text:
Tag Archive for: Facebook
Was Facebook Biased or Was It Manipulated?
February 6, 2019 /55 Comments/in 2016 Presidential Election, Culture, Media /by Rayne
[Notez bien: Cet essai n'a pas été écrit par Marcy ou bmaz mais par moi. Merci. Oh, and some this is speculative. /~Rayne]
Facebook has been in the news a lot this last two weeks with regard to its sneaky surveillance of competitors and users by paying teens for their data as well as its 15th anniversary.
But that's not what this essay is about.
This is about the 2016 election and in particular a claim I thought was peculiar when it was first reported.
Gizmodo, a former Gawker Media outlet, published two stories claiming that Facebook's news feed was biased against conservative news based on feedback from contract editors.
It struck me as odd at the time because
the first story was published within the week that Trump became the presumptive nominee for the Republican Party;
conservative news outlets weren't complaining about being suppressed by Facebook;
the story broke at a troubled outlet via a relatively new technology editor at a lesser technology outlet.
It'd already struck me as bizarre that Trump wasn't using traditional campaign media practices to reach his base. He wasn't spending money on ad buys and other media like a new-to-politics candidate would. The commercial media was all over him providing him enough coverage that he didn't have to buy more. Media coverage of Trump suffocated the rest of the GOP field in addition to swamping coverage of Democrats' primary race.
So why were these contract editors/curators complaining about Facebook's bias if so much of the media was focused on a Republican candidate?
Gawker, as you may recall, had been under siege by billionaire Peter Thiel after its founder Nick Denton had allowed Thiel's sexuality to be outed in an Valleywag article. Thiel helped former professional wrestler and celebrity Terry Bollea, a.k.a. Hulk Hogan, sue Gawker for invasion of privacy, intentional infliction of emotional distress, negligent infliction of emotional distress, publication of private matter, and violation of the right to publicity. Gawker ultimately lost the case in March 2016 in a Florida court; it filed bankruptcy on June 10.
When Gawker lost to Bollea it was clear the media outlet suffered a mortal blow. Bollea won $115 million in compensatory damages and $25 million in punitive damages and Gawker didn't have that much in cash or assets. It was only a matter of time before Denton would either fold or sell Gawker.
In that nebulous period when Gawker's fate hung in the balance, Gizmodo ran two stories about Facebook's alleged anti-conservative bias within six days' time.
Why would Facebook's contract editors reach out to an affiliate of troubled outlet Gawker? Facebook was the largest social media platform in the U.S.; why wouldn't they have gone to a major U.S. newspaper instead of beleaguered Gawker?
One reason could have been Gawker's financial vulnerability. A hungry outlet might publish any clickbait-y story when they have little to lose but paychecks.
Another reason might be inexperience. The reporter/editor whose byline appears on the Facebook stories didn't have years-deep experience in technology reporting, unlike folks at competing dedicated technology journalism outlets. The journalist joined the organization in January 2016 and stayed with Gizmodo through Gawker's subsequent acquisition; they left for another technology outlet mid-2017. Were they approached by sources because they were relatively inexperienced and working at a distressed outlet?
The journalist's departure doesn't appear to be neutral based on the observation a Gizmodo sister outlet, io9, published on his exit (cached copy). Perhaps it was a grumbly "break a leg" farewell a la Larry Darrell's character in The Razor's Edge (1984), but this doesn't appear to be a regular practice at Gizmodo or other Gawker affiliates.
Once Gizmodo published the story, other outlets picked it up and repackaged it as original content. The New York Times stepped in and did more digging, treating this almost like Clinton's emails with five pieces on Facebook and political bias inside May alone:
09-MAY-2016 — Conservatives Accuse Facebook of Political Bias
10-MAY-2016 — Political Bias at Facebook?
10-MAY-2016 — Senator Demands Answers From Facebook on Claims of 'Trending' List Bias
11-MAY-2016 — Facebook's Bias Is Built-In, and Bears Watching
19-MAY-2016 — Opinion | The Real Bias Built In at Facebook
The story of Facebook's alleged anti-conservative bias in news editing exploded with a huge push by NYT. (It didn't stop in May; NYT published at least four more pieces before the election focused on Facebook and political bias though not all reflected negatively on Facebook.)
One outlet published a story based on Gizmodo's second story seven hours after Gizmodo: the Observer, formerly known as The New York Observer, a small print and online media outlet based in New York city.
At the time it ran its story on Facebook's alleged bias, it was owned by Jared Kushner.
The media editor's story at the Observer noted the Gizmodo story trended on Facebook.
'Facebook 'Supression of Conservative News' Story Is Trending on Facebook' published at 5:15 p.m. (assume this was local time in NYC).
Was it possible the Gizmodo article had been elevated by conservative news outlets and blogs rather than normal Facebook users' traffic from reading the article itself, especially if the contract editors on assignment that day were still applying anti-conservative filters as alleged?
The last update to the Gizmodo article included this excerpt from a statement by Vice President of Search at Facebook, Tom Stocky:
…There have been other anonymous allegations — for instance that we artificially forced #BlackLivesMatter to trend. We looked into that charge and found that it is untrue. We do not insert stories artificially into trending topics, and do not instruct our reviewers to do so. …
If Facebook could not detect foreign interference at that time — and it was known by September 2017 the Black Lives Matter content on Facebook had been elevated by Russian troll bots — would Facebook have been able to detect any artificial elevation of the Gizmodo stories?
Was it possible pro-conservative contract editors set up this scenario in order to skew Facebook's content so that it would be easier for the Russian Internet Research Agency to amplify what appeared to be conservative content?
Or were the Gizmodo articles used to identify conservative outlets based on their liking the article?
Or was this scenario a proof-of-concept revealing Facebook's inability or unwillingness to detect artificial manipulation of content?
Was it possible the Observer's media page had been prepared to cover this development long before other east coast and national news outlets?
The timing of the Gizmodo stories is awfully convenient:
26-APR-2016 — GOP primaries/caucuses in CT, DE, MD, PA, RI, all won by Trump.
03-MAY-2016 — GOP primary in IN won by Trump.
03-MAY-2016 — Gizmodo article published: Want to Know What Facebook Really Thinks of Journalists? Here's What Happened When It Hired Some.
03-MAY-2016 — Ted Cruz withdrew from race.
04-MAY-2016 — Trump became presumptive GOP nominee.
04-MAY-2016 — John Kasich withdrew from race.
09-MAY-2016 — Gizmodo article published at 9:10 a.m.: Former Facebook Workers: We Routinely Suppressed Conservative News.
09-MAY-2016 — Gizmodo updated article noting the piece had begun to trend with pickup by conservative sites; time of update not specified.
09-MAY-2016 — Gizmodo posted a second update at 4:10 p.m., posting Facebook's initial response to TechCrunch, BuzzFeed, other unnamed outlets inquiries; the social media company denied suppression of content by political ideology.
09-MAY-2016 — Observer article published at 5:15 p.m.: Facebook 'Supression of Conservative News' Story Is Trending on Facebook.
10-MAY-2016 — Gizmodo adds final update at 8:10 a.m. with a statement from Facebook denying again any suppression by political ideology.
10-MAY-2016 — GOP primaries in NE, WV won by Trump.
17-MAY-2016 — Guardian-US published an op-ed by a Facebook contract curator pushing back at earlier Gizmodo stories. The article does not stop a steady number of stories repeating the earlier claims of anti-conservative bias.
17-MAY-2016 — GOP primary in OR won by Trump.
24-MAY-2016 — GOP primary in WA won by Trump.
26-MAY-2016 — Trump attains 1,237 total delegates, minimum required to win nomination — after CO, ND, and PA unbound delegates pledged to support Trump.
And by the end of May the race for media coverage isn't a fight on the right among a broad field of GOP candidates but just Trump against Hillary Clinton and Bernie Sanders for the next 10 days.
The too-convenient timing creates so many questions. It'd be nice to know if Facebook traffic showed an uptick of troll or bot interest promoting the Gizmodo story but Facebook has been less than forthcoming about traffic even though its business integrity was questioned.
It'd also be nice to know if the Observer had been tipped off ahead of the Gizmodo story trending and if the Observer's report had other connotations apart from being a random story about social media.
But just as the Gizmodo journalist/editor who wrote the May 3 and May 9 stories moved on, the Observer journalist left their job, departing in late July 2016.
And the names of the Facebook curators/editors never appeared in subsequent coverage. Non-disclosure agreements may be the reason.
The kicker is another interesting bit of timing bookending Gizmodo's stories:
19-APR-2016 — A domain for DCLeaks was registered.
06-JUN-2016 — Clinton attained 2383 delegates, the minimum threshold needed to earn the Democratic nomination.
08-JUN-2016 — A fake American identity posted a link in Facebook to a Russian GRU-associated website, DCLeaks, sharing content stolen from American servers including the DNC. The site "had gone live a few days earlier," sharing small amounts of hacked material.
10-JUN-2016 — Gawker filed for bankruptcy.
By the time DCLeaks' content was promoted by a fake account, the conservative commentariat from news sites to blogs had been primed to watch Facebook for a change in their coverage and Gawker as we'd known it under Nick Denton was on life support.
One other oddity about the Gizmodo stories about Facebook's biased curation and the Observer piece observing Gizmodo's Facebook pieces?
Trump's name isn't mentioned once in any of the three articles though his name had swamped all other media.
