The National Security Agency maintains a page on its website that outlines its mission statement. But earlier this month, the agency made a discreet change: It removed "honesty" as its top priority.
Since at least May 2016, the surveillance agency had featured honesty as the first of four "core values" listed on NSA.gov, alongside "respect for the law," "integrity," and "transparency." The agency vowed on the site to "be truthful with each other."
On January 12, however, the NSA removed the mission statement page – which can still be viewed through the Internet Archive – and replaced it with a new version. Now, the parts about honesty and the pledge to be truthful have been deleted. The agency's new top value is "commitment to service," which it says means "excellence in the pursuit of our critical mission."
Those are not the only striking alterations. In its old core values, the NSA explained that it would strive to be deserving of the "great trust" placed in it by national leaders and American citizens. It said that it would "honor the public's need for openness." But those phrases are now gone; all references to "trust," "honor," and "openness" have disappeared.
The agency previously stated on its website that it embraced transparency and claimed that all of its activities were aimed at "ensuring the safety, security, and liberty of our fellow citizens." That has also been discarded. The agency still says it is committed to transparency on the updated website, but the transparency is now described as being for the benefit of "those who authorize and oversee NSA's work on behalf of the American people." The definition of "integrity" has been edited, too. The agency formerly said its commitment to integrity meant it would "behave honorably and apply good judgment." The phrase "behave honorably" has now been dropped in favor of "communicating honestly and directly, acting ethically and fairly and carrying out our mission efficiently and effectively."
The new list of values includes the additions "respect for people" and "accountability." But the section on respecting people is a reference to diversity within the NSA workforce, not a general commitment to members of the public. Accountability is defined as taking "responsibility for our decisions." The one core value that remains essentially unchanged is "respect for the law," which the agency says means it is "grounded in our adherence to the U.S. Constitution and compliance with the U.S. laws, regulations and policies that govern our activities."
In response to questions from The Intercept on Tuesday, the NSA played down the alterations. Thomas Groves, a spokesperson for the agency, said: "It's nothing more than a website update, that's all it is."
Top photo: Adm. Mike Rogers, director of the National Security Agency, testifies about the Fiscal Year 2018 budget request for U.S. Cyber Command during a House Armed Services Committee hearing on Capitol Hill in Washington, D.C., on May 23, 2017.
Ransomware attack 'like having a Tomahawk missile stolen', says Microsoft boss | Technology | The Guardian
This is Homeland Security mother fuckers. NSA. Shadowbrokers
I've had unusual traffic from Ukraine and Virginia. Amazon thinks I'm in the UK and they have 8 devices registered via AWS.
NO WAY IN HELL IS TRUMP CAPABLE OF HANDLING THE SITUATION.
Me, a nobody in Nashville managed to blow several transformers and tap apparently interrupt emergency response system and trigger a lock down in New York City when my iPhone was stolen at the Genius Bar next to Trump Tower by a Israeli "?" who followed me for days.
My iPhone was stolen on 9/11 at the Apple Store and they had the nerve to tell me the GPS location feature was just a glitch they fixed.
How stupid do I fucking look?
I immediately went to Director of Academic Computing who knew I was the target of a targeted attack that revealed every university file and user on the University mainframe.
At that point the entire University went into DDoS and I broke into tears.
I was down thousands of dollars and my life felt threatened being followed by Hebrew and followed me around until right after my phone went missing.
I was surrounded black SUV with Hebrew Lettering on the side and the closed the intersection under the guise of a bomb threat.
That's when I started doubting Israel and wondered why NYC had Israeli military type police in the USA.
Until I got back to Nashville and found a Black SUV a few feet from my apartment in the hood and I learned of the Israeli Art students and the Israeli Spies with New Zealand passports and realized no one was going to help me now.
The police didn't respond when a Nazi threw a brick through my window and attempted to run me over when that didn't kill me.
There were at least 30 witnesses and none were interviewed or subpoenaed despite the Mayor and chief of police demanding an internal affairs investigation.
Ransomware attack 'like having a Tomahawk missile stolen', says Microsoft boss
Brad Smith says 'WannaCry' virus attack that locked up to 200,000 computers in 150 countries is a 'wake-up call' amid fears more will be hit as week begins
Guardian staff and agencies
The massive ransomware attack that caused damage across the globe over the weekend should be a "wake-up call" for governments, the president of Microsoft has said.
