html?_r=1&amp;">The
New York Times</a></i> reported on Sunday that several journalists who
regularly cover Burma-related news recently received warning messages from
Google that their email accounts may have been hacked by "state-sponsored
attackers."</p>]]>
        <![CDATA[<p class="MsoNormal">Burma-based Associated Press reporter Aye Aye Win and
Thailand-based Swedish reporter Bertil Lintner both recently received the
Google warnings, according to <i style="mso-bidi-font-style:normal">The New
York Times</i> report. <i style="mso-bidi-font-style:normal"><a href="http://www.irrawaddy.org/">Irrawaddy</a></i> reporter Saw Yan Naing and <i style="mso-bidi-font-style:normal">Weekly Eleven News Journal</i> Executive Editor
Nay Htun Naing told CPJ that they, too, had recently been warned by Google that
their accounts may have been compromised. <o:p></o:p></p>

<p class="MsoNormal">All of the journalists have reported on the armed conflict
between ethnic guerillas and government forces in the country's northern Kachin
state, despite official attempts to bar reporting from the area. <i style="mso-bidi-font-style:normal">Weekly Eleven</i> was the first local
publication to report in late December that government forces had used air
power against rebel positions--news that sparked international condemnation of
the conflict's escalation. <o:p></o:p></p>

<p class="MsoNormal">While President Thein Sein's quasi-civilian administration
has loosened restrictions on the press--for example, ending pre-publication
censorship of newspapers and magazines last year--many local journalists and
editors remain skeptical about his government's commitment to press and
Internet freedoms. <o:p></o:p></p>

<p class="MsoNormal">The Electronic Act, a law used to prosecute and jail
journalists under the previous military junta, is still on the books and allows
for seven- to 15-year prison terms for receiving or sending information over
the Internet deemed a threat to state security, community peace and tranquility,
or national solidarity. &nbsp;&nbsp;<o:p></o:p></p>

<p class="MsoNormal">The <a href="/internet/2012/06/what-to-do-if-google-warns-of-state-sponsored-atta.php">Google
warning</a> said that "we believe that state-sponsored attackers may be
attempting to compromise your account or computer" and "It's likely that you
received emails containing malicious attachments, links to malicious software
downloads, or links to fake websites that are designed to steal your passwords
or other personal information."&nbsp;<o:p></o:p></p>

<p class="MsoNormal">The warnings follow cyberattacks against independent local
media. <i style="mso-bidi-font-style:normal">Weekly Eleven</i>'s website was
hacked and temporarily disabled on January 15 and 16, according to a February 5
memorandum of complaint, addressed to the National Press Council and copied to
Thein Sein, calling for an independent investigation into the attacks. The
letter, written by <i style="mso-bidi-font-style:normal">Weekly Eleven</i> Chief
Editor Wai Phyo and reviewed by CPJ, said the hackers identified themselves as
"Red Army Team." &nbsp;<o:p></o:p></p>

<p class="MsoNormal"><i style="mso-bidi-font-style:normal">The Voice</i>, another
local news publication, reported that anonymous hackers referring to themselves
as "MMFC" and "Anonymous Myanmar" infiltrated and posted unsanctioned
information to their Facebook page on February 4, according to the same
memorandum. <o:p></o:p></p>

<p class="MsoNormal">Exile-run media groups like <i style="mso-bidi-font-style:
normal">Irrawaddy</i> and Democratic Voice of Burma have been hit in the past
with anonymous distributed denial-of-service (DDoS) attacks that disabled their
websites at crucial news junctures, such as during the 2007 government
crackdown on Buddhist monk-led street protests. Government officials have
consistently denied responsibility for those attacks.<o:p></o:p></p>

<p class="MsoNormal">This time, however, there are significant leads that a truly
independent probe should actively pursue. In his complaint letter, Wai Phyo
noted that the military-aligned <i style="mso-bidi-font-style:normal">Myanmar
Express</i> in reports on its website rightly predicted the cyberattacks
against <i style="mso-bidi-font-style:normal">Weekly Eleven</i> and had
previously published the same information that was posted by hackers to <i style="mso-bidi-font-style:normal">The Voice</i>'s Facebook page. <o:p></o:p></p>

<p class="MsoNormal">"It is strongly suspected that the people representing <i style="mso-bidi-font-style:normal">Myanmar Express</i> website seem to be some
army officers with a hardline attitude and outlook who are collaborating with
some department that is displeased with ongoing democratization," Wai Phyo
wrote.<o:p></o:p></p>

<p class="MsoNormal">Burma's Ministry of Defense has chafed at critical
reporting, saying in a rare public statement on January 29 that international
organizations, embassies, and media were <a href="http://www.irrawaddy.org/archives/25414">"fabricating news"</a> about the
Kachin conflict. If peeved army officials are indeed responsible for the recent
cyberattacks, Thein Sein can make good on his reform vows by punishing them
under the law while allowing the media to report freely on the conflict without
fear of reprisal on the ground or in cyberspace. <o:p></o:p></p>]]>
    </content>
</entry>

<entry>
    <title>Drawing lessons from Chinese attacks on US media</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/02/drawing-lessons-from-chinese-attacks-on-us-media.php" />
    <id>tag:cpj.org,2013:/internet//19.21187</id>

    <published>2013-02-07T17:38:21Z</published>
    <updated>2013-02-07T17:54:43Z</updated>

    <summary> Not every media company is as tempting a target for hackers as The New York Times, The Washington Post, or The Wall Street Journal. Not every company can afford high-priced computer security consultants, either. Is there anything that everyday reporters and their editors can learn about protecting themselves, based...</summary>
    <author>
        <name>Danny O’Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="China" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="hacked" label="Hacked" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="thenewyorktimes" label="The New York Times" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="thewallstreetjournal" label="The Wall Street Journal" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="thewashingtonpost" label="The Washington Post" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="twitter" label="Twitter" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="wenjiabao" label="Wen Jiabao" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/nytimes.afp.jpg"> <img alt="The Times reported in January that it had succeeded in expelling hackers from its computer systems. (AFP/Emmanuel Dunand) " onload="javascript:addCaption(this)" src="/internet/assets_c/2013/02/nytimes.afp-thumb-400x220-4383.jpg" width="400" height="220" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 10px;" /> </a> </span><p>Not every media company is as tempting a target for
hackers as <i style="mso-bidi-font-style:normal">The New York Times</i>,<i style="mso-bidi-font-style:normal"> The Washington Post</i>, or <i style="mso-bidi-font-style:normal">The Wall Street Journal</i>. Not every
company can afford high-priced computer security consultants, either. Is there
anything that everyday reporters and their editors can learn about protecting
themselves, based on the revelatory details the <i style="mso-bidi-font-style:
normal">Times</i> and other targets made public last week?</p> ]]>
        <![CDATA[<p>As we <a href="/blog/2013/01/as-nyt-reports-china-hacking-know-your-digital-sec.php">wrote</a> at the time, the
cyber-attacks on the <i style="mso-bidi-font-style:normal"><a href="http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all&amp;_r=1&amp;">Times</a></i>, the <i style="mso-bidi-font-style:normal"><a href="http://articles.washingtonpost.com/2013-02-01/business/36685685_1_chinese-hackers-cyberattacks-mandiant">Post</a></i>, and the <i style="mso-bidi-font-style:normal"><a href="http://online.wsj.com/article/SB10001424127887323926104578276202952260718.html">Journal</a></i> came as no
surprise to foreign reporters working in <a href="/internet/2012/06/state-sponsored-attacks-open-season-on-online-jour.php">China</a> or <a href="/internet/2012/07/finfisher-journalists-danger-email.php">elsewhere</a> who
repeatedly face fake emails, custom malware, and hacking attacks on their
webmail. But the level of access that the hackers obtained at the <i style="mso-bidi-font-style:normal">Times</i>' main offices, and the publication
of details by their technical advisers, can be instructive.</p>

<p>The <i style="mso-bidi-font-style:normal">Times</i> <a href="http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all">revealed</a> that it had
been persistently attacked by hackers for four months. The attackers
specifically aimed for access to emails and contacts kept by reporters covering
the financial affairs of China's premier, Wen Jiabao, and his relatives. There
was no smoking gun indicating that this was the work of state-sponsored
hackers, but the <i style="mso-bidi-font-style:normal">Times</i>' security
experts, Mandiant, said the target, the techniques, and the timing of the
attacks strongly suggest it was planned by Chinese hackers working under the
guidance of the Chinese military.</p>

