CIA's "Facebook" Program Dramatically Cut Agency's Costs

from Onion News Network Season 1 Episode 9

Stop the Internet Blacklist Legislation

This is primarily for my visitors in the United States...but serves as a good example of how NOT to write Internet legislation for my international visitors. Let's keep it open and free folks.

https://blacklist.eff.org/

The Internet blacklist legislation—known as PROTECT IP Act (PIPA) in the Senate and Stop Online Piracy Act (SOPA) in the House—invites Internet security risks, threatens online speech, and hampers innovation on the Web. Urge your members of Congress to reject this Internet blacklist campaign in both its forms! Read More

TEDxBrussels: Mikko H. Hypponen - Defending the Net

"Privacy is implied. Privacy is not up for discussion. This is not a question between privacy against security. It is a question of freedom against control. And while we might trust our governments, right now, right here in 2011. Any rights we give away will be given away for good. And do we trust...do we blindly trust any future government, a government we might have 50 years from now. And these are the questions that we have to worry about for the next 50 years."
-Mikko H. Hypponen

Ai Weiwei - 'Shame on Me'

http://www.spiegel.de/international/world/0,1518,799302,00.html

The Chinese artist Ai Weiwei speaks about the changes in his life since the end of his detention in June and shows himself moved and surprised by a new culture of protest in his country.

--------------------------------------------------

Ai Weiwei is a Chinese contemporary artist. Ai collaborated with Swiss architects Herzog & de Meuron as the artistic consultant on the Beijing National Stadium (Bird's Nest) for the 2008 Olympics. As political activist, he has been highly and openly critical of the Chinese Government's stance on democracy and human rights. He has investigated government corruption and cover-ups, in particular the Sichuan schools corruption scandal following the collapse of so-called "tofu-skin schools" in the 2008 Sichuan earthquake.

Such an awesome interview by Der Spiegel.

China's Great Firewall Tests Mysterious Scans On Encrypted Connections

Via Forbes (Andy Greenberg) -

In the cat-and-mouse game between Chinese censors and Internet users, the government seems to be testing a new mousetrap–one that may be designed to detect and block tunnels through its Great Firewall even when the data in those tunnels is aimed at a little-known computer and obscured by encryption.

In recent months, administrators of services with encrypted connections designed to allow users secure remote access say they’ve seen strange activity coming from China: When a user from within the country attempts to reach a server abroad, a string of seemingly random data hits the destination computer before he or she can connect, sometimes followed by that user’s communication being mysteriously dropped.

The anti-censorship and anonymity service Tor, for instance, has found that many of its “bridge nodes”–privately-placed servers around the world designed to connect users to the rest of Tor’s public network of traffic re-routing computers–have become inaccessible to Chinese users within hours or even minutes of being set up, according to Andrew Lewman, the project’s executive director. Users have told him that other censorship circumvention services like Ultrasurf and Freegate have seen similar problems, he says. “Someone will try to connect, then there’s a weird scan, and the bridge stops working,” says Lewman. “We see weird things all the time, but this is a semi-consistent weird thing, and it’s only coming from China.”

Lewman believes that China’s internet service providers may be testing a new system that, rather than merely block IP addresses or certain Web pages, attempts to identify censorship circumvention tools by preceding a user’s connection to an encrypted service with a probe designed to reveal something about what sort of service the user is accessing. “It’s like if I tell my wife I’m going bowling with my friends, and she calls the bowling alley ahead of time to see if that’s what I’m really doing,” says Lewman. “It’s verifying that you’re asking for what you seem to be asking for.”

But so far, Lewman says Tor’s developers haven’t determined how that probe is able to see what’s an encrypted connection to a Tor server and what’s merely a connection to an encrypted banking or ecommerce site, which in theory should both look to a snooping government like indecipherably scrambled web traffic. The Chinese government after all, wouldn’t be likely to block all encrypted connections, such as corporate VPNs, Lewman points out. “If Foxconn were disconnected from Apple, that would be big problem,” he says.