Security officials around the world are scrambling to find who was behind the attack which affected 200,000 computer users and closed factories, hospitals and schools by using malicious software that believed to have been stolen from the US National Security Agency.
Europol, the pan-European Union crime-fighting agency, said the threat was escalating and predicted the number of "ransomware" victims was likely to grow across the private and public sectors as people returned to work on Monday.
But Brad Smith, Microsoft president's and chief legal officer, said on Sunday that it was the latest example of why the stockpiling of vulnerabilities by governments was such a problem.
Smith, whose company's older system software such as Windows XP was exploited by the ransomware, wrote in a blog post : "The governments of the world should treat this attack as a wake-up call," Smith wrote. "We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits."
"An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen."
Cyber security experts said the spread of the virus dubbed WannaCry had slowed but that the respite might only be brief amid fears it could cause new havoc on Monday when employees return to work.
New versions of the worm are expected, they said, and the extent – and economic cost – of the damage from Friday's attack were unclear.
"It's going to be big, but it's too early to say how much it's going to cost because we still don't know the magnitude of the attacks," said Mark Weatherford, an security executive whose previous jobs included a senior cyber post with the US Department of Homeland Security.
The investigations into the attack were in the early stages, and attribution for cyber attacks is notoriously difficult.
US President Donald Trump on Friday night ordered his homeland security adviser, Tom Bossert, to convene an "emergency meeting" to assess the threat posed by the global attack, a senior administration official told Reuters.
Senior US security officials held another meeting in the White House situation room on Saturday, and the FBI and the National Security Agency were working to help mitigate damage and identify the perpetrators of the attack, said the official, who spoke on condition of anonymity to discuss internal deliberations.
The NSA is widely believed to have developed the hacking tool that was leaked online in April and used as a catalyst for the ransomware attack.
Infected computers appear to largely be out-of-date devices that organisations deemed not worth the price of upgrading or, in some cases, machines involved in manufacturing or hospital functions that proved too difficult to patch without possibly disrupting crucial operations, security experts said.
Marin Ivezic, cyber security partner at PwC, said that some clients had been "working around the clock since the story broke" to restore systems and install software updates, or patches, or restore systems from backups.
Microsoft released patches last month and on Friday to fix a vulnerability that allowed the worm to spread across networks, a rare and powerful feature that caused infections to surge on Friday.
Code for exploiting that bug, which is known as "Eternal Blue", was released on the internet in March by a hacking group known as the Shadow Brokers. The group said it was stolen from a repository of NSA hacking tools. The agency has not responded to requests for comment.
Hong Kong-based Ivezic said that the ransomware was forcing some more "mature" clients affected by the worm to abandon their usual cautious testing of patches "to do unscheduled downtime and urgent patching, which is causing some inconvenience".
He declined to identify clients that had been affected.
The head of the European Union police agency said on Sunday the cyber assault hit 200,000 victims in at least 150 countries and that number would grow when people return to work on Monday.
"At the moment, we are in the face of an escalating threat. The numbers are going up, I am worried about how the numbers will continue to grow when people go to work and turn (on) their machines on Monday morning," Europol director Rob Wainwright told Britain's ITV.
Monday was expected to be a busy day, especially in Asia which may not have seen the worst of the impact yet, as companies and organisations turned on their computers.
"Expect to hear a lot more about this tomorrow morning when users are back in their offices and might fall for phishing emails" or other as yet unconfirmed ways the worm may propagate, said Christian Karam, a Singapore-based security researcher.
Associated Press and Reuters contributed to this story
Since you're here …
… we have a small favour to ask. More people are reading the Guardian than ever but advertising revenues across the media are falling fast. And unlike many news organisations, we haven't put up a paywall – we want to keep our journalism as open as we can. So you can see why we need to ask for your help. The Guardian's independent, investigative journalism takes a lot of time, money and hard work to produce. But we do it because we believe our perspective matters – because it might well be your perspective, too.
I appreciate there not being a paywall: it is more democratic for the media to be available for all and not a commodity to be purchased by a few. I'm happy to make a contribution so others with less means still have access to information. Thomasine F-R.
If everyone who reads our reporting, who likes it, helps fund it, our future would be much more secure. For as little as $1, you can support the Guardian – and it only takes a minute. Thank you.
