North Korea’s senior leadership has been exploiting loopholes in international sanctions to obtain the U.S. technology that Pyongyang uses to conduct “destructive cyber operations,” according to a global cyberthreat intelligence company.

Recorded Future, based in Massachusetts, found that while export bans and restrictions are somewhat effective in keeping North Korea from acquiring technology for its nuclear weapons program, sanctions fail when it comes to regulating computer products from entering into North Korea.

“Because of the globalized nature of technology production and distribution, the traditional export control is not really working for [computer] technology,” said Priscilla Moriuchi, one of the authors of “North Korea Relies on U.S. Technology for Internet Operations.” “It may work quite well for ballistic missile parts or fissile material, but the system is not designed to limit technology transfer, and it’s not optimized for that.”

​Upcoming summit

In the report, Moriuchi and her co-author, Fred Wolens, call for a “globally robust unified effort to impose comprehensive sanctions” on North Korea, warning that without this Pyongyang “will be able to continue its cyberwarfare operations unabated with the aid of Western technology.”

The report was released days before North Korean leader Kim Jung Un and U.S. President Donald Trump are scheduled to meet in Singapore for a summit focused on ending the North’s nuclear weapons program in exchange for economic incentives and security guarantees.

But some consider North Korea’s cyberthreat capabilities as damaging as the threat of its nuclear weapons, Morgan Wright, a former a senior adviser in the U.S. State Department Antiterrorism Assistance Program, wrote in The Hill.

Even as advance teams prepared for the June 12 summit, North Korean cyberattacks continued, Moriuchi told Cyberscoop. On May 28, it reported the Department of Homeland Security and the FBI released a joint alert about Hidden Cobra, which is associated with North Korea’s hacking activities.

FireEye, a Silicon Valley cybersecurity company, detected cyberattacks by Lazarus, the North Korean hacking effort responsible for stealing millions of dollars from the Bangladesh Central Bank in 2016. Lazarus is also believed responsible for the 2014 Sony Picture’s hack and last year’s WannaCry ransomware attack.

​Defining ‘luxury goods’

How did U.S. technology reach North Korea? Part of the answer lies in “international inconsistencies in the definition of the term ‘luxury goods,’” according to the Recorded Future report. The U.S. “effort to restrict technology exports at the national and international level” has not reaped results because of “varied definitions by nations and [their] inconsistent implementations,” said Moriuchi, a former East Asia analyst for the National Security Agency.

While the United Nations did not include electronics in Resolution 2321, which covered exports to North Korea, when it was issued in 2016, each member nation was allowed to interpret luxury goods. The U.S. has defined luxury goods to include laptop computers, digital music players, large flat-screen televisions and electronic entertainment software. China, in particular, does not “honor the luxury goods listed by other countries when it exports to” North Korea, according to the report.

US exports OK

Another factor is that for seven years in the period spanning 2002 to 2017, “the United States allowed the exportation of ‘computer and electronic products’ to North Korea,” according to the report. The total for those seven years was more than $430,000 of legal exports, and according to Recorded Future, “at its peak in 2014, the U.S. exported $215,862 worth of computers and electronic products to North Korea.”

The Recorded Future report, citing the U.S. Department of Commerce (DOC), said that category includes “computers, computer peripherals (including items like printers, monitors and storage devices), communications equipment (such as wired and wireless telephones), and similar components for these products.”

Much of that equipment remains in use, according to Recorded Future, and North Korea’s ruling elites, including party, military, and intelligence leaders and their families, have long been known to use products manufactured by U.S. companies such as Apple, Microsoft and IBM to access the internet.

A third element in how the U.S. tech went astray is what the report called North Korea’s “sophisticated sanctions evasion operation, which uses intermediaries and spoofs identities online.”

As an example, the study points to North Korea’s shell company Glocom with which Pyongyang “used a network of Asian-based front companies to buy computer components from electronic resellers, and the payment was even cleared through a U.S. bank account.” The United Nations found that Glocom was tied to Pan Systems Pyongyang, whose director, Ryang Su Nyo, reports to Liaison Office 519 in the North Korean intelligence agency’s Reconnaissance General Bureau.