<p>The <i style="mso-bidi-font-style:normal">Post</i>
was later reported to be using the same company to fight off an attack that
began in 2011. The <i style="mso-bidi-font-style:normal">Journal</i> said the
FBI had warned them of a breach in their security in mid-2012. On Tuesday,
Rupert Murdoch, chairman of the paper's<i style="mso-bidi-font-style:normal"> </i>owner,
News Corp., tweeted that "[the] Chinese [are] still hacking us, or were over
[the] weekend."</p>

<p>The first lesson: Even if your employer has a
dedicated computer security detail (most do not), you should still make the
security of your own computer a personal matter. Hackers target the weakest
leak in order to enter a system, and do not differentiate between personal or
professional systems. <i style="mso-bidi-font-style:normal">The New York Times</i>
indicated in its report that the first breach was a personal "spear-phishing"
mail sent to a <i style="mso-bidi-font-style:normal">Times</i> employee on his
or her own computer. The most convincing of these attacks use personal details
gleaned from public sources or private intelligence. Be careful what email
attachments you open. Don't use the same password on different services, even
if one is professional and the other private. With the cracking of passwords
used by <i style="mso-bidi-font-style:normal">Times</i> employees on an
internal system, other accounts used by those employees elsewhere became
vulnerable, the <i style="mso-bidi-font-style:normal">Times</i> implied. Follow
<a href="/reports/2012/04/information-security.php">our advice</a> and <a href="https://safermobile.org/resource/mobile-security-survival-guide-for-journalists/">others</a> on developing
your own computer security regime.</p>

<p>Second, you should understand that hackers can gain
access to a great deal of incidental material, even when their attacks fail at
their goals. It is reassuring that even when the <i style="mso-bidi-font-style:
normal">Times</i> hackers were attempting to target investigators in China,
they were unable to penetrate the additional security those reporters used.
But, this same group now presumably has a large amount of other
information--including names, passwords, and personal information on other
reporters. Such information can be used in future attacks, or may be traded to
other groups with other targets. Twitter <a href="http://news.cnet.com/8301-1023_3-57567596-93/twitter-hack-may-have-targeted-elected-officials-journalists/">lost control</a> of the
(obfuscated) database holding the passwords and email addresses of its earliest
users this week. That information could be used as tradable knowledge for more
targeted attacks on reporters who re-used their Twitter passwords on other
services.</p>

<p>For now, these professional, advanced, and
persistent attacks are being conducted in cases of well-financed industrial
espionage or sophisticated state-level spying. But given the impunity with
which these hackers operate, it's only a matter of time before the data they
collect and the tactics they use will trickle down to common crooks or petty
dictators.</p>

<p>Which brings us to a third point. Both China and the
United States are now suspected of using malware and the illegal entry of
computer systems as tactics in their foreign policy. China spies on American
news media; the U.S. is assumed to have been behind StuxNet, a customized piece
of malware targeting the Iranian nuclear program.</p>

<p>There are no clearly defined international norms
that govern these practices. As China's Ministry of Defense <a href="http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all&amp;_r=0">told</a> <i style="mso-bidi-font-style:normal">The New York Times</i>, "Chinese laws
prohibit any action including hacking that damages Internet security," and
similar laws apply in Iran and the U.S. But if nations believe that they can
conduct these operations abroad against any target without consequence, in an
environment where all countries see hacking as legitimate statecraft, then
journalists will inevitably be among the many unprotected groups that will
suffer for it.</p>

<p>In the end, the only weapon journalists have to
defend themselves against such attacks is vigilance, and their most well-worn
weapon: transparency. <i style="mso-bidi-font-style:normal">The New York Times</i>,<i style="mso-bidi-font-style:normal"> Washington Post</i>, and <i style="mso-bidi-font-style:normal">The Wall Street Journal</i> all took an
important step when they began publicizing the attacks they have faced. They
can continue to help smaller media companies and individual reporters by publishing
more details, and pressuring governments to outlaw cyber-attacks as a tool of
international affairs.</p>]]>
    </content>
</entry>

<entry>
    <title>Yahoo HTTPS mail not a moment too soon, nor too late</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2013/01/yahoo-encrypted-mail-not-moment-too-soon--nor-too.php" />
    <id>tag:cpj.org,2013:/internet//19.20884</id>

    <published>2013-01-09T22:50:11Z</published>
    <updated>2013-01-09T23:12:56Z</updated>

    <summary>I remember sitting with a Yahoo employee in 2009, talking about the lack of protective encryption on Yahoo&apos;s Web mail accounts. Like many, the employee had been caught up in the news of how Iranians were using the Internet to document and protest the presidential elections in that country, and...</summary>
    <author>
        <name>Danny O’Brien/Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="encryption" label="Encryption" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="google" label="Google" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="journalistsecurity" label="Journalist Security" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="yahoo" label="Yahoo" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<p class="MsoNormal">I remember sitting with a Yahoo employee in 2009, talking
about the lack of protective encryption on Yahoo's Web mail accounts. Like
many, the employee had been caught up in the news of how <a href="/2010/02/attacks-on-the-press-2009-iran.php"><span class="InternetLink">Iranians were using the Internet</span></a> to document and
protest the presidential elections in that country, and had grown worried about
the possibility of governments intercepting Yahoo customer's emails without due
process. As an immigrant from a repressive regime, he told me, he was aware of how
much danger this posed. He said he was going to raise the topic internally.</p>]]>
        <![CDATA[<p class="MsoNormal">A year later, I met him again. Turning on "https" or secure sockets
layer (SSL) encryption for Yahoo Mail, it was clear, was going to be a fairly
major undertaking. The infrastructure that Yahoo had built to cope with
millions of users was not easy to convert to support "https" connections. He
had heard that the proposal reached board level before being put to one side. His
company, he felt, had let him down.</p>

<p class="MsoNormal">Three years later, Yahoo has a new board, and a new chief
executive. Within the <a href="/2008/10/cpj-joins-launch-of-global-network-initiative.php"><span class="InternetLink">Global Network Initiative</span></a> and without, human
rights groups had <a href="https://www.eff.org/document/letter-marissa-mayer"><span class="InternetLink">repeatedly</span></a> <a href="https://www.accessnow.org/page/s/protectourprivacy"><span class="InternetLink">encouraged</span></a> Yahoo to protect its mail users from
spying. Late last year, <a href="https://twitter.com/danny_at_cpj/status/277157398412677120"><span class="InternetLink">we got word</span></a> from Yahoo that they were
experimentally rolling out SSL as an option. Last week, the company quietly revealed
its availability to all users. <o:p></o:p></p>

<p class="MsoNormal">I can't say that the change in priorities came about as a
direct result of Yahoo's new leadership, but its CEO freely acknowledged that
public pressure <a href="https://twitter.com/marissamayer/status/287936644156366848"><span class="InternetLink">played a role</span></a>.<o:p></o:p></p>

<blockquote class="twitter-tweet" data-in-reply-to="287337653576278016"><p>@<a href="https://twitter.com/dangillmor">dangillmor</a> Thanks, Dan!Twitter spoke and we listened.This was very important and we're doing our best.More to come...</p>&mdash; marissamayer (@marissamayer) <a href="https://twitter.com/marissamayer/status/287936644156366848" data-datetime="2013-01-06T15:00:20+00:00">January 6, 2013</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script><p class="MsoNormal">The announcement was quickly buried in more bad news for
Internet security, however. Google <a href="http://googleonlinesecurity.blogspot.com/2013/01/enhancing-digital-certificate-security.html"><span class="InternetLink">announced Thursday</span></a> that users in Turkey were
being tricked into using a fake certificate for their connections to Google's
own email and other secure services. The trick being used is one that could
potentially remove the protection of any "https" site. Then on Monday, reports
came through of <a href="http://lifehacker.com/5973937/new-exploit-affecting-yahoo-mail-users-dont-click-anything-suspicious"><span class="InternetLink">a new, unconnected, security vulnerability</span></a> in
Yahoo Mail. <o:p></o:p></p>

<p class="MsoNormal">In the face of flaws both in Yahoo's software and the nature
of the SSL infrastructure itself, is there any value to Yahoo's change of heart,
and to the effort put into switching to an encrypted service?<o:p></o:p></p>

<p class="MsoNormal">I'd strongly argue that there is. The computer security
staff at large Internet companies have a good idea of the sort of attackers
from which they need to protect users, and strategies they can use to do so.
That list of common foes won't be the same as the attackers that dissident and
independent journalists fear. Yahoo and Google expect cybercriminals, not local
law-enforcement or corrupt officials. But many of the protections that Internet
companies can erect to protect the general consumer can also protect vulnerable
reporters.<o:p></o:p></p>