Treat this as an open thread.
https://www.emptywheel.net/wp-content/uploads/2018/04/Facebook_NewLogo_2015_Wikimedia.jpg 609 1087 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2019-02-06 22:40:132019-02-06 22:40:13Was Facebook Biased or Was It Manipulated?
Rattled: China's Hardware Hack – SMCI's Response
October 8, 2018 /11 Comments/in Cybersecurity, Foreign Policy /by Rayne
[NB: Note the byline. Portions of my content are speculative. / ~Rayne]
The following analysis includes a copy of an initial response Bloomberg Businessweek received from Super Micro Computer in response to its story, The Big Hack. In tandem with the Bloomberg story this was published on October 4 at this link. Super Micro Computer's response is offset in blockquote format. No signer was indicated in the published response. Additional responses to Bloomberg's story will be posted separately.
While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard.[1] We are not aware of any customer dropping Supermicro as a supplier for this type of issue.[2]
[1] (a) "we are not aware" "nor have we been contacted" — who is we?
(b) "nor have we been contacted by any government agency" — has Supermicro been contacted by customers or their auditors or their security teams, contract or not, about security problems?
[2] Were one or more of Supermicro's customers dropped by their customers because of security concerns including problems with firmware? Are any of the customers or customers of customers U.S. government entities?
Every major corporation in today's security climate is constantly responding to threats and evolving their security posture. As part of that effort we are in regular contact with a variety of vendors, industry partners and government agencies sharing information on threats, best practices and new tools. This is standard practice in the industry today. However, we have not been in contact with any government agency regarding the issues you raised.[3]
[3] Has Supermicro been in contact with any government agency regarding any security issues including firmware updates?
Furthermore, Supermicro doesn't design or manufacture networking chips or the associated firmware and we, as well as other leading server/storage companies, procure them from the same leading networking companies.[4]
[4] Interesting pointer about networking chips. What other motherboard content does Supermicro not design or manufacture, procuring from other companies? What procured motherboard components have firmware associated with them?
https://www.emptywheel.net/wp-content/uploads/2018/10/DragonHack_red-v2_rayne.jpg 780 1500 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-10-08 17:30:262018-10-08 17:30:26Rattled: China's Hardware Hack - SMCI's Response
Rattled: China's Hardware Hack – Amazon's Response
October 8, 2018 /5 Comments/in Cybersecurity, Foreign Policy /by Rayne
[NB: Note the byline. Portions of my analysis may be speculative. / ~Rayne]
The following analysis includes a copy of an initial response received from Amazon by Bloomberg Businessweek in response to its story, The Big Hack. In tandem with the Bloomberg story Amazon's response was published on October 4 at this link. The text of Amazon's response is offset in blockquote format. No signer was indicated in the published response. Additional responses by Amazon to Bloomberg's story will be assessed separately in a future post.
This analysis is a work in progress and subject to change.
It's untrue that AWS[1] knew about a supply chain compromise, an issue with malicious chips, or hardware modifications[2] when acquiring Elemental. It's also untrue that AWS knew about servers containing malicious chips or modifications in data centers based in China, or that AWS worked with the FBI[3] to investigate or provide data about malicious hardware.
[1] Identity – were there ever any third-party contractors or representatives involved in the relationship with Elemental? With Supermicro? Are there more than one Amazon subsidiary entity involved in the evaluation, purchasing, implementation of Elemental or Supermicro products into Amazon or its subsidiary enterprise? Which entity submitted this denial to Bloomberg Businessweek: Amazon, AWS, or some other subsidiary?
[2] What about evidence of bad or mismatched firmware and firmware updates?
[3] Did any law enforcement, military, or intelligence agency work with Amazon or any of its subsidiaries or contractors to investigate or provide data on hardware which failed to operate to specification or as expected?
We've re-reviewed our records[4] relating to the Elemental acquisition for any issues related to SuperMicro, including re-examining a third-party security audit[5] that we conducted in 2015 as part of our due diligence prior to the acquisition. We've found no evidence to support claims of malicious chips or hardware modifications.[6]
[4] "our records" — whose records and what kind? Identity needs clarification as well as the type of records.
[5] Who is the third-party security auditor? How and why were they engaged?
The pre-acquisition audit described four issues with a web application (not hardware or chips)[7] that SuperMicro provides for management of their motherboards. All these findings were fully addressed before we acquired Elemental. The first two issues, which the auditor[8] deemed as critical, related to a vulnerability in versions prior to 3.15 of this web application (our audit covered prior versions of Elemental appliances as well), and these vulnerabilities had been publicly disclosed by SuperMicro on 12/13/2013.[9]
[7] "web application" — but not firmware?
[8] Is this still the unnamed third-party security auditor or an internal auditor employed by Amazon or a subsidiary?
[9] How was this "publicly disclosed by SuperMicro"? SMCI's website does not currently have either a press release or an SEC filing matching this date (see screenshots at bottom of this page).
Because Elemental appliances are not designed to be exposed to the public internet, our customers are protected against the vulnerability by default.[10] Nevertheless, the Elemental team had taken the extra action on or about 1/9/2014 to communicate with customers and provide instructions to download a new version of the web application from SuperMicro (and after 1/9/2014, all appliances shipped by Elemental had updated versions of the web application).[11] So, the two "critical" issues that the auditor found, were actually fixed long before we acquired Elemental. The remaining two non-critical issues with the web application were determined to be fully mitigated by the auditors if customers used the appliances as intended, without exposing them to the public internet.[12]
[10] "exposed to the public internet" — did customer data run through Elemental's Supermicro devices between 2013 and 2015?
[11] What about firmware?
[12] Did customer data still run through devices with the two non-critical issues? Are any machines with these non-critical issues still in production?
Additionally, in June 2018, researchers made public reports of vulnerabilities in SuperMicro firmware.[13] As part of our standard operating procedure, we notified affected customers promptly, and recommended they upgrade the firmware in their appliances.[14]
[13] Researchers at Eclypsium are reported to have told Supermicro of vulnerabilities in January 2018. When was Amazon, AWS, or other Amazon subsidiary notified of these vulnerabilties?
[14] Give the six-month gap between Eclypsium's notification to Supermicro and the public's notification, when were Amazon's, AWS', or other Amazon subsidiary's customers notified of these vulnerabilties?
Supermicro's SEC filings – last of year 2013:
Supermicro's press releases – last of year 2013:
https://www.emptywheel.net/wp-content/uploads/2018/10/DragonHack_red-v2_rayne.jpg 780 1500 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-10-08 06:05:482018-10-08 10:48:17Rattled: China's Hardware Hack - Amazon's Response
Rattled: China's Hardware Hack – Apple's Response
The following analysis includes a copy of an initial response received from Apple by Bloomberg Businessweek in response to its story, The Big Hack. In tandem with the Bloomberg story this was published on October 4 at this link. Apple's response is offset in blockquote format. No signer was indicated in the published response. Additional responses from Apple to Bloomberg's story will be assessed separately in a future post.
Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple.[1] Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them.[2] We have repeatedly and consistently offered factual responses, on the record, refuting virtually every aspect of Bloomberg's story relating to Apple.[3]
[1] Phrasing avoids who made the allegation(s).
[2] "rigorous internal investigations" doesn't describe what they actually investigated; "each time" refers to investigations AFTER Bloomberg contacted Apple, AFTER 2016 when Apple had broken off relations with Supermicro.
[3] "refuting virtually aspect" does not mean "every and all."
On this we can be very clear: Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server.[4] Apple never had any contact with the FBI or any other agency about such an incident.[5] We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
[4] (a) What about problems with firmware updates, including malicious firmware, firmware not issued by Supermicro, or hijacking to firmware upgrade sites not created by Supermicro?
(b) "purposely planted in any server" refers not to Supermicro's motherboards but Elemental or other server assemblies.
[5] What about contact with any government agency regarding firmware? What about contact with a third-party entity regarding firmware problems, including security researchers?
[6] This phrasing focuses on law enforcement but not on other possibilities like intelligence entities or non-law enforcement functions like Commerce or Treasury Departments.
In response to Bloomberg's latest version of the narrative, we present the following facts: Siri and Topsy never shared servers;[7] Siri has never been deployed on servers sold to us by Super Micro; and Topsy data was limited to approximately 2,000 Super Micro servers, not 7,000. None of those servers has ever been found to hold malicious chips.[9]
[7] (a) What about earlier versions of Bloomberg's narrative the public hasn't seen?
(b) Did Siri and Topsy ever share a data farm facility?
[8] (a) Was Siri ever deployed on Elemental brand servers?
(b) Was Topsy ever deployed on Elemental brand servers?
[9] Did any of the servers on which Siri and Topsy were deployed experience firmware problems including malicious firmware, firmware not issued by Supermicro, or hijacking to firmware upgrade sites not created by Supermicro?
As a matter of practice, before servers are put into production at Apple they are inspected for security vulnerabilities and we update all firmware and software with the latest protections. We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures.[10]
[10] Is this a statement of current practices or practices during the period of time about which Bloomberg reported? Why did Apple end its relationship with Supermicro?
We are deeply disappointed that in their dealings with us, Bloomberg's reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs.[11] That one-time event was determined to be accidental and not a targeted attack against Apple.[12]
[11] Gaslighting about the journalists' credibility. Have there ever been any servers from Elemental or other server manufacturer with "infected drivers," including the "single Super Micro server in one of our labs"? Were any servers of any make with "infected drivers" in production environments, whether they faced customers or not?
[12] How is an "infected driver" an accident?
