Ubiquitous Technical Surveillance & Countermeasures: Existential Threats & Mitigations

Ubiquitous Technical Surveillance (UTS) is the widespread collection and analysis of data from various sources—ranging from visual and electronic devices to financial and travel records—for the purpose of connecting individuals, events, and locations. 

This surveillance poses risks to government operations, business organizations, and individuals alike, threatening to compromise sensitive investigations, personal privacy, and organizational security. The surprising findings of a recent audit of FBI techniques to address UTS further heighten the need for awareness and response to the threats. 

As the sophistication and reach of surveillance technologies continue to grow, understanding the nature of UTS and implementing effective Technical Surveillance Countermeasures (TSCM) is essential for safeguarding sensitive information and ensuring operational integrity. This work explores UTS and TSCM and suggests mitigation strategies to combat the threats.

Overview

Ubiquitous Technical Surveillance (UTS) refers to the pervasive collection and analysis of data including visual, electronic, financial, travel, and online for the purpose of connecting individuals, events, and locations. The significance of the threats is outlined in a recently declassified but heavily redacted DOJ/OIG audit of the FBI's response to UTS (DOJ, 2025). Based on the number of redactions, particularly from the CIA's section of the report, it is reasonable to imagine that many incidents have occurred that have not been reported to the public.

Technical Surveillance Countermeasures (TSCM) refers to specialized procedures and techniques designed to detect, locate, and neutralize unauthorized surveillance devices and eavesdropping threats. TSCM is commonly known as a "bug sweep" or "electronic counter-surveillance" and is used to protect sensitive information from being intercepted by covert listening devices, hidden cameras, or other forms of technical surveillance (REI, 2025), (Conflict International Limited, 2025).

UTS Devices, Data Sources, & Risks

Technical surveillance data collection can occur through a variety of devices and data sources including the following:

UTS is recognized as a significant and growing threat to government, business organizations, and individuals, with the potential to compromise investigations, business operations, and personal safety. When the collected technical surveillance information is in the wrong hands and used for nefarious purposes, harm can result.

UTS Threats

What are the UTS threats?

• Significance: Described as an “existential threat” by the Central Intelligence Agency (CIA) due to its ability to compromise sensitive operations and personal safety (DOJ, 2025, p.4).

Risks:

• Compromise of investigations, personnel PII, and sources (DOJ, 2025)
• Exposure of operational details
• Threats to personal and organizational security
• Corporate espionage (Pinkerton, 2022)

Real-World UTS Scenarios

The following incidents are a sample of situations involving UTS.

• Cartel Tracking via Phones and Cameras: Criminals exploited mobile phone data and city surveillance cameras to track and intimidate law enforcement and informants (DOJ, 2025, p.18).
• Organized Crime and Phone Records: Crime groups used call logs and online searches to identify informants (DOJ, 2025, p.18).
• Financial Metadata De-Anonymization: Commercial entities re-identified individuals from anonymized transaction data. Though this data is anonymized, in 2015, researchers from the Massachusetts Institute of Technology found that with the data from just four transactions, they could positively identify the cardholder 90% of the time. (DOJ, 2025, p.17).
• Travel Data Correlation: Adversaries used travel records to reveal covert meetings and operational activities (DOJ, 2025, p.1).
• Online Activity Analysis: Aggregated web and social media data to build detailed personal profiles (DOJ, 2025, p.1).
• Visual Surveillance: Use of CCTV and smart devices for real-time tracking and event reconstruction.
• Electronic Device Tracking: Exploitation of device signals and unique identifiers for location tracking.
• Combined Data Exploitation: Overlaying multiple data sources to establish “patterns of life.”
• Commercial Data Brokers: Purchase of large datasets for profiling and targeting.
• Compromised Communications: Poorly secured communications exposing sensitive activities.

UTS Response: Organizational Challenges - FBI

The FBI identified UTS as an issue impacting the Bureau. However, a recently unclassified audit of the FBI's approach to UTS by the Office of Inspector General (OIG) identified several challenges and areas for improvement in the FBI's approach (DOJ, 2025, p.4).

OIG Audit of the FBI's Efforts (DOJ, 2025)

• Red Team Analysis: Initial FBI efforts were high-level and did not fully address known vulnerabilities.
• FBI Strategic Planning: Ongoing development, but lacking clear authority and coordination.
• Training Gaps: Basic UTS training is mandatory for FBI personnel, but advanced training is limited and optional.
• Incident Response: FBI Data breaches revealed policy gaps and lack of coordinated response.
• Recommendations: The FBI needs comprehensive vulnerability documentation, strategic planning, clear authority, and expanded training.

Countermeasures & Best Practices

Combating the threats from UTS is a daunting challenge. Several steps can be taken to mitigate the threats.

Scenario-Specific Steps

Suggested General Countermeasures

• Regular training on digital hygiene and counter-surveillance
• Encryption of sensitive data and communications
• Physical security for sensitive locations and devices
• Vigilance and behavioral adaptation to signs of surveillance
• Technical Surveillance Countermeasures (REI, 2025), (Conflict International Ltd, 2025), (EyeSpySupply, 2023).