<p class="MsoNormal">Google quickly spotted the fraudulent certificate and
publicly warned companies like Apple, Mozilla, and Microsoft to identify and
reject it. Yahoo fixed the temporary flaw in its software. Both of these steps
protected the general userbase--and it protected the most vulnerable users.<o:p></o:p></p>

<p class="MsoNormal">The best security measures are the ones which protect all
users, from all attacks. Sometimes companies cannot commit to such a high level
of protection. But the average user is better served when they do.<span style="mso-spacerun:yes">&nbsp; </span>If you advocate for that level of protection,
you're also helping those who might face more determined and more powerful
adversaries. And there is the side-effect of respecting the wishes of your most
diligent employees: those who speak up on behalf of your customers.<o:p></o:p></p>

<p class="MsoNormal"><o:p></o:p></p><p>In the meantime, whether you're a reporter under a
repressive regime or any other Yahoo mail user, you should <a href="http://nakedsecurity.sophos.com/2013/01/08/yahoo-mail-https-ssl"><span class="InternetLink">turn on SSL encryption now</span></a><span class="InternetLink">.</span> And <a href="http://thenextweb.com/insider/2013/01/07/yahoo-mail-users-hit-by-widespread-hacking-xss-exploit-seemingly-to-blame/"><span class="InternetLink">don't click on any strange links</span></a>.</p>]]>
    </content>
</entry>

<entry>
    <title>China&apos;s name registration will only aid cybercriminals</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/12/chinas-name-registration-will-aid-not-hinder-cyber.php" />
    <id>tag:cpj.org,2012:/internet//19.20855</id>

    <published>2012-12-28T22:24:20Z</published>
    <updated>2012-12-28T22:37:16Z</updated>

    <summary> China&apos;s mounting crackdown on online news dissemination took an extra step today, when the country&apos;s Standing Committee of the National People&apos;s Congress, its de facto legislative body, announced new requirements on Internet service providers and mobile phone companies to identify their users. The new rules would potentially allow ISPs...</summary>
    <author>
        <name>Danny O’Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="China" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="censored" label="Censored" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="cybercrime" label="Cybercrime" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="socialmedia" label="Social Media" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/china.internet.12.28.AP.jpg"> <img alt="China's new Communist Party leaders are increasing already tight controls on Internet use. (AP/Alexander F. Yuan)" onload="javascript:addCaption(this)" src="/internet/assets_c/2012/12/china.internet.12.28.AP-thumb-400x252-4308.jpg" width="400" height="252" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" /> </a> </span><p class="MsoNormal">China's mounting crackdown on online news dissemination took
an <a href="http://www.nytimes.com/2012/12/29/world/asia/china-toughens-restrictions-on-internet-use.html?pagewanted=allan">extra
step</a> today, when the country's Standing Committee of the National People's
Congress, its de facto legislative body, announced new requirements on Internet
service providers and mobile phone companies to identify their users. The new
rules would potentially allow ISPs and the authorities to more closely tie real
identities to posts and commentary on micro-blogging sites like Weibo, as well
as connect text messaging and mobile phone conversations to individuals.<o:p></o:p></p> ]]>
        <![CDATA[<p class="MsoNormal">The announcement follows a series of new restrictions on
Internet access in the country, including the blocking of virtual private
network (VPN) connections used to evade the "Great Firewall;" the blocking of major
foreign news sites' reporting on Chinese leaders; and censoring <a href="http://blog.feichangdao.com/2012/12/how-other-websites-are-censoring.html">discussions
on domestic social media</a>. The timing of the new steps is particularly
troubling to those who anticipated that restrictions would ease after the Communist
Party's National Congress in November, where new leaders were appointed, <i style="mso-bidi-font-style:normal">The New York Times </i>notes<i style="mso-bidi-font-style:normal">.</i><o:p></o:p></p>

<p class="MsoNormal">Demanding real names for mobile phone users and even websites
is not unique to China, but it seems unlikely that the reasons that the Chinese
authorities gave--to protect against cybercriminals--are the entirety of the
thinking behind the ruling.<o:p></o:p></p>

<p class="MsoNormal">"Nowadays on the Internet there are very serious problems
with citizens' personal electronic information being recklessly collected, used
without approval, illegally disclosed, and even traded and sold," the<i style="mso-bidi-font-style:normal"> Times</i> quoted a member of the Standing
Committee as saying.<o:p></o:p></p>

<p class="MsoNormal">But China's new rules will hardly improve matters. In fact,
real identity systems exacerbate the problem, by requiring users to upload the
identity information and documents that others can use to commit fraud.<o:p></o:p></p>

<p class="MsoNormal">South Korea passed a law in 2004 requiring all forums to
collect the state resident registration numbers (the equivalent of a U.S. Social
Security number) of their users. In August 2011, hackers broke into the system
used to verify the numbers, and obtained the personal details, including the resident
registration numbers, of 35 million people, around 70% of the entire
population. The companies involved blamed Chinese hackers. The rule was later
struck down by the Korean Supreme Court as <a href="http://online.wsj.com/article/SB10000872396390444082904577606794167615620.html">an
unconstitutional restraint</a> on free speech. In 2010, Mexico retroactively
required all of its mobile phone users to provide their personal details with
the carrier. Shortly after the deadline for registration passed, copies of the
official databases--including the names and home addresses of police officers--were
<a href="http://articles.latimes.com/2010/may/12/world/la-fg-mexico-data-20100512">found
for sale</a> at Mexico City's Tepito flea market.<o:p></o:p></p>

<p class="MsoNormal">China's state media attempted to head off critics of the new
policy, while conceding that it would be used to target online conversations. "Reports
state that the identity policy will clamp down on the freedom of speech in
Chinese cyberspace," <a href="http://news.xinhuanet.com/english/indepth/2012-12/28/c_132069782.htm">said</a>
China's English-language Xinhua News Agency, "But the accusers should know that
freedom without limits or responsibility is chaotic and dangerous... The rule
should only be feared by slanderers who wish to take advantage of online
anonymity."<o:p></o:p></p>]]>
    </content>
</entry>

<entry>
    <title>In Internet freedom fight, why the ITU matters (for now)</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/12/why-the-itu-matters.php" />
    <id>tag:cpj.org,2012:/internet//19.20805</id>

    <published>2012-12-14T17:39:49Z</published>
    <updated>2012-12-14T18:47:27Z</updated>

    <summary> For most of its almost-150-year history, the meetings of the International Telecommunication Union (ITU), the United Nations&apos; communications standards body, have been rather predictable affairs....</summary>
    <author>
        <name>Danny O&apos;Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="internationaltelecommunicationunion" label="International Telecommunication Union" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <img alt="Hamdoun Toure, ITU secretary general, speaks at the group's conference in Dubai. (AP/Kamran Jebreili)" onload="javascript:addCaption(this)" src="/internet/ITU.ap1.jpg" width="400" height="231" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" /></span><p class="MsoNormal">For most of its almost-150-year history, the meetings of the
International Telecommunication Union (ITU), the United Nations'
communications standards body, have been <a href="http://www.itu.int/en/history/Pages/home.aspx">rather predictable affairs</a>.</p>]]>
        <![CDATA[<p>Representatives of the world's governments regularly gather to sign off on technical recommendations drafted by the technocrats of telephone companies and government bureaucrats. The diplomats would then return home to encode the minutiae of the regulations into their governments' communications policies. Less frequently the same officials met to renegotiate the terms and scope of the ITU's work, to take into account new telecommunications innovation (like&nbsp;<a href="http://www.itu.int/en/history/Pages/LandmarkDates.aspx" style="text-decoration: underline; ">radio or television</a>) that may have come into view. It's a meticulous and slow-moving body of international technical co-operation which for over a century has ensured that radio stations don't interfere with each other, communication satellites pass safely in the night, and that telephone lines in one country can seamlessly connect to those in another.</p><p class="MsoNormal">The work behind such standards and definitions, however, has
a far wider effect than just fine-tuning our communication devices.
Telecommunications standards shape the media they describe, and can influence
how free those media are. As long as the majority of media passes through
cables and between aerials, the outcome of these technical arguments will have
a serious knock-on effect on press freedom. </p>

<p class="MsoNormal">This week's ITU meeting in Dubai was intended to be another
uncontroversial renegotiation of its organizing principles, the <a href="http://news.dot-nxt.com/itu/wcit/itr/all">International<span style="mso-spacerun:yes">&nbsp;T</span>elecommunication Regulations</a><span style="mso-spacerun:yes">&nbsp; </span>or ITRs. Instead, deep divides emerged, with <a href="http://news.dot-nxt.com/itu/wcit/itr/all">the United States</a> and at
least a dozen other countries (out of 193 member states) exercising their strongest
sanction by refusing to sign the ITU's final document. <o:p></o:p></p>