While there has been no claim that customer data was involved, we take these allegations seriously and we want users to know that we do everything possible to safeguard the personal information they entrust to us.[13] We also want them to know that what Bloomberg is reporting about Apple is inaccurate.[14]
[13] This is not the same as saying "customer data was not exposed."
[14] "inaccurate" but not "wrong," "erroneous," "false," or "untrue"?
Apple has always believed in being transparent about the ways we handle and protect data.[15] If there were ever such an event as Bloomberg News has claimed, we would be forthcoming about it and we would work closely with law enforcement.[16] Apple engineers conduct regular and rigorous security screenings to ensure that our systems are safe. We know that security is an endless race and that's why we constantly fortify our systems against increasingly sophisticated hackers and cybercriminals who want to steal our data.[17]
[15] Tell us about iPhone encryption.
[16] "an event" is not "events". "Forthcoming" may not mean "public disclosure" or "reveal that we are under non-disclosure agreements." "Would work closely with law enforcement" is not the same as "working with intelligence community," or "working with Commerce/Treasury Departments."
[17] No specific mention of nation-state actors.
https://www.emptywheel.net/wp-content/uploads/2018/10/DragonHack_red-v2_rayne.jpg 780 1500 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-10-08 06:03:492018-10-08 02:45:57Rattled: China's Hardware Hack - Apple's Response
Rattled: China's Hardware Hack
As I noted in my last Three Things post, information security folks are rattled by the October 4 Bloomberg Businessweek report that extremely tiny microchips may have been covertly embedded in motherboards used by U.S. businesses.
Their cognitive dissonance runs in two general directions — the feasibility of implanting a chip at scale, and the ability of such a chip to provide a viable backdoor to a device.
Hardware security researchers and professionals have been debating manufacturing feasibility and chip ability across Twitter. Joe Fitz' recent tweet threads suggest implantation of a rogue chip is entirely doable on a mechanical basis though what happens once a chip has been embedded must be assessed from a software perspective. Fitz is not alone in his assessment; other professionals and academics believe it's possible to insert a 'malicious' chip. Computer security academic Nicholas Weaver pointed to small devices which could do exactly what the Bloomberg report suggested if these tiny objects were embedded into motherboards during manufacturing.
The feasibility also requires the right opportunity — a confluence of personnel, manufacturing capability and capacity, timing and traceability. Let's say a rogue or compromised employee manages to slip chips into a batch of motherboards; which ones? To whom will they ship? How could a rogue/compromised employee ensure the motherboards left the facility undetected?
The Bloomberg report paints the U.S.-based Supermicro plant as a perfect environment in which such hardware infiltration could happen easily. With employees divided by two very different languages — English-speakers far less likely to understand Mandarin-speakers — discussions between multiple rogue/compromised employees could be very easy as would be sharing of written instructions. Supermicro's ISO certifications for standards 9001, 13485, 14001, and 27001 may shed some light on how the company expected to manage two different languages in the same workplace.
One could argue a bilingual workplace shouldn't pose a challenge given how many companies already use English/Spanish, English/French, or English/German. Compare, however, these words:
English: hardware
German: either hardware or computerhardware
French: either hardware or le matériel
Spanish: either hardware or los equipos
Mandarin: 硬件 (yìng jiàn)
With enough exposure the average English-as-primary-language worker could readily understand the most common western language words for equipment they were manufacturing. It would take considerably more investment in education to recognize and understand a pictographic language making casual quality control difficult.
The environment is even more challenging for mixed language staff in manufacturing plants located in China.
~ | ~ | ~
Let's look at a timeline of events leading up to the Bloomberg report this week. Note how often the word 'firmware' is used in this timeline and in the responses from Apple and Amazon to the Bloomberg story:
1993 — Charles Liang launched Supermicro.
2007 — Social search analytics company Topsy founded.
2005 — Defence Science Board warned "trojan horse" chips bought overseas could negatively affective military systems.
2008 — BusinessWeek reported that fake Chinese-made microchips had entered the military's supply chain causing system crashes.
2010 — Defence Department bought 59,000 chips, unaware they were counterfeit.
2Q2011 — China denied entry visas to senators Levin and McCain staff for congressional probe in Guangdong province.
October 2011 — Apple releases Siri.
December 2013 — Apple acquired Topsy.
December 2013 — Supermicro publicly disclosed vulnerability/ies in a web application related to management of motherboards (Amazon response, email Oct 2018)
December 2013 — CBS' 60 Minutes program aired a story about the NSA in which a plot involving a rogue BIOS had been identified.
First half 2014 (date TBD) — Intelligence officials tell White House that PRC's military would infiltrate Supermicro's motherboard production with microchips intended for the U.S. market.
January 2014 — Elemental communicated to existing customers that a new version of the web app was available for download; equipment shipped after this date had updated versions of the web app. (Amazon response, email Oct 2018)
Early 2015 — Amazon launched pre-acquistion evaluation of startup Elemental Technologies which used Supermicro motherboards in servers it made.
Late spring 2015 — Elemental sent several servers to Ontario CAN for testing by third-party security firm. It found non-spec chips on server motherboards. (Bloomberg report)
May 2015 — Apple detected unusual network activity and experienced firmware problems.
Summer 2015 — Apple found non-spec chips on Supermicro motherboards Apple bought from Supermicro. (Bloomberg report)
September 2015 — Amazon announced its acquisition of Elemental.
December 2015 — Apple shut down Topsy.
Mid-2016 — Apple broke off its relationship with Supermicro.
June 2018 — Researchers publicized vulnerabilties found in Supermicro firmware. AWS notified customers and recommended a firmware upgrade. (Amazon response, email Oct 2018)
October 2018 — Amazon, Apple, Supermicro, and PRC submitted responses denying Bloomberg's report. (Published by Bloomberg)
Follow up reporting by other news outlets increase the layers of denial that cloud companies Amazon and Apple were affected by a possible breach of the hardware supply chain.
Some have asked if Bloomberg's report is merely an attempt to undermine Amazon and Apple, which are the two most valuable companies in the U.S. and in Apple's case, the world.
It is their value and their place in the stock market along with the customers they serve which may drive some of the denial.
Remember that Amazon's AWS has provided hosting to U.S. government agencies. Government employees also use Apple iPhones and by extension, Apple's cloud services. Is it at all possible that in providing services to government agencies these corporations and/or their subsidiaries have been read into programs obligating a degree of secrecy which includes denial of vulnerabilities and breaches which do not affect directly the average non-governmental user of Amazon and Apple products and services?
There are additional events which appear to have happened independently of the alleged hardware supply chain infiltration. They may be extremely important and highly relevant if looked at from an industry and intelligence perspective.
March 2014 — Freescale Semiconductor lost 20 employees in apparent crash of Malaysia Air flight MH370 en route to Beijing. The employees were supposed to begin work on a new chip manufacturing facility in China. While Freescale's chips were not those one might ordinarily associate with server motherboards, it's worth asking if Freescale at that time had any chips which might have served as server chips, or if they could work as illicit hardware hacks when embedded in a motherboard. Freescale has since been acquired by NXP.
Late 2010 — Beginning in late 2010, China identified and executed a network of U.S. agents within its borders over a two-year period, resulting in the deaths of at least 30 persons and the prosecution of former CIA agent Jerry Chung Shin Lee who worked as an informant for PRC. The exposure of these spies was blamed in part on a compromised communications system which had been previously used in the middle east. Due to compartmentalization of the project, it's reported Lee could not have identified the agents, placing more emphasis on the communications system.
Mid-2011 — China refused visas to staff for senators Carl Levin and John McCain for the purposes of investigating electronic components manufacturing in city of Shenzhen in Guangdong province. The congressional probe sought the source of counterfeit parts which had entered the U.S. military's supply chain; U.S. Commerce Department reported in January 2010 that 400 companies surveyed "overwhelmingly cited China" as the point of origin for counterfeit parts.
These events spawn more questions when looking at technology supply chain hacking and communications systems which rely on this supply chain.
Did Freescale's plans to expand production in China pose a risk to the hardware supply chain hack? Or was it simply a fluke that a substantive portion of the company's manufacturing engineers disappeared on that flight? Though Freescale originated in Austin, Texas, it had a presence in China since 1992 with at least eight design labs and manufacturing facilities in China as of 2014.
Was the communications system used by doomed U.S. assets in China affected not by tradecraft or betrayal, or even by counterfeit parts, but by the hardware supply chain hack — and at an even earlier date than the timeline of events shown above related to Supermicro's compromised motherboard production?
Did China refuse admittance to Guangdong province in 2011 related not to counterfeit parts but to the possibility that supply chain hacks beyond counterfeiting alone might be revealed?
Is the supply chain hack reported by Bloomberg part of a much larger security threat which has been slowly revealed but not widely acknowledged because the threat has been viewed through narrow military, or intelligence, or tech industry lenses?
The tech industry may be rattled by allegations that the computer hardware supply chain has been hacked. But the possibility this hack has gone on much longer and with massive potential collateral damage may truly shake them up.
There is a third train of cognitive dissonance, not limited to information security professionals. Persons outside the tech industry have indulged in denialism, taking comfort in the aggressive pushback by Apple and Amazon which each claim in their own way that the Bloomberg report is inaccurate. (I have an analysis of the early responses by Apple and Amazon; I will also examine later expanded responses as well as Supermicro's and PRC's responses as soon as time permits.)
But there have been reports for years about counterfeit electronic components, obstruction of investigations into these components, system failures which could be attributed to hardware or software which do not meet specifications. Cognitive dissonance also resists Bloomberg's report that as many as 30 U.S. companies were affected, not just Apple and Amazon which have offered up high-profile rebuttals.