Training & Awareness (DOJ, 2025)

• Basic UTS Awareness: Should be mandatory for all FBI personnel.
• Advanced UTS Training: Recommended for high-risk FBI roles; should be expanded and resourced.
• Continuous Learning: Stay updated on emerging threats and countermeasures.

Incident Response Recommendations from the OIG Audit of the FBI (DOJ, 2025)

• FBI should establish clear lines of authority for UTS incidents.
• FBI should develop and rehearse coordinated response plans.
• FBI should regularly review and update internal controls and policies.

Summary

The growing sophistication and reach of surveillance technologies have made UTS a threat to government operations, business organizations, and individuals. Real-world incidents demonstrate how adversaries exploit mobile phone data, surveillance cameras, financial transactions, and travel records to compromise investigations, expose operational details, and threaten personal and organizational security.

The FBI, recognizing UTS as an existential threat, has faced challenges such as insufficient planning, limited training, and gaps in incident response.

Technical Surveillance Countermeasures (TSCM), including procedures like bug sweeps and electronic counter-surveillance, are tools for detecting and mitigating unauthorized surveillance devices. Best practices for mitigation include regular training, encryption, physical security, and continuous awareness of emerging threats.

Conclusion

The risks posed by UTS are immediate and evolving, with the potential to undermine investigations, compromise privacy, and threaten organizational integrity. Effective countermeasures require a combination of technical solutions, organizational policies, and training. The findings of the OIG audit of the FBI highlight the need for clear authority, coordinated response plans, and regular updates to internal controls. As surveillance technologies continue to advance, adopting a proactive and comprehensive approach to counter-surveillance is important for safeguarding information and maintaining operational security.

References

Conflict International Ltd. (2025, June). Bug Sweeps (TSCM): Protecting Against AirTag Stalking and Modern Surveillance. https://conflictinternational.com/news/bug-sweeps-tscm-protecting-against-airtag-stalking-and-modern-surveillance

DOJ. (2025, June). Audit of the Federal Bureau of Investigation's Efforts to Mitigate the Effects of Ubiquitous Technical Surveillance. Department of Justice, Office of the Inspector General. https://oig.justice.gov/sites/default/files/reports/25-065.pdf

EyeSpySupply. (2023, December). The Importance of TSCM Equipment for Security. Blog. https://blog.eyespysupply.com/2023/12/29/the-importance-of-tscm-equipment-for-security/

Pinkerton. (2022, July). Technical Surveillance Countermeasures to Prevent Corporate Espionage. https://pinkerton.com/our-insights/blog/technical-surveillance-countermeasures-to-prevent-corporate-espionage

REI. (2025). Research Electronics Institute. TSCM Equipment and Training. https://reiusa.net/

Disturbing Revelations - Annual Assessment of the IRS’s Information Technology Program

The Treasury Inspector General for Tax Administration (TIGTA) released its annual assessment of the IRS’s Information Technology (IT) Program for 2024. This review, based on audit reports from TIGTA and the Government Accountability Office (GAO), paints a mixed picture: while progress has been made in some areas, significant vulnerabilities and management failures persist. These issues threaten the security of taxpayer data, the effectiveness of IRS operations, and public trust in the agency.

Summary of Findings

The IRS is a massive and complex organization, collecting $5.1 trillion in federal tax payments and processing 267 million tax returns and forms in FY 2024. Its reliance on computerized systems is absolute, making IT security and modernization paramount. Despite efforts to modernize and secure its systems, the IRS faces mounting challenges due to funding cuts, workforce reductions, and persistent weaknesses in cybersecurity, access controls, and IT asset management.

Audits revealed that while the IRS is making strides in areas like identity proofing for its Direct File pilot and blocking suspicious email websites, it falls short in critical cybersecurity functions, proper management of user access, timely vulnerability remediation, and oversight of cloud services. Insider threats, incomplete audit trails, and inadequate separation of duties further exacerbate the risks.

Some Disturbing Revelations

• The IRS’s cybersecurity program was rated “not fully effective,” failing in three of five core cybersecurity functions (Identify, Protect, Detect), including shortcomings in system inventories, vulnerability remediation, encryption, and multifactor authentication.

• 279 former IRS users retained access to sensitive systems for up to 502 days after separation, exposing taxpayer data to unauthorized access and potential misuse.

• The IRS failed to timely remediate tens of thousands of critical and high-risk vulnerabilities, including 2,048 critical and 13,558 high-risk vulnerabilities in a single security application environment.

• Personally Identifiable Information (PII) for over 613,000 IRS user authentications was sent to unauthorized locations outside the U.S. due to a vendor’s flaw in the Login.gov system, placing sensitive data at risk.

• The IRS was unable to locate all cloud services contracts or determine their value for nearly half of its cloud applications, undermining financial oversight and increasing the risk of waste or duplication.

