- cypherpunks - lists.cpunks.org

United Nations (UNFICYP) 60 Year Medal Ceremony
by Gunnar Larson 05 Mar '24

05 Mar '24

United Nations (UNFICYP) 60 Year Medal Ceremony: https://www.instagram.com/p/C4GxPRgNZtJ/?igsh=MWoyc2N1bm5iajJjMw==

1 0

Re: Recipe for a CISO
by Karl Semich 04 Mar '24

04 Mar '24

yeah, and i’m crazy now of course whether that reverse engineering is done by hand by individuals, or entirely automated, or done by huge groups of people, has a big impact on what kinds of threats are encountered, and how to effectively handle them i think our current situations are hopefully temporary, where there is at least for me a lot of obscurity around specifics of information power layout. when conflicts find winners maybe that can change. if instead the role of the vulnerability researcher goes away (i don’t know, i’m not involved), this would of course also be a temporary situation as things become more and more open to problems arising something i didn’t mention in my email is the interception and mutation of communications, intertwines the digital and the human. hope you find good work if you are needing it i guess what i’m saying is there was big potential building around automation of analysis. On Mon, Mar 4, 2024 at 08:08 J.M. Porup <jm(a)porup.com> wrote: > If you will permit me to zoom out, the overall trend you have identified > is that security has moved up the stack to higher and higher layers of > abstraction. Since it is impossible to know all the systems, security > has specialized. And since security issues lurk at greater quantities > at higher layers of abstraction, it makes sense for someone in a CISO > role to focus on higher layers of abstraction (as opposed to, say, > focusing on reverse engineering a small cross-section of binaries > of interest.) > > jmp > > * Karl Semich <0xloem(a)gmail.com> [2024-03-04 13:52:04 +0000]: > > > it used to be knowing systems meant learning to look inside obscure > > binaries and figuring out how to turn them to your ends like an > > anthropologist decoding ancient tablets (breaking into systems by hand), > > and doing this so well that you could defend against others doing it > > effectively. basically, nobody else had any idea how anything worked, it > > seemed they were all living in fantasy worlds based on marketing > materials. > > > > it’s been a decade or two now for me, and i don’t know how it is in the > > present day. since the era of the dedicated hacker there are public tools > > maybe starting with metasploit that magnify power immensely. various > actors > > have stimulated serious reduction in the quality of new code while other > > groups have secured some systems very strongly, such as blockchains. > > > > phones and routers still languish without updates while vulnerabilities > sit > > in public databases to be used. things like this likely shift the power > > away from the researcher. > > > > i took one brief intro in cybersecurity and it was all AI, training > models > > to detect and respond to anomalies. > > > > and those same powerful entities put backdoors straight in the hardware, > > contributing to frustration of complete review. > > > > my personal experiences lend me to think that AI has been used on the > > offensive for quite some time now. it seems things may have also shifted > a > > ton toward social influence, which may even simply be more familiar to > most > > people. > > > > On Mon, Mar 4, 2024 at 06:24 Cyber Cyber Cyber Cyber < > > cybercybercybercyber(a)substack.com> wrote: > > > > > eye of newt and toe of frog > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ > > > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ > > > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > > > > Forwarded this email? Subscribe here > > > < > https://email.mg-d1.substack.com/c/eJxckr1yqzoUhZ8Gunj0A7YpKGJsEmkAX-cS89Oc… > > > > > for more > > > Recipe for a CISO > > > < > https://email.mg-d1.substack.com/c/eJxcksuSojwYQJ8m7LByA5sFC2ikfvof8TK2PfbG… > >eye > > > of newt and toe of frog > > > > > > J.M. Porup > > > < > https://email.mg-d1.substack.com/c/eJxckL3O0zAYRq_G3hzZr53YGTwAbUSDQAgGJBbk… > > > > > Mar 4 > > > > > > < > https://email.mg-d1.substack.com/c/eJxckL3O0zAYRq_G3hzZr53YGTwAbUSDQAgGJBbk… > > > > > > > > > > > < > https://email.mg-d1.substack.com/c/eJxcksFuozAQhp_G3BLZY6DhwCFbkpY2EKVKs8le… > > > > > > > > < > https://email.mg-d1.substack.com/c/eJyUks1uozwUhq_G7IjsY8cJCxakFH30m5Cmk7aT… > > > > > > > > < > https://email.mg-d1.substack.com/c/eJxckk1vozAQhn-NuSXyB5Bw4AClaOluSNOm7aaX… > > > > > > > > < > https://email.mg-d1.substack.com/c/eJxck01zozgYhH8NviWlD3DMwQdjgwNj5JgAMlxS… > > > > > > > > READ IN APP > > > < > https://email.mg-d1.substack.com/c/eJxskM1uIyEQhJ8GbmM1DbaZA4eVrHkNi58em90Z… > > > > > > > > > > > < > https://email.mg-d1.substack.com/c/eJxckL2O1DAURp_G6Ty6vr7O2oULYDdigkAICiQa… > >this > > > won’t hurt at all, promise > > > > > > What exactly is a CISO, anyway? > > > > > > I see CISO job ads asking for people’s GitHub handles, but you’re not > > > hiring a developer, and you're not hiring an engineering manager, > you're > > > hiring a CISO. > > > > > > Thanks for reading Cyber Cyber Cyber Cyber! Subscribe for free to > receive > > > new posts and support my work. > > > > > > Pledge your support > > > < > https://email.mg-d1.substack.com/c/eJxcU812qkwQfBrY6ZkfUFmwMBIj8wnGyMffJgdm… > > > > > > > > Security engineering is not about writing code, so even if you were > hiring > > > an Security Engineering Manager you still wouldn’t want to be measuring > > > candidates based on the code they write. > > > > > > So if a CISO isn’t just a weird form of security engineering manager, > then > > > what exactly do we do all day long, anyway? > > > > > > What’s the recipe for a CISO? > > > One bushel of technical systems knowledge > > > > > > How do things work? You can’t secure a system if you don’t understand > the > > > system at least as well as attackers. From my point of view, that > means a > > > good CISO is much more likely to come out of traditional IT or even a > > > DevSecOps role than from a developer role. Developers are generally > > > laser-focused on a specific tech