The NHS is working to bring its systems back online after it became the highest-profile victim of a global ransomware attack and faced renewed concern about the strength of its infrastructure.
The National Cyber Security Centre (NCSC) said teams were "working round the clock" in response to the attack, which resulted in operations being cancelled, ambulances being diverted and documents such as patient records made unavailable in England and Scotland.
Computers at hospitals and GPs surgeries in the UK were among tens of thousands hit in almost 100 countries by malware that appeared to be using technology stolen from the National Security Agency in the US. It blocks access to any files on a PC until a ransom is paid.
The British prime minister, Theresa May, and NHS Digital said they were not aware of any evidence patient records had been compromised in Friday's attack, which is thought to have affected computers in nearly 100 countries.
May said: "This is not targeted at the NHS, it's an international attack and a number of countries and organisations have been affected."
Amber Rudd, the home secretary, refused to confirm on Saturday morning whether patient data had been backed up, and said the NHS would upgrade its software in the wake of the attack. She said data "should" be backed up, but would not say whether it actually had been.
The shadow health secretary, Jonathan Ashworth, urged the government to be "clear about what's happened", describing the attack as "terrible news and a real worry for patients".
The unprecedented attacks, using software called WanaCrypt0r 2.0 or WannaCry, exploits a vulnerability in Windows. Microsoft released a patch – a software update that fixes the problem – for the flaw in March, but computers that had not installed the security update were vulnerable.
In December it was reported that nearly all NHS trusts were using an obsolete version of Windows for which Microsoft had stopped providing security updates in April 2014. Data acquired by software firm Citrix under freedom of information laws suggested 90% of trusts were using Windows XP, then a 15-year-old system.
It is not known how many computers across the NHS today are still using Windows XP or recent variants Windows 8 and Windows 10.
About 40 NHS organisations are though to have been affected by Friday's bug, which was released the day after a doctor warned that NHS hospitals needed to be prepared for an incident precisely of the kind seen.
In an article published in the British Medical Journal, Dr Krishna Chinthapalli, a neurology registrar at the National Hospital for Neurology and Neurosurgery in London, said hospitals "will almost certainly be shut down by ransomware this year".
Ross Anderson, of Cambridge University, said the "critical" software patch released earlier this year may not have been installed across NHS computers. "If large numbers of NHS organisations failed to act on a critical notice from Microsoft two months ago, then whose fault is that?" Anderson said.
Alan Woodward, a visiting professor of computing at the University of Surrey, said the attack's success was "likely to be because some organisations have either not applied the patch released by Microsoft, or they are using outdated operating systems."
NHS Digital said on Friday night it was unable to comment on the suggestion.
Marco Cover, a systems security researcher, said critics should take into account the complexity of keeping systems up to date. "It's easy to blame people who don't upgrade," he said. "But in practice things are often more complicated: operations teams may not touch legacy systems for a number of reasons. In some cases they may even be unaware that such legacy systems are running in their infrastructure."
The same malicious software that hit NHS networks attacked some of the largest companies in Spain and Portugal, including phone company Telefónica, and has also been detected on computers in Russia, Ukraine and Taiwan among other countries. The international shipping company FedEx was also affected.
Kaspersky Lab, a cybersecurity company based in Moscow, estimated that 45,000 attacks had been carried out in 99 countries, mostly in Russia. In a blogpost, it added that the totals could be "much, much higher".
In the UK, computers in hospitals and GP surgeries simultaneously received a pop-up message demanding a ransom in exchange for access to the PCs.
A warning was circulated on Friday within at least one NHS trust of "a serious ransomware threat currently in circulation throughout the NHS", but the attack proved impossible to stop. Patient records, appointment schedules, internal phone lines and emails were rendered inaccessible and connections between computers and medical equipment were brought down. Staff were forced to turn to pen and paper and to use their own mobile phones.
Last year the government established the NCSC to spearhead the country's defences. In the three months after the centre was launched, there were 188 "high-level" attacks as well as countless lower-level incidents. The chancellor, Philip Hammond, disclosed in February that the NCSC had blocked 34,550 potential attacks targeting UK government departments and members of the public in six months.
Theresa May: 'This is not targeted at the NHS, it's an international attack' – video
The Patients Association condemned the criminals behind Friday's attack, and said lessons from earlier incidents had not been learned. "It has long been known that the NHS struggles with IT in multiple respects and that this includes serious security problems," it said.
