5 ms·

Serious security breach hits EU police agency

112 points by isaacfrond 3y ago

lenerdenator 3y ago
I find myself wondering if Russia, China, Iran, North Korea, wherever see the same security breaches that the West seems to be suffering. Probably wouldn't hear as much about it due to their governments clamping down on any media that suggests these places have any sort of flaws, but you'd think the CIA/DIA, MI6, DGSE, etc. would be having at least some success.
- alephnerd 3y ago
  There have been notable examples recently in Russia [0][1], and most likely similar attempts in China as well. A lot of Iran's nuclear scientists keep finding bullets in their heads for some mysterious reason. > Probably wouldn't hear as much about it due to their governments clamping down on any media that suggests these places have any sort of flaws It comes up but most western news organizations skimp on translation services now and don't really follow Russian/Mandarin/Farsi/etc language media. There's a reason why American news channels keep quoting English speaking Global Times instead of Mandarin language sources [0] - https://www.reuters.com/technology/russias-fsb-says-us-nsa-penetrated-thousands-apple-phones-spy-plot-2023-06-01/ https://www.reuters.com/technology/russias-fsb-says-us-nsa-p... [1] - https://www.reuters.com/world/us-justice-department-says-it-disrupted-russian-intelligence-hacking-network-2024-02-15/ https://www.reuters.com/world/us-justice-department-says-it-...
  - sam_lowry_ 3y ago
    Navalny and many others used leaked databases of banks, mobile companies, airlines, delivery companies and even law enforcement for many years to run their investigations. Such leaks were pervasive in Russia until very recently, when the risks to leakers accrued. Most of the time, these databases were leaked not to independent investigators but to crooks of all kinds to take on credits, spy on cheaters, steal property from the elderly, etc. This went even further in Belarus, where the civil society crowd-sourced an online database of pretty much everyone who was involved in 2020 rigged elections, from school officials to members of special forces. Check for yourself at https://blackmap.org/ https://blackmap.org/
    - junaru 3y ago
      I would encourage everyone to use translate on https://blackmap.org/ https://blackmap.org/ and judge for themselves. In my humble opinion its just a politically charged map where everyone not sharing the same political affiliation are being doxxed. I can read a bit Cyrillic and the language is informal and full of prejudice, stuff like: > sniched so hard he got recognised by the regime And the link leads to https://t.me/nexta_tv/21342 https://t.me/nexta_tv/21342 where the text translates: > Cops began to reward informers with certificates. This is done in order to encourage Christianity. > The regime cultivates the worst in people. No one likes informers and traitors, but for the junta they are useful fools who help them in the war against the people. > It was such "Stakhanovites" as Anatoly Bambiza, who received a certificate for denunciations of BCH flags in windows, who betrayed Jews and partisans to the Nazis. Everyone knows what awaited them at the end of the war. > So a jar of jam and a pack of cookies from punishers is a mark, as well as state awards to rapists and propagandists. When Lukashenko plays in the box, such a letter certainly does not bode well. This is neither civil nor objective and just illustrates the pettiness of both sides.
      - lupusreal 3y ago
        Yikes. It's hard to believe the people who compiled this list were careful and diligent with their research before leveling accusations when they're outright threatening to enact vigilante justice.
        sam_lowry_ 3y ago
