With the troves of extremely valuable personal information collected by social media giants, it’s likely—if not already occurring—that foreign spies have infiltrated several Silicon Valley companies in the hopes of accessing your/our data, according to leading cyber security strategist Menny Barzilay.
“It’s a mistake to think that the American government is the only one taking things out of Facebook,” Barzilay told me, “Other countries are putting a lot of effort into SIGINT [signals intelligence, similar to what the NSA does], but it would be a lot easier for one of them to pay someone in Facebook to access the data they [foreign intelligence agencies] want.”
Social media’s data has immense value to the intelligence community. “Why else would the NSA go after it?” Barzilay quipped. One of the most concrete examples he cited was mapping social connections, a technique that intelligence experts concluded would have generated significant amounts of actionable intelligence leading up to 9/11. Geolocation tags embedded in images—even if a user doesn’t specifically tag the post with a location—can also be incredibly useful in assisting analysts building a profile of a target. Mapping where a target is, could, hypothetically, help an intelligence team infiltrate their home or office to plant someNSA-style spy gear, or more traditional bugs.
Barzilay is a former information security officer with the Israeli Defense Forces, and now heads the IT department of one the country’s largest banks, and is referring to what’s called human intelligence, or HUMINT—the oft-romanticized James Bond type business of spying in person, or using moles, and informants to collect information. What’s interesting, Barzilay said, is that nowadays we have this “unprecedented” situation where corporations run by civilians have actually rapidly outpaced the military in terms of bleeding edge technology; namely, all of that extremely valuable data the Facebooks of the world collect.
Other security researchers agree with Barzilay’s assessment. “Silicon Valley companies are built around developers and the dev environment with values like trust and transparency,” independent security expert Rodrigo Bijou told me, “As a result, company projects, new deals, and even salaries are open information company-wide, which could make it very easy for an insider to gather valuable intelligence.” He went on to explain that the data isn’t all that well protected because most of the tech giants are set up with a development focus, and because of that controlling access to information that might be useful to “malicious actors” presents numerous challenges.
Barzilay pointed out too that low level employees—who don’t undergo the same level of vetting as a military officer—have access to the same, massive datasets as their superiors, theoretically making it easier to install an agent. “They have unrestricted access to information,” Barzilay said. One of the other key differences is that in the private sector, unlike in the military, there are many more people who hold positions of information-related trust, Barzilay said. Now data scientists, and many others have relatively unrestricted access to petabytes of personal information, unlike in the past.
“These guys [foreign intelligence services] are good at recruiting spies in much more sensitive locations and access to classified information,” Barzilay said, “When thinking about this, we have to understand that private companies are in a weird situation, CIOs are in a weird situation, they have to build controls to deal with states or countries.” Military installations have considerably tighter security than most companies in the US, he said.
Private sector companies aren’t oblivious to the threat—at this years’ RSA security conference, for example, there were a handful of talks on the subject, and how to deal with what the industry calls “insider threats.” There are numerous technical measures and security protocols to be sure, but according to former FBI chief information security officer Patrick Reidy, it may not be possible to detect and prevent every insider threat, even at the FBI. But, it’s definitely possible—through deterrence and detection—to make it a lot more difficult for spies to do their work.
Reidy made clear that insider threats are far more than a just cyber security concern. Often they are regular employees who joined an organization with “no malicious intent.” Insiders are most often people with trusted access to do things that they aren’t supposed to, Reidy said, and only about 1.5 percent of espionage cases involved “admin” privileges. This means most were perpetrated by “normal” employees. And as a result companies wishing to get serious about detection have to couple data/technical driven approaches, with traditional ways of weeding out insider threats.
It’s worth noting that to date there aren’t any examples of spooks successfully infiltrating and stealing data from the social media giants in Silicon Valley, a fact that Barzilay acknowledged. But, he pointed out that the world’s intelligence community would be loath to make public statements boasting about their successes in any area—much less the companies themselves. There are numerous examples of the Chinese government successfully infiltrating companies, and stealing trade secrets. And regardless of the lack of hard evidence, the scenario seems entirely possible, begging the question what would prevent foreign governments from attempting such activities? It’s also yet another opportunity to reconsider the amount of information you, as a social media user, are willing to trust to a private corporation.