In the mean time, only a small fraction of Tor’s Chinese users are experiencing the issue, implying that it may be just a subset of Chinese broadband providers experimenting with the new tool, says Lewman.

China's Internet Users Targeted in Online Rumour Probes

Via BBC -

China is intensifying restrictions on internet use after official reports revealed that three people have been "punished for spreading false rumours" online.

Authorities say they are carrying out inquiries into other suspected cases.

The news comes just over a week after Communist Party leaders agreed a list of "cultural development guidelines".

They include increased controls over social media and penalties for those spreading "harmful information".

The Xinhua news agency quotes regulators as saying that efforts will be stepped up "to stop rumours and punish individuals and websites spreading rumours".

It says a university student was detained after being accused of posting a fake news story about a man killing eight village chiefs in the south-western province of Yunnan.

It goes on to report that a website editor was issued with a warning after publishing a story about an air force fighter crash without confirming the facts.

And it says that a Shanghai resident was held in police custody for 15 days after accusations he had posted a falsified income tax document online.

The agency says China has 485 million registered web users.

"We have seen a tightening of control under the Hu Jintao government," said Sarah McDowall, Asia-Pacific regional manager at IHS Global Insight.

"Officials are particularly worried by the rise in popular protests and will have observed the fall of Gaddafi last week. With China facing a leadership change next year, the government feels it cannot soften its stance."

German 'Government' R2D2 Trojan FAQ

Via Naked Security Blog (Sophos) -

What has happened?

A Trojan horse has been discovered that is capable of spying on Skype internet calls, monitoring the online activity of infected computers, logging keystrokes, and updating its functionality via the net. The Trojan, which most anti-virus vendors are calling "R2D2", but is also referred to as "0zapftis" or "Bundestrojaner", was announced by the famous Chaos Computer Club (CCC).

Why is the Trojan called R2D2?

The name comes from a string of characters embedded inside the Trojan's code: C3PO-r2d2-POE

Where did the CCC get the malware from?

German lawyer Patrick Schladt has told the media that the Trojan horse was found on the hard disk of one of his client's computers.

The malware was allegedly installed onto the computer as it passed through customs control at Munich Airport.

Schaldt was defending his client against charges that fall under German law related to pharmaceuticals.

When the suspect and his legal team examined the digital evidence against them they found evidence that suggested a Trojan had been present - and the hard disk was shared with the CCC with the permission of Schladt's client.

The CCC were able to use forensic software to restore deleted files from the hard drive, uncovering the R2D2 Trojan horse.

Why is the Trojan so newsworthy?

The CCC implies that the malware was created for, and is being used by, German law enforcement authorities such as the BKA and LKA. Furthermore, Schaldt claims that the Customs department was also involved in the planting of the malware.

[...]

Shouldn't you guys work with the law enforcement agencies and deliberately not detect their malware?

We detect all the malware that we know about - regardless of who its author may be. So, SophosLabs adds protection against attacks on our customers' computers regardless of whether they may be state-sponsored or not.

If you think about it - there is no sensible alternative. What's to stop a cybercriminal commandeering a law enforcement Trojan and using it against an innocent party?

Our customers' protection comes first. If the authorities want us to not detect their malware, the onus is on them to try to write something that we can't detect, not for us to cripple our software.

---------------------------------------------------------------------------------------------

Several German States Admit Use of Controversial Spy Software
http://www.dw-world.de/dw/article/0,,15449054,00.html

Three additional German states have admitted to deploying spyware in order to investigate serious criminal offenses, according to regional media sources.

The interior ministers of the states of Baden-Württemberg, Brandenburg and Lower Saxony said that regional police had used the software within the parameters of the law. In Lower Saxony, the software has been in use for two years, according to the public broadcaster NDR.