<p class="MsoNormal">At the heart of the dispute was the belief, on the U.S.
side, that the ITU <a href="http://www.washingtonpost.com/world/national-security/us-refuses-to-back-un-treaty-saying-it-endorses-restricting-the-internet/2012/12/13/ba497952-4548-11e2-8e70-e1993528222d_story.html">should
not get involved in Internet regulation</a>; and the insistence of others that
the ITU has a role to play in management of the Net.<o:p></o:p></p>

<p class="MsoNormal">The Internet has a long history of ruffling feathers at the
ITU. Here's a journalist's report from <a href="http://books.google.com/books?id=E2BdY6WQo4AC&amp;lpg=PA159&amp;vq=heated%20international%20argument&amp;dq=%22heated%20international%20argument%22&amp;pg=PA159#v=snippet&amp;q=heated%20international%20argument&amp;f=false">an
earlier spat</a>, back in 1976:<o:p></o:p></p>

<blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><p>There is a heated international
argument over who will control packet-switched communication networks--the
carriers or the users... Many multi-terminal users believe they can maximize
the benefit of packet service only by employing end-to-end communication
protocols... This contention makes the carriers livid and helps explain why the
argument was gathering heat at the Geneva [ITU] meetings.</p></div></blockquote><div><p><o:p></o:p></p>

<p class="MsoNormal">That was a description by Phil Hirsch of <i style="mso-bidi-font-style:normal">Datamation</i> of the first conflict between
the young advocates for what became the Internet, and the ITU's own standard
designers. <o:p></o:p></p>

<p class="MsoNormal">The fight then reflects the fight now. The ITU is run by
governments, who at that time mostly directly controlled their countries'
telephone networks through state-owned telephone companies ("the carriers").
Back in 1976, the ITU's in-house design for the future was a protocol called
X.25. It assumed the future of the new digital network would be similarly, centrally
controlled by the same state-run telephone companies. <o:p></o:p></p>

<p class="MsoNormal">The United States' ARPANET TCP/IP protocol, designed by <a href="http://internethalloffame.org/inductees/vint-cerf">Vint Cerf</a>'s team
of academics and sponsored by the U.S.<span style="mso-spacerun:yes">&nbsp;
</span>military, was the competition. It was an "end-to-end communication
protocol," which meant the power and responsibility for almost every aspect of
how data was sent and received shifted to end-users instead.<o:p></o:p></p>

<p class="MsoNormal">The ITU lost that battle. The users, it seemed, wanted more
control. TCP/IP dominates our packet-switched Internet, not the ITU's X.25
protocol. <o:p></o:p></p>

<p class="MsoNormal">As a consequence, the descendants of those "carriers" ended
up losing a great deal of power over what passes over their digital networks.
Indeed, everyone lost the ability to control the flow of information online.
Countries like China have policies explicitly in place to limit and filter
Internet news, but they are often stymied by Internet users' ability to adopt
new software and web platforms, and the network's resistance to central
mandates. All of that slipperiness, so useful to fight censorship and propagate
the news, comes from the network's decentralized design and TCP/IP's triumph
over more centralized protocols like X.25.<o:p></o:p></p>

<p class="MsoNormal">The incentives and biases that made X.25 the ITU's favorite
protocol are still present today. The ITU remains the exclusive domain of
governments, advised by large incumbent telecommunications companies. Its
deliberations have traditionally taken place <a href="https://www.eff.org/deeplinks/2012/05/hey-itu-member-states-no-more-secrecy-release-wcit-documents-0">behind
closed doors</a> , with a limited set of participants invited by governments.
At best, its delegates prefer carefully documented, precisely controlled, and
universally proven approaches. At worst, its technical decisions are
disproportionately influenced by the authoritarian bent of some participating
nations, including countries unfriendly to press freedom such as Saudi Arabia,
China, and the United Arab Emirates.<o:p></o:p></p>

<p class="MsoNormal">What standards govern the wider Internet, by contrast, have
always been more free-wheeling. The process in its own informal standards
bodies is sometimes chaotic, and often bypassed entirely. There's no Internet
standard or oversight board for Skype, for instance. BitTorrent, one of the
most popular protocols online due to its use in sharing large (often
copyright-infringing) files, has never been near a standards body. <o:p></o:p></p>

<p class="MsoNormal">But no one compels anyone to use Skype or BitTorrent, nor
the more official standards of the Internet and the Web. And no international
organization exists that might suggest that users should not be allowed to use
those protocols. The users' choices take precedence.<o:p></o:p></p>

<p class="MsoNormal">The <a href="http://www.internetcoup.org/en/">fear among Internet<span style="mso-spacerun:yes">&nbsp; </span>freedom advocates</a><span style="mso-spacerun:yes">&nbsp; </span>was that by having the ITU assume some of
the<span style="mso-spacerun:yes">&nbsp; </span>roles of defining the protocols of
the Internet, arguments for more direct<span style="mso-spacerun:yes">&nbsp;
</span>government control would trump those offering more flexibility or
freedoms. <o:p></o:p></p>

<p class="MsoNormal">The past 12 days in Dubai showed that to be the case.
Telephone companies lobbied to <a href="http://arstechnica.com/business/2012/12/dear-itu-please-dont-bill-internet-use-like-phone-calls/">up-end
the pricing system</a> of the Net. A proposal to <a href="http://news.cnet.com/8301-13578_3-57558910-38/u.n-summit-derailed-over-human-rights-controversy/">encode
human rights obligations</a> into the organization's charter failed after
objections from China, Algeria, and Iran. Finally, <a href="https://www.cdt.org/blogs/ellery-biddle/1212wcit-watch-day-10-definitely-about-internet">a
late-night act of procedural sleight-of-hand</a> led to clauses about the
Internet being pasted into the proposed treaty. By the final day, several
countries, including the U.S., the United Kingdom, Australia, Kenya, and India,
declined to sign the end result.<o:p></o:p></p>

<p class="MsoNormal">If the leadership of the ITU was serious about taking more
control over Internet affairs, its plan failed. In the wake of the ITU's split
vote, the Internet remains as loosely coordinated and user-driven by default as
it has always been.<o:p></o:p></p>

<p class="MsoNormal">That's not a universally positive result for online press
freedom. While all the countries<span style="mso-spacerun:yes">&nbsp;
</span>declining to sign the ITU treaty cited control of the Internet as the
reason,<span style="mso-spacerun:yes">&nbsp; </span>academic Milton Mueller has <a href="http://www.internetgovernance.org/2012/12/13/what-really-happened-in-dubai/">suggested
that another proposal</a> , requiring countries to provide "non-discriminatory
access to modern<span style="mso-spacerun:yes">&nbsp; </span>telecommunications,"
might have inspired the United States' <span style="mso-spacerun:yes">&nbsp;</span>ire.
The resolution, a sore point for years, was prompted by <a href="http://www.internetgovernance.org/wordpress/wp-content/uploads/Res69incidentsSudan.pdf">the
effects</a> of the U.S. sanctions on Internet availability in the Sudan. Other
proposals in the ITU document, including on transparency and notification about
<a href="http://wcit-proposals.info/article-7/">the use of Internet "kill
switches"</a>, would have promoted connectivity in the face of government
suppression, not limited it.<o:p></o:p></p>

<p class="MsoNormal">And Internet regulation is not all sweetness and light
without the ITU. Many countries suspected the U.S. of wanting to maintain
control of the domain name system through its support for ICANN, the American
private company that manages the more central elements of the domain name
infrastructure. The ITU may be secretive, but by comparison ICANN is <a href="http://www.icannwatch.org/">positively opaque</a>, and continues to lack
the international involvement that the ITU can genuinely boast. As <a href="http://www.ethanzuckerman.com/blog/2012/12/05/good-and-bad-reasons-to-be-worried-about-wcit/">Ethan
Zuckerman notes</a>, the Internet is not perfect as it is, and lacks obvious
ways to change for the better.<o:p></o:p></p>

<p class="MsoNormal">But perhaps the most worrying potential future for the Internet
will happen whether the ITU is able to<span style="mso-spacerun:yes">&nbsp;
</span>recover from this diplomatic collapse or not. <o:p></o:p></p>