        You just don't know the situation on the ground, and it is so different from your personal experience, this could have easily been a political satire or science fiction to you. People who compiled this are in exile, together with roughly 300,000 out of 9,000,000 population. The state is engaged in a never ending, ever deepening violence against the rest of the population. The above website is a weak deterrent, but better this than nothing.
  - wolverine876 3y ago
    > most western news organizations skimp on translation services now and don't really follow Russian/Mandarin/Farsi/etc language media By what standard are they 'skimping'? Did they used to translate those sources? In the past I've done a lot of looking into non-English journalism and never found many translations, unless it was done by the publication itself (e.g., it might translate some articles or have an English edition).
    - alephnerd 3y ago
      American (and also British, Canadian, etc) News Bureaus used to have Foreign Offices in Beijing, Moscow, Tehran, etc that had staff that spoke the regional language and would monitor regional language news. All this changed due to cost cutting in the 2000s-2010s. Most foreign news is now contracted out to freelancers or Press Bureaus like Reuters (who also use freelancers).
      - wolverine876 3y ago
        I see what you mean. As a minor addition: The major national / international journalism orgs, such as the NY Times, CNN, etc., still have them. The NY Times publishes a Chinese-language edition. https://cn.nytimes.com/ https://cn.nytimes.com/
        alephnerd 3y ago
        > major national / international journalism orgs, such as The NY Times Barely. The NYT's Beijing bureau has maybe 10-11 people total, of which only 4-6 are actually editors and journalists, and half of them are Westerners. Most of the China related content is made in their HK outpost which itself only has like 13 reporters and editors, of whom almost all are Westerners. Most of their China sourcing comes from their parntership with the SCMP for printing and publishing the NYT in Mainland China and HK [0], and most of NYT's China and HK staff are concurrently employed by the SCMP. It's a similar story in their Russia (4-6) and India (4) bureaus. These numbers are barely enough to report on a small town, let alone federalized countries in the hundreds of millions or even billions Even the NYT depends on unnamed freelance reporters to source stories. The person who's name is on the byline basically stitched the research the freelancers did for them. It's the same story for WaPo, CNN, BBC, Guardian, WSJ, etc. For anything Asia, I prefer reading Japanese, Singaporean, or HK sourced business news as organizations like Nikkei/FT, Straits Times, and SCMP have a massive presence across Asia, and built networks since the 1970s when Japan began it's "Flying Geese" policy. [0] - https://corp.scmp.com/scmp-enters-printing-deal-with-international-new-york-times/ https://corp.scmp.com/scmp-enters-printing-deal-with-interna...
- pphysch 3y ago
  There is no evidence that the West has ever suffered anything as serious and sophisticated as STUXNET.
nik736 3y ago
Will they pay a GDPR fine as well?
- betaby 3y ago
  Government agencies exempted themselves from GDPR and similar. That was discussed on HN in context of the break in Ireland.
  - cess11 3y ago
    Really? https://www.edps.europa.eu/press-publications/press-news/press-releases/2024/european-commissions-use-microsoft-365-infringes-data-protection-law-eu-institutions-and-bodies_en https://www.edps.europa.eu/press-publications/press-news/pre...
    - District5524 3y ago