Authorities in Brandenburg, meanwhile, told the daily Berliner Morgenpost that they are currently using the spyware in a single, on-going investigation. Baden-Württemberg has also used such software to investigate "individual cases," according to the Badische Zeitung.

Officials in the southern German state of Bavaria were the first to confirm late Monday that their agencies have been using a spyware program since 2009. It remains unclear whether all four states had been using the same software or not.

-------------------------------------------------------------------------------

On Oct 10th, Microsoft added signatures for the R2D2 trojan, following the lead of most other AV vendors.

Three samples outlined by Sophos on VirusTotal...

Sample 1: SHA-1 = 7bd8d737460c1dbbfc4b250fb1b6b906ed643a2d
Sample 2: SHA-1 = e4f07b5a443cd99fd45cb5e1445ac2c1be4b455e
Sample 3: SHA-1 = a6a0f45180f5b3390ee2ef21fe4b89813ed641f4

Iran Blocks Tor; Tor Releases Same-day Fix

Via Tor Project -

Yesterday morning (in our timezones — that evening, in Iran), Iran added a filter rule to their border routers that recognized Tor traffic and blocked it. Thanks to help from a variety of friends around the world, we quickly discovered how they were blocking it and released a new version of Tor that isn't blocked. Fortunately, the fix is on the relay side: that means once enough relays and bridges upgrade, the many tens of thousands of Tor users in Iran will resume being able to reach the Tor network, without needing to change their software.

[...]

There are plenty of interesting discussion points from the research angle around how this arms race should be played. We're working on medium term and longer term solutions, but in the short term, there are other ways to filter Tor traffic like the one Iran used. Should we fix them all preemptively, meaning the next time they block us it will be through some more complex mechanism that's harder to figure out? Or should we leave things as they are, knowing there will be more blocking events but also knowing that we can solve them easily? Given that their last blocking attempt was in January 2011, I think it's smartest to collect some more data points first.

Diginotar: Iranians – The Real Target

Via TrendLabs Malware Blog -

In this blog posting, we present concrete evidence that the recent compromise of Dutch Certification Authority Diginotar was used for spying on Iranian Internet users on a large scale.

We found that Internet users in more than 40 different networks of ISPs and universities in Iran were confronted with rogue SSL certificates issued by Diginotar. Even worse: we found evidence that some Iranians who used software designed to circumvent censorship and snooping on traffic were not protected against the massive man-in-the-middle attack.

[...]

On August 29 2011, the rogue Google.com SSL certificate issued by Diginotar was discovered. This rogue certificate makes snooping on Gmail traffic possible in man-in-the-middle attacks. Trend Micro has concrete evidence that these man-in-the-middle attacks happened indeed on a large scale in Iran.

[...]

Attack Targeted Iranian Users

For domain validation.diginotar.nl, we see a very remarkable pattern in recent weeks: it was mostly loaded by Dutch and Iranian Internet users until August 30, 2011. Domain name validation.diginotar.nl is used by Internet browsers to check the authenticity of SSL certificates that are issued by Diginotar. Diginotar is a small Dutch Certification Authority with customers mainly in the Netherlands. We therefore expect that this domain name is requested by mostly Dutch Internet users and perhaps a handful of users from other countries. Not by a lots of Iranians.

From analysis of Smart Protection Network data, we see that a significant part of Internet users who loaded the SSL certificate verification URL of Diginotar were from Iran on August 28, 2011. On August 30, 2011 most traffic from Iran disappeared and on September 2, 2011 about all of the Iranian traffic was gone and Diginotar received mostly Dutch Internet users, as expected.

These aggregated statistics from Trend Micro Smart Protection Network clearly indicates that Iranian Internet users were exposed to a large scale man-in-the-middle attack, where SSL encrypted traffic can be decrypted by a third party. For example: a third party probably was able to read all e-mail communication an Iranian Internet user has sent with his Gmail account.