<p class="MsoNormal">For 35 years, Internet advocates' concerns with the ITU have
been with its dominant voices:<span style="mso-spacerun:yes">&nbsp;
</span>governments and their closely associated incumbent telecom
companies.<span style="mso-spacerun:yes">&nbsp; </span>In the next decade, a large
part of end-user Internet traffic <a href="http://www.brookings.edu/research/papers/2011/12/08-mobile-broadband-west">will
be shifting to mobile broadband devices</a>.<span style="mso-spacerun:yes">&nbsp;
</span>Mobile networks are largely run by those same incumbent telcos. Their
networks are heavily regulated and controlled by local governments. Mobile
companies are free to block protocols like Skype, censor websites, and spy on
their users, with little oversight or global condemnation. It would be a
tragedy if the pioneers of the Internet fought off the slow-moving bureaucratic
threat of the ITU, only to lose control of their ideals to those same forces in
the fast-moving and unregulated wilds of the mobile Internet. Their victory at
the ITU would be pyrrhic; and the real losers would be journalists and their
audiences, reading news on a mobile but spied-upon and censored Internet.<o:p></o:p></p></div>]]>
    </content>
</entry>

<entry>
    <title>Syria&apos;s desperate move to cut links won&apos;t succeed</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/11/syrias-desperate-move-to-cut-communication-wont-su.php" />
    <id>tag:cpj.org,2012:/internet//19.20724</id>

    <published>2012-11-30T18:52:15Z</published>
    <updated>2012-11-30T19:57:53Z</updated>

    <summary><![CDATA[ The Syrian Internet, like the country, appears to have been collapsing into a patchwork of unconnected systems for some time. I spent time talking to Syrians&nbsp;tech activists this week in Tunisia before Thursday's shutdown, and their reports from the front painted a picture of two different networks....]]></summary>
    <author>
        <name>Danny O’Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Syria" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="basharalassad" label="Bashar al-Assad" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/Syria.blog.11.30.AP.jpg"> <img alt="This image provided by Edlib News Network shows an anti-Syrian regime protester holding up a placard reading: 'the victory fingers over the Place (the presidential palace),' during a demonstration at Binnish village, Idlib province, on Friday. (AP/Edlib News Network ENN)" onload="javascript:addCaption(this)" src="/internet/assets_c/2012/11/Syria.blog.11.30.AP-thumb-400x270-4185.jpg" width="400" height="270" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" /> </a> </span><p class="MsoNormal">The Syrian Internet, like the country, appears to have been
collapsing into a patchwork of unconnected systems for some time. I spent time talking to Syrians&nbsp;<a href="http://openitp.org/?q=cts_tunis_nov_2012">tech activists this week</a> in Tunisia before Thursday's <a href="/2012/11/syria-must-restore-internet-immediately.php">shutdown</a>, and their reports from the front painted a picture of two different networks.</p>]]>
        <![CDATA[<p class="MsoNormal">In government-controlled regions, they said, the Internet was available, but heavily controlled. Cybercafés had mandatory ID requirements, video cameras trained on screens and visitors, and keystroke loggers whose contents were collected daily by security personnel. At checkpoints, Assad forces were said to be visually checking laptops for programs like Tor and TrueCrypt that would allow users to get around the government controls.</p><p class="MsoNormal">In the rebel-controlled areas, Internet connectivity was
shut down, and almost all external digital communication was via satellite
phone. Rebels have seized cell towers, the activists told us, but are
struggling to establish their own communications services.<o:p></o:p></p>

<p class="MsoNormal">Nonetheless, there's a profound difference between the Assad
regime's previous policy of attempting to control the flow of news and
information from Syrians to the outside world, and within rebel controlled
regions, and Thursday's mass shutdown, which was still in effect Friday. The
evidence from companies like <a href="http://blog.cloudflare.com/how-syria-turned-off-the-internet">Cloudflare</a>
and <a href="http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml">Renesys</a>
shows that Syria followed the same kill switch procedure as Egypt--an orderly <a href="/internet/2011/01/watching-egypt-disappear-from-the-internet.php">shutdown
of almost routes within the country</a>, managed by the government's continuing
control over the edge routers that announce those pathways to the outside
world.<o:p></o:p></p>

<p class="MsoNormal">As it was in Egypt, this is a <a href="/internet/2011/02/what-the-world-loses-from-egypts-internet-disappea.php">desperate
act</a>. Killing the entire Internet stops Assad's allies from using it--as
they have with some effect, intercepting unencrypted communications and
distributing malware to opposition activists. It prevents not just anti-Assad
propaganda from leaving the country, but any information at all. It suspends
modern business communication, and any reporting.<o:p></o:p></p>

<p class="MsoNormal">No news, they say, is good news. But if a regime has so lost
control of its country that suspending any and all communications is better
than permitting even the smallest peep of objective reporting to escape its
grip: well, as Egypt showed, that has to be bad news for that regime.<o:p></o:p></p>

<p class="MsoNormal">And even such drastic steps are not going to prevent the
news from escaping Syria.<o:p></o:p></p>

<p class="MsoNormal">Even before the cut-off, there were plenty of witnesses
smuggling video and reports out of Syria using USB sticks. The jamming of
satellite phones is used but not ubiquitous, activists say. The reception areas
of mobile phone networks in Syria's neighboring countries reach past their
borders. Syria's technical community inside and outside the country were
already working on alternatives to the state Internet infrastructure, and that
work goes on--mesh networks, dial-up systems, and satellite phone media
centers. None of these will be able to replace the economic and social
functions of a fully-functioning Internet. But they will be used by reporters
and citizen journalists to uncover the truth. That function of an open society,
at least, will not be stopped by an Internet kill switch.<o:p></o:p></p>]]>
    </content>
</entry>

<entry>
    <title>Dear CPJ: Some malware from your &apos;friend&apos;</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/08/dear-cpj-some-malware-from-your-friend.php" />
    <id>tag:cpj.org,2012:/internet//19.20342</id>

    <published>2012-08-30T20:32:23Z</published>
    <updated>2012-09-04T18:10:37Z</updated>

    <summary> We talk a lot about hacking attacks against individual journalists here, but what typifies an attempt to access a reporter&apos;s computer? Joel Simon, CPJ&apos;s executive director, received an email last week that reflects some characteristics of a malware attack against a journalist or activist. There was nothing particularly notable...</summary>
    <author>
        <name>Danny O&apos;Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="article19" label="Article 19" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="blogger" label="Blogger" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="cyberattack" label="Cyberattack" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="cybercrime" label="Cybercrime" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="hacked" label="Hacked" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="socialmedia" label="Social Media" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="worldpressfreedomcommittee" label="World Press Freedom Committee" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/internet.malware.rtrs.jpg"> <img alt="An analyst looks at malware code in a lab. (Reuters/Jim Urquhart)" onload="javascript:addCaption(this)" src="/internet/assets_c/2012/08/internet.malware.rtrs-thumb-400x225-3984.jpg" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 10px;" height="225" width="400" /> </a> </span><p>We
talk a lot about hacking attacks against individual journalists here, but what typifies
an attempt to access a reporter's computer? Joel Simon, CPJ's executive
director, received an email last week that reflects some characteristics of a
malware attack against a journalist or activist. There was nothing particularly
notable about the targeting. (Like many reporters, CPJ receives such attempts
occasionally). The attack failed at the first fence, and my casual
investigation into the source was inconclusive. There are no shocking answers
or big headlines to draw from this attack. But it does illustrate a
contemporary reality: Opportunistic assailants regularly shower journalists with
software attacks.</p> ]]>
        <![CDATA[<p>The
email was marked as being from "Rony Kevin," a misspelling of Rony
Koven, who works with the <a href="http://www.wpfc.org/">World Press Freedom Committee</a>, a partner
press freedom organization. The originating Yahoo account wasn't his, of course;
the attackers had no connection with Koven at all.<o:p></o:p></p>

<p>The
subject of the mail was "Fw: Journalists arrested in Gambia," and the
content of the mail was boilerplate text about reporters who had been recently
imprisoned, followed by "Please review the attachments for more
information." The text was actually copied and pasted from this <a href="http://www.article19.org/resources.php/resource/3397/en/the-gambia:-arresting-and-detaining-court-reporters-damages-public-trust-in-the-judiciary">Article 19 alert</a>. The text promised more
information in an attached ZIP file, called "Details," which it said
was password encoded with the letters "CPJ."</p>

<p>CPJ
staffers are, as you might imagine, extremely cautious about opening strange
attachments, but, after the mail had been quarantined, and in a suitably safe
computing environment, I took a closer look at the attachments' contents. Out
of the five documents in the Details.zip file, one was a text copy of the
Article 19 article, three were accompanying pictures of the Gambian journalists--and
one file was a Windows program, disguised as an image, which would have
starting running if anyone clicked on it. (It would probably have also
triggered several dozen anti-virus Klaxxon warnings, but some people don't use
anti-virus software or ignore it.)</p>

