Category: Digital investigations and Forensics

What happened to Hacking Team neither is the first nor will be the last time a security company that lives by the sword, dies by the sword. Neither this is the first nor will be the last time that huge quantity of critical data are made available through the Internet.

So, to some extent, there is actually nothing new under the sun in the fact itself. This is why – putting aside the legal issues involved – I can hardly understand all the rants aimed at Hacking Team.

It is interesting, though, analyze the “claims” that some “expert” did about the story. To make my points, instead of talking about someone in particular, I’d rather refer in general to the accusations made against HT, so:

1. Hacking Team has been “unethical”. A company is just supposed to be legally compliant. Ethic is a horse of different colours: it’s a personal thing, is relative and – thank to the French Revolution – is not mixed with laws. As soon as Hacking Team didn’t break any law by selling its stuff, it can’t be blamed because “money doesn’t smell”.
2. Hacking Team sold its technology to human-rights bashing countries. While I’m in the digital rights world since 1994, I wasn’t aware that there were so much human-rights (keybord) warriors… Anyway, as soon a state has a seat in UN, and the sell is compliant to international laws and treaties (such as the Wassenaar Agreement), doing business with it shouldn’t raise any concern (as international weapon dealers are well aware of.)
3. Hacking Team has jeopardized investigations and covert activities all around the world. No, the investigation have been jeopardized by the choice made by governments of “going private” instead of developing in house its intelligence-gathering tools, and by the lack of a “Plan B” in case things – as just happened – screwed up. In particular, is rather curious that nobody checked the fact that the HT’slicense was associated to the customer identity in clear, instead of using a nickname or a cipher.
   
4. There will soon be a “black” Hacking Team’s software clone that will be used against the “good guys”. This malware is far from being the “only kid in town” and the Internet is full of brilliant (rogue) programmers able to build a “HT-like” software. So this statement is just a nonsense.
5. The are hints suggesting that ?Hacking Team’s malware has been exploited to plant fake evidence in the targeted computer. So what? Blackmailing is a standard tool-of-the-trade in the intelligence world and the way this is done is irrelevant. And to shut down the disturbing voice of a political opponent it’s easier to frame him with conventional means (drugs, sex) that are cheaper while very effective, then using a costly and complex to manage application.
6. Hacking Teams’s software is untraceable and now can and will be used without control. No, HT malware is not invincible and while it is able to fly under the antivirus’ radars, it doesn’t mean that there are no defense. Guess how you can reduce its’ might? Use pure text emails, don’t click links and attachments, check your machines and data-traffic for odd behaviours… In other words, stop using ? wisthle&bell operating systems and fancy features and go back to basics. Ain’t no fancy, but is safer.
7. Hacking Team helped intelligence agencies to gain access to everybody’s computer. Again, so what? Are intelligence agencies around the world supposed to play bridge, instead? As much as I dislike the fact, I cannot but pragmatically accept that the powers-that-be can do whatever they want, without actual accountability. They call it “democracy”.

—

Post Scriptum: Though I met David Vincenzetti about eighteen years ago at the Department of Computer Science in the Milan University and a couple of times in the following years, I never worked with or for him.

A significant part of the aftermath of an event is the so called “post mortem”: a thorough analysis of ? what went right, what wrong and why.

While “post-mortem” is a common practice within complex organizations and helps detecting flaws to be fixed or positive actions to be standardized, it must not be confused with the “rolling-barrell” attitude of putting the load of a (ex-post proven wrong) choice on somebody else’s shoulders.

As everybody outside the intelligence’s ? “inner circle” should, I neither claim to own the knowledge nor the expertise to assess the work’s quality and the assumed weakness of the French security system. But what I can say – relying upon my criminal trial lawyer experience – is that is always easier to find an explanation for something that happened once it happened, while it is very hard to “foresee” an event.

This is to say that once you know where to look for, the needle in the haystack is fairly easy to find. Or, put in other words, those who came late always look smarter than those who were there earlier: they already know where not to look at.

Whether the French intelligence services did a mistake or not, then, is of poor importance. Mistakes happens (much too) often and it wouldn’t be a surprise to discover that in the Charlie Hebdo massacre mistakes have been done.

But the best we can do is to learn from it, instead of publicly blaming people in the line of fire just for the sake of looking “smart”.