Closer analysis of our data revealed even more alarming facts: we have seen that outgoing proxy nodes in the US of anti-censorship software made in California were sending web rating requests for validation.diginotar.nl to the cloud servers of Trend Micro. Very likely this means that Iranian citizens, who were using this anti censorship software, were victims of the same man-in-the-middle attack. Their anti-censorship software should have protected them, but in reality their encrypted communications were probably snooped on by a third party.

--------------------------------------------------------------------------------------

cui bono?

Who has the most to gain from spying on everyday normal Iranians inside Iran?

The Iranian government would be the most likely answer.

Pakistani Government Warns ISPs to Block Encrypted Traffic / VPNs

Via Softpedia -

Pakistan's The Express Tribune reports that the Pakistan Telecommunication Authority (PTA) has sent warning notices to ISPs about the continuous use of encrypted virtual private networks.

"In line with [Monitoring & Reconciliation of International Telephone Traffic] Regulations 2010 and national security, Authority prohibited usage of all such mechanisms including encrypted virtual private networks (EVPNs) which conceal communication to the extent that prohibits monitoring. It is observed that the aforementioned directive has not been followed in true letter and spirit as EVPNs are heavily being used on the Licensees Network," reads a letter received by one ISP.

The new telecom law, which was adopted in July, is meant to make it harder for militants to use secure communications and easier for national security agencies to monitor them. Unfortunately, these regulations affect all Internet users in the country and if the government go as far as to block all forms of encryption, including HTTPS, they might have serious effects.

"The problem is that banning every sort of 'communications concealing' technology online would destroy the very fabric of the internet's law-abiding use. There would be no SSH, no SSL, no TLS, no HTTPS. There would be no Wi-Fi security. Online commerce would implode," writes Sophos security expert Paul Ducklin.

Nissan LEAF Cars Leaks Speed, Position, Destination to RSS Feeds

Via H-Online -

A developer has found that the in-car electronics on the Nissan LEAF all-electric car leaks telemetry information to RSS feeds. The in-car electronics, CARWINGS, allows drivers to access their own selected RSS feeds which are then read to them.

But when Casey Halverson added his own feeds to the system, he found that his Apache server logs held more than just a request for the RSS data. The GET request for the RSS feed also included his latitude, longitude, speed, direction, and destination latitude and longitude.

"All of these lovely values are being provided to any third party RSS provider you configure" writes Halverson; there are no warnings that this information is being sent and it is not possible to disable it. The information is only provided when the RSS feed is requested, so it cannot be used as a vehicle tracker but it does offer real-time snapshots. The IP address shown for the request appears to belong to Hitachi Automotive Systems in Japan, which may indicate that the RSS request is being proxied by a Nissan data center; whether this will make the problem easier to fix is unclear.

Halverson has created a demonstration RSS feed for LEAF drivers which will read back the details that are being leaked. He has also created a "less evil" RSS feed which will give weather information for the car's current location. The issue is a good demonstration of the next generation of privacy problems.

---------------------------------------------------------------------

I think Nissan has some serious explaining to do...

Time to pull that Privacy officer out of HR / Marketing and get him/her into the engineering side of the house too ;)

EFF: How to Disable Facebook's Facial Recognition Feature & Control Photo Tagging

EFF shows you three ways to delete your facial fingerprint data from Facebook and shows you a privacy setting that lets you ensure that you are the only person who can see tags identifying you in photographs.

-----------------------------------------------------

As always Facebook would "love" for everyone to share everything with the world (and with them), therefore this new feature is enabled by default (aka opt-out).

Privacy advocates and security professionals [i.e. those paid to be paranoid] and Europe greatly prefer features which are disabled by default (aka opt-in).

Mobile App Privacy Continued…

Via Veracode ZeroDay Labs Blog -

The blog post we made earlier this week entitled, Mobile Apps Invading Your Privacy, gives detail around the information being requested by the advertisement libraries embedded inside a popular online radio application. There have been a number of great posts and comments that got us thinking more about the issues and the types of data being requested.

