Slashdot Mirror
Blue Coat Concedes Its Devices Operating in Syria
A few weeks ago, in reaction to claims that Blue Coat systems were being used to track internet use in Syria, a company spokesman denied the charges here, saying "To our knowledge, we do not have any customers in Syria," and that the company followed the web of regulations that would prohibit sale to certain countries, Syria among them. In response to the logs on which the claims were based, he said "it appears that these logs came from an appliance in a country where there are no trade restrictions." A report at the Wall Street Journal says that the company has now acknowledged that Blue Coat devices are being used in Syria after all; the paper reports that at least 13 of the censorware boxes are in use there, and cites an unnamed source who says "as many as 25 appliances have made their way into Syria since the mid-2000s, with most sold through Dubai-based middlemen."
Third parties smuggling hardware into a banned country isn't quite the same as adding to your customer base. Unless of course your are a superpower.
Who here is surprised by this?
I'm sure a nice premium was paid to the Dubai distributor, who also most likely set up proxies for Syria so the update requests to BlueCoat look like they originate in the UAE.
I'd be stunned to learn there wasn't more than a few dedicated suppliers in the Middle East who do nothing BUT funnel high-tech equipment into Syria and Iran, along with anyone else who pays in cash. They probably have plenty of competition from Russian distributors.
Learning HOW to think is more important than learning WHAT to think.
I don't like to have many sites blocked by the Bluecoat box in our network, but they do a necessary service, using Facebook and Youtube belongs to the home and your personal devices. The use or abuse of this equipment is a decision of the customers, not the company making products. Linux and a lot of GNU software can an surely have been used to enable the killing of thousands, but we will not be blaming Stallman and Torvalds for that.
Mexico: 100% conservative's America now!
A Bluecoat box, without updates, eventually ceases to operate properly if at all. So, Bluecoat can just chase down the offending machines and therefore the money stream, and stop updating them. Eventually they won't be able to run a report (to figure out who went where), block proxy avoidance sites, or do anything useful with it. How do I know this? I have a large customer that stopped paying the maintenance, and that is what happened.
quoting:
Blue Coat told The Wall Street Journal the appliances were transmitting automatic status messages back to the company as the devices censored the Syrian Web. Blue Coat says it doesn't monitor where such "heartbeat" messages originate from.
I call BS.
who, here, believes the company goes to the trouble of having the appliances phone home and yet does not scrutinize every bit of info that comes back, *especially* what subnets and routes its connected to?
shit, man, if I was the company, *I* would do such things and I'm one of the good guys. there's no way a vendor would not want to see data and look for things that are not registered or show up all of a sudden, etc. the license fees are not insignificant (I'm guessing, but its a fair guess) and so any new box would cause an alarm. again, I would do this and I'm not even in this business.
--
"It is now safe to switch off your computer."
Call me a devil's advocate here:
With my IT pro hat on, this active MITM is a good thing. It will substitute its SSL cert for the other one and actively inspect traffic. Of course, you have to add the Blue Coat cert into the domain root, as well as other web browsers.
The benefit of this is that confidential info can't just be kicked to an exploit site via SSL, or someone isn't going to be trying to make a proxy via SSL (since traffic that isn't decrypted gets blocked.) This is important because an intruder can create a SSL connection and use that as a proxy.
Of course, wearing the concerned individual hat, the same technology that keeps confidential data from leaking could be used by ISPs for nefarious reasons, such as Phorm over SSL. At least people will start complaining if a SSL cert gets replaced, but if the ISP's CA makes it into the root stash of Web browsers, this would be a field day for them.
As the supreme court is fond of pointing out, it is up to the legislature [or in this case, the State Department] to pass laws which are clear and specific.
We've had posts before about ISPs being told to "ban PirateBay.com" but not PirateBay.org, or to ban a specific IP address in an effort to take a website offline. Both of these are ineffective for the stated goal.
The overall opinion is that companies should implement the court instructions to the letter. Anything else might provoke the wrath of the court. Even doing something *effective* in lieu of a court's ineffective instructions is a bad move and likely to provoke a contempt of court ruling.
So Blue Coat's software is used in Syria, so what? They have followed the law and that's that. We may find their actions less than ethical, but the dividing line between ethics seems to waver depending on who and where you are. The Syrian government probably views the software as a stabilizing influence, and something that protects the population.
Put your blame where it truly lies. Write your congresscritter if you feel strongly about it.
The International Traffic in Arms Regulation are a Waste Of Fucking Time And Money.
There's this crazy notion that we can keep technology from folks by not selling it to them. Yet there is a thousand ways for folks to get the same technology, from paying a middle man, to sending people here to use it and recreate it. The absolute best case is delaying, by a small amount of time, how long before they get the technology.
It's also quite hypocritical that this technology is A-Ok for US companies to use on US citizens working for them....but somehow if Syria uses it to determine what Syrians see it's evil. That really doesn't make any sense.
And it's all perfectly legal.
Not necessarily. The terms of the initial contract may require that it not be sold/exported to nations on a certain list, and that any party you sell it to also agree to these terms. In other words the terms of the contract may be required to transfer with the goods.
Libyan NTC repealed the secular gaddafi bans on polygamy as their first official act
Maybe they should first ban incestuous relationships with first cousins, but that would be against their muslim tradition.
The manufacturer should have a list of what serial numbers were sold to whom.
So it should just be a matter of matching the serial numbers to buyers who should have agreed to the export limitations.
In fact, Blue Coat should be ACTIVELY pursuing this avenue of investigation in order to demonstrate that they themselves followed the legal restrictions.
A company like this should introduce Windows Product Activation functionality. Any license that isn't valid (e.g. pirate copies or those in countries where it isn't allowed to sell the software), they can blacklist it and make it so that it does not actually censor anything. (or update its censor list)
Ho Hum, Corps lying, then they admit it, and no one has any energy left to care.
Oh ye of little faith. Get thee to Wall Street and start Occupying.
Crumb's Corollary: Never bring a knife to a bun fight.
Why is "Syria," as shown in the title, displayed a more narrow font than the rest of that title?
(Or am I really the only person to notice this?)
Kid-proof tablet..
Very few countries have that rule, actually. Discussing the same topic with some friends I ended up googling the subject. Do it, and you'll be surprised
When my Karma level reaches 0 I feel in piece with the Universe
Actually 18 US states allow first cousin marriages which has nothing to do with islamic law. In fact cousin marriage was legal in all US states prior to the civil war.
http://en.wikipedia.org/wiki/Cousin_marriage
You sir, just earned a tinfoil hat. While I have no particular love for Bluecoat (they're competitors in another field), you're assuming things based on what you think to be the case. Claiming that others are misinformed simply because it doesn't fit your mental image is rather silly.
There's only so and so much time in a workday. Spending it on going over phone-home in detail and sending across sensitive information in the first place? Not so useful.
(We also do phone home. Aggregates only, nothing sensitive. It usually makes very little sense to go fucking with your customers or risking their sensitive data, so there's no reason to send anything else.)
I don't doubt they'll have an election. I'm not sure they'll have a second one, though.