I couldn’t tweet a better description than the headline for this piece: After SolarWinds breach, lawmakers ask NSA for help in cracking Juniper cold case.

For those who haven’t heard this story, the context here is back in 2015 hackers broke into the source code repository of Juniper’s NetScreen firewalls and introduced serious vulnerabilities. 1/
Everyone has heard of the SolarWinds supply chain attack, but almost nobody outside our little community remembers Juniper. We don’t even know who the ultimate victim was. And there’s a reason for that. 2/
The reason is simple: following the Juniper hack, the FBI and Juniper put a tight lid on everything. Nobody, including members of Congress, were able to get straight answers about who did it or what the target was. So it vanished from our collective memory. 3/
This has real consequences. To some extent our lack of preparedness for SolarWinds is a direct result of our government’s decision to pretend that the previous major supply-chain attacks didn’t happen. 4/
Why has the Juniper attack been buried by secrecy? There are two possible answers. One has to do with the nature of the hack, which very likely repurposed an existing backdoor in NetScreen firewalls. The other has to do with the ultimate target. 5/
Regarding the first, we know that Juniper included a *likely* crypto backdoor based on an NSA algorithm called Dual_EC_DRBG even before the hack. We also know that the attackers repurposed that code to use new public keys of their choosing. This is very embarrassing. 6/
(We know this because people on Twitter and co-authors of mine were able to reverse engineer the details from the published firmware images. See here for a nice explanation. https://t.co/CPHw8oA6zA)
The second answer to “why was this buried” is much more speculative. It has to do with the identity of the actual target(s) that were attacked using the NetScreen vulnerabilities. We don’t know who they are, and they might be important. 8/
I continue to harbor the conspiracy theory that the Office of Personnel Management hack was in some way related to Juniper, based solely on the timing and some equipment manifests from that agency. I’m probably wrong, but that would be a hell of a reason to cover things up. 9/
The point here is that with attacks like this and a secrecy response, we’re screwed. Until we know what happened in these cases, we can’t learn from it. This makes us defenseless, and you can bet our adversaries prefer it that way. 10/
It’s as though the US government decided to react to Pearl Harbor by covering things up. You have to imagine that history would look a lot different. Hopefully we’ll stop making this mistake. //fin

More from Law

1/ After a good night's sleep, I have a few thoughts on the impending Ripple lawsuit.

Less schadenfreude, more "what now?" https://t.co/a0oTwblBHB


2/ First of all, the USG is going to lose.

I don't even need to read the complaint. They might force a settlement, but they're outclassed on legal.

Remember Ripple engaged former SEC Chair Mary Jo White in a civil matter in 2018. A hint of their

3/ Second, the USG should lose.

The SEC restrictions on non-accredited investors; the ridiculous Howey test; 80 year old securities law like the "40 Act" all need to die in fire. They are un-American and completely outdated.

I hope Ripple wins. (WUT?)

4/ Third, it's incumbent upon industry to self-police and hold the moral high ground.

I give certain individuals A's and others F's, but as a whole, the most powerful people and companies generally take a Swiss neutrality stance on assets.

So we're effectively in this together.

5/ We're "in this together" to draw lines of regulatory demarcation.

XRP as a "security" further hurts the U.S. businesses while global comps will continue to make these markets.

XRP as a security also means other assets will meet the same fate. At least Ripple has $ to fight.
High crime talk from Fredo


VA curfew


Sen. Grassley - Biden family investigated, potential financial crimes WW including China

Warning


March
One of the judges this story mentions is William Cassidy, who was promoted from an Atlanta IJ position to a BIA member position in 2019 by the Trump DOJ. Cassidy has an awful history that has been well-documented, but I'm still enraged reading this reporting.


The story notes that the EOIR Director served as an ICE attorney in Atlanta and practiced before Cassidy for years. And it points to FOIA records unearthed by Bryan Johnson showing they remain friendly.

A trove of complaints against Cassidy was published by AILA in 2019 after FOIA litigation. They generally show misconduct, substantiated in the record, followed by "written counseling" etc.

One way Cassidy could avoid discipline is by turning off the recording device during the hearing. If he made a lewd or offensive comment off the record, all the EOIR would do is listen to the recording. If it's not there, the complaint is "unsubstantiated" https://t.co/wUeBPEEbpV


In that case, Cassidy joked about a detained immigrant saying he missed his wife. The complaint was dismissed because the ACIJ found "no levity or joking" in the comment.

You May Also Like

My top 10 tweets of the year

A thread 👇

https://t.co/xj4js6shhy


https://t.co/b81zoW6u1d


https://t.co/1147it02zs


https://t.co/A7XCU5fC2m
THREAD: 12 Things Everyone Should Know About IQ

1. IQ is one of the most heritable psychological traits – that is, individual differences in IQ are strongly associated with individual differences in genes (at least in fairly typical modern environments). https://t.co/3XxzW9bxLE


2. The heritability of IQ *increases* from childhood to adulthood. Meanwhile, the effect of the shared environment largely fades away. In other words, when it comes to IQ, nature becomes more important as we get older, nurture less.
https://t.co/UqtS1lpw3n


3. IQ scores have been increasing for the last century or so, a phenomenon known as the Flynn effect. https://t.co/sCZvCst3hw (N ≈ 4 million)

(Note that the Flynn effect shows that IQ isn't 100% genetic; it doesn't show that it's 100% environmental.)


4. IQ predicts many important real world outcomes.

For example, though far from perfect, IQ is the single-best predictor of job performance we have – much better than Emotional Intelligence, the Big Five, Grit, etc. https://t.co/rKUgKDAAVx https://t.co/DWbVI8QSU3


5. Higher IQ is associated with a lower risk of death from most causes, including cardiovascular disease, respiratory disease, most forms of cancer, homicide, suicide, and accident. https://t.co/PJjGNyeQRA (N = 728,160)
I’m torn on how to approach the idea of luck. I’m the first to admit that I am one of the luckiest people on the planet. To be born into a prosperous American family in 1960 with smart parents is to start life on third base. The odds against my very existence are astronomical.


I’ve always felt that the luckiest people I know had a talent for recognizing circumstances, not of their own making, that were conducive to a favorable outcome and their ability to quickly take advantage of them.

In other words, dumb luck was just that, it required no awareness on the person’s part, whereas “smart” luck involved awareness followed by action before the circumstances changed.

So, was I “lucky” to be born when I was—nothing I had any control over—and that I came of age just as huge databases and computers were advancing to the point where I could use those tools to write “What Works on Wall Street?” Absolutely.

Was I lucky to start my stock market investments near the peak of interest rates which allowed me to spend the majority of my adult life in a falling rate environment? Yup.