Day: August 28, 2024

ISLAMABAD — Slow internet speeds that have frustrated Pakistanis for several weeks may persist more than a month while repairs to a faulty submarine internet cable continue, the country’s telecom regulator announced Wednesday.

Internet speed and connectivity have been spotty across much of Pakistan since at least July, with users increasingly struggling to access popular messaging and social media apps.

On Wednesday, Pakistan Telecommunication Authority, or PTA, announced that repairs to the faulty cable will likely be completed by early October. The cable in question, SMW-4, is one of two that authorities say needed repairs.

“The fault in SMW-4 submarine cable is likely to be repaired by early October 2024. Whereas submarine cable AAE-1 has been repaired which may improve internet experience,” the brief statement said.

Pakistan relies on seven undersea cables for internet service. The regulator reported problems with the SMW-4 cable in mid-June.

Pakistan Telecommunication Corporation Ltd., or PTCL, is the landing party for most of the seven international internet cables, including the two that have experienced technical issues. The Pakistani government holds a majority share in the national telecom carrier.

Conflicting statements

With public anger mounting, officials have issued a variety of statements to explain the slump in services.

Earlier in August, the state minister for information technology, Shaza Fatima Khawaja, blamed increased use of VPNs by Pakistanis for the slowdown nationwide. She rejected the notion that the government was deliberately throttling internet speed.

“I can say it under oath that the government of Pakistan did not block the internet or slow it down,” Khawaja said at a press briefing in Islamabad on August 18.

Later in the month, the PTA chief told lawmakers the faulty submarine cable was to blame, saying it would be repaired by August 28.

Meanwhile, the secretary for the Ministry of Information Technology and Telecommunication told a Seate committee hearing the problem with accessing certain app functions was on the end of mobile data providers.

Although Wednesday’s statement by the PTA referenced two damaged cables, a PTA lawyer told the Islamabad high court this week that a third cable may also be damaged.

‘Firewall’

Business community and internet service providers blamed the slump in services on the government’s efforts to implement a “firewall.”

Speaking to VOA in late July, Khawaja confirmed that a firewall was being installed. However, the IT minister claimed the tool was meant to strengthen cybersecurity and not to control free speech.

Still, after a Senate committee hearing in mid-August, Khawaja told the news media the government was simply upgrading an older “web management system.”

The junior minister, currently the top IT official, has repeatedly accused the media of blowing the “firewall” issue “out of proportion.”

According to a source familiar with the implementation of the “firewall,” the tool, acquired from China and under installation by the Ministry of Defense since May, is deployed at cable landing stations in Pakistan, the place where the undersea internet data cable meets a country’s internet system.

The “firewall,” also being installed on the servers of major internet providers, has the capability to detect and slow digital communication between individual users.

In a statement condemning the “grave consequences of the hastily implemented firewall,” the Pakistan Software Houses Association, an industry group of software developers, gaming and IT companies, said slow internet speed has cost the country’s fledgling IT industry more than $300 million in losses.

“These disruptions are not mere inconveniences but a direct and aggressive assault on the industry viability,” the statement released earlier in August said.

Another organization, Wireless and Internet Service Providers Association of Pakistan, said users are leaving smaller internet service providers because of poor internet speed.

Internet disruptions and implementation of the firewall have been challenged in high courts in Lahore and Islamabad.

Prominent Pakistani journalist Hamid Mir filed a petition requesting that the Islamabad High Court seek details of the firewall’s scope and purpose. He said access to the internet is a fundamental right for the purpose of livelihood.

Expressing frustration with authorities’ “conflicting responses” this week, the court’s top judge demanded a detailed report on the reasons for connectivity disruptions. The next hearing is scheduled for September 3.
…

Washington — Russian opposition politician Ilya Ponomarev says he saw no reason to be suspicious when he received what appeared to be an email from former U.S. ambassador to Russia Michael McFaul, a trusted contact with whom he communicates periodically.

“This letter was visually no different from his other letters. I believed that it was his letter because it was visually no different from his other letters,” Ponomarev told VOA Russian in a Zoom interview.

But this email from several months ago turned out to be one of numerous “phishing attacks” targeting U.S. diplomats and others that have been identified as the work of two cyber-espionage outfits linked to the Russian government. And the fact that it accurately mimicked McFaul’s previous messages indicated the attackers had already seen those earlier messages.

“The letter contained a reference to a report on Ukraine that McFaul supposedly intended to deliver in China, and also a request to check whether he had mixed something up,” Ponomarev said. McFaul did in fact deliver a lecture to Chinese students in April.