And there have been reports in industries outside of cloud services and the military where off specification or counterfeit electronic components have made it into production. One such anecdote appears in a thread at Hacker News YCombinator, discussing credit card payment systems and development of screening systems requiring application of tests using angular momentum to determine if a board has been altered without breaking the board's tamper-proof seal.
In addition to his early tweets assessing feasibility of malicious or covert off-spec chips added to motherboards, Nicholas Weaver wrote a post for Lawfare about the Bloomberg report.
The Bloomberg story also explains a previous mystery: in 2016, Apple quietly removed all SuperMicro servers from their products due to an unspecified "Security Incident." At the time the rumor was that SuperMicro provided a sabotaged BIOS—that is, the bootstrap program used to start the computer, another "god mode" target for compromise. Apple denied then that there was any security incident—just as they are denying one now.
This incident once again illustrates the "Coventry problem," referring to Winston Churchill's apocryphal decision not to prevent the bombing of Coventry in order to keep secret that British intelligence had decrypted the Enigma machine. Robertson and Riley describe a U.S. intelligence apparatus that knew of these ongoing attacks, but could not effectively notify the affected companies nor provide useful recommendations. If the intelligence community had warned these companies, it would probably have revealed to the Chinese that the U.S. was aware of these activities, as well as potentially compromise an ongoing FBI investigation described in the article.
Weaver called the suspect Supermicro firmware a 'BIOS' — the first use of this term across multiple reports covering the Bloomberg report and its aftermath. This change in nomenclature is critical, particularly so given the point he makes about the "Coventry problem." The term 'BIOS' does not appear in the early responses from Apple, Amazon, or Supermicro.
In December 2013, CBS' 60 Minutes aired a report about the NSA; it appeared at the time to puff up the agency after the publication of Edward Snowden's leaked documents about the government's domestic spying using PRISM. Within the story was a claim about a thwarted cyberattack:
Debora Plunkett: One of our analysts actually saw that the nation state had the intention to develop and to deliver, to actually use this capability— to destroy computers.
John Miller: To destroy computers.
Debora Plunkett: To destroy computers. So the BIOS is a basic input, output system. It's, like, the foundational component firmware of a computer. You start your computer up. The BIOS kicks in. It activates hardware. It activates the operating system. It turns on the computer.
This is the BIOS system which starts most computers. The attack would have been disguised as a request for a software update. If the user agreed, the virus would've infected the computer.
John Miller: So, this basically would have gone into the system that starts up the computer, runs the systems, tells it what to do.
Debora Plunkett: That's right.
John Miller: —and basically turned it into a cinderblock.
Debora Plunkett: A brick.
John Miller: And after that, there wouldn't be much you could do with that computer.
The description sounds remarkably like the rogue firmware update in concert with a malicious/covert chip.
The manner in which this report was handled by the NSA, however, made it appear like disinformation. The assessment that such firmware would be used solely brick a device heightened the FUD around this report, deterring questions about applications other than bricking a device — like taking control of the computer, or collecting all its transaction and data. Was the FUD-enhanced release via 60 Minutes the intelligence community's approach to the "Coventry problem"?
The problem Bloomberg's Jordan Robertson and Michael Riley reported is probably much bigger than they described. It is bigger than Supermicro motherboards and firmware, and it's not a problem of the near-term future but ongoing over the last decade.
At what point will U.S. industries organize a collective response to both counterfeit and off-specification manufacturing of electronic components overseas? They can't count on a calm and rational response from the Trump administration given the unnecessary trade war it launched against China.
Disclosure: I have positions in AAPL and AMZN in my investment portfolio.
https://www.emptywheel.net/wp-content/uploads/2018/10/DragonHack_red-v2_rayne.jpg 780 1500 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-10-08 06:00:482018-10-08 10:49:20Rattled: China's Hardware Hack
Three URGENT Things: POTUS' Alert Text, Facebonked, Kavanuh-uh
October 3, 2018 /253 Comments/in Domestic Policy, Law, Trump Administration /by Rayne
Let's get right to it, no time for preamble (and don't forget to check the byline above).
~ 3 ~
There will be an unblockable nationwide test of the Presidential Alert system on all cell phones today at 2:18 p.m. ET.
This infuriates me to no end, especially after Trump's insulting bullshit at his fan club rally last night in which he denigrated assault survivor Dr. Blasey Ford. It's as if he's going to grab us all by the privates at the same time today without our consent.
Think about it: so much of your private personal life goes through your phone and now Trump's FEMA has decided it will inject itself into your phone?
Lifehacker has a decent article suggesting some methods for mitigating or avoiding the text if not blocking it — you can read about it at this link.
Make sure you tell friends and family ASAP about this alert so they don't freak out and aren't in the middle of something important when this alert shows up.
Pity the poor residents of Hawaii, having to face this crap first thing this morning.
Time zone conversion for the alert:
Eastern: 2:18 p.m. ET
Central: 1:18 p.m. CT
Mountain: 12:18 p.m. MT
Pacific: 11:18 a.m. PT
Alaska: 10:18 a.m.
Hawaii: 08:18 a.m.
Check time conversion at this link. I'm going to shut my phone off at 2:00 p.m. ET and take an hour-long break.
The half-assed FBI investigation will likely be finished today; don't expect to see the Swiss cheese-y results riddled with holes where testimony wasn't collected. It's unlikely the public will see this report.
This means McConnell will likely pursue a vote on cloture today to end debate in order for the full Senate to vote on Kavanaugh before the end of the week.
Which in turn means CALL YOUR SENATORS. Yes, even the steadfast Democrats who are unlikely to sway because their offices are being flooded with right-wing calls demanding their poor rich white frat boy judge be seated for a lifetime on the Supreme Court.
Screw that. Just MAKE THE CALLS.
Congressional switchboard: (202) 224-3121
Need a script for your call? @Celeste_pewter has them broken into four categories:
– The Democrats who have already said yes, and won't flip no matter what.
– The red state Democrats.
– The potential GOP flips.
– The GOP senators who will vote yes, no matter what.
And a universal, all-senators script.
Pick the appropriate script and have at it. (Thanks, Celeste!)
HOOSIERS: Make a special effort to thank Joe Donnelly who came out last night as a NO on Kavanaugh. He is surely being pummeled today by Indiana's finest red staters.
NORTH DAKOTANS: Heitkamp is down but within margin of error of her Republican opponent. Make sure you call so that she doesn't feel pressure to backslide.
Trouble getting through switchboard or full mailbox? Try contacting your senators' local offices. Look them up at:
Contacting Congress: https://www.contactingcongress.org
Ballotpedia: https://ballotpedia.org/Who_represents_me%3F
Facebook's massive breach exposes what a bad, BAD idea it was to allow a Facebook login to become a universal login for other applications. Let's not forget Facebook has also appropriated users' phone numbers for advertising without users' consent. It's a security cataclysm and Facebook is once again flat-footed.
NEVER LOG INTO SITES WITH FACEBOOK USERID.
Never use the same password for more than one site.
Use a password manager.
Read up here about the problem.
What did I do? I gave up Facebook years ago when it was clear to me they were a security cesspool.
Now get going. Run!
https://www.emptywheel.net/wp-content/uploads/2017/12/ThreePhones_PavanTrikutam_Unsplash.jpg 1000 1500 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-10-03 11:25:552018-10-03 12:26:22Three URGENT Things: POTUS' Alert Text, Facebonked, Kavanuh-uh
The Crimes with which NSD Envisions Charging Those Attacking Elections
June 12, 2018 /14 Comments/in 2016 Presidential Election, 2018 Mid-Term Election, Mueller Probe /by emptywheel
The Senate Judiciary Committee had a hearing on how to protect our elections today. Among others, Deputy Assistant Attorney General Adam Hickey from DOJ's National Security Division testified. He gave a list of some of the crimes he thought might be used to charge people who tampered with elections.
Foreign influence operations, though not always illegal, can implicate several U.S. Federal criminal statutes, including (but not limited to) 18 U.S.C. § 371 (conspiracy to defraud the United States); 18 U.S.C. § 951 (acting in the United States as an agent of a foreign government without prior notification to the Attorney General); 18 U.S.C. § 1001 (false statements); 18 U.S.C. § 1028A (aggravated identity theft); 18 U.S.C. § 1030 (computer fraud and abuse); 18 U.S.C. §§ 1343, 1344 (wire fraud and bank fraud); 18 U.S.C. § 1519 (destruction of evidence); 18 U.S.C. § 1546 (visa fraud); 22 U.S.C. § 618 (Foreign Agents Registration Act); and 52 U.S.C. §§ 30109, 30121 (soliciting or making foreign contributions to influence Federal elections, or donations to influence State or local elections).
In their testimony, Ken Wainstein (someone with extensive experience of national security prosecutions, but less apparent focus on the available evidence in this investigation) and Ryan Goodman (who doesn't have the prosecutorial experience of Wainstein, but who is familiar with the public facts about the investigation) also list what crimes they think will get charged.
I find a comparison of what each raised, along with what has already been charged, to be instructive. I believe that comparison looks like this:
I'm interested, in part, because Hickey, who likely has at least a sense of the Mueller investigation (if not personal involvement), sees the case somewhat differently than two differently expert lawyers. Two charges — agent of a foreign power (basically, being a foreign spy in the US not working under official cover) and CFAA (hacking) seem obvious to both National Security Division prosecutors, but have not yet been publicly charged. Illegal foreign contributions seems obvious to those paying close attention, but also has not been charged. We might expect to see all three charges before we're done.