stack—deep and narrow—but a CISO > needs to > > > spread themselves thin across everyone and everything in their > org—shallow > > > but broad. > > > a demijohn of people, people, people > > > > > > Not just technology, but also process and people. Because the human > > > systems you are defending are not technical. CISOs are focused on risk > > > management, and the way you manage risk—since risk mitigation is almost > > > always part of risk management—is to change things. To change the way > > > people do things. In other words, change management. But people hate > > > change! Oh my lord do people hate change. So exercising diplomacy and > > > influence across an org is key to securing an org. That’s not a 133t > > > supercoder job. > > > a peck of security mindset > > > > > > No one can be successful in any security role without the security > > > mindset. This is the adversarial thinking that distinguishes a builder > from > > > a breaker, and it’s the raw material I look for when interviewing > > > candidates. You can teach technical skills, but you can’t teach > adversarial > > > thinking to someone who lacks the knack. It’s a raw talent that I’ve > > > discovered in people both technical and non-technical. A CISO unable to > > > think creatively about adversaries—whether the North Korean military, a > > > ransomware gang, or the Irish Data Protection Authority—is not going > to be > > > effective in their role. > > > two liters of leadership ability > > > > > > A one-man CISO is just a phony title. Ultimately a company of any size > > > that needs a CISO is going to need a security team for the CISO to > lead. > > > But that means the CISO needs to be an effective team leader who knows > how > > > to delegate, to motivate, to discipline—to get the most out of their > team > > > for the benefit of their employer. This includes leading on both > security > > > engineering (managing real securiy risk) as well as security compliance > > > (working with Legal to meet regulatory risk appetite, acquiring > security > > > certifications like ISO 27001 to enable the business to close deals, > etc). > > > a barrel of business mindset > > > > > > It is a tempting but fatal rookie error in security to be an absolutist > > > about security. This is unhelpful and makes you a bad CISO. A CISO is > not > > > just a technical engineering manager—a CISO is a business executive > whose > > > job is to working closely with the CEO and Board of Directors to > balance > > > risk and opportunity to meet business goals. A CISO is not a high > priest of > > > security trying to achieve perfection or a Cassandra warning of doom. > Risk > > > is part of doing business, and security risk is part of doing business. > > > Making sure the business understand that risk, and helping the > business to > > > choose between accepting risk or spending money to mitigate that risk, > is > > > the fundamental service the CISO provides. > > > a heaping tablespoonful of lawyer > > > > > > I am not a lawyer and I don’t play one on TV. But I need a solid grasp > of > > > the law in order to do my job. As I explained to a disbelieving > colleague—a > > > software engineering manager—security straddles the fence between > > > Engineering and Legal. Legal and regulatory risk are a major part of > my job > > > as a CISO. When my adversaries aren’t just criminal hackers but > government > > > regulators, I better understand the regulations that we aim to either > > > comply with (or, as an executive decision involving the General > Counsel, to > > > not comply with because the risk of a regulatory fine is so low). > > > a pinch of accountant > > > > > > You can either accept risk or spend money to mitigate risk. That means > you > > > need a solid beancounter mentality to be effective as a CISO. How much > > > money should we spend? What's the cost/benefit analysis of that spend? > > > (What's your Security ROI?) Are you spending money wisely, and being a > good > > > steward of company funds? > > > a megaphone of hostage negotiator > > > > > > Negotiating contracts with security vendors sometimes feels like a > hostage > > > negotiation. "Pay us this crazy money for a substandard product, or the > > > hostage gets it." In this case my employer is the hostage. It’s not > > > racketeering but it sometimes feels like it! Being able to go to the > mat > > > with vendors and tear into their offering to get a better price is a > > > crucial skill for a CISO. It’s not enough to just mitigate security > risk, > > > you should be optimizing for cost as well. > > > Recipe > > > > > > Throw all the ingredients into a blender. Puree on low for twenty > years or > > > so. Pour into a suit hoodie (half suit, half hoodie) and serve with a > > > heaping side order of ambiguity. > > > > > > Thanks for reading Cyber Cyber Cyber Cyber! Subscribe for free to > receive > > > new posts and support my work. > > > > > > Pledge your support > > > < > https://email.mg-d1.substack.com/c/eJxcU812qkwQfBrY6ZkfUFmwMBIj8wnGyMffJgdm… > > > > > > > > Cyber Cyber Cyber Cyber is free today. But if you enjoyed this post, > you > > > can tell Cyber Cyber Cyber Cyber that their writing is valuable by > pledging > > > a future subscription. You won't be charged unless they enable > payments. > > > > > > Pledge your support > > > < > https://email.mg-d1.substack.com/c/eJxck02TsjgUhX8N7LTyAbywYGFL25IRfG0ZvjZd… > > > > > > > > Like > > > < > https://email.mg-d1.substack.com/c/eJxcksFuozAQhp_G3BLZY6DhwCFbkpY2EKVKs8le… > > > > > Comment > > > < > https://email.mg-d1.substack.com/c/eJyUks1uozwUhq_G7IjsY8cJCxakFH30m5Cmk7aT… > > > > > Restack > > > < > https://email.mg-d1.substack.com/c/eJxck01zozgYhH8NviWlD3DMwQdjgwNj5JgAMlxS… > > > > > > > > > > > © 2024 J.M. Porup > > > 548 Market Street PMB 72296, San Francisco, CA 94104 > > > Unsubscribe > > > < > https://email.mg-d1.substack.com/c/eJxck7mSqzgUhp_Gzm6XFrBNQOAFuqEsuGCxJreQ… > > > > > > > > [image: Get the app] > > > < > https://email.mg-d1.substack.com/c/eJxckLuO1TAURb_G7hzZx4_EhQtgJuIGgRAUSDTI… > >[image: > > > Start writing] > > > < > https://email.mg-d1.substack.com/c/eJxckstyskoUhZ8GZrG6d4PaAwZGBbF-SPQoCJNU… > > > > > >