McFaul has confirmed to VOA that he was the target of a hacker attack but did not elaborate. The details of the attack were revealed in a recent joint report from the digital rights group Access Now and the Canadian research nonprofit Citizen Lab.

The report says the attacks were conducted between October 2022 and August 2024 by two “threat actors close to the Russian regime” known as ColdRiver and ColdWastrel.

According to The Washington Post, “multiple governments” have said that ColdRiver works for the Federal Security Service, or FSB, the successor agency to the Soviet KGB, while ColdWastrel is believed to be “working for another Russian agency.”

Among their targets were exiled Russian opposition figures, employees of U.S. think tanks, former U.S. ambassadors to Russia, Ukraine and Belarus, political figures and academics, employees of American and European non-profit organizations, and media organizations.

VOA has spoken with several of those named as victims, including former U.S. Ambassador to Ukraine John Herbst, a Russian journalist and a Russian human rights activist, as well as Ponomarev and McFaul.

The goal of phishing attacks is to try to get a user to click on a malicious link or enter their data – login and password – on a fake website. If the attack is successful, hackers gain access to the victim’s confidential information, including correspondence, contact lists and, in some cases, financial information.

Hackers conducting phishing campaigns employ a technique called “social engineering,” which a leading American cyber security software and services company described as using “psychological manipulation” designed to trick users into divulging sensitive information.

Herbst, who is currently director of the Atlantic Council’s Eurasia Center, told VOA that he has been facing attacks from Russian hackers for the past 10 years.

The Kremlin “didn’t like from the beginning what I was doing because I was pointing out that they’re conducting an illegal invasion of Ukraine, I guess going back to 2014,” he said.

Herbst said that Russian hackers target people who take a public position aimed at countering Moscow’s aggressive foreign policy: “So, it’s not surprising that people like Steve Pifer or Michael McFaul, or myself have received attention from the FSB, the GRU [Russian military intelligence] and others.”

Herbst added: “I don’t want to overstate the attention they give to us. You know, we are pretty much tertiary or even less than tertiary players on the international political scene, but they know they have such a massive security apparatus that they give some low-level guy the job of following people like me.”

“The stuff that linked me with Mike McFaul or Steve Pifer … was a fishing expedition, right? [To] see if they could get one of them to say something in confidence to me, which would be embarrassing.”

Steven Pifer did not respond to a VOA request for comment on the details of the hacker attack.

Ponomarev said that he responded to the fake McFaul email, but did not have time to download the malicious file attached to it since he was on a plane when he opened the email, and it was inconvenient to download the file from a phone.

“When I opened it on my computer, I noticed that the address he sent it to me from was not his usual Stanford University address, it was something completely different,” Ponomarev told VOA.

“Being an IT guy, I looked at the IP address of the file in the email and was convinced that it was phishing. After that, I passed the information on to the competent authorities so that they could look into the matter further.”

Ponomarev added that the fact the email ostensibly sent by McFaul came from a Proton service mailbox did not initially arouse any particular suspicions.

“I also have an address on Proton, for some kind of confidential correspondence,” he said, noting that attackers can forge addresses on Proton by changing one letter, so that visually it still looks like a regular mailing address.

“They use it because it’s completely anonymous,” Ponomarev added. “You can’t trace an IP address to Proton, so when you use Proton, it’s a dead end, you can’t excavate it any further.”

Polina Machold, publisher of Proekt, an independent Russian media outlet specializing in investigative journalism, told VOA that in the phishing attack targeting her, which took place last November, the hackers also employed social engineering and the Proton mail service.

“I received a letter from a ‘colleague’ from another media outlet, with whom we had previously done a joint project, asking to look at a new potential project or something like that,” Machold told VOA.

“We corresponded for some time, and when it came to opening the file, I discovered that something very suspicious was going on, because the link in the file supposedly led to Proton Drive, but the domain was something completely different.”

Machold said she called a colleague who confirmed that the attacker was pretending to be him. The information was passed on to Citizen Lab, which determined that hackers likely associated with the FSB were behind the attack.

Dmitry Zair-Bek, who heads First Department, a Russian rights group, said that a member of his group was among the first targets of a hacker attack “because we defend people in cases of treason and espionage.”

“One of our employees received an email from an address that mimicked the address of one of our partners,” he said. “The email contained a link that led to a phishing site.”

Zair-Bek added that the ColdWastrel group carried out the attack targeting First Department.

“They are the ‘C’ students of the hacker world,” Zair-Bek said of ColdWastrel. “The idea is the same as the ColdRiver group, they just paid less attention to some small details.

“The fact that they are ‘C’ students does not mean that they are less effective. They choose a person who from their point of view, on the one hand, has the largest amount of information that interests them and, on the other hand, is the most vulnerable.”

