Eliana Willis

More stories

  • 138 Shares179 Views

    in Information Technology

    Moody's to invest $250 million in BitSight, create 'cybersecurity risk platform'

    Moody’s Corporation announced on Monday that it would be investing in cybersecurity company BitSight and working with the firm to create a “comprehensive, integrated, industry-leading cybersecurity risk platform.”First reported by CNN, the partnership will see Moody’s invest $250 million in BitSight and the cybersecurity company will acquire Moody’s cyber risk ratings venture VisibleRisk, which they created with global venture group Team8. In a statement, Moody’s CEO Rob Fauber said organizations need a way to accurately measure and quantify cyber risk and exposure as they continue to invest in cyber defense and resilience. “Creating transparency and enabling trust is at the core of Moody’s mission — to help organizations assess complex, interconnected risks and make more informed decisions,” Fauber said. “BitSight is the leader in the cybersecurity ratings space, and together we will help market participants across disciplines better understand, measure, and manage their cyber risks and translate that to the risk of financial loss.”Moody’s said its Investors Service review of cyber vulnerability and impact found 13 sectors that have high or medium-high risk, with “total rated debt exceeding $20 trillion.”Moody’s noted that BitSight has more than 2,300 customers around the world, including dozens of Fortune 500 companies, government agencies, insurers and asset managers.

    BitSight said its acquisition of VisibleRisk adds a cyber risk assessment capability and advances its ability to analyze and calculate an organization’s financial exposure to cyber risk. BitSight’s valuation grew to $2.4 billion after the investment. BitSight CEO Steve Harvey added that the partnership with Moody’s and acquisition of VisibleRisk expands the company’s “reach to help customers manage cyber risk in an increasingly digital world.””Cybersecurity is one of the biggest threats to global commerce in the 21st century,” Harvey said.The $250 million deal will make Moody’s the largest minority shareholder in Bitsight, according to CNN. Fauber told CNN Business that the effort was started because of the opacity around cyber risk and the spate of serious cyberattacks that have affected a broader range of industries. More

  • 88 Shares169 Views

    in Information Technology

    Surprise! iOS 14.8 for iPhone is out

    We’ve known it was on the way for a few weeks, and now it’s finally here. Ahead of tomorrow’s Apple event — where we’re likely to see the new iPhone and release data for iOS 15 — iOS 14.8 is out. iOS 14.8According to Apple, this release contains two security updates and is recommended for all users. Both the security vulnerabilities patched “may have been actively exploited,” which makes this update all the more important to install. iOS 14.8 security fixesAs to whether this update contains any other surprises, we’ll have to wait and see. I’ll post a rundown of any other changes I see shortly. There’s also an iPadOS 14.8 for iPad users. To install the update, go to Settings > General > Software Update and download it from there. More

  • 138 Shares129 Views

    in Information Technology

    Over 60 million wearable, fitness tracking records exposed via unsecured database

    An unsecured database containing over 61 million records related to wearable technology and fitness services was left exposed online.

    On Monday, WebsitePlanet, together with cybersecurity researcher Jeremiah Fowler, said the database belonged to GetHealth.  Based in New York, GetHealth describes itself as a “unified solution to access health and wellness data from hundreds of wearables, medical devices, and apps.” The firm’s platform is able to pull health-related data from sources including Fitbit, Misfit Wearables, Microsoft Band, Strava, and Google Fit.  On June 30, 2021, the team discovered a database online that was not password protected.  The researchers said that over 61 million records were contained in the data repository, including vast swathes of user information — some of which could be considered sensitive — such as their names, dates of birth, weight, height, gender, and GPS logs, among other datasets.  While sampling a set of approximately 20,000 records to verify the data, the team found that the majority of data sources were from Fitbit and Apple’s HealthKit.
    WebsitePlanet
    “This information was in plain text while there was an ID that appeared to be encrypted,” the researchers said. “The geo location was structured as in “America/New_York,” “Europe/Dublin” and revealed that users were located all over the world.”
    WebsitePlanet