1 0

Kiva.org Financial Inclusion Video
by Gunnar Larson 04 Mar '24

04 Mar '24

Kiva.org Financial Inclusion Video: https://www.instagram.com/reel/C3_Ra3LyQJm/?igsh=MXhsMjgwczc3bXl1dg==

1 0

Memo #4 - Goldman Sachs Deferred Prosecution Agreement
by Gunnar Larson 04 Mar '24

04 Mar '24

https://docs.google.com/document/d/1ajVVx6NGB9wd2GDXfLRftf0RVFpqjl8WWITvdNV… March 10, 2022 BY ELECTRONIC MAIL Mr. John Marzulli United States Department of Justice Eastern District of New York 271 Cadman Plaza East Brooklyn New York, 11201 John.Marzulli(a)usdoj.gov Re: Memo #4 - Goldman Sachs Deferred Prosecution Agreement Dear Mr. Marzulli: The Department of Justice has yet to respond to Memo #1, Memo #2 and Memo #3 with our recent inquiry to the 1Malaysia Development Berhad Deferred Agreement. Goldman Sachs' Deferred Prosecution Agreement <https://www.justice.gov/usao-edny/pr/goldman-sachs-resolves-foreign-bribery…> with the United States of America is in potential breach, with ethical enforcement being concerned. Memo #4 aims to associate the malfeasance in Malaysia with war crimes of aggression (in the planning, initiation, or execution of a large-scale and serious act of aggression), leveraging the world’s only military divided capital city Nicosia, Cyprus. 1. Additionally, Memo #4 aims to earn the DOJ’s assessment of New York State’s regulatory marketplace manipulation deriving the war crime against peace, related to the planning, preparation, initiation, waging or participation in a common plan or conspiracy related to a war of aggression, which can only apply in relation to international armed conflict. 2. In this case, the first challenge is to observe and consider the simple idea that the DOJ’s Deferred Prosecution Agreement with Goldman Sachs alone, through means of regulatory arbitrage naively fails to recognize the ‘cause and effect’ relationship at play at the inception of Memo #4’s assertion of war crimes. 3. Even with the best of intentions, perhaps unknowingly the DOJ may be amplifying the effect of potential war crimes by indirectly supplementing the root cause of the problem and financial model of the Deferred Agreement being self-policing. Mr. Marzulli, there has been an active United Nations peacekeeping mission in Cyprus since the 1964 Turkish military invasion and occupation of the northern third of Cyprus. Only Turkey recognises the Turkish Republic of Northern Cyprus, while there is broad recognition that the ongoing military presence constitutes occupation of territories that are under Turkish military control. - The graduate education behind Memo #4 is a product of the University of Nicosia’s (UNIC) main campus, located adjacent to the United Nations Buffer Zone that separates the invaded Turkish Republic of North Cyprus and the Republic of Cyprus, which joined the European Union in 2004. - Memo #4 is also a product of United Nations consultancy, based at its Manhattan headquarters, where (today, what is now xNY.io - Bank.org) was credited with increasing the breadth and accessibility of reference content from the world’s most important multinational organization. - Memo #4’s subject of war crimes has preeminent association with such projects as the Audio Visual Library of International Law. Over the following sections, Memo #4 will provide a detailed timeline that would constitute real concern of the war crime of aggression yielding the war crime against peace in active war conflict in the world’s only military divided capital, funded from Manhattan Island. The Bank of Cyprus and Illegal Short Selling Irregularities of Turkey’s Markets Mr. Marzulli, turn this matter as we will, and look at it from any side whatsoever, and it presents the appearance of a cross-border act of aggression. Goldman Sachs’ potential disrespect to the Deferred Agreement’s core values has cultivated new crimes that aim to manipulate cross-border war crime regulatory frameworks. - On April 02, 2021 the Financial Times reported that Turkey fined Goldman Sachs over alleged irregularities in short selling, just a week after foreign investors pulled $1.9B from the country’s stock and bond markets. Turkey’s Capital Markets Board said that Goldman Sachs was among 10 securities firms that had placed orders for short selling without proper notification, violating rules enacted previously that temporarily prohibited such transactions. - On April 20, 2021 the CyprusMail (Cyprus’ only English Language daily newspaper) reported Goldman Sachs International acted as Global Coordinators and Dealer Managers in a $330M bond issuance for the Bank of Cyprus. Given the active military conflict in Cyprus, Memo #4 notes that there is one place on the planet you are not supposed to do this sort of thing. Furthermore, the DOJ’s Deferred Agreement with Goldman Sachs may have been tainted with the potential war crime of aggression, risking international peace and the lives of United Nations peacekeepers, while jeopardizing the United States of America’s financial security. Concern of New York Prime Bank Instrument Fraud and Marketplace Manipulation The United States Department of the Treasury warns that Prime Bank Instrument Fraud schemes have attracted significant international attention, since individuals and organizations have lost billions of dollars worldwide. "Prime Bank Instrument Fraud" is the general term given to prime bank fraud schemes that go by many different names. During April 2021, Goldman Sachs could not in good faith (and, plausible deniability) make any reasonable claim of holding a pristine relationship with Turkey’s Central Bank or with Cyprus’ largest financial institutions, given the 1Malaysia Development Berhad scandal and then pending Deferred Prosecution Agreement