<p>Taking
a closer look at that executable with some simple analysis tools, it was clear
that the real job of the program was to unpack a piece of malware, stick it
somewhere innocuous on the computer, and set it up to run automatically in the
future. The unpacking code was a standard utility, with some comments in
Chinese. At this point, I handed the file over to security researcher <a href="http://citizenlab.org/author/mmboire/">Morgan
Marquis-Boire</a> to see what he could make of it. Morgan let me know
that the file was indeed malware and, when started, began communicating with a
machine in Indonesia. I've mailed the administrators of that machine, but as
usual, they did not reply. For now, the trail has run cold.</p>

<p>What
can we learn from this attack? The fake identity of the email's source and the
content about Gambian journalists suggest that somebody had dedicated some time
to understanding CPJ, its interests, and its network of partners. This is all
evidence of "spear-phishing"--a person or group targeting a particular
individual or organization, rather than the usual fraudsters and spammers
attempting to exploit hundreds or thousands of generic Internet users. Whoever
sent this wanted access to CPJ's computers in particular, and was willing to spend
at least some resources obtaining information that would make their emails
convincing to us, and perhaps other international press freedom groups like the
World Press Freedom Committee and Article 19.</p>

<p>The
encryption of the Zip file was a smart way to get past the simplest anti-virus
software. Anti-virus software that runs automatically wouldn't know the
password so it would not be able to automatically unzip the attachment and look
inside for trouble. The personalized password also helps make the email seem
more genuine.</p>

<p>The
Chinese language in the executable means that this malware has come from a
toolkit that used Chinese elements. There are plenty of Russian and Chinese
tools floating around the international computer underground, however. You
might not need to speak Chinese to use a piece of software with Chinese
comments embedded within it, so I don't think you can draw many conclusions
from that.</p>

<p>Neither
can you draw much from the use of an Indonesian command-and-control center.
Just because the first stop for information sent from the infected computer is
Jakarta, that doesn't mean that it's the final destination. That machine is
undoubtedly an innocent system, taken over remotely by the attackers, and used
as a convenient middleman for their activities.</p>

<p>So
we don't have much information about the specific identity of the hackers. We
do know, however, that they exist: This isn't an attacker who particularly
cares to cover his tracks and doesn't mind too much if the attack fails.</p>

<p>The
software is generic, and could have been obtained by anyone interested in
conducting an attack. There's nothing that shouts state actors here, except
perhaps for the target. There aren't many other reasons to spend time
specifically targeting press freedom groups, unless you are able to sell
control of their computers to a third party who cares to disrupt or monitor
their activities.</p>

<p>Who
are those third parties? Whoever they are, their tactics are illegal in most
countries. And their long-term targets are surely not NGOs like ours, but the
journalists we seek to defend.</p>]]>
    </content>
</entry>

<entry>
    <title>Weak cyber protections lead to personal, institutional risk</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/08/weak-cyber-protections-lead-to-institutional-perso.php" />
    <id>tag:cpj.org,2012:/internet//19.20235</id>

    <published>2012-08-06T22:14:27Z</published>
    <updated>2012-08-06T22:22:02Z</updated>

    <summary>The Syrian civil war is also a propaganda war. With the Assad regime and the rebels both attempting to assure their supporters and the world that they are on the brink of victory, how the facts are reported has become central to the struggle. Hackers working in support of Assad...</summary>
    <author>
        <name>Danny O&apos;Brien/CPJ Internet Advocacy Coordinator </name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Syria" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="apple" label="Apple" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="basharalassad" label="Bashar al-Assad" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="blogger" label="Blogger" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="gizmodo" label="Gizmodo" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="mathonan" label="Mat Honan" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="reuters" label="Reuters" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="twitter" label="Twitter" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<p class="MsoNormal">The Syrian civil war is also a propaganda war. With the
Assad regime and the rebels both attempting to assure their supporters and the
world that they are on the brink of victory, how the facts are reported has
become central to the struggle. Hackers working in support of Assad loyalists
this week decided to take a shortcut, attacking the Reuters news agency's <a href="http://www.reuters.com/article/2012/08/03/net-us-reuters-syria-hacking-idUSBRE8721B420120803">blogging
platform</a> and one of its <a href="http://www.reuters.com/article/2012/08/06/net-us-reuters-syria-hacking-idUSBRE8721B420120806">Twitter
accounts</a>, and <a href="http://redtape.nbcnews.com/_news/2012/08/03/13106396-reuters-hacked-twice-in-48-hours-pro-syrian-government-stories-tweets-posted">planting
false stories</a> about the vanquishing of rebel leaders and wavering support
for them from abroad.<o:p></o:p></p> ]]>
        <![CDATA[<p class="MsoNormal">The stories and tweets were unconvincing, and none spread
much further than their home sites. The <a href="http://topsy.com/twitter.com/reutersme/status/231983945250648064">majority
of readers</a> disseminating the repurposed Twitter stream appeared to be Assad
partisans, either keen to spread the misconceptions or to believe them
themselves.<o:p></o:p></p>

<p class="MsoNormal">The attacks demonstrate, however, how media institutions are
at risk of targeted attacks by <a href="/internet/2011/06/syrias-assad-gives-tacit-ok-to-online-attacks-on-p.php">state-supported</a>
electronic activists--and that hackers will attempt to leverage the outlying
parts of a large organization to take wider control, or at least the appearance
of wider control.<o:p></o:p></p>

<p class="MsoNormal">Neither Reuters' blogging site nor its minor Twitter accounts
feed the company's authoritative wire service, but as a consequence they may
not have the same levels of heavy protection against misuse. A weak password
used by a single person could have granted an outsider the power to post
publicly to either service.<o:p></o:p></p>

<p class="MsoNormal">Even when a hacker's target is an individual journalist and
not his or her media organization, things can escalate to affect the
institutions journalists work for. When the tech reporting site <i style="mso-bidi-font-style:normal">Gizmodo</i>'s Twitter account was taken over
on Friday, it was through an attack on <a href="http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard">one of
its former reporters, Mat Honan</a>. <i style="mso-bidi-font-style:normal">Gizmodo</i>'s
reporting has <a href="/blog/2010/05/apple-gizmodo-case-takes-a-bite-out-of-global-jour.php">made
it unpopular</a> in some quarters, but Honan says that he was the target, and
that <i style="mso-bidi-font-style:normal">Gizmodo</i> was "collateral
damage." His Twitter account was linked to <i style="mso-bidi-font-style:
normal">Gizmodo</i>'s corporate account, and the attackers used one to post to
the other.<o:p></o:p></p>

<p class="MsoNormal">Honan's story should give anyone pause about their own
digital safety, especially if they rely on external companies. His Twitter
account was taken over by a hacker who persuaded a tech support line operator
to reset the password to his Apple account. The attacker used this account to
change his linked Gmail and Twitter account information, and then proceeded to
use the "remote wipe" feature on the latest Apple iPhone and laptops
to disable and delete the content of his phone, iPad and Macbook. As a
freelancer, Honan did not have offline backup of his work. (Honan says he is
waiting for a response from Apple the company; meanwhile, Apple tech support is helping
with damage control).<o:p></o:p></p>

<p class="MsoNormal">Honan has corresponded with an individual who claims to be
his hacker, and says that the real intent of the compromise was his <a href="http://www.twitter.com/mat">three-letter Twitter account</a>. Whether
it's by common cybercriminals or state-supported propagandists, journalists are
being targeted as individuals. The organizations that employ them need to
invest resources and training to improve their cyber-security; not least
because when one person's security is compromised, everyone who relies on that
person is also under threat.<o:p></o:p></p>]]>
    </content>
</entry>

<entry>
    <title>For journalists, danger lurking in your email</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/07/finfisher-journalists-danger-email.php" />
    <id>tag:cpj.org,2012:/internet//19.20200</id>

    <published>2012-07-27T11:47:42Z</published>
    <updated>2012-07-29T02:29:31Z</updated>

