An anonymous reader quotes a report from 404 Media: Border Patrol is running secretive predictive policing units that analyze Americans' financial activity and other data, then feed that intelligence to local police who pull people over who are not suspected of any specific crime, but which the government thinks may be worth searching, 404 Media has found. The units, the name of which 404 Media is revealing here for the first time, are called Predictive Intelligence Targeting Teams (PITT). In one case, a PITT analyzed the financial activity of a man who was driving across Montana, and local authorities stopped him under the pretense of an obstructed license plate and charged him with a DUI. 404 Media identified one PITT in the Spokane Sector, Washington, which polices the U.S. border with Canada, and another in the Laredo Sector, Texas, which polices the border with Mexico. The findings add to an Associated Press investigation from last year which found Border Patrol was using automatic license plate readers (ALPRs) as part of the same wide-spanning predictive policing program. "The bottom line is genuine probable cause cannot be synthetically generated," Jake Laperruque, deputy director of the Security and Surveillance Project at the Center For Democracy & Technology, told 404 Media in an email. Here Border Patrol seems to be "using parallel construction to cloak the reason behind its car stops in secrecy. If we can't meaningfully review and evaluate these systems, we can't trust them," he added. [...] The DHS document obtained by 404 Media shows that Border Patrol is analyzing the financial activity of Americans to find people to pull over. The Associated Press's investigation found the predictive policing program is also heavily using ALPRs to track potential targets' movements. It is not clear how exactly Border Patrol is monitoring Americans' financial activity. Customs and Border Protection (CBP) declined to answer what financial activity the agency was monitoring, and whether it obtained a warrant or not. A CBP spokesperson told 404 Media in an email: "U.S. Border Patrol uses intelligence-informed analysis and planning to support national security operations, allocate resources, and help identify potential threats and bad actors to public safety. These efforts are conducted consistent with applicable law, policy, privacy protections, and oversight requirements." The statement continued: "For operational security reasons, we do not discuss specific analytical methods, data sources, targeting criteria, investigative techniques, system capabilities, or deployment details. Public disclosure of such information could compromise law enforcement operations and investigations as well as creating safety risks for agents and the public." Rob Frommer, senior attorney at the Institute for Justice, told 404 Media: "The government's increasing use of mass surveillance -- whether that surveillance comes via ALPRs, financial records, or the like -- coupled with predictive policing is a recipe for tyranny. We fought a revolution for the idea that we are citizens, not subjects. Yet schemes like CBP's Predictive Intelligence Targeting Team treat all Americans as if they are potential suspects. This is not just wrong, it's unconstitutional, and IJ will keep pushing courts and Congress to end this attack on Americans' security."

Read more of this story at Slashdot.

An anonymous reader shared this report from Fast Company: Providers of critical infrastructure in the United States are doing a sloppy job of defending against cyber intrusions, the National Security Council tells Fast Company, pointing to recent Iran-linked attacks on U.S. water utilities that exploited basic security lapses [earlier this month]. The security council tells Fast Company it's also aware of recent intrusions by hackers linked to China's military at American infrastructure entities that include water and energy utilities in multiple states. Neither the Iran-linked or China-linked attacks affected critical systems or caused disruptions, according to reports. "We're seeing companies and critical services facing increased cyber threats from malicious criminals and countries," Anne Neuberger, the deputy national security advisor for cyber and emerging tech, tells Fast Company. The White House had been urging infrastructure providers to upgrade their cyber defenses before these recent hacks, but "clearly, by the most recent success of the criminal cyberattacks, more work needs to be done," she says... The attacks hit at least 11 different entities using Unitronics devices across the United States, which included six local water facilities, a pharmacy, an aquatics center, and a brewery... Some of the compromised devices had been connected to the open internet with a default password of "1111," federal authorities say, making it easy for hackers to find them and gain access. Fixing that "doesn't cost any money," Neuberger says, "and those are the kinds of basic things that we really want companies urgently to do." But cybersecurity experts say these attacks point to a larger issue: the general vulnerability of the technology that powers physical infrastructure. Much of the hardware was developed before the internet and, though they were retrofitted with digital capabilities, still "have insufficient security controls," says Gary Perkins, chief information security officer at cybersecurity firm CISO Global. Additionally, many infrastructure facilities prioritize "operational ease of use rather than security," since many vendors often need to access the same equipment, says Andy Thompson, an offensive cybersecurity expert at CyberArk. But that can make the systems equally easy for attackers to exploit: freely available web tools allow anyone to generate lists of hardware connected to the public internet, like the Unitronics devices used by water companies. "Not making critical infrastructure easily accessible via the internet should be standard practice," Thompson says.

Read more of this story at Slashdot.