with the United States of America. - Memo #4 suggests that Goldman Sachs developed a Prime Bank Instrument Fraud program to level out yo-yo market dynamics caused by failed marketplace manipulation exercises in Turkey and Cyprus. - Systematic bank fraud and/or marketplace manipulation of any kind between Turkey and Cyprus could constitute the war crime of aggression. - Furthermore, Memo #4 argues that Goldman Sachs may have tried to bambooze governments in New York, Cyprus and Turkey through regulatory arbitrage loopholes, while Goldman seemingly may have not considered the totality of such actions as war crimes. Turkey has the highest inflation in Europe. It has the second-highest rate of inflation among emerging markets, just behind Argentina. It has the 13th highest inflation rate in the world, ranking it between South Sudan and Nigeria. After Goldman Sachs was fined for illegal stock and bond market short selling by the Turkish government, logic would argue further malfeasance potentially could have been avoided by the DOJ’s 1Malaysia Development Berhad investigation. - On April 15, 2021 CNBC reported that Goldman Sachs (note, the previous section’s milestones of April 02, 2021 and April 20, 2021) crucially removed its bias toward Turkey tightening interest rates. Goldman issued guidance highlighting the fact that the bank thought that, “…the removal of the tightening bias against rising inflation expectations suggests that the TCMB (Turkish Central Bank) now has a more dovish reaction function.” - On August 14, 2021 the CyprusMail reported serious concern among economists about data reporting from the Turkish Statistical Institute. Ahmet Takan, a former official with the office of the Turkish prime minister, acted as a whistle blower, warning that Turkey potentially was manipulating inflation data. - On September 1, 2021 Reuters reported that Goldman Sachs hiked Turkish growth forecasts. Goldman economists issued guidance stating, "Overall, the Turkish economy has been able to grow faster than we thought without a deterioration in its external balances, as the pickup in foreign demand has been very supportive." - On November 30, 2021 Reuters reported that Goldman Sachs trimed Turkey’s 2022 growth forecast. Goldman Sachs' Murat Unur stated, "We think that the GDP figures released today tell us little about the pace of economic activity going forward as the recent sell-off in the Lira is likely to impact economic activity significantly" Mr. Marzulli, the DOJ’s Deferred Prosecution Agreement with Goldman Sachs was signed on October 21, 2021. The timeline of events above do not coincide with terms and conditions of the Deferred Agreement mandated by the United States of America. Furthermore, as an international graduate scholars of the world’s only military divided capital on the planet, xNY.io - Bank.org should be protected from any association of crimes against peace, related to the planning, preparation, initiation, waging or participation in a common plan or conspiracy related to a war of aggression, which can only apply in relation to international armed conflict. War Crimes Against Humanity Mr. Marzulli, xNY.io - Bank.org is concerned that potential breaches to the Deferred Agreement are impacting our global enterprise. Crimes against humanity can be committed in peacetime as well as during an armed conflict. Even a single act could fall under this exclusion ground provided it forms part of a widespread or systematic attack against a civilian population and the act is committed by any person (including a civilian) who had knowledge of the attack and the link of the act to the attack. 1. We are looking to learn more about the DOJ’s approach to assessing any potential breaches to the Deferred Agreement’s mandates as we determine New York State’s role in cross-border bank regulation and corresponding innovation beyond war crimes against humanity. 2. In order to establish whether a war crime or a crime against humanity has been committed, the case officer should consult the relevant international instruments and case law. 3. Crimes against humanity are fundamentally inhumane acts, committed as part of a systematic or widespread attack. Inhumane acts, which could reach this threshold when committed pursuant to or in furtherance of a State or organizational policy (potentially, New York State bank regulation). 4. Persecution against any identifiable group or collectivity on political, racial, national, ethnic, cultural, religious, gender, or other grounds that are universally recognised as impermissible under international law. 5. Furthermore, we have made 28 highlights to the Deferred Agreement providing supporting reference to Memo #4’s overarching premise. xNY.io - Bank.org submits Memo #4 for DOJ consideration of other inhumane acts of a similar character intentionally causing great suffering, or serious injury to body or to mental or physical health. Some crimes against humanity would require an additional specific intent, such as Goldman Sachs willfully disrespecting New York State and/or overall peace and security of the United States of America. Memo #1, Memo #2, Memo #3 and Memo #4 outline instances that correspond with the associated definitions of the potential war crimes abroad and jeopardize the future of bank innovation from New York, at great sacrifice to the Homeland. We hope to learn the DOJ’s approach to comment on Memo #4’s subject matter or, without delay refer these concerns to the International Criminal Court and/or International Court of Justice for comment. Respectfully yours with anticipation, Gunnar Larson - xNY.io <http://www.xny.io> | Bank.org <http://bank.org>MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107