    “The files also show where data is stored and a blueprint of how the network operates from the backend and was configured,” the team added. References to GetHealth in the 16.71 GB database indicated the company was the potential owner, and once the data had been validated on the day of discovery, Fowler privately notified the company of his findings. GetHealth responded rapidly and the system was secured within a matter of hours. On the same day, the firm’s CTO reached out, informed him that the security issue was now resolved, and thanked the researcher.  “It is unclear how long these records were exposed or who else may have had access to the dataset,” WebsitePlanet said. “[…] We are not implying any wrongdoing by GetHealth, their customers, or partners. Nor, are we implying that any customer or user data was at risk. We were unable to determine the exact number of affected individuals before the database was restricted from public access.” ZDNet has reached out to GetHealth with additional queries and we will update when we hear back.
    Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 188 Shares109 Views

    in Information Technology

    Zoom unveils new security features including end-to-end encryption for Zoom Phone, verified identities and more

    Zoom announced a slate of new security features users can take advantage of as the school year begins and millions continue to work and learn remotely. At Zoomtopia, the company announced that end-to-end encryption, which they rolled out last October in Zoom Meetings, will now be available for Zoom Phone users.  Zoom Phone users can upgrade to end-to-end encryption “during one-on-one phone calls that occur via the Zoom client.””During a call, users can click ‘More’ to find the option to enable end-to-end encryption. The upgrade takes under a second and helps users get security protection against server compromise,” the company explained in a statement. “Users can optionally exchange security codes over the voice channel to rule out the presence of a ‘meddler in the middle.’ E2EE for Zoom Phone will be available in the coming year.”Zoom also announced two other features designed to enhance the security of its platform: Bring Your Own Key (BYOK) and Verified Identity. 

    BYOK was designed to help customers who have to deal with stringent compliance requirements or data residency needs. The tool allows users to manage their own encryption keys, creating a system where people will own and manage a key management system in AWS. The system will contain a customer master key that Zoom cannot access or see.

    “Zoom will interact with the customer’s KMS to obtain data keys for encryption and decryption and will use these data keys to encrypt and decrypt customer assets before those assets are written to long-term storage. Zoom will not store plaintext data keys in long-term data storage,” Zoom explained in a statement. “BYOK is a separate offering from E2EE and is not designed for real-time use cases like streaming video. It’s best used for the secure storage of larger assets, such as recording files. BYOK will roll out as a customer beta in the coming months for recordings for Zoom Meetings, recordings for Zoom Video Webinars, Zoom Phone voicemails and recordings, and calendar for Zoom Rooms.”Verified Identity was built to help address the growing sophistication of social engineering and phishing attacks. The Verified Identity feature allows users to determine if a meeting guest is actually who they say they are. Zoom said the tool would help users who deal with classified information, specialized services and more. Multi-factor authentication is used to vet users entering a meeting. The tool asks you to identify your role in an organization, your credentials and the network you use. It also provides information about your device, authentication apps, codes, biometrics and email addresses. It also uses passwords, security questions and profile information to verify users. “To make attestation and authentication integral to the Zoom experience, we’re working with Okta to help verify users as they join Zoom Meetings. Once they’re in a meeting, a user will have a checkmark next to their name and can share their verified profile information — including name, email address, and company domain — with meeting participants,” Zoom explained. “Meeting hosts can use in-meeting security controls to remove a participant if for some reason they are not verified, or the displayed information seems incorrect. Displaying verified profile information via Okta will be available sometime next year and is the start of Zoom’s long-term identity attestation and verification initiative strategy.” More

  • 125 Shares129 Views

    in Information Technology

    This is how a cybersecurity researcher accidentally broke Apple Shortcuts

    A Detectify researcher has explained how an investigation into Apple CloudKit led to the accidental downtime of Shortcuts functionality for users. 