Even someone well-versed in digital security issues can fall for the bait of hackers, says Natalia Krapiva, an expert at Access Now, which co-authored the report on the Russian hacker attacks.

“The ColdRiver and ColdWastrel groups use quite sophisticated social engineering, a very good understanding of the context,” she told VOA.

“They know how the organization is structured in general, which people are responsible for finance, HR, politics, and so on. That is, they know which employee to send this [phishing] email to. They also understand with whom these organizations interact and on what issues.”

“We have seen examples of exploiting existing relationships between a Russian and an American human rights organization,” Krapiva added, noting that hackers knew that one of the organizations was waiting for a grant application and sent a malicious PDF file to the employee who was waiting for it.

This suggests that hackers already have a certain amount of information at the time they attempt to attack their victims, she said.
…

…

…

PARIS — French prosecutors on Wednesday freed Telegram CEO Pavel Durov from police custody after four days of questioning over allegations that the platform is being used for illegal activities.

Durov was detained on Saturday at Le Bourget airport outside Paris as part of a judicial inquiry opened last month involving 12 alleged criminal violations.

“An investigating judge has ended Pavel Durov’s police custody and will have him brought to court for a first appearance and a possible indictment,” a statement from the Paris prosecutor’s office said.

Other allegations against Durov, who is a French citizen, include that his platform is being used for child sexual abuse material, drug trafficking, fraud and abetting organized crime transactions, and that Telegram refused to share information or documents with investigators when required by law.

His arrest in France has caused outrage in Russia, with some government officials calling it politically motivated and proof of the West’s double standard on freedom of speech. The outcry has raised eyebrows among Kremlin critics because in 2018, Russian authorities themselves tried to block Telegram but failed, withdrawing the ban in 2020.

In Iran, where Telegram is widely used despite being officially banned after years of protests challenging the country’s Shiite theocracy, Durov’s arrest in France prompted comments from the Islamic Republic’s supreme leader. Ayatollah Ali Khamenei weighed in with veiled praise for France for being “strict” against those who “violate your governance” of the internet.

French President Emmanuel Macron said Monday that Durov’s arrest wasn’t a political move but part of an independent investigation. Macron posted on X that his country “is deeply committed” to freedom of expression but “freedoms are upheld within a legal framework, both on social media and in real life, to protect citizens and respect their fundamental rights.”

In a statement posted on its platform after Durov’s arrest, Telegram said that it abides by EU laws and that its moderation is “within industry standards and constantly improving.”

“It is absurd to claim that a platform or its owner are responsible for abuse of that platform,” Telegram’s post said. “Almost a billion users globally use Telegram as means of communication and as a source of vital information. We’re awaiting a prompt resolution of this situation. Telegram is with you all.”

Durov is a citizen of Russia, France, the United Arab Emirates and the Caribbean island nation of St. Kitts and Nevis.

The UAE Foreign Ministry said Tuesday that it was “closely following the case” and had asked France to provide Durov “with all the necessary consular services in an urgent manner.”

Kremlin spokesperson Dmitry Peskov said he hoped that Durov “has all the necessary opportunities for his legal defense” and added that Moscow stands “ready to provide all necessary assistance and support” to the Telegram CEO as a Russian citizen.

“But the situation is complicated by the fact that he is also a citizen of France,” Peskov said.

Telegram, which says it has nearly a billion users worldwide, was founded by Durov and his brother after he himself faced pressure from Russian authorities.

In 2013, he sold his stake in VKontakte, a popular Russian social networking site he launched in 2006.

The company came under pressure during the Russian government’s crackdown following mass pro-democracy protests that rocked Moscow at the end of 2011 and 2012.

Durov had said authorities demanded that the site take down online communities of Russian opposition activists, and later that it hand over personal data of users who took part in the 2013-2014 popular uprising in Ukraine, which eventually ousted a pro-Kremlin president.

Durov said in a recent interview that he had turned down these demands and left the country.

The demonstrations prompted Russian authorities to clamp down on the digital space, and Telegram and its pro-privacy rhetoric offered a convenient way for Russians to communicate and share news.

Telegram also continues to be a popular source of news in Ukraine, where media outlets and officials use it to share information on the war and deliver missile and air raid alerts.

Western governments have often criticized Telegram for a lack of content moderation, which experts say opens up the messaging platform for potential use in money laundering, drug trafficking and the sharing of material linked to the sexual exploitation of minors.

In 2022, Germany issued fines of $5 million against Telegram’s operators for failing to establish a lawful way to report illegal content or to name an entity in Germany to receive official communication. Both are required under German laws that regulate large online platforms.
…