1 0

New ruling in SEC’s Coinbase insider trading lawsuit comes as a blow to the crypto industry as judge finds secondary token sales were securities | Fortune
by Gunnar Larson 04 Mar '24

04 Mar '24

https://fortune.com/crypto/2024/03/03/sec-coinbase-insider-trading-kraken-h… Insider trading The SEC’s Coinbase insider trading lawsuit is a more complicated case because none of the defendants are crypto firms, but instead, individuals accused of using insider information for personal gain. In two cases brought by the SEC and Department of Justice, prosecutors argued that a Coinbase employee, Ishan Wahi, shared confidential information with his brother and friend, who were able to net more than $1.5 million in trades.

1 0

Watchdog, Better Markets, Investigates the Bank that Has Lost 65 Percent of Its Market Value in Two Months and Was Downgraded to Junk by Moody’s
by Gunnar Larson 04 Mar '24

04 Mar '24

https://wallstreetonparade.com/2024/03/watchdog-better-markets-investigates… By Pam Martens and Russ Martens: March 4, 2024 ~ Frightened Wall Street TraderThe widely respected banking and Wall Street watchdog, Better Markets, has a new report out on the latest teetering bank holding company, New York Community Bancorp (ticker NYCB). The title of the well-researched report pretty much says it all: “A Frankenstein Monster Federal Regulators Created.” NYCB has lost 65 percent of its stock market value year-to-date and was downgraded to a junk credit rating by Moody’s after the stock market closed on February 6. Moody’s wrote in its downgrade that a third of the bank’s deposits lack FDIC insurance. NYCB’s rapid share price descent began on January 31 when the bank filed an 8K form with the SEC indicating a $260 million net income loss in the fourth quarter; a dividend cut from 17 cents to 5 cents; and a $552 million provision for credit losses on commercial real estate – an area of growing concern by the credit rating agencies. The facts in the Better Markets report are astonishing in terms of what passes for federal bank regulation today. The Better Markets researchers write as follows: “In late 2022 and early 2023, the federal banking regulators inexplicably approved not one, but two, mergers for NYC Bancorp in rapid succession. First, in December 2022, Flagstar was acquired by NYC Bancorp and at the same time Flagstar acquired [New York Community Bank]. Then, only about 100 days later, Flagstar was selected as the winning bidder by the FDIC to acquire the failed Signature Bank (‘Signature’). A bank acquiring and integrating any one of these transactions in isolation would be challenging under the best of circumstances, it is inexplicable that the banking regulators allowed them in tandem under extremely stressed conditions.” And this: “…over the course of just two quarters, Flagstar’s two acquisitions quadrupled its asset size, from $25 billion on September 30, 2022, to $123 billion on March 31, 2023. It also more than doubled its employee count, from about 2,800 in September 2022 to 6,800 in March 2023.” It should be noted that rapid asset growth was cited by federal banking regulators as a key factor in the collapse of Silicon Valley Bank, which set off a banking panic and bank runs in the spring of last year. That panic resulted in the second, third and fourth largest bank failures in U.S. history. The Better Markets investigation points the finger at the federal regulator of national banks, the Office of the Comptroller of the Currency (OCC), as a key player in the making of this Frankenstein bank. (National banks are those allowed to operate across state lines.) What happened was that when this bank didn’t initially get merger approval from its primary federal regulator, it simply switched its primary regulator to the OCC and got its merger approved. Better Markets calls this “shocking and literally unbelievable,” writing as follows: “…The American people rely on the banking regulators to protect them, and the broader financial system and the facts related to this situation suggest unacceptable failures in these areas. “The apparent lack of regulatory coordination and the ability of a bank to switch regulators and receive a different decision on a merger application is shocking and literally unbelievable. However, what is worse is the apparent willingness of regulators to overlook all that and racial discriminatory conduct by merger participants on multiple occasions in approving the final merger transaction. The American people deserve better from their financial regulators, and financial stability depends on it.” The grimy fingerprints of the OCC were also at play when it approved the purchase of the failed First Republic Bank by the riskiest and largest bank in the United States – JPMorgan Chase – on May 1 of last year. On July 12 of last year, Senator Elizabeth Warren, Chair of the Senate Banking’s Subcommittee on Economic Policy, held a hearing on “Bank Mergers and the Economic Impacts of Consolidation.” Warren had this to say during the hearing: “When First Republic Bank collapsed in April, the bank was ultimately sold to the biggest bank in America, JP Morgan Chase. That sweetheart deal cost the Federal Deposit Insurance Fund $13 billion. Meanwhile, overnight, the country’s biggest bank got $200 billion bigger. And what happened to the regulators? The Acting Comptroller of the Currency, Michael Hsu, rubber stamped the deal in record time. When I asked Mr. Hsu at a hearing in May to explain how this merger was approved, he was unable to provide a clear answer. “But the overall picture gets worse. Instead of inattentive regulators who don’t use their tools to block increasing consolidation, leaders within the Biden Administration seem to be inviting more mergers. In a May 2023 statement before the House Financial Services Committee, Acting Comptroller Hsu reassured banks that the agency would be ‘open-minded’ while considering merger proposals…. “Treasury Secretary Yellen recently warned that the banking ‘turmoil’ from the collapse of Silicon Valley Bank, Signature Bank, and First Republic might lead to more mergers and that regulators would be – quote – ‘open to’ them. Then the New York Times also reported that Secretary Yellen privately told big banks that she would, and I quote, ‘welcome more mergers.’ ” At the hearing, Warren called this lax position by regulators to be “stunningly wrongheaded” and “courting disaster.” Tens of millions of Americans are sleepwalking their way to the next banking crisis. If you agree with Wall Street On Parade that the current banking structure in the U.S. represents a threat to national security and economic stability, please contact your U.S. Senators today via the U.S. Capitol switchboard by dialing (202) 224-3121. Tell your Senators to hold immediate hearings on the Fed’s non-stop bailouts of the banking sector and demand the restoration of the Glass-Steagall Act to separate Wall Street’s trading casinos from federally-insured commercial banks.

1 0

Ukraine strikes deal with Peter Thiel’s tech giant to clear unexploded mines
by Gunnar Larson 04 Mar '24

04 Mar '24

https://www.telegraph.co.uk/business/2024/03/02/ukraine-deal-peter-thiels-t… Ukraine has turned to a company founded by Silicon Valley billionaire Peter Thiel to clear thousands of square miles of mines and explosives. The deal will see Palantir supply Ukraine with its artificial intelligence (AI) tools to organise and accelerate its demining efforts. Ukraine is hoping to decontaminate 80pc of its potentially mined land within 10 years and bring it back into economic use, freeing up millions of acres of farmland. Roughly a third of the country’s landmass is thought to be hazardous owing to mines or unexploded ordnance. The World Bank has estimated efforts to remove the explosives could cost up to $38bn (£30bn), with Ukraine seeking international deals and support to accelerate the effort even as it grapples with Russian advances in the Donbas. The 12-month agreement with Palantir builds on an earlier pilot programme. Palantir’s technology can be used to create a digital map of Ukraine’s territory and resources, such as heavy machinery and drones, and prioritise its clearance efforts.