First off we want to thank some people who commented about the Pandora application not having permission to actually access the GPS on the device. Below are the Manifest permissions for the version of Pandora currently in the Google Application Marketplace:

• Full Internet Access
• Create Bluetooth Connections
• Read Contact Data
• Add or Modify Calendar Data and Send Emails to Guests
• Read Phone State and Identity
• Modify Global System Settings
• Prevent Device from Sleeping
• Bluetooth Administration
• Change Wifi State
• Change Network Connectivity

As you can see, GPS access is NOT included in that list. There was an error in the original post we made stating that some of the library code was requesting permissions from the Google system for GPS access, and as the commenter pointed out, that is incorrect. The code snippet we posted is only checking whether the parent application, Pandora in this case, has permission to access the GPS. If the parent does not have permission, the accessing of GPS data can’t occur.

However, the overarching theme of the original post is still valid. If Pandora had required GPS access for a legitimate reason, the embedded advertisement library would have been able to request the GPS data and send it off device. As we mentioned in the original post, there is a chance that Pandora has no idea what the embedded advertising library actually does, simply taking it from the advertising partner and embedding it into their application.

Mobile Apps Invading Your Privacy

Via Veracode ZeroDay Labs Blog -

An article in the Wall Street Journal, dated April 5, 2011, disclosed that Federal prosecutors in New Jersey are investigating numerous smart phone application manufacturers for allegedly, illegally obtaining and distributing personal private information to third party advertisement groups. The allegations state that mobile applications are gathering data such as GPS location, device identifiers, gender, and even user age without proper notice or authorization from the end user. The Journal tested 101 applications and found that 56 of them transmitted the device unique identifier off the device, while 47 transmitted the phone’s location. Five of the tested applications leaked personal information such as user gender and age.

Analysis

The folks at the Veracode research team decided to spend a bit of our time today breaking apart one of the accused applications to see what could be found within the code. Given what was written in the Journal article, we thought it would be most interesting to take an in-depth look through the Pandora application for the Android platform. A quote from the article states the following about the Pandora application:

In Pandora’s case, both the Android and iPhone versions of its app transmitted information about a user’s age, gender, and location, as well as unique identifiers for the phone, to various advertising networks. Pandora gathers the age and gender information when a user registers for the service.

[...]

Conclusion

So what does this mean to the end user? It means your personal information is being transmitted to advertising agencies in mass quantities. As more and more “free” applications attempt to monetize their offerings, we will likely see more of your personal information being shuttled out to marketing and advertising data aggregation firms. The application developers may not even be aware of the privacy violations they are introducing by using third party advertising libraries. They may merely think they are getting $x per ad impression, not that the ad library is leaking significant information about the user.

In isolation some of this data is uninteresting, but when compiled into a single unifying picture, it can provide significant insight into a persons life. Consider for a moment that your current location is being tracked while you are at your home, office, or significant other’s house. Couple that with your gender and age and then with your geolocated IP address. When all that is placed into a single basket, it’s pretty easy to determine who someone is, what they do for a living, who they associate with, and any number of other traits about them. I don’t know about you, but that feels a little Orwellian to me.

Information Warfare Monitor: RIM Monitoring Project

http://www.infowar-monitor.net/2010/10/information-warfare-monitor-citizen-lab-and-secdev-group-announces-rim-monitoring-project/

Recently a number of governments have threatened to ban Research in Motion’s BlackBerry services if the company does not make encrypted BlackBerry data and other content available to state authorities. A major concern of these regimes is that BlackBerry data can be encrypted and routed through servers located outside of their jurisdictions. Unconfirmed reports have circulated that RIM has made data sharing agreements with India and Saudi Arabia and the United Arab Emirates. Other countries are also requesting the company locate data centres within their jurisdictions.