• 35% of IRS systems required to send audit trails for detecting unauthorized access to PII and Federal Tax Information failed to do so, severely limiting the ability to investigate or detect data breaches.

• The IRS did not fully comply with federal mandates to block TikTok on government devices, leaving more than 2,800 mobile devices and 900 computers potentially exposed to foreign surveillance risks.

• Inadequate separation of duties was found in 70% of reviewed cloud systems, with the same individuals controlling multiple key roles, heightening the risk of fraud or error going undetected.

• The IRS’s data loss prevention controls could be circumvented, allowing users to intentionally exfiltrate sensitive taxpayer data despite existing monitoring tools.

• Despite identifying 334 legacy systems needing updates or retirement, only 2 had specific decommissioning plans, leaving the IRS reliant on outdated, potentially insecure systems.

The findings underscore the need for the IRS to address IT security and management deficiencies. Without corrective action, the agency remains vulnerable to internal and external threats, risking taxpayer privacy, financial integrity, and the effective administration of the nation’s tax system.

Read the full report at this link: https://www.tigta.gov/sites/default/files/reports/2025-06/20252S0007fr.pdf

Disturbing Spying Revelations: Meta/Facebook/Instagram & Yandex

Overview:

The web page https://localmess.github.io/ discloses a previously undocumented and highly invasive tracking technique used by Meta (Facebook/Instagram) and Yandex that affected billions of Android users. Researchers [4] discovered that this method covertly linked users' mobile web browsing sessions to their identities in native apps, bypassing standard privacy protections. 

The practice was active until early June 2025, when both Meta and Yandex, after being caught with their hands in the proverbial PII cookie-jar, ceased these behaviors following public disclosure [1][2][3].

Key Findings

1. Covert Web-to-App Tracking via Localhost on Android

·       Meta and Yandex embedded scripts (Meta Pixel and Yandex Metrica) on millions of websites.

·       When a user visited such a site in a mobile browser on Android, the script would communicate directly with native apps (like Facebook, Instagram, or Yandex Maps) installed on the same device.

·       This communication happened via localhost sockets—special network ports on the device that allow apps to talk to each other without user knowledge or consent [1][3].

2. How the Tracking Worked

·       Meta Pixel:

o   The Meta Pixel JavaScript sent the browser’s _fbp cookie (used for advertising and analytics) to Meta apps via WebRTC (using STUN/TURN protocols) on specific UDP ports (12580–12585).

o   Native Facebook and Instagram apps listened on these ports in the background, received the _fbp value, and linked it to the user’s app identity, effectively de-anonymizing web visits[1][3].

o   This bypassed protections like cookie clearing, incognito mode, and Android permission controls.

·       Yandex Metrica:

o   Yandex’s script sent HTTP/HTTPS requests with tracking data to localhost ports (29009, 29010, 30102, 30103), where Yandex apps listened.

o   The apps responded with device identifiers (e.g., Android Advertising ID), which the script then sent to Yandex servers, bridging web and app identities[1].

3. Privacy and Security Implications

·       This method allowed companies to:

o   Circumvent privacy mechanisms such as incognito mode, cookie deletion, and even Android’s app sandboxing.

o   Link browsing habits and cookies with persistent app/user identifiers, creating a cross-context profile of the user.

o   Potentially expose browsing history to any third-party app that listened on those ports, raising the risk of malicious exploitation[1][3].

4. Prevalence

·       Meta Pixel was found on over 5.8 million websites; Yandex Metrica on nearly 3 million.

·       In crawling studies, thousands of top-ranked sites were observed attempting localhost communications, often before users had given consent to tracking cookies[1].

5. Timeline and Disclosure

·       Yandex has used this technique since 2017; Meta adopted similar methods in late 2024.

·       Following responsible disclosure to browser vendors and public reporting in June 2025, both companies stopped the practice. Major browsers (Chrome, Firefox, DuckDuckGo, Brave) have since implemented or are developing mitigations to block such localhost abuse[1][3]

Technical Details

Aspect	Meta/Facebook Pixel	Yandex Metrica
Communication Method	WebRTC STUN/TURN to UDP ports (12580–12585)	HTTP/HTTPS requests to TCP ports (29009, etc.)
Data Shared	_fbp cookie, browser metadata, page URLs	Device IDs (AAID), browser metadata
Apps Involved	Facebook, Instagram	Yandex Maps, Browser, Navigator, etc.
User Awareness	None; bypassed consent and privacy controls	None; bypassed consent and privacy controls
Platform Affected	Android only (no evidence for iOS or desktop)	Android only (no evidence for iOS or desktop)
Risk of Abuse	High: enables de-anonymization, history leakage	High: enables de-anonymization, history leakage

Broader Implications

·       Bypassing Privacy Controls:
This method undermined the effectiveness of cookie controls, incognito/private browsing, and Android’s app isolation, showing that even sophisticated privacy tools can be circumvented by creative inter-app communications[1][3].