1 0

Re: Recipe for a CISO
by Karl Semich 04 Mar '24

04 Mar '24

it used to be knowing systems meant learning to look inside obscure binaries and figuring out how to turn them to your ends like an anthropologist decoding ancient tablets (breaking into systems by hand), and doing this so well that you could defend against others doing it effectively. basically, nobody else had any idea how anything worked, it seemed they were all living in fantasy worlds based on marketing materials. it’s been a decade or two now for me, and i don’t know how it is in the present day. since the era of the dedicated hacker there are public tools maybe starting with metasploit that magnify power immensely. various actors have stimulated serious reduction in the quality of new code while other groups have secured some systems very strongly, such as blockchains. phones and routers still languish without updates while vulnerabilities sit in public databases to be used. things like this likely shift the power away from the researcher. i took one brief intro in cybersecurity and it was all AI, training models to detect and respond to anomalies. and those same powerful entities put backdoors straight in the hardware, contributing to frustration of complete review. my personal experiences lend me to think that AI has been used on the offensive for quite some time now. it seems things may have also shifted a ton toward social influence, which may even simply be more familiar to most people. On Mon, Mar 4, 2024 at 06:24 Cyber Cyber Cyber Cyber < cybercybercybercyber(a)substack.com> wrote: > eye of newt and toe of frog > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ > ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ ͏ ‌ > Forwarded this email? Subscribe here > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9uaW5qYS5jeWJlcmN5YmVyY3l…> > for more > Recipe for a CISO > <https://substack.com/app-link/post?publication_id=39961&post_id=142092104&u…>eye > of newt and toe of frog > > J.M. Porup > <https://substack.com/redirect/8a26d781-dff5-47aa-83a2-acdbbd8aa0ac?j=eyJ1Ij…> > Mar 4 > > <https://substack.com/redirect/8a26d781-dff5-47aa-83a2-acdbbd8aa0ac?j=eyJ1Ij…> > > > <https://substack.com/app-link/post?publication_id=39961&post_id=142092104&u…> > > <https://substack.com/app-link/post?publication_id=39961&post_id=142092104&u…> > > <https://substack.com/app-link/post?publication_id=39961&post_id=142092104&u…> > > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9vcGVuLnN1YnN0YWNrLmNvbS9…> > > READ IN APP > <https://open.substack.com/pub/cybercybercybercyber/p/recipe-for-a-ciso?utm_…> > > > <https://substack.com/redirect/86b5fba9-0a16-455d-953e-0b44c9a0a2dd?j=eyJ1Ij…>this > won’t hurt at all, promise > > What exactly is a CISO, anyway? > > I see CISO job ads asking for people’s GitHub handles, but you’re not > hiring a developer, and you're not hiring an engineering manager, you're > hiring a CISO. > > Thanks for reading Cyber Cyber Cyber Cyber! Subscribe for free to receive > new posts and support my work. > > Pledge your support > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9uaW5qYS5jeWJlcmN5YmVyY3l…> > > Security engineering is not about writing code, so even if you were hiring > an Security Engineering Manager you still wouldn’t want to be measuring > candidates based on the code they write. > > So if a CISO isn’t just a weird form of security engineering manager, then > what exactly do we do all day long, anyway? > > What’s the recipe for a CISO? > One bushel of technical systems knowledge > > How do things work? You can’t secure a system if you don’t understand the > system at least as well as attackers. From my point of view, that means a > good CISO is much more likely to come out of traditional IT or even a > DevSecOps role than from a developer role. Developers are generally > laser-focused on a specific tech stack—deep and narrow—but a CISO needs to > spread themselves thin across everyone and everything in their org—shallow > but broad. > a demijohn of people, people, people > > Not just technology, but also process and people. Because the human > systems you are defending are not technical. CISOs are focused on risk > management, and the way you manage risk—since risk mitigation is almost > always part of risk management—is to change things. To change the way > people do things. In other words, change management. But people hate > change! Oh my lord do people hate change. So exercising diplomacy and > influence across an org is key to securing an org. That’s not a 133t > supercoder job. > a peck of security mindset > > No one can be successful in any security role without the security > mindset. This is the adversarial thinking that distinguishes a builder from > a breaker, and it’s the