Neither Wainstein nor Goodman mentioned false statements, but of course that's what we've seen charged most often so far.
Then there are the two crimes Hickey mentions that the others don't, but that have not yet been charged (both have been alleged as overt acts in the Internet Research Agency indictment): Visa fraud (alleged against the trolls who came to the US to reconnoiter in 2014) and destruction of evidence (again, alleged against IRA employees destroying evidence after Facebook's role was discovered). Mueller also described George Papadopoulos destroying evidencec when he deleted his Facebook account, but like the Russian trolls, he didn't get charged for it. Visa fraud, in particular, is something that multiple figures might be accused of — Alexander Torshin and others reaching out via NRA, Natalia Veselnitskaya, and even Brits who worked illegally during the election for Cambridge Analytica.
I confess I'm most interested in Hickey's mention of destruction of evidence, though. That's true, in part, because SDNY seems to think Michael Cohen might destroy evidence.
Hope Hicks, too, reportedly thought about hiding evidence from authorities. Then there's the report that Mueller is checking encrypted messaging apps as people turn in phones when they arrive for interviews.
Huckey seems to think some of the people being investigated — beyond Papadopoulos and IRA troll Viktorovna Kaverzina — may have been destroying evidence.
I wonder if he has reason to suspect that.
https://www.emptywheel.net/wp-content/uploads/2018/02/RobertMueller_PeteSouza_2012_Wikimedia.jpg 1054 1500 emptywheel https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png emptywheel2018-06-12 16:35:112018-07-28 10:44:21The Crimes with which NSD Envisions Charging Those Attacking Elections
Open Thread: Oddments Olio
April 12, 2018 /58 Comments/in 2016 Presidential Election, Culture, Mueller Probe /by Rayne
A dog's breakfast, hodgepodge, pastiche, olio — this is a catch-all post with an open thread. I have a bunch of tidbits and loose ends with no place to go, not enough on which to center posts. Make of them what you will and bring your own potpourri in comments.
Loews — No, not Lowe's as in the big box hardware store chain. Loews Regency, as in pricey hotel in NYC where Trump's personal attorney and likely cut-out has been staying, ostensibly because of construction at his home. Yeah, the same home which was searched this past week along with this hotel room and office.
One detail folks may have forgotten: Loews Regency is the same hotel where Felix Sater arranged a 27-JAN-2017 meeting between Michael Cohen and Ukrainian lawmaker Andrey Artemenko to discuss a plan to lift the sanctions on Russia. Totally legal one week after the inauguration, right? But why meet with the president's personal lawyer instead of State Department employees, or wait until Rex Tillerson was confirmed on February 1?
And when was the meeting set up — did Sater take a phone call from Artemenko before the inauguration?
It wasn't clear back in early 2017 when exactly this back-channel was first established and it's still not clear now.
Searching Cohen's room at the Loews seems more reasonable considering the Artemenko meeting. Has Cohen had a room or rooms in Loews Regency since inauguration day or earlier?
~ | ~
Hacka cracka lacka — Hey, remember how former CIA director John Brennan was hacked in 2015 and 2016 by a couple of "Cracka" hackers? Two dudes from North Carolina were arrested and prosecuted, sent to prison for two years for hacking senior U.S. officials.
One detail sticking in my craw has been the third party characterized as a group leader; only a teenager at the time, they were located in the U.K.
Why have so many issues related to politics and information security had links to the U.K. — like Cambridge Analytica/SCL and Brexit? Did somebody manipulate an autistic U.K. teenager into work assisting larger aims?
Facebook's Chancellor — Prof. David Carroll asked a very good question: why didn't any member of Congress on either the Senate Judiciary Committee or the House Energy & Commerce Committee ask about Facebook employee Joseph Chancellor, a psychologist who had been hired away from Cambridge Analytica. Well?
Speaking of Facebook, there are several folks who've been all over the this scandal, some of whom have been responsible for the public's awareness that Facebook data had been acquired without users' consent. Give them a follow:
Carole Cadwalladr — reporter-writer for Guardian-UK and Observer who has doggedly covered Cambridge Analytica/SCL links to Facebook user data and their impact on the Brexit referendum in June 2016. Her Guardian content here (consider throwing them a few bucks for her great work.)
Chris Wylie — Cambridge Analytica's former director of research now whistleblower who revealed much of the workings between CA/SCL and Facebook's ill-gotten data.
David Carroll — Associate professor of media design at the School of Art, Media, and Technology at The New School's Parsons School of Design; he's been chasing his personal data located in the U.K and is now suing Cambridge Analytica's parent, SCL, for U.S. data it obtained without consent. (Read about the case and chip into the legal fund at this link.)
Also note that Verge senior writer Sarah Jeong generously tweeted all the members of Congress who'd received donations from Facebook as they questioned CEO Mark Zuckerberg. Check it out.
Content bias — During this week's committee hearings with Facebook CEO, GOP members of Congress tried repeatedly to make a case that Facebook was biased against conservative content. Too bad Facebook helped get a GOP POTUS elected, shooting that narrative in the ass.
But one related thing has stuck in my craw for quite some time, and I can't help wonder if it was yet another way in which Facebook was manipulated by a disinformation operation.
Remember back in 2016 stories reporting Facebook's contract content editors complained that Facebook was biased against conservatives? The story first appeared in Gizmodo on May 9, then got picked up by other outlets. A political story during the campaign season usually happens the other way around — covered first in a big national outlet then picked up in lesser outlets. Why did this story happen via Gizmodo first? This would be the perfect manner in which to launder information; the point of origin is obscured by the second and third outlets to pick it up as they typically go to the biggest source to confirm their story. In this case, an outlet like NYT or WaPo would go to Facebook and put them on the spot. They wouldn't bug Gizmodo or the leakers who went to Gizmodo.
Another important factor: Gizmodo was part of beleaguered Gawker Media, which was about to implode and bought out months later by Univision. Anybody remaining at the time this story hit was uncertain about the security of their job. Journalists would have been ripe for manipulation because they needed an attention-getting story to improve their odds for a next gig.
In fact, Gawker Media filed for Chapter 11 bankruptcy one month after the Facebook bias story was published — on June 10, 2016. Think of this 30-day time frame as two very stressful paydays for beleaguered Gawker employees who were trying hard to keep on keeping on but probably frantically wallpapering prospective media employers with resumes.
One more important factor: the reporter who covered this story was a technology editor whose beat wasn't politics or free speech issues. This changed the way the story was covered and rolled out; if a reporter with more savvy and experience covering politics had been approached with this particular tip, they might have known there was something more to this than poor-conservatives-being-suppressed-by-liberal-bias. A political contributor might have questioned the insistance that outlets like Breitbart and Newsmax weren't being included alongside NYT and WaPo.
Watching GOP congresspersons repeatedly bash Zuckerberg about media bias, I could see the same deer-in-the-headlights reaction Facebook had back in 2016 when these contract editors complained about bias. There was no bias; the hearings this week and the story in 2016 were naked attempts to screw with Facebook's algorithms so that POS outlets like Mercer-funded, Bannon-operated Breitbart and Alex Jones' InfoWars could get the same attention as legitimate outlets like NYT and WaPo.
We're still going to have to press Facebook and other social media outlets to address this problem. It's just not a problem of bias but identifying legitimate reported journalism. And we all have a problem with being easily played for our lack of sufficient skepticism.
Go for it. What detritus have you been carrying around that doesn't fit anywhere else? Share in comments.
https://www.emptywheel.net/wp-content/uploads/2017/08/Question_EmilyMorter-Unsplash.jpg 1000 1500 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-04-12 13:01:482018-04-12 13:38:53Open Thread: Oddments Olio
Facebook, Hot Seat, Day Two — House Energy & Commerce Committee Hearing
April 11, 2018 /30 Comments/in 2016 Presidential Election, Culture, Cybersecurity, Internet infrastructure /by Rayne
This is a dedicated post to capture your comments about Facebook CEO Mark Zuckerberg's testimony before the House Energy & Commerce Committee today.
After these two hearings my head is swimming with Facebook content, so much so that I had a nightmare about it overnight. Today's hearing combined with the plethora of reporting across the internet is only making things more difficult for me to pull together a coherent narrative.
Instead, I'm going to dump some things here as food for further consideration and maybe a possible future post. I'll update periodically throughout the day. Do share your own feedback in comments.
Artificial Intelligence (AI) — every time Mark Zuckerberg brings up AI, he does so about a task he does not want to employ humans to do. Zuckerberg doesn't want to hire humans even if it means doing the right thing. There are so many indirect references to creating automated tools that are all substitutions for labor that it's obvious Facebook is in part what it is today because Facebook would rather make profits than hire humans until it is forced to do otherwise.
Users' control of their data — this is bullshit whenever he says it. If any other entity can collect or copy or see users' data without explicit and granular authorization, users do not have control of their data. Why simple controls like granular read/not-read settings on users' data operated by users has yet to be developed and implemented is beyond me; it's not as if Facebook doesn't have the money and clout to make this happen.
Zuckerberg is also evasive about following Facebook users and nonusers across the internet — does browsing non-Facebook website content with an embedded Facebook link allow tracking of persons who visit that website? It's not clear from Zuckerberg's statements.