    In March, Apple users began to report error messages when they attempted to open shared shortcuts. As noted by 9to5Mac, this bizarre issue was of particular concern to content creators who shared shortcuts with their followers via iCloud, who suddenly found their links were broken.  Reports began to surface on March 24. A day later, the iPad and iPhone maker told MacStories editor-in-chief Federico Viticci that the company was “working to restore previously shared shortcuts as quickly as possible.” According to Detectify Knowledge Advisor and bug bounty hunter Frans Rosén, the root cause of the issue was a misconfiguration flaw he accidentally stumbled upon — and triggered — in Apple CloudKit. On Monday, Rosén published details on the situation, in which he was examining the security of Apple services. Rosén’s exploration began in February, and in particular, he wanted to investigate the CloudKit framework, a platform for creating containers suitable for data storage in the Apple ecosystem.  Rosén says that he noticed that many of Apple’s own applications stored information in databases based on CloudKit. He was “curious” to know if any specific apps’ data could be modified by obtaining access to their public CloudKit containers.The researcher found that various APIs were being used to connect to CloudKit. According to Rosén, there are three scopes in the containers: Private (information is only accessed by you), Shared (shareable between users), and Public (accessible to anyone). Zones are also set with varying permission levels. 

    Rosén began testing these permissions and found several vulnerabilities in CloudKit relating to iCrowd+, Apple News, and Shortcuts which permitted him to tamper with content, including stock entries.  The most prominent and public issue, found in Shortcuts during March, “caused all Shortcut sharing links to break, and it was quickly noticed amongst Apple users, media reporters, and especially Shortcuts fans,” Detectify said.According to Rosén, he had previously tested different ways to delete public zones and permission was always denied — however, in the Shortcuts CloudKit database, the researcher was surprisingly able to create zones and was also given an “OK” message in an attempt to delete a default zone. A misconfiguration on Apple’s part caused this.  “All of them were gone,” the researcher said. “I now realized that the deletion did somehow work, but that the _defaultZone never disappeared. When I tried sharing a new shortcut, it also did not work, at least not to begin with, most likely due to the record types also being deleted.”At this point, Rosén reached out to Apple’s security team, who asked him to stop testing immediately. Apple Security then set to work resolving the issue, restoring Shortcuts functionality and patching the problem in the process by refining its security controls and removing the options to both create new and delete existing public zones.It should be noted that the break did not allow the researcher access to any user or sensitive data.While accidental and causing not only panic for the researcher but also unintentional downtime for users, Rosén was awarded a $28,000 bug bounty for his discovery via the Apple Security Bounty program. “Approaching CloudKit for bugs turned out to be a lot of fun, a bit scary, and a really good example of what a real deep-dive into one technology can result in when hunting bugs,” Rosén commented. “The Apple Security team was incredibly helpful and professional throughout the process of reporting these issues.”The vulnerabilities in iCrowd+ and Apple News also earned him bounties of $12,000 and $24,000.”We would like to thank this researcher for working side by side with us to keep our users and their data safe,” an Apple spokesperson told ZDNet. “He immediately reported his actions so that we were able to quickly fix the issues documented and restore functionality after the researcher unintentionally disrupted the ability to use iCloud sharing links for Shortcuts.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 150 Shares129 Views

    in Networking

    Fortinet, Linksys joint venture aims to bring enterprise security to home offices

