Security Central: Apple and the FBI Spar, Microsoft Opens a Cybersecurity Center

This past week has been one of continuing sagas, unfolding cause and effect scenarios and “now whats?” Our first story resurfaces the ongoing battle between Apple and the FBI. These guys really just can’t seem to get along. At a press conference in St. Cloud, Minn., last Friday, FBI special agent Rich Thorton made statements bemoaning the fact that the agency is unable to unlock the iPhone of Dahir Adan, the man who attacked and stabbed 10 people in a Minnesota mall last month. After the attacks, ISIS took full responsibility for Adan’s actions. 

According to an article by Wired, Thorton told reporters last week that the FBI is currently “assessing [its] legal and technical options to gain access to this device and the data it may contain.” Sounds like fightin’ words to us, and an awful lot like the FBI is gearing up for yet another legal battle with the tech giant. As you may well recall, the FBI and Apple have sparred over this very issue before, trying to find the legal and ethical lines between a national security need to to access vital data and the violation of users’ privacy rights. It all began with the shooting in San Bernadino last year. After that incident, U.S. government officials essentially ordered Apple to come up with a way for authorities to “break in” to iPhones and access encrypted data.

The case against Apple was eventually dropped because the FBI found its own way to hack into the phone, but it was an important “line in the sand” moment between law enforcement and privacy advocates. According to Fortune, the likelihood of the FBI being able to access Adan’s phone is slim. Without Apple’s help, things don’t look good for the agency. Unless of course they’re able to hit the jackpot again and find a third party to successfully jump the iPhone’s security fence. Only time will tell. For now, we’ll leave you with this past quote from Tim Cook: “Privacy is a fundamental human right,” he said. “If you have an open door in your software, then the bad guys get in there, too.” Food for thought. 

And now we turn to an VAR/MSP favorite, Microsoft. The company announced last Tuesday that it opened a new cybersecurity and “transparency” center in Singapore. According to Fortune, it has an open door policy for participating government agencies in the Asia-Pacific region and is designed to allow those agencies “to look at the source code of Microsoft products, access cybersecurity threat information, and consult with Microsoft security staff on security issues.” 

This is pretty revolutionary stuff, but it’s something Microsoft is no stranger to. The technology powerhouse announced in September that it was set to open a transparency center in Beijing later this fall. These Singapore and Beijing centers are in addition to Microsoft’s already-existing centers in Redmond, Wash., and in Brussels, Belgium.

“Public-private partnerships are key to strengthening national cybersecurity,” said Toni Townes-Whitley, Microsoft’s corporate vice president of worldwide public sector, in a statement. “The opening of the Microsoft regional Transparency Center in Singapore to serve the wider Asia-Pacific region, advances our worldwide commitment to drive transparency, security and trust in digital technologies in the mobile-first and cloud-first world.”

Microsoft’s government security program has been around since 2003, established to give governments access to source code and cybersecurity data. Microsoft said that there are 40 countries around the globe that participate in the program. For channel partners, at the customer level, there is a great need for and emphasis on that level of transparency. Many vendors are already building their operations around openness and transparency which ensures the integrity of their products and relationships. 

To wrap up the week, we revisit the Yahoo/Verizon debacle. Yahoo really got themselves into a pickle on this one, as Verizon understandably got cold feet regarding its deal to buy the struggling company once news broke of a recent large-scale breach. Or rather, the most massive breach in the history of breaches. In an exchange with the New York Post, sources say that Verizon is reportedly clamoring for a discount to the tune of $1 billion off its pending $4.8 billion agreement to buy Yahoo. Shocking.

“In the last day we’ve heard that [AOL boss] Tim [Armstong] is getting cold feet,” said a Verizon source to the Post. “He’s pretty upset about the lack of disclosure and he’s saying, ‘Can we get out of this or can we reduce the price?’” Essentially, Verizon feels that it shouldn’t have to pay the originally agreed-upon price due to the fact that Yahoo’s value has been diminished. And Yahoo might just have to do it, too – it’s hard to argue with that logic when threats dating back to 2014 were ignored and resulted in the biggest cybersecurity FUBAR ever.

Absurdly, Yahoo is digging their heels in and pushing back against Verizon’s attempt to drive the price down. “Yahoo is telling Verizon that a deal is a deal and that the telecom giant has no legal avenue to change the terms.” What a weird, unexpected plot twist that is…

Yahoo’s next board meeting is in two week, but discussions between the two parties regarding the issue will continue. At the risk of being repetitious, it’s worth mentioning again that as these sorts of issues keep cropping up – that is, companies (even major ones) not taking the proper measures to secure their networks – discussions surrounding these vulnerabilities will need to keep occurring among resellers and service providers. What happened with Yahoo is one of the best cautionary tales there is, so channel partners need to take a “learn from their mistakes” approach and emphasize the criticality of holistic security and recovery.