raw material I look for when interviewing > candidates. You can teach technical skills, but you can’t teach adversarial > thinking to someone who lacks the knack. It’s a raw talent that I’ve > discovered in people both technical and non-technical. A CISO unable to > think creatively about adversaries—whether the North Korean military, a > ransomware gang, or the Irish Data Protection Authority—is not going to be > effective in their role. > two liters of leadership ability > > A one-man CISO is just a phony title. Ultimately a company of any size > that needs a CISO is going to need a security team for the CISO to lead. > But that means the CISO needs to be an effective team leader who knows how > to delegate, to motivate, to discipline—to get the most out of their team > for the benefit of their employer. This includes leading on both security > engineering (managing real securiy risk) as well as security compliance > (working with Legal to meet regulatory risk appetite, acquiring security > certifications like ISO 27001 to enable the business to close deals, etc). > a barrel of business mindset > > It is a tempting but fatal rookie error in security to be an absolutist > about security. This is unhelpful and makes you a bad CISO. A CISO is not > just a technical engineering manager—a CISO is a business executive whose > job is to working closely with the CEO and Board of Directors to balance > risk and opportunity to meet business goals. A CISO is not a high priest of > security trying to achieve perfection or a Cassandra warning of doom. Risk > is part of doing business, and security risk is part of doing business. > Making sure the business understand that risk, and helping the business to > choose between accepting risk or spending money to mitigate that risk, is > the fundamental service the CISO provides. > a heaping tablespoonful of lawyer > > I am not a lawyer and I don’t play one on TV. But I need a solid grasp of > the law in order to do my job. As I explained to a disbelieving colleague—a > software engineering manager—security straddles the fence between > Engineering and Legal. Legal and regulatory risk are a major part of my job > as a CISO. When my adversaries aren’t just criminal hackers but government > regulators, I better understand the regulations that we aim to either > comply with (or, as an executive decision involving the General Counsel, to > not comply with because the risk of a regulatory fine is so low). > a pinch of accountant > > You can either accept risk or spend money to mitigate risk. That means you > need a solid beancounter mentality to be effective as a CISO. How much > money should we spend? What's the cost/benefit analysis of that spend? > (What's your Security ROI?) Are you spending money wisely, and being a good > steward of company funds? > a megaphone of hostage negotiator > > Negotiating contracts with security vendors sometimes feels like a hostage > negotiation. "Pay us this crazy money for a substandard product, or the > hostage gets it." In this case my employer is the hostage. It’s not > racketeering but it sometimes feels like it! Being able to go to the mat > with vendors and tear into their offering to get a better price is a > crucial skill for a CISO. It’s not enough to just mitigate security risk, > you should be optimizing for cost as well. > Recipe > > Throw all the ingredients into a blender. Puree on low for twenty years or > so. Pour into a suit hoodie (half suit, half hoodie) and serve with a > heaping side order of ambiguity. > > Thanks for reading Cyber Cyber Cyber Cyber! Subscribe for free to receive > new posts and support my work. > > Pledge your support > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9uaW5qYS5jeWJlcmN5YmVyY3l…> > > Cyber Cyber Cyber Cyber is free today. But if you enjoyed this post, you > can tell Cyber Cyber Cyber Cyber that their writing is valuable by pledging > a future subscription. You won't be charged unless they enable payments. > > Pledge your support > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9uaW5qYS5jeWJlcmN5YmVyY3l…> > > Like > <https://substack.com/app-link/post?publication_id=39961&post_id=142092104&u…> > Comment > <https://substack.com/app-link/post?publication_id=39961&post_id=142092104&u…> > Restack > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9vcGVuLnN1YnN0YWNrLmNvbS9…> > > > © 2024 J.M. Porup > 548 Market Street PMB 72296, San Francisco, CA 94104 > Unsubscribe > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9uaW5qYS5jeWJlcmN5YmVyY3l…> > > [image: Get the app] > <https://substack.com/redirect/d2324bc1-691d-4b73-9cfb-6af14547e6b5?j=eyJ1Ij…>[image: > Start writing] > <https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9zdWJzdGFjay5jb20vc2lnbnV…> >