​Just like us

North Korea’s elites surfed and browsed just like users outside North Korea until recently when the Recorded Future researchers found “a stark change” in the elite’s usage patterns as they “migrated almost completely” from Facebook, Google and Instagram “to their Chinese equivalents — Alibaba, Tencent and Baidu,” and over the course of a few months “dramatically increased” their use of internet obfuscation services, such as virtual private networks (VPN), virtual private servers (VPS), transport layer security (TLS) and the Onion Router (Tor).

While tracking the change in activity from December 2017 to April 2018, researchers found “the overwhelming presence of American hardware and software on North Korea networks and in daily use by senior North Korean leaders.”

While U.S. exporters are responsible for understanding and adhering to export regulations, the study indicates even the implementation of robust compliance procedures were insufficient in preventing banned U.S. computer products from reaching North Korea.

U.S. export enforcement rests with the Office of Foreign Asset Control, the Office of Export Enforcement and Homeland Security Investigations. The U.S. is one of the only countries that enforces its export laws outside of its national boundaries, placing federal agents in foreign countries to work with local authorities.

Widespread international sanctions were imposed beginning in 2006, when North Korea conducted its first nuclear weapons test. In response, the U.N. passed two resolutions (Resolution 1695 and 1718) banning a broad range of exports to North Korea by any U.N. member states. The U.N. subsequently expanded those sanctions through a number of resolutions that prohibit and restrict exporting items ranging from missile material to oil to North Korea.

The case of ZTE

The Recorded Future report mentions Chinese manufacturer ZTE (Zhongxing Telecommunications Equipment) as a case where the implementation of export regulation failed, pointing out that the U.S. had the chance to enforce its export laws when the company was under Export Administration Regulation (EAR), a dense set of laws regulating exports.

ZTE was initially placed on the so-called Entities List for violating U.S. sanctions for selling products containing U.S. goods to Iran and North Korea in March 2016. For two years, the company and the U.S. government attempted to reach an agreement over penalties and how to verify that ZTE had stopped violating U.S. sanctions.

The Department of Commerce (DOC) ended the negotiations and imposed a denial order that banned U.S. companies from selling to ZTE for seven years.

In May, the DOC lifted the denial order, which would have put ZTE out of business, and allowed ZTE to purchase components from U.S. companies. The move came after threats of a trade war and Trump’s intervention.

Moriuchi said if the U.S. had let ZTE fail, it would have sent “a huge message to the rest of the world that there is no [company] too big to fail” and that “the U.S. government takes export control very seriously.”

In the end, “an opposite message ended up being sent with the administration’s deal with China, and that there are companies too big to fail especially if that company … has significant interest with the United States,” she said, adding the case demonstrated that “you can circumvent U.S. export control as a company and in the end, survive.”

The U.S. enforces its export laws through the DOC and regulates them through EAR, which not only restricts commercial goods and technologies from reaching hostile countries but also regulates the re-export of U.S. goods and technologies from one foreign country to another.

Until 2008, U.S. sanctions prohibiting exports to North Korea were implemented through the Trading with the Enemy Act, through which the U.S. government banned any exports to designated countries including North Korea.

Subsequently, the Obama administration issued the North Korea Sanctions Regulations and a number of Executive Orders (13551, 13570, 13687, and 13722) to further prohibit various measures, including exports of “goods, services or technology to North Korea.”

Additionally, numerous U.S. sanctions were imposed against North Korea under Trump’s “maximum pressure” campaign, especially in 2017 during Pyongyang’s nuclear weapons and ballistic missiles tests, which also saw the U.N. issue new sanctions.

VOA’s Christy Lee contributed to this report.
…

Growing up on Mount Boutmezguida in southwest Morocco on the edge of the Sahara desert, Khadija Ghouate never imagined that the fog enveloping the nearby peaks would change her life.

For hours every day and often before sunrise, Ghouate and other women from nearby villages would walk 5 km (3 miles) to fetch water from open wells, with girls pulled out of school to help and at risk of violence on the lonely treks.

But with groundwater levels dropping due to overuse, drought and climate change, the challenge to get enough water daily was becoming harder, and almost half of people in the local area sold up and quit rural life after generations for the city.

As the future of the traditional Berber region by Mount Boutmezguida floundered, a mathematician whose family came from the area had a eureka moment gleaned from living overseas – using fog to make water.

Now Ghouate’s village is connected to the world’s largest functioning fog collection project, alleviating the need to collect water that fell mainly on women, and with state-of-the-art equipment setting an example for other projects globally.