    Security software provider Fortinet and networking hardware maker Linksys have introduced a new joint security-connectivity package designed to give enterprises a smoother and more efficient way to enable work-from-home networks. The idea is to give remote workers the same level of enterprise-level security and connectivity as they would get from an office location.The companies claim that Linksys HomeWRK for Business | Secured by Fortinet, announced Sept. 13 and planned for release in Q4, is the first enterprise solution to provide continuous secure network connectivity for remote corporate work in a router pre-optimized for business applications and collaboration tools, including Zoom and others. The single device enables the operation of two separate, secure networks within the home, for both business and personal uses, Fortinet and Linksys told ZDNet. Fortinet is a leading global enterprise security software provider; Linksys sells about 70 percent of its routers to consumers and is trying to increase its presence in the B2B market, CEO Harry Dewhirst told ZDNet. “The two biggest issues in remote work are connectivity quality of service and security,” Dewhirst said. “Most homes don’t have high-quality networking (meaning seamless coverage, room-to-room roaming), and they may have VPNs and client software on their devices (for security), but they’re meant for occasional use. They’re not meant for days, weeks, months, years of use. “We see the collaboration between Linksys and Fortinet as something that brings together two best-of-breed solutions to solve the two issues that every company has experienced.”With the rapid increase in remote and hybrid work during the last 18 months, enterprise IT teams are reprovisioning their workforces to operate more effectively from outside the office while protecting their organizations from security threats that include ransomware, malware, and phishing attacks–many of which are introduced by home networks. 

    A recent survey from Sungard Availability Services revealed that only about 20 percent of companies are fully confident their infrastructure security can support long-term remote work.”Our goal was two-fold: First, make it very simple for anyone to set up a fast and reliable home Wi-Fi network. Second, we wanted to provide enterprise IT with the ability to secure and manage the business aspects of that work-from-home Wi-Fi network, just as they do with any other device attached to the network,” John Maddison, EVP of products and CMO at Fortinet, said. “The Linksys and Fortinet joint venture is not just a simple OEM agreement of two distinct parties, it’s the start of a completely new market.”Key featuresThe new offering, expected to become available later in 2021, will feature the following:Secure Wi-Fi mesh connectivity: HomeWRK uses Wi-Fi 6 tri-band technology and Linksys’ Velop Intelligent Mesh software in a single router. Enterprise IT teams can distribute the provision-free hardware to employees to replace their existing home router to establish both corporate and personal networks that cover the entire physical location.Enterprise-grade security: Fortinet’s software guards against cyber threats introduced by home networks and automatically blocks suspicious malware, prevents intrusions, and filters harmful content.Zero-touch provisioning: Streamlines the employee onboarding experience with simple plug-and-connect devices that don’t require physical assistance from corporate IT teams to install. The solution also includes a guided app for best placement of nodes at home. Simple remote management: Management console enables enterprise IT managers to monitor and diagnose the performance of all devices connected to the corporate network in real-time via a single portal. The solution is natively integrated with Fortinet management systems to further streamline management for existing Fortinet customers. Employees are also able to manage their personal network via a separate console with visibility and control of all personal devices.Employee privacy protection: Remote employees’ privacy is protected with support for multiple networks. While the corporate network is managed by the IT team, employees maintain complete ownership of the personal network and security settings, allowing all household members to benefit from a fast and secure connection for non-corporate devices, such as laptops and gaming consoles. Corporate and personal networks are separated with no visibility or access to personal information granted to corporate IT teams, Fortinet said.Linksys-Fortinet HomeWRK will be available in the United States in Q4 2021 and globally beginning in Q1 2022 on hardware-as-a-service subscription plans that require no upfront investment for enterprise IT teams, the companies said. Two levels of service give enterprises flexibility in supporting their remote and hybrid workers: Standard includes two nodes with standard Fortinet security, and Advanced includes two nodes with advanced Fortinet security. Additional nodes to extend coverage will be available, the companies said. More

  • 50 Shares179 Views

    in Networking

    Best travel VPN 2021

    Of all the situations you might find yourself in when using a VPN, perhaps the one where your VPN is at its most mission critical is when you’re traveling. When you’re away from home, you’re dependent on whatever communication infrastructure exists where you are. That might be a solid, secure infrastructure, or it might be one that’s insecure, or even one designed by the host government where you’re located to siphon up every last bit of information about you that it can. Also: Air-gapping the planet: How to travel safely in digitally scary places VPNs create secure tunnels that should allow you to get back to your home network resources, whether that’s a public cloud in your home country or your corporate server. They protect your ability to conduct whatever financial transactions you need to make while traveling. They may even protect your identity from stalkers or local organized crime that might be looking for an executive to kidnap and ransom.  Keep in mind that VPNs are illegal in some countries, precisely because the host government wants to snoop on all traffic. Make sure you check into local laws before you do something that may be frownNed upon, possibly with quite serious consequences. Also: Take home along: How a VPN can help travelers connect wherever they go Sure, VPNs can also let you stream your movies from your home services while away, but they serve a much more serious purpose when on the road. Choose carefully.