·       Need for Platform-Level Fixes:
Browser and OS vendors are now patching this specific exploit, but the underlying issue—unrestricted localhost socket access—remains a systemic risk on Android. The researchers call for stricter platform policies and user-facing controls for localhost access[1].

·       User and Developer Awareness:
Most website owners were unaware their sites enabled this tracking. End-users had no indication or control over the process. The lack of transparency and documentation from Meta and Yandex is highlighted as a major concern[1].

Conclusion

The research revealed a disturbing tracking vector that allowed Meta and Yandex to link users’ web and app identities on Android at a massive scale, defeating standard privacy safeguards. The disclosure led to rapid mitigation, but the incident underscores the need for deeper systemic changes in how browsers and mobile platforms handle inter-app communications and tracking[1][2][3]. “This tracking method defeats Android's inter-process isolation and tracking protections based on partitioning, sandboxing, or clearing client-side state.”[1]

1.      https://localmess.github.io

2.      https://www.grc.com/sn/sn-1029-notes.pdf

3.      https://gigazine.net/gsc_news/en/20250604-meta-yandex-tracking/

4.      Researchers & Authors of the localmess github page: Aniketh Girish (PhD student),  Gunes Acar (Assistant Professor),  Narseo Vallina-Rodriguez (Associate Professor), Nipuna Weerasekara (PhD student), Tim Vlummens (PhD student).

Note: Perplexity.AI was used to assist in preparing this report.

Video/Lecture: Privacy and the Internet

Short lecture about privacy and the Internet.

Editor: Ava Gozo.

Kardasz, F. (July 2023). Privacy and the Internet. [Video]. https://youtu.be/kR7EYoAZGFA

Your PII at Risk

Hostile Acts in the Data Spheres: The Battles for Your Personally Identifiable Information

Dr. Frank Kardasz, MPA, Ed.D.

Editor: Ava Gozo.

December 24, 2021 (revised September 27, 2022)

The relentless barrage of cybercrimes involving data breaches, doxing’s, deepfakes, identity thefts, intrusions, and malware are continuing attacks on those trying to preserve personal information, freedom, and finances.  Furthering the misdeeds are leak-prone data storage systems, lawful and unlawful surveillance operations, and ineffective laws. As this generation slowly succumbs to the rise of the data collection machines; the monetization, politicization and weaponization of information is an alarming reality and a wicked menace. This work discusses some of the factors involved in the data battles and concludes with some resources for protection and prevention.

Some Terms of (the Dark) Art

Those new to the data malfeasance underworld may be unfamiliar with some of the commonly used terms. Here are definitions of four: Personally Identifiable Information (PII), Phishing, Doxing, and Deepfakes

Personally Identifiable Information

Personally Identifiable Information (PII) is information that, when used alone or with other relevant data, can identify an individual (Investopedia, 2021). PII can include date and place of birth, social security number, addresses, account information, maiden name, pet names, schools attended, graduation dates, and other identifiers. PII should be protected and kept confidential, but it is sometimes released and made available to those who would misuse it. One study showed that most consumers simply do not understand just how vulnerable their PII is (PYMNTS, 2018).

Phishing

Phishing is an exploit in which a perpetrator impersonates a legitimate business or reputable person to acquire private and sensitive information, such as credit card numbers, personal identification numbers (PINs) and passwords (Techopedia, 2021).  Phishing techniques are often seen in social media sites where otherwise amiable questions are posed for the purpose of slowly collecting information about the respondent.

Doxing

Doxing is the process of retrieving, hacking, and publishing other people’s information such as names, addresses, phone numbers and credit card details. Doxing may be targeted toward a specific person or an organization. There are many reasons for doxing, but one of the most popular is coercion (Techopedia, 2021). Doxing is also a technique threatened in ransomware situations where the attackers threaten to publish Doxed information if the ransom is not paid.

Deepfake

Deepfake, also known as Synthetic Content, is a term for videos and presentations enhanced by artificial intelligence and other modern technology to present falsified results. One of the best examples of deepfakes involves the use of image processing to produce video of celebrities, politicians or others saying or doing things that they never actually said or did (Techopedia, 2021).

Some Users Place Themselves at Risk

In the relentless quest to gain fame, fortune, recognition, votes or clicks, vulnerable victims young and the old strive to become "influencers” and seek to add subscribers via social media. And in those attention-seeking sometimes profit-motivated efforts, victims often expose far too much about themselves, their families and their finances; thus permitting data harvesters to develop targeted exploits. Incidents of Sextortion are being reported all across the US.

Depending upon ones geo-political situation, publicizing your personal information and wealth may have other unusual consequences. The New York Times reported that in China, bragging about your wealth may get you censored by the government.  The Chinese authorities have declared war on content deemed to be “flaunting wealth" (Wang, 2021).

Unwitting Victims

Others are victimized through no fault of their own. Their PII data finds itself in the wrong place at the wrong time and that data is used in the furtherance of malicious cyber acts.

