WikiLeaks Stratfor Disclosure Highlights Email Encryption Failure

Hacktivist group Anonymous said it obtained the intelligence contractors clear-text emails, and shared them with whistleblower and information-release website WikiLeaks, as part of a new working relationship.

Anonymous: 10 Facts About The Hacktivist Group (click image for larger view and for slideshow)
The hacktivist collective Anonymous Sunday announced a new partnership with whistleblowing website WikiLeaks, followed by the release Monday of a collection of 5 million emails from Texas-based Stratfor (aka Strategic Forecasting), which bills itself as a subscription-based provider of geopolitical analysis.
Stratfor Monday released a statement denouncing the email release as a deplorable, unfortunate--and illegal--breach of privacy and launched a damage-control campaign seeking to discredit the emails, saying they could have been altered by Anonymous. But Stratfor refused to confirm or deny any of the emails contents. Having had our property stolen, we will not be victimized twice by submitting to questioning about them, it said.
Stratfor appears to have run afoul of Anonymous and WikiLeaks on account of its intelligence-gathering activities. A blog post published Sunday on the
AnonOps Communications blog
, a reliable source of Anonymous-related information, accused Stratfor of being a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopals Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon, and government agencies, including the U.S. Department of Homeland Security, the U.S. Marines and the U.S. Defense Intelligence Agency.
[ See our complete
RSA 2012 Security Conference coverage
, live from San Francisco. ]
The new leak represents a homecoming for WikiLeaks, which has released few documents after publishing a massive trove of sensitive, unredacted government cables. But the sites operations had apparently been
hobbled
after MasterCard and PayPal ceased allowing people to donate to the site. Meanwhile, the sites founder, Julian Assange,
remains under house arrest in England
as he fights extradition to Sweden to face
allegations of rape and sexual misconduct
.
With the
Stratfor emails
, WikiLeaks said that it was working with more than 25 media organizations--including
Rolling Stone, La Repubblica
in Italy, and
Russia Reporter
--as well as activist groups to analyze and publicize the contents of the emails. Interestingly, that list didnt appear to include any of the media organizations that had participated in the analysis of the government cables that WikiLeaks obtained, perhaps owing to the whistleblowing websites decision to release the cables itself, in unredacted form, after
Assange apparently lost control
of a BitTorrent archive containing a copy of every cable.
Given that misstep, why might
Anonymous
suddenly be sharing information with WikiLeaks? WikiLeaks has great means to publish and disclose, a described member of Anonymous
told
Wired
. Also, they work together with media in a way we dont. Members of Anonymous and its
AntiSec branch
have reportedly said that the working relationship could continue, with future leaks being made on a regular basis. On a related note, early news reports had questioned how WikiLeaks had received the Stratfor archive. But a
Twitter post
from AnonOps said Monday, To clarify to all journalists - YES, #Anonymous gave the STRATFOR emails obtained in the 2011 LulzXmas hack to WikiLeaks. #GIFiles. The GIFiles tag refers to The Global Intelligence Files campaign being run by WikiLeaks, which appears to be updated naming for
The Spy Files program
WikiLeaks announced in December 2011, when it said it planned to release hundreds of documents from as many as 160 intelligence contractors in the mass surveillance industry.
With that possibility still looming, Michael Ross, a Canadian expert on intelligence gathering and former Israeli Mossad officer, noted that
the release of Stratfor emails
, which hes begun reviewing, highlights the dangers of attempting to spy on others--especially in todays WikiLeaks world.
But writing in Canadas
National Post
, he said the bigger question is whether such services offer any real value. Stratfor, and other similar outfits that have cropped up like weeds in the post 9/11 era, are cashing in by offering up a lot of so-called expert opinion that isnt worth anything more than what can be found in a Robert Ludlum novel, he said. The difference between an intelligence service and a company like Stratfor is that they know how to focus their resources and assess information by separating the wheat from the chaff. By all accounts of the Wikileaks Stratfor emails, their clients are getting nothing but a lot of chaff.
Ironically, according to the internal emails, Stratfor employees had looked for a way to cash in the information-leakage gravy train created by the
WikiLeaks release of U.S. cables
. Could we develop some ideas and procedures on the idea of leak-focused network security that focuses on preventing ones own employees from leaking sensitive information... In fact, Im not so sure this is an IT problem that requires an IT solution, read one email.
But Forrester Research information security analyst John Kindervag said that Stratfor should have paid attention to its own IT problems--namely, its failure to
encrypt its own, sensitive emails
. They would have saved themselves a ton of embarrassment--not to mention all of the costs associated with the breach--had they deployed encryption on their toxic data stores, he said. Compared to all of the costs, hassles, embarrassment, and brand damage, the cost to do enterprise quality encryption would have been trivial.
Instead, he said, the firm is following Freds #2 rule: Admit nothing, deny everything and make counter-accusations. That rule was cited during a Stratfor
missing-lunch email chain
, tracking the whereabouts of a missing pesto tortellini from a company refrigerator. Unfortunately for Stratfor, denial or no, that wont be the only company secret to be made public.
The effort to achieve and maintain compliance with Sarbanes-Oxley requirements remains one of the primary drivers behind many IT security initiatives. In our
Security Via SOX Compliance
report, we share 10 best practices to meet SOX security-related requirements and help ensure youll pass your next compliance audit. (Free registration required.)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
WikiLeaks Stratfor Disclosure Highlights Email Encryption Failure