Infected computers show a message demanding a $300 (£233) ransom per machine to be paid to a Bitcoin wallet address. It says: "Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.
"You only have three days to submit the payment. After that the price will be doubled. Also if you don't pay in seven days, you won't be able to recover your files forever."
NHS Digital confirmed that a "number of NHS organisations" had been affected and refused to confirm or deny reports that put the total as high as 40. "The investigation is at an early stage but we believe the malware variant is Wanna Decryptor," it said. "At this stage, we do not have any evidence that patient data has been accessed. We will continue to work with affected organisations to confirm this.
"NHS Digital is working closely with the National Cyber Security Centre, the Department of Health and NHS England to support affected organisations and to recommend appropriate mitigations."
British law enforcement agencies said they believed the attack was criminal in nature, as opposed to a cyber-attack by a foreign power, and was being treated as serious but without national security implications.
One NHS worker, who asked to remain anonymous, said the attack began at about 12.30pm and appeared to have been the result of phishing. "The computers were affected after someone opened an email attachment. We get a lot of spam and it looks like something was sent to all the trusts in the country. Other hospitals have now been warned not to open these emails – all trusts communicate with each other."
Another NHS worker, who works at an Essex hospital and also asked to remain anonymous, said her team's computers went down at about 2pm. "We were told to shut down, take out network cables and unplug the phones," she said. "A message came up for just one of our team about the fact that all the files would be wiped in two hours unless we gave $300 in bitcoins."
Dr Chris Mimnagh, a GP in Liverpool, said his surgery had "severed links" to the wider NHS network as a precaution. He said: "Unable to access our clinical system – as a precaution our area has severed links to the wider NHS, which means no access to our national systems, no computers means no records, no prescriptions, no results. We are dealing with urgent problems only. Our patients are being very understanding so far."
Lorina Nash, 46, from Hertfordshire, was bringing her mother for an appointment at Lister hospital in Stevenage when systems went down. "We have been here since 12.30pm and the computers were affected at about 12pm – patients are still waiting around but most of the A&E patients have been sent to other hospitals. I have never seen accident and emergency so empty.
"They gave my mum a blood test but have had to send her blood to Cambridge by courier for testing. They said it could take two or three hours before it comes back with a result."
Dr Asif Munaf, a gastroenterologist at Chesterfield hospital, said there was a backlog of patients in its A&E, which he said had been badly affected because it was unable to book new patients on the system.
"From my ward's point of view, we're not able to make referrals to, for example, psychiatry because they use a different system to us," he said. "Everything's getting delayed. Patients who were supposed to go home this afternoon won't go home until Monday because they now won't be seen and get a follow-up plan. It's quite unfortunate for the patients."
Dr Christopher Richardson, the head of the cybersecurity unit at Bournemouth University, said the process of recovering the NHS's IT systems would involve a painful and longwinded "deep strip" of affected computers.
"You go down to the basic machine, you take everything off it, you reconfigure it and then you build it back up again," he said. "If you're talking national health, you're talking a lot of machines on a single site and you've got to get them all because these nasty pieces of malware, they float around, so they only have to remain on one machine and when you reboot it will deliver the same thing again."
Trump FCC Moves Forward Plans to Gut Lifeline Program and Strand Millions on the Wrong Side of the Digital Divide
WASHINGTON — The FCC voted along party lines on Thursday to move forward plans to eviscerate the Lifeline program, which provides a modest $9.25 monthly subsidy to most recipients so that millions of poor people can connect to communications services.
The agency's Republican leadership voted to advance a proceeding to consider, among other things, implementing a budget cap, which would arbitrarily limit program participation or slash funding to fully eligible recipients.
Subsequent FCC proposals even float the possibility of a lifetime benefits cap that would arbitrarily cut off funding for the most vulnerable users, such as elderly people and people with disabilities, by limiting the amount of time an individual can use the program.
The proposal also eliminates program participation by "non-facilities-based providers," including four of the top five Lifeline providers, accounting for more than half of the program's current expenditures. This would likely eventually zero out participation by providers serving more than 70 percent of current Lifeline beneficiaries — and would have an immediate impact on Lifeline service to tribal territories as the FCC moves to eliminate resellers on tribal lands.