Audio tracking — It's a good thing that Congress has brought up the issue of "coincident" content appearing after users discuss topics within audible range of a mobile device. Rep. Larry Buschon (R-Indiana) in particular offered pointed examples; we should remain skeptical of any explanation received so far because there are too many anedotes of audio tracking in spite of Zuckerberg's denials.
Opioid and other illegal ads — Zuckerberg insists that if users flag them, ads will be reviewed and then taken down. Congress is annoyed the ads still exist. But at the hear of this exchange is Facebook's reliance on users performing labor Facebook refuses to hire to achieve the expected removal of ads. Meanwhile, Congress refuses to do its own job to increase regulations on opioids, choosing instead to flog Facebook because it's easier than going after donors like Big Pharma.
Verification of ad buyers — Ad buyers' legitimacy based on verification of identity and physical location will be implemented for this midterm election cycle, Zuckerberg told Congress. Good luck with that when Facebook has yet to hire enough people to take down opioid ads or remove false accounts of public officials or celebrities.
First Amendment protections for content — Congressional GOP is beating on Facebook for what it perceives as consistent suppression of conservative content. This is a disinfo/misinfo operation happening right under our noses and Facebook will cave just like it did in 2016 while news media look the other way since the material in question isn't theirs. Facebook, however, has suppressed neutral to liberal content frequently — like content about and images featuring women breastfeeding their infants — and Congress isn't uttering a peep about this. Congress also isn't asking any questions about Facebook's assessments of content
Connecting the world — Zuckerberg's personal desire to connect humans is supreme over the nature and intent of the connections. The ability to connect militant racists, for example, takes supremacy (literally) over protecting minority group members from persecution. And Congress doesn't appear willing to see this as problematic unless it violates existing laws like the Fair Housing Act.
More to come as I think of it. Comment away.
UPDATE — 2:45 PM EDT — I'm gritting my teeth so hard as I listen to this hearing that I've given myself a headache.
Terrorist content — Rep. Susan Brooks (R-Indiana) asked about Facebook's handling of ISIS content, to which Zuckerberg said a team of 200 employees focus on counterintelligence to remove ISIS and other terrorist content, capturing 99% of materials before they can be see by the public. Brooks further asked what Facebook is doing about stopping recruitment.
What. The. Fuck? We're expecting a publicly-held corporation to do counterintelligence work INCLUDING halting recruitment?
Hate speech — Zuckerberg used the word "nuanced" to describe the definition while under pressure by left and right. Oh, right, uh-huh, there's never been a court case in which hate speech has been defined…*head desk*
Whataboutism — Again, from Michigan GOPr Tim Walberg, pointing to the 2012 Obama campaign…every time the 2012 campaign comes up, you know you are listening to 1) a member of Congress who doesn't understand Facebook's use and 2) is working on furthering the disinfo/misinfo campaign to ensure the public thinks Facebook is biased against the GOP.
It doesn't help that Facebook's AI has failed on screening GOP content; why candidates aren't contacting a human-staffed department directly is beyond me. Or why AI doesn't interact directly with campaign/candidate users at the point of data entry to let them know what content is problematic so it can be tweaked immediately.
Again, implication of discrimination against conservatives and Christians on Facebook — Thanks, Rep. Jeff Duncan, waving your copy of the Constitution insisting the First Amendment is applied equally and fairly. EXCEPT you've missed the part where it says CONGRESS SHALL MAKE NO LAW respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press…
The lack of complaints by Democratic and Independent representatives about suppression of content should NOT be taken to mean it hasn't happened. That Facebook allowed identified GOP-voting employees to work with Brad Parscale means that suppression happens in subtle ways. There's also a different understanding between right and left wings about Congress' limitation under the First Amendment AND Democrats/Independents aren't trying to use these hearings as agitprop.
Internet service — CONGRESS NEEDS TO STOP ASKING FACEBOOK TO HELP FILL IN THE GAPS BETWEEN NETWORKS AND INTERNET SERVICE PROVIDERS THEY HAVE FAILED TO REGULATE TO ENSURE BROADBAND EVERYWHERE. Jesus Christ this bugs the shit out of me. Just stop asking a corporation to do your goddamned jobs; telcos have near monopoly ensured by Congress and aren't acting in the best interest of the public but their shareholders. Facebook will do the same thing — serve shareholders but not the public interest. REGULATE THE GAP, SLACKERS.
3:00 PM thank heavens this beating is over.
Three more thoughts:
1) Facial recognition technology — non-users should NEVER become subjected to this technology, EVER. Facebook users should have extremely simple and clear opt-in/opt-out on facial technology.
2) Medical technology — absolutely not ever in social media. No. If a company is not in the business of providing health care, they have no business collecting health care data. Period.
3) Application approval — Ask Apple how to do it. They do it, app by app. Facebook is what happens when apps aren't approved first.
UPDATE — 9:00 PM EDT — Based on a question below from commenter Mary McCurnin about HIPAA, I am copying my reply here to flesh out my concerns about Facebook and medical data collection and sharing:
HIPAA regulates health data sharing between "covered entities," meaning health care clearinghouses, employer-sponsored health plans, health insurers, and medical service providers. Facebook had secretly assigned a doctor to work on promoting a proposal to some specific covered entities to work on a test or beta; the program has now been suspended. The fact this project was secret and intended to operate under a signed agreement rather than attempting to set up a walled-off Facebook subsidiary to work within the existing law tells me that Facebook didn't have any intention of operating within HIPAA. The hashing concept proposed for early work but still relying on actual user data is absurdly arrogant in its blow off of HIPAA.
Just as disturbing: virtually nothing in the way of questions from Congress about this once-secret program. The premise which is little more than a normalized form of surveillance using users' health as a criteria is absolutely unacceptable.
I don't believe ANY social media platform should be in the health care data business. The breach of U.S. Office of Personnel Management should have given enough Congress enough to ponder about the intelligence risks from employment records exposed to foreign entities; imagine the risks if health care data was included with OPM employment information. Now imagine that at scale across the U.S., how many people would be vulnerable in so many ways if their health care information became exposed along with their social records.
Don't even start with how great it would be to dispatch health care to people in need; we can't muster the political will to pay for health care for everybody. Why provide monitoring at scale through social media when covered entities can do it for their subscriber base separately, and apparently with fewer data breaches?
You want a place to start regulating social media platforms? Start there: no health care data to mingle with social media data. Absolutely not, hell to the no.
https://www.emptywheel.net/wp-content/uploads/2018/04/Facebook_NewLogo_2015_Wikimedia.jpg 609 1087 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-04-11 13:33:052018-04-11 21:13:50Facebook, Hot Seat, Day Two — House Energy & Commerce Committee Hearing
Facebook on the Hot Seat Before Senate Judiciary Committee
This is a dedicated post to capture your comments about Facebook CEO Mark Zuckerberg's testimony before the Senate Judiciary Committee this afternoon. At the time of this post Zuckerberg has already been on the hot seat for more than two hours and another two hours is anticipated.
Before this hearing today I have already begun to think Facebook's oligopolic position and its decade-plus inability to effectively police its operation requires a different approach than merely increasing regulation. While Facebook isn't the only corporation monetizing users' data as its core business model, its platform has become so ubiquitous that it is difficult to make use of a broad swath of online services without a Facebook login (or one of a very small number of competing platforms like Google or Twitter).
If Facebook's core mission is connecting people with a positive experience, it should be regulated like a telecommunications provider — they, too, are connectors — or it should be taken public like the U.S. Postal Service. USPS, after all, is about connecting individual and corporate users by mediating exchange of analog data.
The EU's General Data Protection Regulation (GDPR) offers a potential starting point as a model for the U.S. to regulate Facebook and other social media platforms. GDPR will shape both users' expectations and Facebook's service whether the U.S. is on board or not; we ought to look at GDPR as a baseline for this reason, while compliant with the First Amendment and existing data regulations like the Computer Fraud and Abuse Act (CFAA).
What aggravates me as I watch this hearing is Zuckerberg's obvious inability to grasp nuance, whether divisions in political ideology or the fuzzy line between businesses' interests and users' rights. I don't know if regulation will be enough if Facebook (manifest in Zuckerberg's attitude) can't fully and willingly comply with the Federal Trade Commission's 2011 consent decree protecting users' privacy. It's possible fines for violations of this consent decree arising from the Cambridge Analytica/SCL abuse of users' data might substantively damage Facebook; will we end up "owning" Facebook before we can even regulate it?
Have at it in comments.
UPDATE — 6:00 PM EDT — One of my senators, Gary Peters, just asked Zuck about audio capture, whether Facebook uses audio technology to listen to users in order to place ads relevant to users' conversational topics. Zuck says no, which is really odd given the number of anecdotes floating around about ads popping up related to topics of conversation.
It strikes me this is one of the key problems with regulating social media: we are dealing with a technology which has outstripped its users AND its developers, evident in the inability to discuss Facebook's operations with real fluency on either the part of government or its progenitor.
This is the real danger of artificial intelligence (AI) used to "fix" Facebook's shortcomings; not only does Facebook not understand how its app is being abused, it can't assure the public it can prevent AI from being flawed or itself being abused because Facebook is not in absolute control of its platform.
Zuckerberg called the Russian influence operation an ongoing "arms race." Yeah — imagine arms made and sold by a weapons purveyor who has serious limitations understanding their own weapons. Gods help us.
EDIT — 7:32 PM EDT — Committee is trying to wrap up, Grassley is droning on in old-man-ese about defending free speech but implying at the same time Facebook needs to help salvage Congress' public image. What a dumpster fire.