    Servers in 94 countries

    Locations: 160Simultaneous Connections: 5 or unlimited with the router appKill Switch: YesPlatforms: A whole lot (see the full list here)Logging: No browsing logs, some connection logsTrial/MBG: 30 daysWith 160 server locations in 94 countries, ExpressVPN has a considerable VPN network across the internet. In CNET’s review of the service, staff writer Rae Hodge reported that ExpressVPN lost less than 2% of performance with the VPN enabled and using the OpenVPN protocol vs. a direct connection.When it comes to travel, a key advantage of ExpressVPN is the private DNS it runs on every VPN server. That means that when you’re trying to access Gmail, for example, ExpressVPN’s DNS will give you an actual IP address for Gmail. If you’re relying on your local host network’s DNS, you have no idea what actual IP address you’re being sent to. It looks like Gmail, but is it really? Or did you just give a hostile government or organized crime your Gmail credentials? Make use of ExpressVPN’s private DNS.Must read:ExpressVPN is one of the most popular VPN providers out there, offering a wide range of platforms and protocols. Platforms include Windows, Mac, Linux, routers, iOS, Android, Chromebook, Kindle Fire, and even the Nook device. There are also browser extensions for Chrome and Firefox. Plus, ExpressVPN works with PlayStation, Apple TV, Xbox, Amazon Fire TV, and the Nintendo Switch. There’s even a manual setup option for Chromecast, Roku, and Nvidia Switch. While you’re unlikely to use all these platforms while traveling, it’s nice to know ExpressVPN will be useful when you’re back home as well.While the company does not log browsing history or traffic destinations, it does log dates connected to the VPN service, amount transferred, and VPN server location. We do want to give ExpressVPN kudos for making this information very clear and easily accessible.Exclusive offer: Get 3 extra months free.

    Servers in 65 countries

    Servers: 3,200+Simultaneous Connections: UnlimitedKill Switch: YesPlatforms: Windows, Mac, Linux, iOS, Android, Fire TV, Firefox, ChromeLogging: None, except billing dataTrial/MBG: 30 dayAt two bucks a month for a two-year plan (billed in one chunk), Surfshark offers a good price for a solid offering. In CNET’s testing, no leaks were found (and given that much bigger names leaked connection information, that’s a big win). The leak protection can be a big deal when traveling, especially if you want to hide the fact that you’re using a VPN from either the local Internet service provider or the host government.The company seems to have a very strong security focus, offering AES-256-GCM, RSA-2048, and Perfect Forward Secrecy encryption. To prevent WebRTC leaks, Surfshark offers a special purpose browser plugin designed specifically to combat those leaks.Surfshark also offers a private DNS capabilities, as well as what they call NoBorders mode. This feature is designed to enable you to access sites regardless of restrictive border connections. Be careful, though. Countries restricting access tend to frown on your bypassing those restrictions.Must read:Surfshark’s performance was higher than NordVPN and Norton Secure VPN, but lower than ExpressVPN and IPVanish. That said, Surfshark also offers a multihop option that allows you to route connections through two VPN servers across the Surfshark private network. We also like that the company offers some inexpensive add-on features, including ad-blocking, anti-tracking, access to a non-logging search engine, and a tool that tracks your email address against data breach lists.