“You always had to go to the wells, always be there, mornings, evenings,” said Ghouate, a mother-of-three, as she prepared lunch for her family, showing off the tap in her home.

“But now water has arrived in our house. I like fog a lot.

The project, running since 2015 after nine years of surveys and tests, was founded by the Moroccan non-government organization Dar Si Hmad, which works to promote and preserve local culture, history, and heritage.

It was the brainchild of mathematician and businessman Aissa Derhem whose parents were originally from Mount Boutmezguida where the slopes are covered in mist on average 130 days a year.

Derhem first came across fog collection when he learned of one of the world’s first projects – in Chile’s Atacama Desert – while he living in Canada in the 1980s studying for his PhD.

But it was not until visiting his parents’ village years later that he realized the mountainous location, situated at the edge of the Sahara and about 35 km (22 miles) from the Atlantic Ocean, was perfect for fog.

Ideal Location

Mist accumulates in coastal areas where a cold sea current, an anticyclone and a land obstacle, such as a mountain range, combine.

“When the sea water evaporates, the anticyclone … stops it from becoming rain, and when it hits the mountain, that’s where it can be gathered,” Derhem told the Thomson Reuters Foundation, looking out from the top of Mount Boutmezguida besides a small building used as a fog observatory and tool deposit.

“If we look at the planet, we see this happening in all tropical regions … In Chile and Peru in Latin America. The Kalahari desert in Africa. In Western Australia. Around the Thar desert in India and in California,” he listed as examples.

Developed in South America in the 1980s, fog collection projects have since spread globally to countries including Guatemala, Ghana, Eritrea, Nepal and the United States.

In Morocco, Dar Si Hmad has built a system of nets stretching about 870 square metres – about 4.5 tennis courts.

These nets are hung between two poles and when wind pushes the fog through the mesh, water droplets are trapped, condense and fall into a container at the bottom of the unit with pipes connecting the water to reservoirs.

Derhem hopes the success of the Mount Boutmezguida scheme can help other areas in West Africa and in North Africa – where the United Nation’s Food and Agriculture Organization (FAO) says fresh water resources are among the world’s lowest.

Studies show climate change impacting water patterns globally and Derhem said in Morocco levels have dropped to about 500 cubic meters a person a year from about 1,500 cubic meters a person in the 1960s on calculations based on government figures.

Challenges Too

The principles behind fog collection are simple, and throughout nature examples exist of creatures capturing moisture from the air in the most arid conditions, ranging from beetles in the Namib Desert to lizards in the Australian outback.

But creating a water collection project on a large scale comes with challenges, as the research and development, as well as the infrastructure and technology involved in expanding and developing fog collection projects, can be costly.

The project at Mount Boutmezguida, however, has been a trailblazer for other projects due to its equipment, according to its founders.

The original nets used were insufficiently resistant to the high winds and tore but a partnership with the German non-profit Water Foundation allowed Dar Si Hmad to develop a stronger net.

The CloudFisher was described by the WaterFoundation as the first maintance-free fog collector that can withstand wind speeds of up 120 kph with flexible troughs following the movement of the net in the wind.

Now collected water is filtered and combined with underground water before being distributed to villages on the grid with homes paying for water through a pre-paid system.

The initial pilot project served five villages. At present, the 870 square metres of nets installed reach about 140 families – 14 villages – while a second set of nets is being built.

“Fog is like aeroplanes at the start. At the beginning they were only little toys but, with some effort, things have changed … but it needs investment,” said Derhem.

“Along the coast, there is three times as much fog as there is available on Mount Boutmezguida. The government spends millions for water desalination processes. This is something that is worth exploring.”

For with dry wells comes anxiety and risk but also the unraveling of traditional livelihoods and communities.

Mohamed Zabour, president of the local municipality, said more than 60 percent of the inhabitants of the region live without running water in their homes.

Between 2004 and 2014, 2,000 of the 5,000 local residents moved to cities.

“Our region is rich but it needs infrastructure. And water is one of the priorities,” said Zabour.

“If we don’t find a solution in the next 10 years, it’s going to be a catastrophe … It’s going to be like a desert. Empty.”

For Ghouate, the fog scheme has improved village life.

