6 ms·

I once worked in the Commission, briefly. Technical security seemed to be non-existent as far as I could tell (in an admittedly very junior role). Once all of

I once worked in the Commission, briefly. Technical security seemed to be non-existent as far as I could tell (in an admittedly very junior role). Once all of the interns got invited to the U.S. embassy to meet the Ambassador (some guy who literally said he got the job because he was friends with Obama). On the way out the nice embassy staff gave us goodie-bags, complete with handy pen drives... Basically everyone was giving away free pen drives in Brussels then. I would be surprised to find that the U.S. didn't already have access to a large number of EU institution computers.

throwaway47748 7y ago
And I work at a European cybersecurity company and we are routinely tasked to inspect USB drives and devices EU politicians receive at conferences, so I guess we've come full circle. I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them.
- blub 7y ago
  What kind of tools do you use for that? Would they catch BadUSB-like malware?
  - throwaway47748 7y ago
    Lasers, electron microscopes and x-ray scanners used for testing and verification in the semiconductor manufacturing industry plus loads of custom and open source tools.
    - pletsch 7y ago
      Can it really be economically viable to have these scanned rather than just toss them out? I would imagine that anyone high enough in the EU to be a target is only using drives provided to them
      - saber6 7y ago
        I think it’s a given they don’t plug them in. I assume forensics is to determine who is trying to get at you, via what methods.
      - dmos62 7y ago
        It's not so much about being able to use a free USB drive; more about knowing if someone is distributing malware.
      - throwaway47748 7y ago
        The economical viability of things is way above my pay grade but if I were to hazard a guess it could be just to know who is "out to get you" or it could also be one of many forms of corporate welfare the same way the US shovels money into the F-35 bonfire to keep its arms industry afloat, the EU could be doing similar thing to keep its own security critical industries going, especially since Snowden. My €0.02
    - Zenst 7y ago
      Yes, x-ray scanners seem to of made big inroads and only recently I learned that companies use them to verify phones as in the past they would visual check them - but copies have gotten so good that xray is the only real way now. Though even then, you have to have something to compare it with and also know what you are looking at and able to eliminate what should and shouldn't be there. Though when you have multilayer flash, the possibility to have a nefarious layer, sandwiched between good layers, makes things way harder. All that said, as a rule, I'd just downright ban any non-company/entity USB drive or any tech. Keyboards and Mice, more so.
- Mirioron 7y ago
  >I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them. Why not? The US was found to be spying on Merkel and nothing seemed to come from that.
  - piinthesky 7y ago
    Brexit wasnt known to them then. Now the EU has just lost a major source of income so the EU are waking up from their socialist utopian dream. You snooze you looze!
- bambataa 7y ago
  That's a good point. How much tracing back can be done if, say, I stuck the drive in my workstation and it proliferated over the DG's intranet? Assuming it's at least vaguely sophisticated wouldn't it obfuscate things like how long it's been on the system for?
heymijo 7y ago
> some guy who literally said he got the job because he was friends with Obama There are two kinds of U.S. ambassadors: 1) Career foreign service people 2) Friends of the presidential administration at the time Examples of the latter aren't hard to find. Off the top of my head I'm familiar with William Timken, a US businessman who was appointed Ambassador to Germany by George W. Bush because he was a huge supporter [0,1]. Colloquially we could say he got the job because "he was a friend of Bush." I remember being surprised to learn that US Ambassadors were (maybe still are) individually responsible for paying for a good part of their formal duties as Ambassadors(eg throwing parties, travel, etc). So historically, having wealthy people in the role was a requisite. I gleaned this from reading "In the Garden of Beasts" by Erik Larson [2]. The bits I have cobbled together suggest there is an interesting history surrounding the practice of selecting and acting as a US Ambassador. [0] https://2001-2009.state.gov/outofdate/bios/t/53349.htm https://2001-2009.state.gov/outofdate/bios/t/53349.htm [1] https://www.spiegel.de/international/spiegel/us-german-relations-how-bush-s-berlin-ambassador-pick-profited-from-protective-tariffs-against-german-companies-a-367881.html https://www.spiegel.de/international/spiegel/us-german-relat... [2] https://www.goodreads.com/book/show/9938498-in-the-garden-of-beasts https://www.goodreads.com/book/show/9938498-in-the-garden-of...
- yardie 7y ago
  All US ambassadorships are political appointment, therefore option 2 is the only answer. These positions are almost always ceremonial. They are there to execute the will of the president. The real work is done by the diplomats who are appointed through the US Foreign Service office. They do the actual work of the embassies.
  - Seenso 7y ago
    > All US ambassadorships are political appointment, therefore option 2 is the only answer. These positions are almost always ceremonial. They are there to execute the will of the president. Not really, a foreign service officer can be appointed by a president to be an ambassador. A recent example from the news is Marie Yovanovitch. In regular times, my impression was that foreign service officers were appointed to the more difficult and critical ambassadorships (e.g. Ambassador to the USSR), and friends of the president were appointed to "easy" ambassadorships (e.g. to a staunch ally with a fashionable capital).