Synthetic Content, a.k.a. Deepfake

International concern is growing among law enforcement officials about Deepfakes. A 2021 FBI warning bulletin stated that malicious actors can be expected to leverage "synthetic content" (aka Deepfakes) for cyber and foreign influence operations.

 

As reported by the news show 60 minutes (Whittaker, 2021), the creators of deepfakes have the computer skill and power to make falsified onscreen look-alikes do or say anything. Oft-photographed celebrities and politicians are popular subjects of Deepfakes.  But soon, anyone whose image is available in Cyberspace could be deepfaked.  Disturbing new computer software applications now exist that undress and "nudify" images by using deep-learning algorithms to remove women's clothes and replace the clothing with nude body parts. The process transforms otherwise benign images into pornography (Cook, 2021).

Data Harvesting Profiteers - Commerce, Capitalism and Profit

In the book, The Age of Surveillance Capitalism, Shoshana Zuboff (2019) discusses the "rogue mutation of capitalism" that resulted in the current commercial surveillance industry.  It is an industry that quietly and invisibly collects and harvests data for financial and/or political gain.

 

According to Edward Snowden, "The invisibility of the data collection makes it so attractive to these companies because if you do not realize that they are collecting this data from you, and it is very private data, there is no way you are going to object to it. What they (the data mining companies) are selling is not information, they are selling our future, they are selling our past, they are selling our history or identity and ultimately stealing our power and making our stories work for them" (2021).

Children's Privacy at Risk

The ByteDance owned social networking site TikTok is facing a $29 million fine in the UK after it was determined that the company breached  child data protection laws for a two year period (Sawers, 2022).

Weak Efforts to Mitigate Data Collection

Mobile devices and Internet-connected systems are collectors and harvesters of personal data and information. After public pressure and awkward appearances at congressional subcommittee hearings, some data-mining and social networking executives are begrudgingly and slowly making changes. Apple now has added an "Ask App Not To Track" feature, but critics deride it as a smoke-and-mirrors function that permits apps associated with Apple to keep snooping anyway (Fowler, 2021).

Disturbing Anecdotes

Here are just a few troubling examples of the problems that innocent people have encountered through misidentification, identity theft, and harassment.

Cybervigilante Misidentification & Harassment:

In 2017, a Michigan man was misidentified by far-right websites as the driver of the car that plowed into a group of counter protesters in Charlottesville, Virginia.  The innocent man's home address was wrongly publicized, and he and his family were subjected to disturbing incidents of harassment. The family was devastated. Local police were forced to increase patrols at the mans home (Bowden, 2017).

In 2021, amateur online investigators misidentified rioters at the Capitol in Washington DC.  One misidentified man, a retired firefighter, received hateful calls and messages calling him a murderer and a terrorist. Subsequently a police officer was stationed outside his home for safety. Others wrongly associated with the Capitol riot included the actor Chuck Norris and comedian Kevin Seefried. Seefried was wrongly accused because he shares the same name as a man involved in the riot (Kornfield, 2021).

Facial Recognition Software Misidentification:

In 2020, a man was wrongly arrested when Detroit Police mis-matched him to a crime based on a facial recognition software match, but without any other corroborating information about the man’s involvement in the crime. The man was arrested in front of his young daughters and suffered embarrassment and wrongful  incarceration (Ward, 2020).

Stolen Identity & Data Breaches & Doxing:

In 2011, a California grandmother spent a night in jail after being wrongly arrested for check fraud as the result of her identity being stolen. She lost $20,000 during the fraud and spent another $60,000 trying to prove her innocence (Fender, 2011). The true offender, 54-year-old Andrea Harris-Frazier, was eventually apprehended after victimizing 28 different people and charged with 43 counts of forgery and attempted theft (DataBreaches.net, n.d.).

In 2022, the identity of a gravely disabled Florida man was used by one or more fraudsters to create several fictitious businesses and defraud Medicare of $350,000 in fraudulent loans (Neal, 2022).

 

In 2020, at least 38 law enforcement officers who responded to riots in Portland, Oregon were doxed. Their personal information is believed to have been released by members of Antifa (Toledo, 2020).  After a 2022 shooting, Portland Police refused to release the identities of the officer involved, citing threats in the following statement:  "PPB has determined that there are credible security threats to officers involved in recent shootings and therefore, PPB is withholding the name of the involved member during the pendency of the doxing investigation. (Portland Police Bureau, 2022)."

 

In 2022, CISA released a bulletin with the following information about Ransomware and the theft and misuse of PII. Over the past several years, the education sector has been a frequent target of ransomware attacks. Impacts from these attacks have ranged from restricted access to networks and data, delayed exams, canceled school days, and unauthorized access to and theft of personal information regarding students and staff. Federal agencies anticipate attacks may increase as the 2022/2023 school year begins and criminal ransomware groups perceive opportunities for successful attacks. School districts with limited cybersecurity capabilities and constrained resources are often the most vulnerable; however, the opportunistic targeting often seen with cyber criminals can still put school districts with robust cybersecurity programs at risk (CISA, 2022).