“When we were kids, we didn’t even know what it meant to need water  … Now there is less rain and if I still had to go to the wells, I wouldn’t find much water now,” she said. “Everything is about water, everything. I don’t have to worry about it anymore.”
…

Facebook said a software bug led some users to post publicly by default regardless of their previous settings. The bug affected as many as 14 million users over several days in May.

 

The problem, which Facebook said it has fixed, is the latest privacy scandal for the world’s largest social media company.

 

It said the bug automatically suggested that users make new posts public, even if they had previously restricted posts to “friends only” or another private setting. If users did not notice the new default suggestion, they unwittingly sent their post to a broader audience than they had intended.

 

Erin Egan, Facebook’s chief privacy officer, said the bug did not affect past posts. Facebook is notifying users who were affected and posted publicly during the time the bug was active, advising them to review their posts.

 

The news follows recent furor over Facebook’s sharing of user data with device makers, including China’s Huawei. The company is also still recovering from the Cambridge Analytica scandal, in which a Trump-affiliated data-mining firm got access to the personal data of as many as 87 million Facebook users.

 

Jonathan Mayer, a professor of computer science and public affairs at Princeton University, said on Twitter that this latest privacy gaffe “looks like a viable Federal Trade Commission/state attorney general deception case.” That’s because the company had promised that the setting users set in their most recent privacy preferences would be maintained for future posts. In this case, this did not happen for several days.

 

Facebook’s 2011 consent decree with the FTC calls for the company to get “express consent” from users before sharing their information beyond what they established in their privacy settings. Even if the bug was an accident on Facebook’s part, Mayer said in an email that the FTC can bring enforcement action for privacy mistakes.

 

Facebook, which has 2.2 billion users, says the bug was active from May 18 until May 27. While the company says it stopped the error on May 22, it was not able to change all the posts back to their original privacy parameters until later.

 

The mistake happened when the company built a new way for people to share “featured items” on their profiles. These items, which include posts and photo albums, are automatically public. In the process of creating this feature, Facebook said it accidentally made the suggested audience for all new posts public.

 

When people post to Facebook, the service suggests a default distribution for their posts based on past privacy settings. If someone made all posts “friends only” in the past, it will set their next post to “friends only” as well. People can still manually change the privacy level of the posts — anywhere from “public” to “only me” — and this was the case while the bug was active as well.
…

Google will not allow its artificial intelligence software to be used in weapons or unreasonable surveillance efforts under new standards for its business decisions in the nascent field, the Alphabet unit said Thursday.

The restriction could help Google management defuse months of protest by thousands of employees against the company’s work with the U.S. military to identify objects in drone video.

Google instead will seek government contracts in areas such as cybersecurity, military recruitment and search and rescue, Chief Executive Sundar Pichai said in a blog post Thursday.

“We want to be clear that while we are not developing AI for use in weapons, we will continue our work with governments and the military in many other areas,” he said.

Breakthroughs in the cost and performance of advanced computers have carried AI from research labs into industries such as defense and health in the last couple of years. Google and its big technology rivals have become leading sellers of AI tools, which enable computers to review large datasets to make predictions and identify patterns and anomalies faster than humans could.

But the potential of AI systems to pinpoint drone strikes better than military specialists or identify dissidents from mass collection of online communications has sparked concerns among academic ethicists and Google employees.

A Google official, requesting anonymity to discuss the sensitive issue, said the company would not have joined the drone project last year had the principles already been in place. The work comes too close to weaponry, even though the focus is on non-offensive tasks, the official said Thursday.

Google plans to honor its commitment to the project through next March, a person familiar with the matter said last week.

More than 4,600 employees petitioned Google to cancel the deal sooner, with at least 13 employees resigning in recent weeks in an expression of concern.

A nine-employee committee drafted the AI principles, according to an internal email seen by Reuters.

The Google official described the principles as a template that any software developer could put into immediate use. Though Microsoft and others released AI guidelines earlier, the AI community has followed Google’s efforts closely because of the internal pushback against the drone deal.

Google’s principles

Google’s principles say it will not pursue AI applications intended to cause physical injury, that tie into surveillance “violating internationally accepted norms of human rights,” or that present greater “material risk of harm” than countervailing benefits.

“The clear statement that they won’t facilitate violence or totalitarian surveillance is meaningful,” University of Washington technology law professor Ryan Calo tweeted Thursday.