Future shock. Our entire society is suffering from future shock, unable to grasp the technology it relies on every day. Even the guy who launched Facebook can't say with absolute certainty how his platform operates. He can point to the users' Terms of Service but he can't say how any user or the government can be absolutely certain users' data is fully deleted if it goes overseas.
And conservatives aren't going to like this one bit, but they are worst off as a whole. They are older on average, including in Congress, and they struggle with usage let alone implications and the fundamentals of social media technology itself. They haven't moved fast enough from now-deceased Alaska Senator Ted Steven's understanding of the internet as a "series of tubes."
https://www.emptywheel.net/wp-content/uploads/2018/04/Facebook_NewLogo_2015_Wikimedia.jpg 609 1087 Rayne https://www.emptywheel.net/wp-content/uploads/2016/07/Logo-Web.png Rayne2018-04-10 17:45:212018-04-10 19:33:20Facebook on the Hot Seat Before Senate Judiciary Committee


text:
Q: DbgHelp vs DbgEng vs DIA SDK in regards to thread safety All these APIs (DbgHelp, DbgEng, DIA SDK) can be used to recover function name/source file location from function pointers, so are usable to decrypt stack traces.
However, every DbgHelp function has the following remark:

All DbgHelp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more than one thread to this function.

As for DbgEng, there aren't such claims, however it seems that it is based on DbgHelp, so cannot be thread-safe: even if DbgEng guards every call to DbgHelp, there may be calls to DbgHelp not from DbgEng, but directly from the user's code.
I'm afraid if DIA SDK is also implemented using DbgHelp.
So is there any robust symbols API that can be used in a library designed for a multithreaded application?

A: DIA SDK is assumed to be a thread safe solution.
There's an issue in Boost.Stacktrace repo that asks for switching to DIA SDK. Unsafety of DbgHelp and DbgEng is mentioned there.
Also there's an option to roll own implementation; a possible starting point is here: https://github.com/microsoft/microsoft-pdb

redpajama_set_name: RedPajamaStackExchange


text:
author, book review, reading, writing
An interview with author Karen Gray
January 9, 2016 January 10, 2016 kjsimmill
Karen Gray is, without a doubt, my favourite author of 2015. Her books For King and Country and Chains of Blood and Steel have a very unique plot and are told with such skill and imagination you can't help but become hooked. It is with great pleasure I present an interview with her.
Tell us a little bit about yourself. (Author Bio)
Karen Gray grew up in a town called Livingston, in central Scotland.
She was horse mad from an early age and moved to Aberdeen at 17 to do a degree in Equine Science. After moving back home to Livingston 4 years later she worked as a care assistant for the elderly and infirm until she got a job in the equestrian industry. Since then she followed her line of work across Scotland to Greenock where she met her husband.
After leaving her job as a riding instructor to have her eldest child, Karen was never able to return to work. Her husband's health deteriorated to the point he needed her available at any time of the day. She now cares for him and their 2 children full time. She began writing again shortly after the birth of her second child and has not stopped since. Writing is her first passion before all others and though she is working on other artistic projects, her writing comes first.
She is now about to embark on the fourth novel in the Warrior Queen Series, the first series from The Saga of Thistles and Roses.
Writing (obviously) photography and graphic design. Crochet and anything to do with horses.
What do you feel is your greatest accomplishment, and why?
I want to say my kids because what mother wouldn't? But I know that's probably not what you mean. I could say writing my books, but I'm not finished yet so they in theory cannot be an achievement until the Saga is complete.
So I will say that my greatest achievement is no single thing but a series of much smaller gestures and achievements mostly to do with my career in the horse world. I Took on a 3 year old Clydesdale on deaths door who'd had cancer and was now lighter than a welsh pony and missing an eye. I turned him into a bombproof horse for a disabled rider. I knew taking him on that he could just drop dead (the cancer was on his retinal nerve and very close to his brain) We gave him 7 fantastic years before the cancer came back, and we lost him 4 weeks before he turned 10.
I've connected to severely disabled children and adults by taking a unique approach to teaching them, in some cases actually gaining the only spoken words ever uttered to someone other than family. I'm really proud of that.
I've helped countless people confront, combat and overcome their fears with regard to horses specifically. I kind of put it down to knowing exactly how badly fear can cripple you and understanding it at a fundamental and basic level and because I know that it helps me to teach people how to deal with it.
There are a thousand more little things like this that all combine to make me proud of being the best instructor I could be while I was still teaching and training.
Which writers inspire you?
Not many. I know most writers are fond of telling other writers that in order to be able to write effectively, they need to read more than they write, but if I followed that advice I would never write anything. I find reading a struggle at times – a poor attention span, being a tad dyspraxic plus having little time free each day makes it particularly difficult to get absorbed in a good book. I find that I lose interest very quickly and that is both disappointing and upsetting. There have been a few I have enjoyed, Trudi Canavan, Garth Nix and Maria Snyder are three of those, however I did crave a slightly more adult theme rather than YA. This is what spurred me on to write my own series which I feel is in a YA style, but absolutely aimed at adults specifically. Something easy to read and enthralling while being deep, deep, deep with the subplot details and adult arcs.
For your own reading, do you prefer e-books or paper/hard back books?
Paperbacks. ALWAYS paperbacks, but e-books are useful while I have limited space and time.
What are you reading at present?
I am reading Darrienia of course! And also doing some Beta reading, but generally I don't read much at all, particularly not when I'm writing (and I'm always writing)
What is your favourite book and why?
That's tough because I don't really have many to choose from. Out of the selection I have read, Sabriel by Garth Nix is my hands down favourite. It helped me through a really tough time in my life when I didn't know who I could trust and was isolated away from everyone and everything. I don't even remember how I got the book. I don't remember buying it or being given it, I only remember having it and of course reading it. This book helped me go somewhere else for a period of time each day and I will never forget just how much that simple little bit of time-out helped me cope.
What is your favourite film/ series and why?
Oh, that's a tough one, I don't really watch TV. Probably "The Tudors." I used to like the Avengers films and Game of Thrones, and The Hunger Games and such like but since I started writing it's all I want to do and if I am watching TV or a film, I feel guilty that I'm not writing, and end up regretting the "wasted" time.
I write. It helps me work out the daily stress and anxiety that accumulates from being a full-time carer. Don't get me wrong, I wouldn't change anything (other than his health) but it is stressful for the majority of the time. Always is when you can't do anything to help except be there.
What advice would you give to aspiring writers?
Most people would recommend that aspiring writers should read at least double what they write. I on the other hand will not. If you want to write, then do so. Write and write and write some more. The only way to find yourself as a writer is to let go and allow your heart and your hand to show you what kind of a writer you really are. Often they will surprise you.
What made you realise your calling as an author?
I started writing and couldn't stop — that was my first clue. Then I shared what I had written with family who raved about it. And I shared it with friends who raved about it and shared it with their friends who raved about it. At that point, when everyone was hounding me for more and more material, I knew that writing was what I was meant to do. When you can make people laugh out loud, feel physically sick, worry for your characters and feel truly angry when they are mistreated, and cry when they are hurt or lost, that's when you know you've made it as a writer.
Where do your ideas come from, what inspires you?
Life, love, loss, loathing, longing. I take inspiration from my own life even — at times — without realising it. A lot of what is going on in the news is relevant in my work, though when I wrote the 2nd book (Chains of Blood and Steel) the news stories were still to break for those subjects. Topics that people want to ignore and pretend don't or aren't happening. There are things in this life that just shouldn't be ignored because they are uncomfortable subjects. Obscure myths and legends that capture the imagination, like the waterhorses in my books. I always loved the stories of how when they lay with lassies, they wouldn't realise their mate was a waterhorse until they combed their fingers through their lover's hair while they slept and would come away with sand beneath their nails and that these were the women that would make a lucky escape. History is a huge influence on me also, though I do like to twist it somewhat to fit my purposes.
How long on average does it take you to write a book?
Depends on the book and what's going on in the background. I wrote For King and Country in around 4 or 5 months. Chains of Blood and Steel took me 3 months to write (that one just fell out of me) and Battle of the Bannockburn was another 4 to 5 months as I was editing For King and Country at the time. A lot has been going on in the background recently so in the last 3 months I have only done 30,000 words of The Highland Queen, but now that Chains of Blood and Steel is published, I will have much more writing time. I plan to have it finished and have started the fifth book Beat the Drums of war by March, which I would like to have complete by August.
Do you work to an outline or plot or do you prefer just see where an idea takes you?
That's a hard one to answer because I am very much a freewriter. I just go with the flow and write what I write. On the other hand, I have all 15 books in the saga planned out in my head and a few stand alones besides, so while I write freely and with no set plan, I am on a semi predetermined route.
Doing anything else when I'd rather be writing.
What is the easiest thing about writing?
The writing itself.
Do you ever get writer's Block and if so, how do you deal with it?
Not at all. I have never had it and I hope never to get it. Perhaps it is because of the method I use. The large cast list and many scene/pov changes which keep me engaged and also show me so many more angles of the story than just one person's perspective. I get bored easily, I have to write in such a way that my attention is always on the job at hand and I suppose that because the story is so varied and vibrant that this is why I have never suffered from writer's block.
How many books have you written, which is your favourite?
To date I have written 3 and a quarter. Book 3 – Battle of the Bannockburn is by far my favourite out of the books I have written. It (in my mind) is also one of the most important books in the entire saga and glues together not only the Warrior Queen series, but all three series in the saga as well. However, though book 3 is my favourite, book 2 – Chains of Blood and Steel, is the one I'm proudest of.