Laws and Legislative Hearings

Laws and law enforcement officials in the United States are struggling to catch up to the growing calls to protect citizens from cybercrime and unlawful surveillance and data collection. In some cases, operations are believed to be taking place despite the legislative controls that were intended to protect data.

 

Confused legislators in the US have been questioning laws and the implementations of government surveillance operations. In a review of declassified CIA documents, Senate Intelligence Committee members Ron Wyden and Martin Heinrich said “...what these documents demonstrate is that many of the same concerns that Americans have about their privacy and civil liberties also apply to how the CIA collects and handles information under executive order and outside the FISA law.  In particular, these documents reveal serious problems associated with warrantless backdoor searches of Americans, the same issue that has generated bipartisan concern in the FISA context” (Wyden, 2022).

 

While legislators in Australia recently updated laws to improve oversight in the area of critical infrastructure, the US may be falling behind. Speaking on the OT and IoT Security Podcast, former Assistant US Attorney Jonathan Rusch commented about the state of Cybersecurity in the US, and compared the current US laws with prescient legislation in Australia.  Rusch said (21:30 min - 23:25 min):

 

"The situation in the United States is a polar opposite from Australia.  Despite multiple administrations in the US government, there is still no consistency of approach, no "This must be done".  As opposed to; "it would be really good If everybody would get behind the banner of cyber security and do more things".  My analogy would be for Australians; imagine if you were asked to play in a game of Australian rules football where you have not 7 but 50 or more different umpires, each with a different rule book who can penalize the players who step on to the field for any one of the violations that they see in their rule books; and there has to be no consistency between the rule books; and where the owners of the teams don't even want to shell out enough money to give the players proper footwear. That's the kind of fragmented, disjointed, asymmetrical kind of approach that we have currently in the United States and where P.S., some of our best efforts by law enforcement only come in after the damage has occurred, and then you bring in the investigators to try to find out how the catastrophic event happened."

 

The Children's Online Privacy Protection Act (COPPA) is one US law that has resulted in some success. In 2021, the US Dept. of Justice announced  a civil penalty of $2 million against the advertising platform OpenX Technologies Inc. According to Director Samuel Levine of the FTC, “OpenX secretly collected location data and opened the door to privacy violations on a massive scale, including against children. Digital advertising gatekeepers may operate behind the scenes, but they are not above the law" (DOJ, 2021).

 

Oklahoma is one US state that recognized and legislated towards threats against active and retired law enforcement officers who are targets of doxing. A 2022 Oklahoma senate bill would add retired peace officers to the list of entities protected from having their personally identifiable information posted online by those with intent to threaten, intimidate or harass was passed unanimously by the Senate Judiciary Committee. Oklahoma SB1522 is a follow-up bill to one  filed last session, which protects law enforcement officers from doxing (McEachern, 2022).

Some Have Surrendered

Sadly, some people have simply surrendered and succumbed to the data mis-appropriators. Broadcaster Leo LaPorte, "The Tech Guy" waved the white surrender flag when he said, "Until we get real privacy laws, and companies start adhering to those laws and not finding loopholes; none of which is gonna happen anytime soon, you might as well just assume that if you are on the Internet; Facebook, Google, Apple, they all know what you are doing" (Laporte, 2021).

 

Surrendering to the data collectors is the path of least resistance, particularly among celebrities who have built careers upon the theory that 'Any publicity (whether good or bad) is good publicity'. Opposing this theory is the tragic litany of public figures whose life or welfare was cut short or endangered by stalkers who pursued and located them based on PII found in cyberspace.

Don't Give Up

Privacy advocate Rob Braxman (2021) said, "The (data privacy) opposition, like Google, is intent upon invading our privacy at every opportunity. We could give up; but I think we should consider this as a game, and if Google, Facebook and Amazon play tricks on us, we are entitled to play tricks on them."

 

Former law enforcement investigator and privacy advocate Michael Bazzell operates a service that help victims towards recovering their privacy and initiating steps towards anonymity.  His book, Extreme Privacy, (2021) discusses some of his many clients (without naming them), including government employees whose activities or investigations have made them targets of the criminals whom they have encountered.

Protect Yourself and Your Loved Ones: Mitigators and Preventative Measures

Protecting yourself in Cyberspace is a daunting challenge. There is no single foolproof solution. There are only mitigators that can bolster defenses. As the privacy wars continue, we should keep trying, and we should not give up.

Tips and Resources from Experts, Government, and Industry

IntelTechniques - Michael Bazzell

Excellent resources for data removal, credit freeze and other useful products.

🔹 Best Tip: The Data Removal Workbook.

https://inteltechniques.com/links.html

Schneier on Security  - Bruce Schneier

Public interest technology Blog.
🔹 Best Tip: Use the Signal Messaging Application for secure communications.
https://www.schneier.com/blog/archives/2017/05/t            he_us_senate_i.html

Federal Trade Commission (FTC) - Tips

Consumer protection tips regarding children, health, consumers, credit, data and other resources.