Google also called on employees and customers developing AI “to avoid unjust impacts on people,” particularly around race, gender, sexual orientation, and political or religious belief.

The company recommended that developers avoid launching AI programs likely to cause significant damage if attacked by hackers because existing security mechanisms are unreliable.

Pichai said Google reserved the right to block applications that violated its principles. The Google official acknowledged that enforcement would be difficult because the company cannot track each use of its tools, some of which can be downloaded free of charge and used privately.

Google’s decision to restrict military work has inspired criticism from members of Congress. Representative Pete King, a New York Republican, tweeted Thursday that Google not seeking to extend the drone deal “is a defeat for U.S. national security.”
…

As the internet continues to revolutionize communications, the next world-changing technology may already be here. Blockchain, a way of recording data and automatically storing it on computers around the world, has the potential to change everything from collecting crime scene evidence to creating new digital currencies. VOA’s Jill Craig visited a blockchain hackathon in Memphis, Tennessee, to learn more.
…

Major changes could be ahead for the International Space Station but there will always be an American astronaut in orbit, NASA’s new boss said Wednesday.

The space agency is talking with private companies about potentially taking over the space lab after 2025, but no decision will made without the other 21 countries that are partners in the project, NASA Administrator James Bridenstine said in his first briefing with reporters.

President Donald Trump’s recent budget requests have put discussions about the station’s future “on steroids,” he said. Under Trump’s 2019 proposed budget, U.S. funding for the space station would end by 2025. The U.S. has spent more than $75 billion on the space station.

Options include splitting the station into different segments or reducing its size by breaking it up and discarding one part.

Always a US astronaut in orbit

But no matter what happens, there won’t be any gap when Americans aren’t in space, Bridenstine vowed. It won’t be as it was after the Apollo moon program closed or even the retirement of the space shuttle fleet, which has forced NASA to pay Russia to ferry astronauts to the station.

“There are kids graduating from high school this month, that their entire lives, we’ve had an astronaut in space,” Bridenstine said. “And we want that to live on in perpetuity forever. No gaps.”

Companies are interested in running the station and “there’s a range of options” that are just now being examined, he said.

The first station piece was launched in 1998. The complex was essentially completed with the end of the shuttle program in 2011. It is about the size of a six-bedroom house, complete with two bathrooms, a gym and a 360-degree bay window. It usually has a crew of six.

Climate change

In wide-ranging remarks, the former Oklahoma Republican congressman said he generally supports NASA’s Earth science missions, including missions that monitor heat-trapping carbon dioxide. He said at least three climate science satellites that the Trump administration had tried to cancel earlier in budget proposals “could all end up in very good shape” and that he supported them in Congress, crossing party lines.

“We’re going forth with missions that are going to do carbon monitoring,” he said, ticking off a couple of projects. “We’re committed to that.”

When told that a Pew Research poll out Wednesday said that 63 percent of Americans said NASA’s top priority should be monitoring key parts of Earth’s climate, Bridenstine said “good” and reiterated his acceptance of human-caused climate change as a threat to national security and the globe.

Back to the moon

Bridenstine also said he hopes NASA will put some kind of small robotic landers on the moon next year, followed at some later date by humans. Astronauts should use the moon as a “proving ground” for future missions to Mars, especially checking out potential health issues for living far away from Earth for a long time. He said he worried about balance, vision, bone loss and heart issues that have been reported with space station astronauts.

“We do not want to go to Mars and have our astronauts to be marshmallows on the surface of Mars,” Bridenstine said. “The moon is our best opportunity to be successful when we go to Mars.”
…

Passenger jets of the future will be safer, lighter, faster, more fuel-efficient and … windowless.

So predicts Emirates Airlines chief Tim Clark. The Dubai-based airline has already introduced virtual windows in the first-class suites of its newest planes. 

Instead of being able to see out a conventional window, the passengers will be able to enjoy the view on a full display of windows that will project live camera feeds on a high-definition screen. 

Clark said the images are “so good, it’s better than with the natural eye.”

Clark told the BBC that the ultimate goal was to have a completely windowless plane. 

“Now you have a fuselage which has no structural weaknesses because of windows. The aircraft are lighter, the aircraft could fly faster, they’ll burn less fuel and fly higher,” he said.