The RIM Check (https://rimcheck.org/) Web site is a research project designed to gather information on how traffic exits the BlackBerry network depending on the country in which the user is located. The findings from this project will be published and made publicly available.

The project is being conducted by the Information Warfare Monitor and the Web site is maintained by the Citizen Lab at the Munk School of Global Affairs, University of Toronto.

----------------------------------------------------------------------------------------------------------------------------

In other UAE and Blackberry news....

Canadian BlackBerry maker Research In Motion (RIM) has signed a new agreement with the UAE's Telecommunications Regulatory Authority (TRA) and telecom service providers etisalat and du to enable advanced e-government services in the country.

Eavesdropping on Smart Homes with Distributed Wireless Sensors

Via Bruce Schneier -

"Protecting your daily in-home activity information from a wireless snooping attack," by Vijay Srinivasan, John Stankovic, and Kamin Whitehouse:

Abstract: In this paper, we first present a new privacy leak in residential wireless ubiquitous computing systems, and then we propose guidelines for designing future systems to prevent this problem. We show that we can observe private activities in the home such as cooking, showering, toileting, and sleeping by eavesdropping on the wireless transmissions of sensors in a home, even when all of the transmissions are encrypted. We call this the Fingerprint and Timing-based Snooping (FATS) attack. This attack can already be carried out on millions of homes today, and may become more important as ubiquitous computing environments such as smart homes and assisted living facilities become more prevalent. In this paper, we demonstrate and evaluate the FATS attack on eight different homes containing wireless sensors. We also propose and evaluate a set of privacy preserving design guidelines for future wireless ubiquitous systems and show how these guidelines can be used in a hybrid fashion to prevent against the FATS attack with low implementation costs.

The group was able to infer surprisingly detailed activity information about the residents, including when they were home or away, when they were awake or sleeping, and when they were performing activities such as showering or cooking. They were able to infer all this without any knowledge of the location, semantics, or source identifier of the wireless sensors, while assuming perfect encryption of the data and source identifiers.

Hadopi: Will France Spy on You?

Via ESET Threat Blog -

Apparently France has some new legislation surrounding pirated software. I applaud reasonable approaches to combating piracy, but it appears that France may be ready to make public the answer to the question “Will Anti-virus ignore government Trojan horse programs?”

I first saw the story at Slashdot and the story was picked up from TechDirt. If this is true it could pit the rest of the European Union and virtually the entire antivirus industry against France.

Hadopi refers to both the High Authority for Copyright Protection and Dissemination of Works on the Internet legislation and the French governmental organization tasked with enforcing France’s new law. Already most of the European Union has indicated that they feel the law violates the EU constitution. The technical specifications of a plan to enforce the Hadopi law were leaked and appear to call out for software, that most reasonable people would call spyware, to be installed upon the computers of French Citizens.

[...]

The very nature of heuristics is such that the program is likely to be detected even if signatures do not detect it, unless the program is white listed. I doubt that AV companies are going to white list such a program.

To anyone with a slight degree of sophistication it is obvious that the criminal element would exploit vulnerabilities in the software so as to take over the spyware, whether it is to harm the user or to interfere with the government.

The idea is almost certain to be doomed from the start and is almost certainly only an excuse for some bureaucrats to waste French tax payer’s money pretending that they were actually doing anything at all. It appears that this idea is not uniquely mine.

Project Grey Goose: Identify Governments with RIM Encryption Keys

http://greylogic.us/2010/08/03/new-project-grey-goose-task-identify-governments-with-rim-encryption-keys/

I recently wrote a post for Forbes.com on how Research In Motion has quietly been making deals to provide encryption keys to the Russian and Chinese governments, with India in the queue for a set as well, while the UAE and Saudi Arabia are threatening to kick RIM out of their respective countries unless they get the same access.