🔹 Best Tip: Children's online privacy protection rule: A six-step compliance plan for your business. 

https://www.ftc.gov/tips-advice/business-center/privacy-and-security

Electronic Frontier Foundation (EFF) - Privacy Badger

A browser add-on that developers say stops advertisers and other third-party trackers.

🔹 Best Tip: Install the Privacy Badger and UBlock Origin add-ons in your browser.

https://privacybadger.org/

Electronic Frontier Foundation (EFF) - Third party tracking

Explanations of methods and practices used by tech companies to track people.

🔹 Best Tip: Check the permission on your mobile phone apps and remove unneeded permissions.

https://www.eff.org/wp/behind-the-one-way-mirror

Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI) - Tools to keep children safe online

Information about protecting children.

🔹 Best Tip: Make sure privacy settings are set to the strictest level possible for online gaming systems and electronic devices.

https://www.ice.gov/news/releases/ice-hsi-shares-tools-keep-children-safe-online

Cybersecurity & Infrastructure Security Agency (CISA) - Recommendations for protecting information.

Fact sheet to address the increase in malicious cyber actors using ransomware.

🔹 Best Tip: Maintain offline, encrypted backups of data and regularly test your backups.

https://www.cisa.gov/sites/default/files/publications/CISA_Fact_Sheet-Protecting_Sensitive_and_Personal_Information_from_Ransomware-Caused_Data_Breaches-508C.pdf

Conclusion

Although the onslaught of cyber-attacks will persist, users must continue the fight to shore up defenses against intrusions. Protecting PII is challenging and time consuming.  There is no single fix that can prevent all of the various types of cybercrimes. The best that one can do is to stay abreast of the current trends and continually implement the preventative measures suggested by IT experts.

References

Bazzell, Michael. (2021). Extreme Privacy: What it takes to Disappear. ISBN 9798729419395. https://inteltechniques.com/

 

Bazzell, Michael. (2021). Data Removal Workbook (PDF). https://inteltechniques.com/data/workbook.pdf

 

Bowden, John. (August 16, 2017). Man misidentified as Charlottesville driver by far-right sites in hiding: report. The Hill. https://thehill.com/homenews/news/346900-man-misidentified-as-charlottesville-driver-by-far-right-sites-in-hiding-report

 

Braxman, Rob. (November 24, 2021). Google Watches ALL Your Devices! How to Stop It. [Video]. https://www.youtube.com/watch?v=LLfoGAHrlQk

 

CISA. (September 6, 2022). National Cyber Awareness System. Alerts #StopRansomware: Vice Society. Alert (AA22-249A). #StopRansomware: Vice Society. https://www.cisa.gov/uscert/ncas/aler                    ts/aa22-249a

 

Cook, Jesselyn. (November 8, 2021). A Powerful New Deepfake Tool Has Digitally Undressed Thousands Of Women. HuffPost. https://www.huffingtonpost.co.uk/entry/deepfake-tool-nudify-women_n_6112d765e4b005ed49053822?ri18n=true

 

Cybersecurity & Infrastructure Security Agency. (n.d.). Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches. https://www.cisa.gov/sites/default/files/publications/CISA_Fact_Sheet-Protecting_Sensitive_and_Personal_Information_from_Ransomware-Caused_Data_Breaches-508C.pdf

 

Cyphers, B.  and Gebhart. G. (December 2,  2019). Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance. Electronic Frontier Foundation. https://www.eff.org/wp/behind-the-one-way-mirror#Part4

 

DataBreaches.net. (February 11, 2020). CO: Woman Accused of Bilking 28 victims. https://www.databreaches.net/co-woman-accused-of-bilking-28-victims/ 

DOJ. (December 28, 2021). Advertising Platform OpenX Agrees to Injunctive Relief and $2 Million Payment in Case Alleging Violations of Children’s Privacy Law. The United States Department of Justice, Justice News. https://www.justice.gov/opa/pr/advertising-platform-openx-agrees-injunctive-relief-and-2-million-payment-case-alleging 

FBI. (March 10, 2021). Malicious Actors Almost Certainly Will Leverage Synthetic Content for Cyber and Foreign Influence Operations. FBI, Dept. of Justice. Private Industry Notification. https://www.ic3.gov/Media/News/2021/210310-2.pdf

Fender, Jessica. (November 12, 2011). Victim of ID theft, once thought a suspect, helps solve her own case. The Denver Post. https://www.denverpost.com/2011/11/12/victim-of-id-theft-once-thought-a-suspect-helps-solve-her-own-case/

 

Fowler, G.A., and Hunter, T. (September 23, 2021). When you ‘Ask app not to track,’ some iPhone apps keep snooping anyway. The Washington Post. https://www.washingtonpost.com/technology/2021/09/23/iphone-tracking/

 

FTC. (n.d.). Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business. Federal Trade Commission. https://www.ftc.gov/tips-advice/business-center/guidance/childrens-online-privacy-protection-rule-six-step-compliance

 

Investopedia. (2021). Personally Identifiable Information. (PII). https://www.investopedia.com/terms/p/personally-identifiable-information-pii.asp

 

Kornfield, Meryl. (January 16, 2021). The wrong ID: Retired firefighter, comedian and Chuck Norris falsely accused of being Capitol rioters. The Washington Post. https://www.washingtonpost.com/technology/2021/01/16/sleuths-falsely-identify-rioters/

 

Laporte, Leo. (December 12, 2021). Podcast: The Tech Guy, Episode 1852, [hour -1:32]. https://twit.tv/shows/the-tech-guy. 