Right now I am working on the 4th book in the series – The Highland Queen. I am enjoying every minute of writing this book. I feel that I really hit my literary stride in the latter half of the third book and I now feel that there is a superior quality to my work that I didn't know existed until I found it. I'm excited about getting further into this engaging storyline (or more accurately, mass of storylines)
What genre are your books?
I have always struggled to pin down a specific genre for my books. SO I tend to call them Scottish Mythical Fantasy. Although I guess they would fit in the Epic Fantasy category, I like promoting their Scottishness as that seems to be one of the things that most people have specifically enjoyed about them, no matter where in the world they are.
What have you written?
Books 1 to 3 (For King and Country, Chains of Blood and Steel and Battle of the Bannockburn) of The Warrior Queen series are already written and I am writing the 4th in the series – The Highland Queen — at present.
Tell us a little bit about the series.
The Saga of Thistles and Roses, is a post-apocalyptic, Scottish, mythical fantasy set in the 27th century.
We enter a world where everyone has developed some level of mental ability – where mythical beasts no longer trust people to live unsupervised, and magic is no longer magic – but something far more normal. The abilities and gifts of the general population, lying dormant below the surface; became heightened in the aftermath of the nuclear apocalypse 600 years before – The world's last-ditch attempt to end the tyrannical rule of Reginald I.
Vast swaths of humanity were wiped out, leaving only those who could afford their way into hidden nuclear shelters, and those with enough latent power to survive the blast and radiation sickness that followed.
These surface dwellers struggled – for a time; until each little group found its own specific niche – and the population thrived. Now numbering in their thousands, people live side by side with the beasts of the world – who will never forget the destruction that unsupervised humanity unleashed; and intend never to allow it to happen again.
For King and Country and Chains of Blood and Steel are part of the first series of this saga called The Warrior Queen Series.
Many queens – or Bhanrighs as they are known in Alba – have come and gone; but none so feared as Mòrag Stewart.
The first of her name; Mòrag struck fear into the hearts of those who sought to oppose her; so much so, that the Sasannach royals captured and held Mòrag's daughter Catrìona in order to control the warrior queen. Their plan backfired, and the Albannach Bhanrigh unleashed her rage upon Lunnainn; burning the Sasannach capital to the ground in retaliation for the incarceration of her daughter. Little is known about events thereafter. Odd for so recent a history as this. What is known, is that the Albannach Bhanrigh met her end suddenly, mere weeks before the death of her only heir – Catrìona.
Unbeknown to all but a chosen few; an heir remained. Not just an heir to the Albannach throne, but a hybrid monarch to rival the darkness of the previous hybrid – Reginald I.
The child is delivered into the hands of Jock MacDonald when she is only hours old and he and his wife raise her in secret until she is ready to take the throne.
The child – also named Mòrag, is brought up on a farm in glen Rannoch; on the edge of Mòinteach Raineach – the Rannoch moor; where wild horses and Kelpies run together; and she can remain out of sight of those who would seek to eliminate her. The Warrior Queen Series follows Mòrag and her companions on her journey to become not only the Albannach Bhanrigh, but the second Bhanrigh to be considered as the warrior queen.
Where can we buy them?
Amazon and CreateSpace are the main places you can by the books, however they are available to any shops that use Ingram/Ingram Spark
Give us an insight into your main character. What does he/she do that is so special?
Another difficult question, because Mòrag is not the only main character, though she is the primary main character. I think she is quite unique in that she is the only one who came from a nice, comfortable, family background. Sure she is an orphan but that doesn't mean her home life was dire. She loved her home and her surrogate family. She possesses abnormally strong powers and when she learns of her lineage she just accepts what is. I love that she saves the men far more often than she herself needs saving, if ever. She is headstrong, and opinionated but kind and caring. She is fallible and at times during her personal growth, toes something similar to the path of a villain rather than a hero, but everything she does is to protect her people and her country. I wrote her like this because I am sick to the back teeth of being presented with supposedly "strong female leads" who are still always, always, ALWAYS saved and protected by the men. Mòrag breaks the mold so'n she does.
Who is your favourite character and why? (an unfair question I know)
Raymond. To find out why you'll have to read book 3 😉
In what formats is your book available?
My books are available in paperback and e-book format and the wonderful Kat Harrison is recording them in audio for me so the Audiobooks will be coming soon.
Find Kat Harrison here:
http://katrinagharrison.wix.com/katsmash
http://voice123.com/katharrison
When is your next book due for release?
Battle of the Bannockburn I plan to release on the 1st June 2016 followed by Beat the Drums of War on the 1st December 2016.
Your first book, For King and Country, reached number one in the UK Amazon best seller ranks in the category of Myths & Legends > Celtic, English & Welsh , How did this make you feel?
I was ecstatic. I danced around the livingroom. Know that way when you're so excited that you have to tense every muscle in your body just to hold it in and then you just can't? It was one of those. And then when it stayed there for the entire week. I was gobsmacked. Truly gobsmacked. And humbled and grateful that people gave it the chance and overjoyed that they were reading my book.
The feeling you get when someone is reading your work is incredible, the feeling you get when so many people are reading it that it pushes the book to #1 for a week is beyond words. One of the best moments I've every experienced right there.
Book titles and synopsis:
Book 1 – For King and Country:
Mòrag's world is one of proud magical creatures and fierce armies bristling with steel and sorcery.
Welcome to twenty-seventh century post-apocalyptic Scotland; where immortal beasts roam wild in the countryside, mighty princes battle for power and the common folk do their best to avoid being trampled in their wake.
Born of a forbidden coupling between the Albannach and Sasannach royal houses; Mòrag is destined to rule. But her birth right has been kept secret – even from her, and discovery of her royal blood could cost her life.
Mòrag is no ordinary girl. Her royal blood's hidden talents begin to reveal themselves during her military training at Sruighlea Castle, and she is suddenly in a lot more trouble than she ever dreamed of.
Mòrag is about to enter a brutal world of conflict and turmoil which will challenge everything she knows and believes in.
Book 2 – Chains of Blood and Steel:
Six months after the communication by Edward, Mòrag is still trying to piece things together. She trains daily with Colonel Tesso, in an attempt to bring her physical skills up to match her mental ones.
Brax battles with visions of his master and fears his presence will put Mòrag in danger as his mental chains are pulled tighter.
The spy-master's daughter struggles to deal with her abusive father, hiding a secret she is prepared to take to the grave.
John whose life has been a lie, discovers the truth about himself through Ava. Brought together after he catches her failed attempted suicide, they overcome the chains of blood and steel that imprison them.
Book 3 – Battle of the Bannockburn: Release date: 1st June 2016
In the smoky aftermath of the still smouldering remains of several buildings in Sruighlea Castle, chaos reigns supreme.
Edward has assumed control of Sasann and proclaimed himself king, and with the Devil's Dog is back under the controlling hand of his master, no one dares challenge him.
Mòrag struggles with the darkness growing inside her, and without Brax's calming companionship, her fragile control is slipping.
When Edward sends his pet to sack one of Alba's border towns, Mòrag retaliates by striking out at Edward's own home in Lunnainn, triggering a freefall of events that culminate in a full-scale battle on the Bannockburn.
Book 4 – The Highland Queen: Release date: 1st December 2016
The Mackenzie's pledge their loyalty and vow to stand with their Bhanrigh against Edward, but there is another danger to Mòrag and her companions. The highland clans are at war with one another in a savage and bloody battle to chose who should lead the people of Alba.
In order to gather her forces to take on her father, Mòrag must bring the clans together under one banner, her banner.
But some of the clans are loyal to Edward. And she soon discovers the truth behind her grandmother's demise.
Book 5 – Beat the Drums of War: Release date: 1st June 2017
Mòrag must face her father in a last ditch effort to defeat him. But what good are swords and arrows when even a nuclear apocalypse could do him no harm?
With the help of Rhona and the remaining members of the MacDonald family, Mòrag comes face to face with the soul of her grandmother. It soon becomes clear that the Mòrag I — the Great Warrior Queen, is far more than she seems. Mòrag must decide if she is willing to relinquish control of her own body for the greater good.
Harry must come to terms with who he is and accept that he is destined to rule. Only the will of the Highland Queen and the Lowland King combined, will be enough to match the ancient evil that seeks to corrupt all.
Mòrag will need her friends and allies more than ever in this final installment of her story.
But can she defeat her father?
Amazon Author Page: Karen Gray on Amazon
Blog: Thistles and Roses
My Writer's Forum: Karen's Writer's Forum
Goodreads: Karen Gray on Goodreads
Linkedin: Karen Gray on LinkedIn
Pinterest: Karen on Pinterest
Twitter: @KarenGr4y
Website: http://thistlesandroses.co.uk
Tagged author interview, Authours, fantasy, For King and Country, Garth Nix, Interview, Karen Gray, Maria Snyder, reading, Scottish, Trudi Canavan, writing
Previous postBook review: Strange Matters by Bret Allen
Next postThe Last Swordmage by Martin F. Hengst

redpajama_set_name: RedPajamaCommonCrawl


cheap New Vans Trainers for Women - Old Skool Trainers - Black Outlet, Latest Fashion &74% discount.
Classic Old Skool trainers by Vans have been kicking about for a while now. Crafted in premium quality for comfort and shred resilience, they have become a status symbol of skate tradition.