      GDPR article 2.2-2.3 does define some exceptions. National law enforcement agencies etc. are subject to a similar directive (LED, https://eur-lex.europa.eu/eli/dir/2016/680/oj https://eur-lex.europa.eu/eli/dir/2016/680/oj). Union bodies, just like in your link yet another (article 2.3), but also quite similar (Regulation (EU) 2018/1725, https://eur-lex.europa.eu/eli/reg/2018/1725/oj https://eur-lex.europa.eu/eli/reg/2018/1725/oj) Eurojust belongs to this one. It's a good thing to have EDPS, otherwise it would be much easier to legislate things nobody can comply with in practice. But for most countries, it doesn't make much sense to fine other authorities. (Unfortunately, national security services are not subject to GDPR or LED at all - the only place you can get protection from them is under national law, Charter of the Fundamental Rights, ECHR etc.)
      - cccbbbaaa 3y ago
        > Unfortunately, national security services are not subject to GDPR or LED at all They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?
pelorat 3y ago
So they have no cameras in that room? crazy
alephnerd 3y ago
[flagged]
- d-z-m 3y ago
  > Before anyone jumps in with "Rust solves all security problems" evangelism (love the language, hate the evangelists) Seems a bit odd to go out of your way to bash rust evangelists on a completely unrelated thread, especially when the nobody in the comments has mentioned rust at all.
- lol768 3y ago
  > Before anyone jumps in with "Rust solves all security problems" evangelism I have literally never seen this on a post not about memory corruption issues.
  - denton-scratch 3y ago
    It was a joke.
  - tialaramex 3y ago
    There are quite a few cases where people say "Rust wouldn't have fixed" this and they're a real mixed bag of whether that's right or wrong or hard to say, partly because in fact Rust's safety culture isn't just about memory safety. So e.g. there are some logic bugs where you're like yeah, I'd totally write that same bug in Rust but there are also arithmetic bugs where the problem arises because C++ inherits C's um, exciting "integer promotion" rules and Rust doesn't have those, far more of such situations in a Rust codebase are going to cause a puzzled programmer to investigate what really is going on with these integers and not write the bug. Or there are type safety bugs where in Rust that mistake just won't compile, but in C++ it will compile it just has astonishing results. Obviously you can't write those bugs in Rust. There's also a lot of contribution from ergonomics considerations where Rust's "Empowering everyone" idea means they think about library and feature design not just from the perspective of an expert but also a beginner, someone learning or maybe familiar with the rest of the language but not this particular feature. In C++ sort() is the unstable sort, if you don't know what unstable sorting is, you're given no clue that this might have consequences which astonish you. In Rust that sort is still there, but it's named sort_unstable() -- cuing a novice to read up about this idea before they are surprised. If they just write sort() they get a stable sort instead.
ericyd 3y ago
The article really does not add much interesting info beyond the headline
- j16sdiz 3y ago
  The article told me it was a hard copy; the headline don't.
  - BelleOfTheBall 3y ago
    To be fair, the article probably gives all the details it can, what do people expect? They can't share information that they don't have or that the police aren't willing to divulge. Not every piece of news will have an in-depth look at a recent event.
mortadelo991 3y ago
[flagged]
santiagobasulto 3y ago
[flagged]
- dns_snek 3y ago
  The companies are not allowed to abuse our data without our consent, how awful. Install uBlock Origin along with optional annoyance filters and you'll almost never see a banner again.