But Emirates’ experiment has raised concerns that might not win it the votes of safety regulators. Some passengers have expressed concerns of possibly feeling claustrophobic on windowless planes. 
…

Facebook has admitted that it had a data sharing agreement with four Chinese technology companies, including one considered a national security threat by the U.S. intelligence community, raising new concerns about the social media giant’s handling of its consumer’s personal information.

The admission by the U.S.-based social media giant Tuesday came two days after The New York Times revealed that Facebook had struck special data-sharing deals with as many as 60 device makers, including Huawei, Lenovo, OPPO and TCL, to make it easier for Facebook users to access their accounts on a wide array of devices.

U.S. intelligence officials have raised concerns for years about Huawei, fearing the Chinese government could demand access to data stored on their devices or servers. The concerns prompted the U.S. military to ban the sale of Huawei smartphones on its bases.

Francisco Varela, Facebook’s vice president of mobile partnerships, said Tuesday that the data sharing deals with Huawei and the other Chinese companies “were controlled from the get-go.”

Facebook has been under intense criticism after it was disclosed that tens of millions of users’ personal information was accessed by the British-based political consultancy firm Cambridge Analytica. The company has also been under fire after revealing in September that Russians, using fake names, used social media to try to influence voters ahead of the 2016 U.S. election.

The U.S. Federal Trade Commission is investigating whether Facebook violated a 2011 consent agreement over a previous ruling that found Facebook had misled consumers over its data-use policies.

 
…

In and around the Mekong Delta, school children will spend this summer moving rainbow-colored blocks and cartoon animals around a screen to get an early taste of computers in a program backed by Google.

The tech company is paying for Vietnamese students to learn some introductory programming, along the way perhaps earning some goodwill from Vietnamese officials who are taking an increasingly strict view toward global internet firms.

The Mekong Community Development Center will run the classes, which make use of Scratch, a very basic computer language that lets children create their own virtual games.

“To support Vietnam’s development in the direction of the Industrial Revolution 4.0 in the most effective and practical way, Google is focused on developing projects to build and raise awareness and capacity in information technology in Vietnam,” said Ha Lam Tu Quynh, who is the director of communications and public relations in charge of Vietnam at Google Asia Pacific. “We believe children in particular will be the best creators of the future.”

She was referring to a tech revolution that has been a buzz word around the Communist country, encompassing all kinds of new tech, from the internet of things, to big data analysis.

Google, which did not disclose how much it is spending, is far from alone in stressing its corporate social responsibility, allowing firms to do good or look good, or both. It would not hurt to earn some goodwill with Vietnam, which has been overhauling its legislative and regulatory system in a way that has not always gone over well with tech companies. 

Last year the Southeast Asian country pressed local advertisers to boycott Facebook and Google’s YouTube because they had permitted content critical of the state. In a more recent example, the National Assembly is debating a draft law on cyber security that would require businesses to store data inside the borders and delete online information that is deemed objectionable.

The U.S. embassy in Hanoi expressed “concerns about Vietnam’s proposed cyber security law, including the impact of localization requirements and restrictions on cross-border services for the future development and growth of Vietnam’s economy.”

Also contributing to the child-friendly computer lessons, with laptops and technical support, is the Dariu Foundation, which focuses on micro-finance and education for low-income people in Vietnam, Myanmar, and India. Nguyen Van Hanh, the director of the Dariu Foundation, noted that roughly 65 percent of those now in primary school will be doing jobs someday that do not exist right now, citing data from the World Economic Forum.

“With all of the economic and social changes brought on by technology, we do not know exactly the kind of skills children will need in order to develop and become citizens who contribute positively to the world in the future through work,” he said in discussing his group’s participation in the Scratch classes. “However, we can be sure that today’s children need to be equipped with many skills to adapt to the challenges and the requirements of the digital era.”

The Massachusetts Institute of Technology invented the simple Scratch language so that computer programming would be more widely accessible. First-time programmers do not type dense lines of code, but rather use logic to design things like animation and games, dragging colorful objects and command labels around the software interface. Even an 8-year-old can do it, and in fact they do.

So will 1,200 public school students in the Vietnamese metropolis of Ho Chi Minh City and the nearby delta provinces of Vinh Long and Tien Giang.

The initiative “Programming the Future with Google,” also includes digital training for 30 local school teachers, will run from now through August.
…