throwaway47748 7y ago

And I work at a European cybersecurity company and we are routinely tasked to inspect USB drives and devices EU politicians receive at conferences, so I guess we've come full circle. I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them.

blub 7y ago
What kind of tools do you use for that? Would they catch BadUSB-like malware?
- throwaway47748 7y ago
  Lasers, electron microscopes and x-ray scanners used for testing and verification in the semiconductor manufacturing industry plus loads of custom and open source tools.
  - pletsch 7y ago
    Can it really be economically viable to have these scanned rather than just toss them out? I would imagine that anyone high enough in the EU to be a target is only using drives provided to them
    - saber6 7y ago
      I think it’s a given they don’t plug them in. I assume forensics is to determine who is trying to get at you, via what methods.
    - dmos62 7y ago
      It's not so much about being able to use a free USB drive; more about knowing if someone is distributing malware.
    - throwaway47748 7y ago
      The economical viability of things is way above my pay grade but if I were to hazard a guess it could be just to know who is "out to get you" or it could also be one of many forms of corporate welfare the same way the US shovels money into the F-35 bonfire to keep its arms industry afloat, the EU could be doing similar thing to keep its own security critical industries going, especially since Snowden. My €0.02
  - Zenst 7y ago
    Yes, x-ray scanners seem to of made big inroads and only recently I learned that companies use them to verify phones as in the past they would visual check them - but copies have gotten so good that xray is the only real way now. Though even then, you have to have something to compare it with and also know what you are looking at and able to eliminate what should and shouldn't be there. Though when you have multilayer flash, the possibility to have a nefarious layer, sandwiched between good layers, makes things way harder. All that said, as a rule, I'd just downright ban any non-company/entity USB drive or any tech. Keyboards and Mice, more so.
Mirioron 7y ago
>I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them. Why not? The US was found to be spying on Merkel and nothing seemed to come from that.
- piinthesky 7y ago
  Brexit wasnt known to them then. Now the EU has just lost a major source of income so the EU are waking up from their socialist utopian dream. You snooze you looze!
bambataa 7y ago
That's a good point. How much tracing back can be done if, say, I stuck the drive in my workstation and it proliferated over the DG's intranet? Assuming it's at least vaguely sophisticated wouldn't it obfuscate things like how long it's been on the system for?

heymijo 7y ago

> some guy who literally said he got the job because he was friends with Obama There are two kinds of U.S. ambassadors: 1) Career foreign service people 2) Friends of the presidential administration at the time Examples of the latter aren't hard to find. Off the top of my head I'm familiar with William Timken, a US businessman who was appointed Ambassador to Germany by George W. Bush because he was a huge supporter [0,1]. Colloquially we could say he got the job because "he was a friend of Bush." I remember being surprised to learn that US Ambassadors were (maybe still are) individually responsible for paying for a good part of their formal duties as Ambassadors(eg throwing parties, travel, etc). So historically, having wealthy people in the role was a requisite. I gleaned this from reading "In the Garden of Beasts" by Erik Larson [2]. The bits I have cobbled together suggest there is an interesting history surrounding the practice of selecting and acting as a US Ambassador. [0] https://2001-2009.state.gov/outofdate/bios/t/53349.htm https://2001-2009.state.gov/outofdate/bios/t/53349.htm [1] https://www.spiegel.de/international/spiegel/us-german-relations-how-bush-s-berlin-ambassador-pick-profited-from-protective-tariffs-against-german-companies-a-367881.html https://www.spiegel.de/international/spiegel/us-german-relat... [2] https://www.goodreads.com/book/show/9938498-in-the-garden-of-beasts https://www.goodreads.com/book/show/9938498-in-the-garden-of...

yardie 7y ago
All US ambassadorships are political appointment, therefore option 2 is the only answer. These positions are almost always ceremonial. They are there to execute the will of the president. The real work is done by the diplomats who are appointed through the US Foreign Service office. They do the actual work of the embassies.
- Seenso 7y ago
  > All US ambassadorships are political appointment, therefore option 2 is the only answer. These positions are almost always ceremonial. They are there to execute the will of the president. Not really, a foreign service officer can be appointed by a president to be an ambassador. A recent example from the news is Marie Yovanovitch. In regular times, my impression was that foreign service officers were appointed to the more difficult and critical ambassadorships (e.g. Ambassador to the USSR), and friends of the president were appointed to "easy" ambassadorships (e.g. to a staunch ally with a fashionable capital).