112 points by isaacfrond 3y ago

I find myself wondering if Russia, China, Iran, North Korea, wherever see the same security breaches that the West seems to be suffering. Probably wouldn't hear as much about it due to their governments clamping down on any media that suggests these places have any sort of flaws, but you'd think the CIA/DIA, MI6, DGSE, etc. would be having at least some success.

alephnerd 3y ago
There have been notable examples recently in Russia [0][1], and most likely similar attempts in China as well. A lot of Iran's nuclear scientists keep finding bullets in their heads for some mysterious reason. > Probably wouldn't hear as much about it due to their governments clamping down on any media that suggests these places have any sort of flaws It comes up but most western news organizations skimp on translation services now and don't really follow Russian/Mandarin/Farsi/etc language media. There's a reason why American news channels keep quoting English speaking Global Times instead of Mandarin language sources [0] - https://www.reuters.com/technology/russias-fsb-says-us-nsa-penetrated-thousands-apple-phones-spy-plot-2023-06-01/ https://www.reuters.com/technology/russias-fsb-says-us-nsa-p... [1] - https://www.reuters.com/world/us-justice-department-says-it-disrupted-russian-intelligence-hacking-network-2024-02-15/ https://www.reuters.com/world/us-justice-department-says-it-...
- sam_lowry_ 3y ago
  Navalny and many others used leaked databases of banks, mobile companies, airlines, delivery companies and even law enforcement for many years to run their investigations. Such leaks were pervasive in Russia until very recently, when the risks to leakers accrued. Most of the time, these databases were leaked not to independent investigators but to crooks of all kinds to take on credits, spy on cheaters, steal property from the elderly, etc. This went even further in Belarus, where the civil society crowd-sourced an online database of pretty much everyone who was involved in 2020 rigged elections, from school officials to members of special forces. Check for yourself at https://blackmap.org/ https://blackmap.org/
  - junaru 3y ago
    I would encourage everyone to use translate on https://blackmap.org/ https://blackmap.org/ and judge for themselves. In my humble opinion its just a politically charged map where everyone not sharing the same political affiliation are being doxxed. I can read a bit Cyrillic and the language is informal and full of prejudice, stuff like: > sniched so hard he got recognised by the regime And the link leads to https://t.me/nexta_tv/21342 https://t.me/nexta_tv/21342 where the text translates: > Cops began to reward informers with certificates. This is done in order to encourage Christianity. > The regime cultivates the worst in people. No one likes informers and traitors, but for the junta they are useful fools who help them in the war against the people. > It was such "Stakhanovites" as Anatoly Bambiza, who received a certificate for denunciations of BCH flags in windows, who betrayed Jews and partisans to the Nazis. Everyone knows what awaited them at the end of the war. > So a jar of jam and a pack of cookies from punishers is a mark, as well as state awards to rapists and propagandists. When Lukashenko plays in the box, such a letter certainly does not bode well. This is neither civil nor objective and just illustrates the pettiness of both sides.
    - lupusreal 3y ago
      Yikes. It's hard to believe the people who compiled this list were careful and diligent with their research before leveling accusations when they're outright threatening to enact vigilante justice.
      - sam_lowry_ 3y ago
        You just don't know the situation on the ground, and it is so different from your personal experience, this could have easily been a political satire or science fiction to you. People who compiled this are in exile, together with roughly 300,000 out of 9,000,000 population. The state is engaged in a never ending, ever deepening violence against the rest of the population. The above website is a weak deterrent, but better this than nothing.
- wolverine876 3y ago
  > most western news organizations skimp on translation services now and don't really follow Russian/Mandarin/Farsi/etc language media By what standard are they 'skimping'? Did they used to translate those sources? In the past I've done a lot of looking into non-English journalism and never found many translations, unless it was done by the publication itself (e.g., it might translate some articles or have an English edition).
  - alephnerd 3y ago
    American (and also British, Canadian, etc) News Bureaus used to have Foreign Offices in Beijing, Moscow, Tehran, etc that had staff that spoke the regional language and would monitor regional language news. All this changed due to cost cutting in the 2000s-2010s. Most foreign news is now contracted out to freelancers or Press Bureaus like Reuters (who also use freelancers).
    - wolverine876 3y ago
      I see what you mean. As a minor addition: The major national / international journalism orgs, such as the NY Times, CNN, etc., still have them. The NY Times publishes a Chinese-language edition. https://cn.nytimes.com/ https://cn.nytimes.com/
      - alephnerd 3y ago
        > major national / international journalism orgs, such as The NY Times Barely. The NYT's Beijing bureau has maybe 10-11 people total, of which only 4-6 are actually editors and journalists, and half of them are Westerners. Most of the China related content is made in their HK outpost which itself only has like 13 reporters and editors, of whom almost all are Westerners. Most of their China sourcing comes from their parntership with the SCMP for printing and publishing the NYT in Mainland China and HK [0], and most of NYT's China and HK staff are concurrently employed by the SCMP. It's a similar story in their Russia (4-6) and India (4) bureaus. These numbers are barely enough to report on a small town, let alone federalized countries in the hundreds of millions or even billions Even the NYT depends on unnamed freelance reporters to source stories. The person who's name is on the byline basically stitched the research the freelancers did for them. It's the same story for WaPo, CNN, BBC, Guardian, WSJ, etc. For anything Asia, I prefer reading Japanese, Singaporean, or HK sourced business news as organizations like Nikkei/FT, Straits Times, and SCMP have a massive presence across Asia, and built networks since the 1970s when Japan began it's "Flying Geese" policy. [0] - https://corp.scmp.com/scmp-enters-printing-deal-with-international-new-york-times/ https://corp.scmp.com/scmp-enters-printing-deal-with-interna...
pphysch 3y ago
There is no evidence that the West has ever suffered anything as serious and sophisticated as STUXNET.