    Servers in 59 countries

    Servers: 5,517Simultaneous Connections: 6Kill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Android TV, Chrome, FirefoxLogging: None, except billing dataTrial/MBG: 30 dayAlso: How does NordVPN work? Plus how to set it up and use itNordVPN is one of the most popular consumer VPNs out there. We found that NordVPN performance was generally consistent across a wide range of test situations. This means that if you’re traveling, you’re likely to be able to count on NordVPN performing about as well, no matter where you’re connecting from and to.Also: My in-depth review of NordVPNIn our review, we liked that it offered capabilities beyond basic VPN, including support of P2P sharing, a service it calls Double VPN that does a second layer of encryption, Onion over VPN which allows for TOR capabilities over its VPN, and even a dedicated IP if you’re trying to run a VPN that also doubles as a server. It supports all the usual platforms and a bunch of home network platforms as well. The company also offers NordVPN Teams, which provides centralized management and billing for a mobile workforce.Also: My interview with NordVPN management on how they run their servicePerformance testing was adequate, although ping speeds were slow enough that I wouldn’t want to play a twitch video game over the VPN. To be fair, most VPNs have pretty terrible ping speeds, so this isn’t a weakness unique to Nord. Overall, a solid choice, and with a 30-day money-back guarantee, worth a try.

    Servers in 52 countries

    Servers: 1,900 Simultaneous Connections: UnlimitedKill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Chrome, plus routers, Fire Stick, and KodiLogging: None, except billing dataTrial/MBG: 30 dayIPVanish is a deep and highly configurable product that presents itself as a click-and-go solution. I think the company is selling itself short doing this. A quick visit to its website shows a relatively generic VPN service, but that’s not the whole truth.Also: My in-depth review of IPVanishIts UI provides a wide range of server selection options, including some great performance graphics. It also has a wide variety of protocols, so no matter what you’re connecting to, you can know what to expect. The company also provides an excellent server list with good current status information. This list can prove hugely helpful when on the road, because it will give you the option to tune which service and server you choose based on your current location.There’s also a raft of configuration options for the app itself. In terms of performance, connection speed was crazy fast. Overall transfer performance was good. However, from a security perspective, it wasn’t able to hide that I was connecting via a VPN — although the data transferred was secure. Inability to hide being on a VPN could be problematic for traveling, which is why this is the last choice in our list of recommendations. Overall, a solid product with a good user experience that’s fine for home connections as long as you’re not trying to hide the fact that you’re on a VPN. The company also has a partnership with SugarSync and provides 250GB of encrypted cloud storage with each plan.

    How can I find out what the VPN rules are for the countries I’m visiting?

    There are a number of sources. First, it’s always a good idea to reach out to your VPN vendor. They often have a good feel for the countries their services operate in. If you’re an American citizen, contact the US State Department. Foggy Bottom often lists travel advisories for US citizens, and they have foreign service officials who can provide general guidance. Check the travel advisories web page. If you’re outside the US, your nation’s foreign ministry may have a similar service.

    Is a VPN all I need to be protected while traveling?

    No. No way. VPNs can, generally, protect your data while it’s in motion. But if your computer or phone is seized (whether or not its encrypted), it’s possible governments can access your data. Some governments might simply hold your devices for whatever reason they deem useful. Online services you access in-country might have less protections than the very same services in your host country. And, of course, there’s all the normal travel security issues, like being careful what you spend, how you handle cash, who you trust, and so on that could cause risk while traveling.

    If my hotel has a wired connection, do I still need to use a VPN?

    Yes. Don’t assume any network endpoint is safe when traveling. Always make sure your connections are encrypted when communicating from any network connection.

    ZDNet Recommends

    You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV. More

  • 163 Shares99 Views

    in Information Technology

    Singapore moots 'foreign interference' law with powers to issue online platforms take-down order

    Singapore has mooted new laws that will arm the government with the ability to issue directives to various platforms, including social media and websites, to remove or block access to content deemed part of hostile information campaigns. The proposed Foreign Interference (Countermeasures) Bill aims to detect and prevent foreign interference in local politics, conducted through such campaigns and the use of local proxies. The country’s Ministry of Home Affairs (MHA) on Monday unveiled details of the proposed bill in parliament, describing foreign interference as a serious threat to its political sovereignty and national security. “During a hostile information campaign, hostile foreign actors can seek to mislead Singaporeans on political issues, stir up dissent and disharmony by playing up controversial issues such as race and religion, or seek to undermine confidence and trust in public institutions,” the ministry said in a statement. 