 

McEachern, Hunter. (February 9, 2022). Backing the Blue: Bill to protect retired law enforcement from doxing advances. Oklahoma's 4 News. https://kfor.com/news/oklahoma-legislature/backing-the-blue-bill-to-protect-retired-law-enforcement-from-doxing-advances/

 

Neal, David. J. (February 13, 2022). ‘He was almost dead.’ $350,000 fraud investigation found Miami man, 84, in squalor. Miami Herald. https://www.msn.com/en-us/news/us/e2-80-98he-was-almost-dead-e2-80-99-miami-medicare-fraud-investigation-found-elderly-man-living-in-squalor/ar-AATMlnT

 

Portland Police Bureau. (July 29, 2022). Information related to Officer-Involved Shooting in SE Portland. https://www.portlandoregon.gov/police/news/read.cfm?id=442429&ec=3&ch=twitter

 

PYMNTS. (October 18, 2018). First Data: 34 Percent Of PII Has Been Compromised In 2018. Pymnts.com. https://www.pymnts.com/news/security-and-risk/2018/first-data-pii-compromised-cybersecurity/

 

Rusch, Jonathan. (March 4, 2021). Dissecting the Security Implications of the Australian Critical Infrastructure Act. The OT and IoT Security Podcast. [Audio Podcast]. https://tunein.com/podcasts/Technology-Podcasts/The-OT-and-IoT-Security-Podcast-p1354400/?topicId=161285361 

 

Sawyers, Paul. (September 26, 2022). TikTok faces $29M fine in UK for ‘failing to protect children’s privacy’. https://techcrunch.com/2022/09/26/tiktok-faces-29m-fine-in-uk-for-failing-to-protect-childrens-privacy/

 

Schneier, Bruce. (May 17, 2017). The US Senate is Using Signal. Schneier on  Security. https://www.schneier.com/blog/archives/2017/05/the_us_senate_i.html

 

Signal Messaging Application.  (n.d.). https://www.signal.org/ 

 

Snowden, Edward. (March 11, 2021). "I Remove it Before Using The Phone!" Edward Snowden. BrainStation. [Video]. https://www.youtube.com/watch?v=0dGqR4ue8dg

 

Techopedia. (2021). Phishing, Doxing. Janalta Interactive. https://www.techopedia.com/definition/4049/phishing, https://www.techopedia.com/definition/29025/doxing, https://www.techopedia.com/definition/33835/deepfake

 

Toledo, Arsenio. (July 23, 2020).  Law Enforcement Officers in Portland Doxed by Antifa. Newswars. https://www.newswars.com/law-enforcement-officers-in-portland-doxed-by-antifa/

 

Wang, V.  and Dong, J. (December 25, 2021). In China, Bragging About Your Wealth Can Get You Censored.  New York Times. https://www.nytimes.com/2021/12/25/world/asia/china-money.html

 

Ward, Jacob. (June 26, 2020). Facial Recognition Software Under Fire After Misidentification Causes Wrongful Arrest | NBC News NOW. [Video]. https://www.youtube.com/watch?v=Bxpx8izG5nA

 

Whittaker, Bill. (October 10, 2021). Synthetic Media: How deepfakes could soon change our world CBS News/60 Minutes. https://www.cbsnews.com/news/deepfake-artificial-intelligence-60-minutes-2021-10-10/

 

Wyden, Ron. (February 10, 2022). Wyden and Heinrich: Newly Declassified Documents Reveal Previously Secret CIA Bulk Collection, Problems With CIA Handling of Americans’ Information. Senators Call for Critically Needed Transparency About CIA Bulk Collection; Documents Declassified at Wyden and Heinrich’s Request. News Press Release. https://www.wyden.senate.gov/news/press-releases/wyden-and-heinrich-newly-declassified-documents-reveal-previously-secret-cia-bulk-collection-problems-with-cia-handling-of-americans-information

 

Zuboff, Shoshana. (2019).  The Age of Surveillance Capitalism: The fight for a human future at the new frontier of power.   ISBN-10 1610395697. www.publicaffairsbooks.co    m

 

=-=-=-=-=-=

https://kardasz.blogspot.com/2021/12/hostile-acts-in-data-spheresthe-battles.html

=-=-=-=-=-=