Blame Russia. In a bombshell indictment, the Department of Justice explained this week how Russian spies worked with common criminals to ransack Yahoo’s customer accounts.
The report backs up Yahoo’s claim, which many in the hacking community had doubted, that a “state-sponsored actor” was responsible for a breach that compromised hundreds of millions of accounts.
Yet not everyone is satisfied with this explanation. A former prosecutor complained to me over lunch this week that the Justice Department is helping Yahoo avoid accountability. In his view, framing the breach as a global espionage incident is a distraction from the main story, which is ordinary criminals exploiting Yahoo’s sloppy security practices for financial profit.
He has a point. The Justice Department account leaves some pretty big questions unanswered, including who carried out an earlier hack at Yahoo, and which corporate officials learned about the breach.
More broadly, the feds risk giving Moscow intelligence too much credit: In this must-read New York Timesarticle, Russia’s spies come across not as evil geniuses, but as opportunists who rely on the work of common cyber criminals. That sure seems like the case with the Yahoo breaches.
There’s one more drawback to overstating the Russian role in the hacks. Namely, the focus on attribution can draw attention from what some cyber-types think should be the real priority—securing our systems from future intrusions.
“Pointing fingers at foreign individual won’t change what happened or stop this happening again. Let’s focus on the root cause of problems and get pre-emptive,” said Oren Falkowitz, a former NSA employee who now runs the email security firm AreaOne.
Sounds like good advice. And if you want to get pre-emptive, read my colleague Robert Hackett’s account of this “frighteningly effective Gmail scam” that is Fortune’s most-read story this month. Thanks for reading—more cyber news below.
Jeff John Roberts
@jeffjohnroberts
jeff.roberts@fortune.com
Welcome to the Cyber Saturday edition of Data Sheet, Fortune’sdaily tech newsletter. You may reach Robert Hackett via Twitter, Cryptocat, Jabber (see OTR fingerprint on my about.me), PGP encrypted email (see public key on my Keybase.io), Wickr, Signal, or however you (securely) prefer. Feedback welcome.
THREATS
Missing! One classified computer: The Secret Service posted a "stolen laptop" notice after a crook broke into a car this week and made off with an agent's backpack that contained her computer. The laptop reportedly contained floor plans and evacuation details for Trump Tower among other sensitive information. Thank heavens it was encrypted. (New York)
Digital currency gone wild: Hey bitcoin boosters, so sorry about the SEC hating on your ETFs. But on the bright side, if you stocked up on Ethereum, Dash or a non-bitcoin currency, you're probably feeling very prosperous about now. Prices are soaring, and these alt-coins now amount for a much bigger share of the overall digital currency market cap. (Fortune)
Show us your searches: A judge in Minnesota granted an unusual search warrant, requiring Google to disclose a list of everyone who had searched the name of an individual who had been the victim of a financial scam. "Case name should be In re Minnesota Unconstitutional General Warrant," tweeted one lawyer. (Ars Technica)
Stay classy, Wikileaks: Julian Assange's outfit has already reneged on its pledge to share the vulnerabilities it obtained from CIA documents with tech companies so the firms can patch them. Now, Wikileaks says it will only disclose the code flaws if the companies agree to a series of demands. (Motherboard)
And President Trump, the Brits are really mad. Maybe keep those wiretap theories to yourself, mmmkay?
Share today's Data Sheet with a friend:
http://fortune.com/newsletter/datasheet/
Looking for previous Data Sheets? Click here.
ACCESS GRANTED
When Gmail scans your messages to serve online ads, it's not an illegal wiretap. Or is it? A federal judge revived an old debate in dealing a setback to Google this week.
Even though this scanning is automated—and doesn't amount to Google employees poking around emails—critics say the practice is akin to AT&T listening in on people's phone calls or the United States Postal Service reading personal letters...
Google's workaround involves scanning in-transit emails for security purposes, and then later parsing them for advertising data. Read more on Fortune.com.
FORTUNE RECON
Creepy App Hoax Claims to Let You Search Facebook with a Stranger's Photoby Jeff John Roberts
You Can Hack Fitbits and Smart Phones Using Soundby Kate Samuelson
Facebook warns firms not to build surveillance toolsby Jeff John Roberts
How to protect yourself from ransomwareby Anna Teregulova and Robert Hackett
Hacked McDonald's Twitter Account Insults Donald Trumpby Phil Wahba
ONE MORE THING
You don't say... “I’m not Inspector Gadget,” [President spokesperson Kellyanne Conway] said Monday on CNN. “I don’t believe people are using the microwave to spy on the Trump campaign.” (New York Times)
