There's some shocking news out of Russia this morning that the head of computer incident investigations at Kaspersky Labs was arrested for treason. According to this article, he was arrested in December and his arrest may be linked to another arrest in the FSB around the same time.
Update: Forbes is reporting that the charges stem back to an investigation into the deputy head of the FSB's information security center (CDC) Sergei Mikhailov. Moscow Times reports that the arrest was related to taking money from foreign sources and also draws a connection to Mikhailov and the CDC.
According to this source there were changes to Russia's treason laws in 2012 that include the following definition for treason:
Where is Russia on this?
The GRIZZLY STEPPE report made it clear that Russian state actors were involved in attempting to manipulate the US elections. The arrests happened in December shortly after the elections, but it would be an illusory fallacy to assume that the timing of the arrest is connected to the elections. However, this an obvious connection that many will jump to (including several members of the press who have called me today). The FSB is smart enough to know this connection will be assumed. If they wanted to get out in front of it, they could. But they haven't. I assess that whether the timing is connected, the FSB is comfortable with people assuming that it is (or at least raising the question).
Keep up the good fight
In any case, today I thank my lucky stars that I perform incident response in the United States where the government doesn't overtly try to suppress my freedoms. That's not to say I don't have a healthy fear of our government when it comes to publishing security information (more on that in a later post). But I seriously doubt that the US government would charge treason for investigating an incident involving our own network exploitation assets. On the contrary, I feel pretty confident Russia could.
For those living and working under oppressive regimes, keep up the good fight. But also remember that no incident response report or conference talk is worth jail time (or worse).
Also, to the GREAT researchers at Kaspersky Lab (I love your work), I hope this incident doesn't in any way tarnish your reputation. The actions of one individual should not be a measure of the group.
Update: Forbes is reporting that the charges stem back to an investigation into the deputy head of the FSB's information security center (CDC) Sergei Mikhailov. Moscow Times reports that the arrest was related to taking money from foreign sources and also draws a connection to Mikhailov and the CDC.
According to this source there were changes to Russia's treason laws in 2012 that include the following definition for treason:
providing financial, technical, advisory or other assistance to a foreign state or international organization . . . directed against Russia's security, including its constitutional order, sovereignty, and territorial integrityIt's worth noting that the definition above is very broad and could meet the definition of publishing (or attempting to publish) information about a Russian state sponsored hacking group. This would definitely be "technical assistance" and would definitely aid "a foreign state." Also, it's pretty easy to see how that would hurt "Russia's security." All the definitions are met here for a hypothetical scenario where a security researcher in Russia could be charged with treason for "outing" a Russian state sponsored hacking group.
Where is Russia on this?
The GRIZZLY STEPPE report made it clear that Russian state actors were involved in attempting to manipulate the US elections. The arrests happened in December shortly after the elections, but it would be an illusory fallacy to assume that the timing of the arrest is connected to the elections. However, this an obvious connection that many will jump to (including several members of the press who have called me today). The FSB is smart enough to know this connection will be assumed. If they wanted to get out in front of it, they could. But they haven't. I assess that whether the timing is connected, the FSB is comfortable with people assuming that it is (or at least raising the question).
Keep up the good fight
In any case, today I thank my lucky stars that I perform incident response in the United States where the government doesn't overtly try to suppress my freedoms. That's not to say I don't have a healthy fear of our government when it comes to publishing security information (more on that in a later post). But I seriously doubt that the US government would charge treason for investigating an incident involving our own network exploitation assets. On the contrary, I feel pretty confident Russia could.
For those living and working under oppressive regimes, keep up the good fight. But also remember that no incident response report or conference talk is worth jail time (or worse).
Also, to the GREAT researchers at Kaspersky Lab (I love your work), I hope this incident doesn't in any way tarnish your reputation. The actions of one individual should not be a measure of the group.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.