In some parts of the country, non-facilities-based carriers are the only ones offering service. They tend to serve the most vulnerable communities — whom large facilities-based carriers have long shunned — and they've provided a level of competition that's led to better services at the same $9.25 subsidy.
The FCC majority gave no rationale for its attack — aside from vague rhetoric about program abuse and fraud. This assault on Lifeline comes in spite of the significant reforms the FCC has begun under prior administrations to streamline the program, efforts that are still underway and already having a positive impact.
Lifeline was created during the Reagan administration to help the most vulnerable people in the United States gain access to communications services that meet their basic needs. It was updated under the George W. Bush administration to allow coverage for wireless phones, and then under the Obama administration to include explicit subsidies for internet service. On his first day as FCC chairman, Ajit Pai claimed that bridging the digital divide was a top priority of his administration.
Free Press Deputy Director and Senior Counsel Jessica J. González made the following statement:
"Let's be crystal clear about what's happening here. Three privileged FCC officials — Chairman Ajit Pai, and Commissioners Mike O'Rielly and Brendan Carr — plan to eliminate affordable phone and internet-access options for millions of poor Americans.
"They're doing this over the objections of Native American tribal leaders, poor people, single moms, unhoused people, people of color, elderly people, victims of natural disasters, veterans and people with disabilities, all of whom will be disproportionately harmed by this extreme FCC proposal.
"They're racing ahead despite the bipartisan objections from Senate and House leaders, who have heard from concerned constituents that this will harm their ability to search for jobs, advance their education, meet their basic needs and stay informed.
"These three commissioners will claim that their action helps close the digital divide, but that's a lie. What they're actually doing is giving breaks to rich companies while taking from the poor — and in this case, even taking away business options for the smaller companies that serve the Lifeline population. As one housing advocate told me not long ago in Los Angeles, 'The trickle down doesn't trickle down to Skid Row.'
"Pai, O'Rielly and Carr allege that such action is necessary to quell waste, fraud and abuse in the program. This rhetoric about fraud is overblown and has racist undertones. The FCC has already moved in 2016 and earlier to address these issues. Chairman Pai should implement the reforms put in place by his predecessors, not starve the program.
"Tonight these three men will return home to their families, who have food, clothes, internet access and a place to rest their heads. They will kick off this holiday season in comfort and warmth while the less fortunate have to endure their cruel decision to rip a path to upward mobility out of their hands."
I can't tell you how much I miss having someone like you in my life. Someone I can have deep intellectual conversations with; someone I can be honest with without judgment; someone who knows all of my dark and brings out all of my light.
I've spent many years looking, and I've been in relationships with some really brilliant and wonderful men, but I never developed a bond with any of them like I did with you. I've had that "crazy love" with others.
You and I had it all for a while. That crazy love, sexual chemistry, infatuation, mutual respect and so much more. Paramount was the deep friendship and bond we had beneath it all. I've missed that the most and I've missed you more than you could ever know.
I know we can't be together and that you are in love with another woman and as much as that hurts, I need you every bit as much today as I did so many years ago. And perhaps even more so now that I'm dealing with a very severe and terrifying healthcare crisis.
I don't want to pressure you, guilt you or shame you into giving me anything more than what you are comfortable with or capable of handling. I know you have a lot on your plate, and the last thing I want is disingenuous words telling me things you think I want to hear or because you feel pity for me due to the rapid onset of such a severe medical condition, but if you do care about me after all we've been through, I need to know and I need to know now.
When I said, "tell me you love me" the other day, I was playing. I would never want you to say anything out of pity, guilt or obligation and I promise you I'm strong enough to fight this battle on my own; but it would be so much easier if I had a Safe place to share my thoughts, fears, and experience with.
Please tell me if I'm asking too much. I know we can never be involved as intimately as we once were. Not only do I respect and commend your commitment to your family; after all, it was one of the reasons I fell in love with you and what made me want to spend my life with you so many years ago.
Just know that I love you now as much as I did then and have a deeper respect for you knowing that you turned out to be the husband and father I also believed you would be.
As always, I love you.
I love all of your dark and all of your light and hope you can continue to share both sides with me and everything in between.
You're safe with me. I promise you with every fiber of my being, your dreams, your secrets, your desires, frustrations, regrets, hopes, and your reality are all safe with me.