    <summary> This week, Morgan Marquis-Boire and Bill Marczak of the University of Toronto&apos;s Citizen Lab provided a disturbing look into the likely use of a commercial surveillance program, FinFisher, to remotely invade and control the computers of Bahraini activists. After the software installs itself onto unsuspecting users&apos; computer, it can...</summary>
    <author>
        <name>Danny O&apos;Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Bahrain" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="China" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="UK" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="aljazeera" label="Al-Jazeera" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="billmarczak" label="Bill Marczak" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="citizenlab" label="Citizen Lab" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="email" label="Email" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="finfisher" label="Finfisher" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="gammainternational" label="Gamma International" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="malware" label="Malware" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="melissachan" label="Melissa Chan" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="morganmarquisboire" label="Morgan Marquis-Boire" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/Bahrain.ap.7.27.12.jpg"> <img alt="A protester in Jidhafs, Bahrain. (AP/Hasan Jamali)" onload="javascript:addCaption(this)" src="/internet/assets_c/2012/07/Bahrain.ap.7.27.12-thumb-400x224-3879.jpg" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" height="224" width="400" /> </a> </span><p class="MsoNormal">This week, Morgan Marquis-Boire and Bill
Marczak of the University of
Toronto's Citizen Lab provided a <a href="https://citizenlab.org/2012/07/from-bahrain-with-love-finfishers-spy-kit-exposed/">disturbing
look</a> into the likely use of a commercial surveillance program, <a href="http://www.finfisher.com/FinFisher/en/index.php">FinFisher</a>,
to remotely invade and control the computers of Bahraini activists. After the
software installs itself onto unsuspecting users' computer, it can record and
relay emails, screenshots, and Skype audio conversations. It was deployed
against Bahraini users after being concealed in seemingly innocent emails.</p>]]>
        <![CDATA[<p class="MsoNormal">In one example decoded by Marquis-Boire's team, the message was
crafted to appear to be from <a href="http://blogs.aljazeera.com/profile/melissa-chan">Melissa Chan</a>,
a journalist working for Al-Jazeera English. The attackers were using Chan's
reputation as a journalist to trick their victims into opening the document.</p>

<p class="MsoNormal">Chan now works for Al-Jazeera in Jerusalem, but when she was
a correspondent in China she was the <a href="http://blogs.aljazeera.com/blog/asia/china-and-google-detailed-look">target
of email attacks</a> herself. In an attempt to take control of her real Gmail
address, a message was sent to her from someone implying they were connected to
China's "Jasmine revolution." The independent Bahraini newspaper <i style="mso-bidi-font-style:normal">Al-Wasat</i> said it has been targeted with <a href="http://in.mobile.reuters.com/article/worldNews/idINIndia-56260920110411">fake
messages from sources</a> as well--not to deliver malware, but to trick
it into running false stories the government then used to try to discredit the
paper.</p>

<p class="MsoNormal">Fake email sources are relatively easy to imitate. The
"From" address used in the Bahraini attack was not Chan's own email
address, but a throwaway Gmail account that looked like an address
("melissa.aljazeera@gmail.com") Chan might conceivably use.</p>

<p class="MsoNormal">Broad caution with unknown correspondents is a defense: If
you don't download attachments and don't click on links in strange emails, you
aren't vulnerable to the hacking attacks these emails are designed to allow.
When I spoke to Chan about the attacks in her name, she noted that "many
people do not look at the email address, but just the 'Last Name, First Name.' ...
There were one or two times when I wasn't sure about the sender and I wrote
back asking them to identify themselves in a way I'd know was definitely
him/her."</p>

<p class="MsoNormal">That's a good technique, but it's even better if you can use
an alternative medium for your fact-checking. Use a phone call or instant
messaging to confirm a message before opening any attachment. If an attacker
has already used malware to take control of another users' computer, they may
have access to private information. They can also act as a "man in the
middle" online, relaying email questions and answers between two
unsuspecting correspondents--but able to spy or add their own fabrications. A
live phone call is harder to fake.</p>

<p class="MsoNormal">In terms of sophistication, it's hard to know what to think
of the Bahraini espionage revealed by Citizen Lab. In some ways, the masquerade
was clumsy--but, then, if it had been more convincing, it may have gone
unnoticed. We only see the results of unsuccessful espionage. Still, even that is
enough to see the damage being caused to the reputations of journalists and the
safety of their communications. Security services faking messages from real
journalists in order to spy on activists is a grave danger to press freedom.</p>

<p class="MsoNormal">Citizen Lab's analysis demonstrates that spyware supposedly
made for law enforcement purposes by the UK company <a href="https://www.gammagroup.com/">Gamma International</a> is
now being used in ways that no democratic society can tolerate. Gamma should
immediately reveal whether they have been selling this technology to the
Bahraini authorities and what it intends to do to prevent abuses from recurring.</p>]]>
    </content>
</entry>

<entry>
    <title>Face-blurring comes into focus for journalists</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/07/face-blurring-comes-into-focus-for-journalists.php" />
    <id>tag:cpj.org,2012:/internet//19.20172</id>

    <published>2012-07-20T21:24:24Z</published>
    <updated>2012-07-30T16:35:24Z</updated>

    <summary> This week, YouTube announced a feature that should catch the eye of video journalists and bloggers working in dangerous conditions. After uploading a video to YouTube, you can now deploy a &quot;blur faces&quot; post-production tool that, in theory, should disguise the visual identity of everyone on the screen. The...</summary>
    <author>
        <name>Danny O&apos;Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Americas" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Middle East &amp; North Africa" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="USA" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="faceblurring" label="Face-blurring" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="google" label="Google" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="journalistsecurity" label="Journalist Security" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="youtube" label="YouTube" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<span class="mt-enclosure mt-enclosure-image" style="display: inline;"> <a href="/internet/Blurring.YouTube.jpg"> <img alt="From YouTube's demonstration page" onload="javascript:addCaption(this)" src="/internet/assets_c/2012/07/Blurring.YouTube-thumb-400x197-3865.jpg" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" height="197" width="400" /> </a> </span><p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">This week, YouTube
announced a feature that should catch the eye of video journalists and bloggers
working in dangerous conditions. After uploading a video to YouTube, you can
now deploy a "blur faces" post-production tool that, in theory,
should disguise the visual identity of everyone on the screen. <i>The Hindu</i>
newspaper has an </span><span style="mso-hansi-font-family:&quot;Times New Roman&quot;"><a href="http://www.thehindu.com/sci-tech/technology/article3662677.ece">excellent how-to guide</a></span> for their
readers.<o:p></o:p></p> ]]>
        <![CDATA[<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">Face-blurring can be an
important security tool for journalists working in regions where witnesses are punished
simply for talking to the media. Documenting events in the manner they occur remains
the common professional mandate, but in certain instances, such as protecting a
vulnerable news source providing sensitive information, blurring a facial image
can serve an important purpose. It's another iteration of the age-old equation
of reporting the news while protecting your sources; each journalist must strike his or her own balance.<o:p></o:p></span></p>

<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">YouTube's new feature is
not yet perfect and, </span><span style="mso-hansi-font-family:&quot;Times New Roman&quot;"><a href="http://youtube-global.blogspot.com/2012/07/face-blurring-when-footage-requires.html">as Google warns</a></span>, some hand-holding is
needed. The algorithm is optimized for speed more than accuracy, which means
that it can sometimes miss a face, or overcompensate. There isn't yet an
interface for choosing which faces to blur or how to disguise voices. It may
fail to work on your particular video because the faces are moving too much or
the recognition system fails to consistently spot them.<o:p></o:p></p>

<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">Nonetheless, it's an
important step forward. Google says that it first considered face-blurring
after activists requested the feature in a </span><span style="mso-hansi-font-family:
&quot;Times New Roman&quot;"><a href="http://www.witness.org/cameras-everywhere/report-2011">2011 report</a></span> compiled by <span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">Witness, the organization
that uses video and other technology to defend human rights. </span><span style="mso-hansi-font-family:&quot;Times New Roman&quot;">Face-blurring is something that
will be appreciated by thousands of other YouTube users, from <a href="http://www.ehow.com/info_8275318_do-blurred-faces-photos-mean.html">protective
parents</a> to merry pranksters, but the most compelling argument for its use
came from videographers trying to report the news while protecting those they cover.<o:p></o:p></span></p>

<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">Journalists need a wider
range of such capabilities, and they need them embedded in consumer
applications. Consumer Internet services, after all, have become entwined in
the lives of professional and citizen journalists. It often falls to individual
reporters to use these tools, instead of relying on an editor down the line.</span><span style="mso-hansi-font-family:&quot;Times New Roman&quot;"><o:p></o:p></span></p>

<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">You can't quite hand off
all your security problems to the cloud, though. Google's face-blurring works
only with its copy of the video, not the original source on your local device.
There's some early work by technologists such as the Guardian Project to bring
real-time face-blurring to <a href="https://guardianproject.info/apps/obscuracam/">android cameras</a>. But integrating such capabilities into the early stages of a
professional work flow is not easy; even computer security experts are still
struggling with how to permanently delete recorded content from <a href="http://www.forensicswiki.org/wiki/Solid_State_Drive_%28SSD%29_Forensics">modern flash storage</a></span>.<o:p></o:p></p>