    It noted that online comments critical of Singapore saw “abnormal” spikes on social media when the country faced bilateral issues with another country in late-2018 and 2019. MHA further pointed to instances in recent years where social media and communications technologies were used as vehicles to carry “covert, coordinated, and sophisticated” online information campaigns. These sought to push the interests of one country against other nations by manipulating public opinion on domestic political issues in the targeted nation, the ministry said. It cited foreign actors that set up troll farms ahead of the 2020 US presidential elections to highlight controversial domestic issues and promote or discredit certain candidates. There also were efforts to discredit the US government’s handling of the COVID-19 pandemic and sow scepticism of Western-developed vaccines.Hostile foreign actors used a range of tactics and tools to interfere in domestic political discussions, including bots on social media or creating inauthentic accounts to mislead users about their identity. 

    MHA said: “As an open, highly digitally-connected, and diverse society, Singapore is especially vulnerable to foreign interference. To counter this evolving threat, we are strengthening our detection and response capabilities, as well as Singaporeans’ ability to discern legitimate and artificial online discourse.”To complement these efforts, our laws need to evolve, just as other countries have introduced new laws to tackle foreign interference. This bill will strengthen our ability to counter foreign interference, and ensure that Singaporeans continue to make our own choices on how we should govern our country and live our lives.”The Foreign Interference Bill would give MHA the powers to issue directives to various entities, such as social media, providers or relevant electronic services–including messaging apps and search engines–and internet access services, and owners of websites, blogs, and social media pages, to help authorities investigate and counter hostile communications that originate overseas. Because hostile information campaigns used sophisticated and covert methods, the bill would empower MHA to issue “technical assistance directions” to these entities on which “suspicious content” was carried, which then would have to disclose information authorities needed to ascertain if the communications were carried out on behalf of a foreign principal. For instance, these foreign actors might use fake accounts and bot networks that were highly sophisticated. Relevant authorities then would require information that resided within the social media companies to ascertain if foreign principals were behind these hostile information campaigns.Technical assistance directions would be issued if MHA had suspicions of plans to conduct an online communication activity in Singapore or on behalf of a foreign actor, and the ministry deemed it in public interest to issue the directive. In addition, “account restriction directions” would be issued to social media and relevant electronic services operators to block content, from accounts used in hostile information campaigns, from being viewed in Singapore. MHA also would be able to issue take-down content orders, which would be needed for content that could cause “immediate and significant harm” in Singapore, the ministry said. These included inciting violence or causing hostility between groups.Should internet intermediaries or communicators fail to comply with such directives, MHA might order internet services providers to block access to the content through an “access blocking direction”.Service restriction directions would require the relevant platforms to take “practicable and technically feasible actions” to restrict the dissemination of content used in hostile information campaigns. These could include disabling or limiting functions that allowed content to become viral, according to MHA. An “app removal direction” also could be issued to require an app distribution service to stop apps, known to be used by foreign principals to conduct such campaigns, from being downloaded in Singapore. The bill would not apply to Singaporeans expressing their personal views on political issues, unless they were agents of a foreign entity, MHA said. Foreigners and foreign publications reporting or commenting on Singapore politics in an “open, transparent, and attributable way” also would not be subject to the new rules. Singapore in May 2019 passed its Protection from Online Falsehoods and Manipulation Act (POFMA), following a brief public debate, which kicked in October 2019. The bill was passed amidst strong criticism that it gave the government far-reaching powers over online communication and would be used to stifle free speech as well as quell political opponents.RELATED COVERAGE More