nik736 3y ago

Will they pay a GDPR fine as well?

betaby 3y ago
Government agencies exempted themselves from GDPR and similar. That was discussed on HN in context of the break in Ireland.
- cess11 3y ago
  Really? https://www.edps.europa.eu/press-publications/press-news/press-releases/2024/european-commissions-use-microsoft-365-infringes-data-protection-law-eu-institutions-and-bodies_en https://www.edps.europa.eu/press-publications/press-news/pre...
  - District5524 3y ago
    GDPR article 2.2-2.3 does define some exceptions. National law enforcement agencies etc. are subject to a similar directive (LED, https://eur-lex.europa.eu/eli/dir/2016/680/oj https://eur-lex.europa.eu/eli/dir/2016/680/oj). Union bodies, just like in your link yet another (article 2.3), but also quite similar (Regulation (EU) 2018/1725, https://eur-lex.europa.eu/eli/reg/2018/1725/oj https://eur-lex.europa.eu/eli/reg/2018/1725/oj) Eurojust belongs to this one. It's a good thing to have EDPS, otherwise it would be much easier to legislate things nobody can comply with in practice. But for most countries, it doesn't make much sense to fine other authorities. (Unfortunately, national security services are not subject to GDPR or LED at all - the only place you can get protection from them is under national law, Charter of the Fundamental Rights, ECHR etc.)
    - cccbbbaaa 3y ago
      > Unfortunately, national security services are not subject to GDPR or LED at all They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?

pelorat 3y ago

So they have no cameras in that room? crazy

alephnerd 3y ago

[flagged]

d-z-m 3y ago
> Before anyone jumps in with "Rust solves all security problems" evangelism (love the language, hate the evangelists) Seems a bit odd to go out of your way to bash rust evangelists on a completely unrelated thread, especially when the nobody in the comments has mentioned rust at all.
lol768 3y ago
> Before anyone jumps in with "Rust solves all security problems" evangelism I have literally never seen this on a post not about memory corruption issues.
- denton-scratch 3y ago
  It was a joke.
- tialaramex 3y ago
  There are quite a few cases where people say "Rust wouldn't have fixed" this and they're a real mixed bag of whether that's right or wrong or hard to say, partly because in fact Rust's safety culture isn't just about memory safety. So e.g. there are some logic bugs where you're like yeah, I'd totally write that same bug in Rust but there are also arithmetic bugs where the problem arises because C++ inherits C's um, exciting "integer promotion" rules and Rust doesn't have those, far more of such situations in a Rust codebase are going to cause a puzzled programmer to investigate what really is going on with these integers and not write the bug. Or there are type safety bugs where in Rust that mistake just won't compile, but in C++ it will compile it just has astonishing results. Obviously you can't write those bugs in Rust. There's also a lot of contribution from ergonomics considerations where Rust's "Empowering everyone" idea means they think about library and feature design not just from the perspective of an expert but also a beginner, someone learning or maybe familiar with the rest of the language but not this particular feature. In C++ sort() is the unstable sort, if you don't know what unstable sorting is, you're given no clue that this might have consequences which astonish you. In Rust that sort is still there, but it's named sort_unstable() -- cuing a novice to read up about this idea before they are surprised. If they just write sort() they get a stable sort instead.

ericyd 3y ago

The article really does not add much interesting info beyond the headline

j16sdiz 3y ago
The article told me it was a hard copy; the headline don't.
- BelleOfTheBall 3y ago
  To be fair, the article probably gives all the details it can, what do people expect? They can't share information that they don't have or that the police aren't willing to divulge. Not every piece of news will have an in-depth look at a recent event.

mortadelo991 3y ago

[flagged]

santiagobasulto 3y ago

[flagged]

dns_snek 3y ago
The companies are not allowed to abuse our data without our consent, how awful. Install uBlock Origin along with optional annoyance filters and you'll almost never see a banner again.