My issue with this is not that RIM is abiding by the laws of the nation within whose borders they want to conduct business. That’s what companies do – Google’s dealings with China being the latest example. The issue that has prompted this Project Grey Goose investigation is RIM’s lack of transparency regarding which governments have the ability to monitor their customers message traffic and which do not. That is a critical bit of data for enterprise blackberry users to know who, by virtue of their place of employment, are high value targets for cyber attacks including espionage by state or state-sponsored actors.

Research In Motion executives are invited to provide an accurate accounting at any time. In the meantime, if you’d like to participate in discovering which other countries have the ability to decrypt your Blackberry’s email or other encrypted messages, please let me know via the Contact button on this website.

Saudi Telco Regulator To Ban BlackBerry Messenger Service

Via WSJ.com -

Saudi Arabia's telecom watchdog has ordered telecom firms operating in the kingdom to stop BlackBerry messenger services later this month, an official said Sunday, hours after regulators in the United Arab Emirates said they would prohibit some BlackBerry services from October.

The Communications and Information Technology Commission, or CITC, issued a memo to operators asking them to block the service, the official, who asked not to be named, told Zawya Dow Jones. He declined to give a reason for the ban.

The United Arab Emirates telecom regulator said earlier Sunday it would prohibit BlackBerry instant messaging, email and Internet-browsing services starting Oct. 11 amid an ongoing dispute between Canada's Research In Motion (RIMM, RIM.T), the maker of the device, and U.A.E. officials over the monitoring of data.

Abdulrahman Mazi, a board member of state-controlled Saudi Telecom Co. (7010.SA) confirmed the watchdog's action to Dubai-based Al Arabiya television, adding that he hoped the move is "only a kind of pressure on [Blackberry maker] Research In Motion to take steps to provide information when needed."

Saudi Telecom alone has about 400,000 Blackberry users in the kingdom, while its other two rivals have about 290,000 customers in total. "CITC is adding its voice to the growing concerns over monitoring Blackberry Messenger service," said Asim Shuja Bukhtiar, senior investment analyst at Riyad Capital.

"The broader issue is regulatory concerns around email and web browsing--this in our view can impact operators' corporate customers and business travelers to the region. Eventually, RIM may come around to providing some sort of monitoring mechanism," he said.

------------------------------------------------------

Basically SA and UAE are unhappy because they are unable to break the RIM encryption and spy on their citizens...errr, I mean monitor the mobile activity of their citizens. ;)

NSA: 'Perfect Citizen' is a Research Program

Via ComputerWorld.com -

The U.S. National Security Agency confirmed the existence of a controversial program aimed at protecting the country's critical infrastructure Thursday, but disputed claims that the program would monitor network traffic on critical infrastructure networks.

The program, called Perfect Citizen, was first disclosed Thursday in a Wall Street Journal article that said the NSA "would rely on a set of sensors deployed in computer networks for critical infrastructure that would be triggered by unusual activity."

Raytheon won the US$100 million contract for the first phase of Perfect Citizen, which is funded by the Comprehensive National Cybersecurity Initiative, the Journal reported.

In a statement released late Thursday, the NSA confirmed that Perfect Citizen exists. But the spy agency called the newspaper's description "inaccurate," saying that the program is "purely a vulnerabilities-assessment and capabilities-development contract."

"This is a research and engineering effort," the NSA said. "There is no monitoring activity involved, and no sensors are employed in this endeavor."

"This contract provides a set of technical solutions that help the National Security Agency better understand the threats to national security networks, which is a critical part of NSA's mission of defending the nation," the NSA said. "Any suggestions that there are illegal or invasive domestic activities associated with this contracted effort are simply not true."

Raytheon declined to comment.

--------------------------------------

According to the WSJ article...

"The overall purpose of the [program] is our Government...feel[s] that they need to insure the Public Sector is doing all they can to secure Infrastructure critical to our National Security," said one internal Raytheon email, the text of which was seen by The Wall Street Journal. "Perfect Citizen is Big Brother."