1 0

State AGs Say SEC's Kraken Case Treads On State Authority
by Gunnar Larson 04 Mar '24

04 Mar '24

State AGs Say SEC's Kraken Case Treads On State Authority <https://www.law360.com/fintech/articles/1808754?nl_pk=d2b3e7ef-ab62-4a62-80…> By Aislinn Keely Attorneys general from eight states have told a California federal judge that the theory used by the U.S. Securities and Exchange Commission in its enforcement case against crypto exchange Kraken could potentially preempt state laws for consumer protection. Brief attached | Read full article » <https://www.law360.com/fintech/articles/1808754?nl_pk=d2b3e7ef-ab62-4a62-80…> | Save to favorites » <https://www.law360.com/fintech/articles/1808754?nl_pk=d2b3e7ef-ab62-4a62-80…>

1 0

McCarter & English Denied $1M Fee Bid In Celsius Ch. 11
by Gunnar Larson 04 Mar '24

04 Mar '24

McCarter & English Denied $1M Fee Bid In Celsius Ch. 11 <https://www.law360.com/fintech/articles/1808899?nl_pk=d2b3e7ef-ab62-4a62-80…> By Ben Zigterman A New York bankruptcy judge has granted requests by a number of creditor groups in the Celsius Network Chapter 11 case for fees and expenses but denied a $1 million request by a borrower group represented by McCarter & English, saying it had failed to make a substantial contribution to the case. Opinion attached | Read full article » <https://www.law360.com/fintech/articles/1808899?nl_pk=d2b3e7ef-ab62-4a62-80…> | Save to favorites » <https://www.law360.com/fintech/articles/1808899?nl_pk=d2b3e7ef-ab62-4a62-80…>

1 0