<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">These problems are hard and
require long-term research. Face-blurring is one of the first steps in a long
road that involves the active involvement and advocacy of companies,
technologists, activists, and journalists. Without feedback and support,
companies will quietly let these features "bitrot" away. And without
active advocacy and criticism, other essential parts of the same emerging
security infrastructure will never get built.</span><span style="mso-hansi-font-family:
&quot;Times New Roman&quot;"><o:p></o:p></span></p>

<p class="MsoNormal" style="margin-bottom:9.0pt;mso-pagination:widow-orphan"><span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">Perhaps the best incentive
to maintain and improve these privacy-protecting features is if the companies
involved sense it's something they're actively competing to provide to their
customers, rather than generously offering. I suspect it's just coincidence
that Google's face-blurring was launched the same week as Facebook was being </span><span style="mso-hansi-font-family:&quot;Times New Roman&quot;"><a href="http://www.pcworld.com/article/259579/facebooks_facial_recognition_draws_us_senate_scrutiny.html">hauled over the coals</a></span> in the U<span style="mso-fareast-font-family:&quot;Times New Roman&quot;;mso-hansi-font-family:&quot;Times New Roman&quot;;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">.S. Senate over its facial
recognition, but that fact is almost certainly why YouTube's addition got some
extra coverage. After a decade of consumer Internet services competing on ease
of data-sharing, it will be equally rewarding to journalists if they were to
start competing on better data protection.</span><span style="mso-hansi-font-family:
&quot;Times New Roman&quot;"><o:p></o:p></span></p>]]>
    </content>
</entry>

<entry>
    <title>Internet law: a good bad example of Russia&apos;s backsliding</title>
    <link rel="alternate" type="text/html" href="http://cpj.org/internet/2012/07/internet-bill-highlights-russias-divergence-on-hum.php" />
    <id>tag:cpj.org,2012:/internet//19.20144</id>

    <published>2012-07-13T19:16:30Z</published>
    <updated>2012-07-13T19:32:10Z</updated>

    <summary>Russia&apos;s State Duma has passed a number of new laws in the past week, all seemingly aimed at reining in civil society and criticism of public figures. The bills would re-criminalize defamation and impose limits and labels on NGOs. They follow the introduction last month of excessive fines for unauthorized...</summary>
    <author>
        <name>Danny O’Brien/CPJ Internet Advocacy Coordinator</name>
        <uri>http://cpj.org/internet/</uri>
    </author>
    
        <category term="Europe &amp; Central Asia" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Russia" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="censored" label="Censored" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="defamation" label="Defamation" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="dmitrymedvedev" label="Dmitry Medvedev" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="internet" label="Internet" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="legalaction" label="Legal Action" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="vladimirputin" label="Vladimir Putin" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://cpj.org/internet/">
        <![CDATA[<p class="MsoNormal">Russia's State Duma has passed a number of new laws in the
past week, all seemingly aimed at reining in civil society and criticism of
public figures. The bills would <a href="/2012/07/russian-parliament-votes-to-recriminalize-defamati.php"><span class="InternetLink">re-criminalize defamation</span></a> and impose limits and
labels on NGOs. They follow the introduction last month of excessive fines for
unauthorized protests.<o:p></o:p></p> ]]>
        <![CDATA[<p class="MsoNormal">One of this week's bills, <a href="http://en.wikipedia.org/wiki/Russian_State_Duma_Bill_89417-6">Duma Bill
89417</a> is a proposed Internet statute that, among other provisions, would create
a blacklist of websites that all Russians Internet service providers (ISPs)
would have to block and refuse to host. The bill was hurried through the
legislature in one week. (The defamation bill was approved today in the Duma's
third and final reading; jail terms were eliminated from an earlier draft, but
fines were allowed reaching as high as 5 million rubles or about US$153,000, <a href="http://english.ruvr.ru/2012_07_13/Russian-Parliament-OKs-anti-defamation-bill/">news
reports</a> said.) Both bills now await President Vladimir Putin's signature.<o:p></o:p></p>

<p class="MsoNormal">Bill 89417 demonstrates everything that is wrong with this
flurry of new legislation. Rather than fixing old legal problems, as the
government claims, it exacerbates them, and to the extent it mirrors other
countries' laws, it demonstrates just how much Russia is diverging from
accepted international norms of human rights.<o:p></o:p></p>

<p class="MsoNormal">The new law ostensibly fixes flaws in a previous media
regulation bill. At the very end of 2010, the Duma passed <a href="http://www.akdi.ru/scripts/gosduma/smotri.php?z=1193"><span class="InternetLink">Law 436-FZ</span></a>, which required all "information
products," including Internet hosted material, deemed unsuitable for children
to be marked with visible warnings. The law was due to take effect on September
1, 2012.<o:p></o:p></p>

<p class="MsoNormal">Internet technologists had <a href="http://en.faitid.org/node/79"><span class="InternetLink">warned</span></a>
that 436-FZ was too broad, and would require individual comments and home pages
to be marked with age-appropriate ratings in the style of American movies. The
new law supposedly corrects this. It amends the law to exclude the majority of Internet
content, although still requires "online publications" to give ratings. The
term is ambiguous, but apparently includes online news services.<o:p></o:p></p>

<p class="MsoNormal">The amendments also include the creation of a centralized
blacklist of websites. After criticism from, <a href="http://en.gazeta.ru/news/2012/07/12/a_4678733.shtml"><span class="InternetLink">among others</span></a>, Prime Minister Dmitry Medvedev, the
criteria for being included on the blacklist has been narrowed--it now is
specifically tied to child-safety related content, including child pornography,
material encouraging drug use, and suicide advice. Which sites should be placed
on the blacklist, however, is to be solely determined by a new Russian agency,
with no further oversight. Under a separate exemption, the Russian courts can place
sites on the registry without limit, provided their content is "banned in the
Russian media." <o:p></o:p></p>

<p class="MsoNormal">As with its predecessor, the new bill creates more questions
and opens more loopholes than it addresses. Will the blacklist be secret? If
so, how will websites be able to appeal being included (which, according to the
law, they are only permitted to do for three months after introduction)? If
websites do not appeal within the three-month timeframe, will they remain on
the blacklist permanently? Will sites that do not contain age ratings be
subject to bans by the courts? Will that include foreign news sites that may be
unaware or unwilling to comply with Russian labeling requirements? Will a
single page be sufficient to ban an entire site or IP address? How will sites
be reported? Will it be possible to trigger a ban by maliciously injecting
prohibited content into vulnerable sites? If such content is removed, will the
ban remain?<o:p></o:p></p>

<p class="MsoNormal">If Russia's lawmakers are seeking to imitate other country's
laws in the area of child protection, they have failed to learn key lessons.
Russia's version of Wikipedia was <a href="http://www.latimes.com/business/technology/la-fi-tn-russian-wikipedia-goes-dark-20120710,0,2968581.story"><span class="InternetLink">one of the largest sites</span></a> to protest the new law,
as well it might. A similar, albeit voluntary, blacklist in the U.K. led the
U.S. version of Wikpedia to be <a href="http://www.guardian.co.uk/technology/blog/2008/dec/08/internet"><span class="InternetLink">blocked</span></a> by some ISPs in that country following
the reporting of a single Wikipedia-hosted image. In the United States, the
1996 Communication Decency Act included provisions that would criminalize the
distribution of obscene content to children, but these were <a href="https://www.cdt.org/grandchild/cda"><span class="InternetLink">overturned
by the U.S. courts</span></a> as creating unconstitutional limits on Internet
expression.<o:p></o:p></p>

<p class="MsoNormal">Russia's compulsory prohibitions suffer from many of the
same potential problems as the current U.K. system--enforced secrecy, arbitrary
blocks, technical challenges, and a limited effect on the actual issue of child
pornography. It carries with it the same wider impact on Internet expression
that may be child-unfriendly, but is vital to an open society--including the
free reporting of adult matters. Add to that the dangers of handing such power
to censor the Net to a centralized and unaccountable government agency, allied
with an administration increasingly unfriendly to dissent, and you are left
with a law that will do little good, and probably much harm.<o:p></o:p></p>

<p class="MsoNormal">Politicians like Medvedev have <a href="http://rt.com/politics/internet-users-help-reforms-347/"><span class="InternetLink">pointed to its uncensored Internet</span></a> as proof their
country respects a free press. That Russia will so quickly abandon that
standard shows how fragile its respect can be.<o:p></o:p></p>]]>
    </content>
</entry>

</feed>
