Page 32 - ARUBA TODAY

A32 FEATURE
Thursday 30 March 2017
AP Exclusive: Colombia ‘panic buttons’ expose activists

FRANK BAJAK buttons directly from the Recipients said the dan- Industrial Ltd. AP’s findings contradict
AP Technology Writer manufacturer. gers they face should not A company official, John that claim.
It is supposed to help pro- The most serious vulner- be underestimated. Some Chung, acknowledged A HISTORY OF VIOLENCE
tect human-rights activists, ability lets anyone with the have received death that Rapid7 notified him Activists have good reason
labor organizers and jour- device’s phone number threats, been kidnapped of the flaws in December. to be wary of public of-
nalists working in risky en- remotely disable it and sur- or forced into exile. They In keeping with standard ficials in Colombia, where
vironments, but a GPS-en- reptitiously take control. complain that the body industry practice, Rapid7 murder rates for land and
abled “panic button” that waited at least two months labor activists are among
Colombia’s government before publicly disclosing the world’s highest, and
has issued to about 400 the vulnerabilities to give there is a legacy of state-
people could be exposing the manufacturer time to sponsored crime.
them to more peril. address them. The DAS domestic intel-
The pocket-sized devices Chung told the AP that ligence agency, which
are designed to notify au- Eview was working to up- provided bodyguards and
thorities in the event of an date the EV-07’s webserv- armored vehicles to high-
attack or attempted kid- er software, where Rapid7 risk individuals prior to 2011,
napping. But the Associ- found flaws that could al- was disbanded after being
ated Press, with an inde- low user and geolocation caught spying on judges,
pendent security audit , data to be altered. journalists and activists.
uncovered technical flaws The audit confirmed sus- Five former DAS officials
that could let hostile par- picions that arose after have been prosecuted
ties disable them, eaves- independent Colombi- for allegedly subjecting
drop on conversations and an journalist Claudia Ju- Duque and her daughter
track users’ movements. lieta Duque reported in to psychological torture
There is no evidence the In this March 23, 2017, photo, Amalfi Rosales, a Colombian jour- August that the devices after she published articles
vulnerabilities have been nalist whose exposes of corruption forced her to flee, holds a have built-in microphones. implicating agency offi-
exploited, but security ex- GPS-enabled “panic button” that Colombia’s government has The government had not cials in the 1999 assassina-
perts are alarmed. issued in Bogota. Associated Press told recipients, and many tion of Jaime Garzon, a
“This is negligent in the ex- stopped using the panic much-loved satirist.
treme,” said Eva Galperin, Simple text messages can armor and cellphones as- buttons. Tanya O’Carroll of Amnes-
director of cybersecurity reset it or activate the mi- signed with panic buttons “To me, it’s just a device ty International, which has
at the nonprofit Electronic crophone remotely, turn- are inadequate. to spy on you,” said Rocio been developing a differ-
Frontier Foundation, calling ing it into a listening post, “What am I going to do Campos, an activist in the ent kind of “panic button”
the finding “a tremendous the audit found. Built-in with body armor riding Magdalena River refinery since 2014 , said the Co-
security failure.” GPS pinpoints the user’s lo- the bus?” said Amalfi Ro- city of Barrancabermeja lombian model is funda-
Over the past four years, cation. sales, a journalist from the whose brother was disap- mentally flawed.
other “distress alarms” and Because the device can northeastern Guajira re- peared in 1998 and who “In many cases, the gov-
smartphone apps have be remotely wiped, it can gion whose exposes of cor- has been helping prosecu- ernment is the adversary,”
been deployed or tested also be reconfigured from ruption forced her to flee. tors search for unmarked she said. “How can those
around the world, with afar, said Deral Heiland, “How does that protect graves. people who are the ex-
mixed results. When effec- the researcher with Rapid7 me?” Mora denies that the de- act adversary be the ones
tive, they can be crucial who performed the audit. EASY-TO-FIND INSTRUC- vices can listen in on users. that are best placed to re-
lifelines against criminal Obtaining the Colombian TIONS The device’s local provid- spond?”
gangs, paramilitary groups device’s phone number is Mora rejected any sugges-
or the hostile security forc- not easy, and the govern- tion that his office, which
es of repressive regimes. ment said it alone knows to offers protective services
REASON FOR PANIC whom each device is as- to some 6,500 people, dis-
The panic button, or “bo- signed. tributed panic buttons with
ton de apoyo,” distributed But security experts said the intent of spying on ac-
by Colombia’s Office of there are ways a sophisti- tivists.
National Protection is a cated adversary could ob- “We’re at ease,” he said.
keychain-style fob. Its Chi- tain the numbers, including He was unable to cite an
nese manufacturer mar- fake cell tower technol- instance of a panic but-
kets it under the name ogy that captures numbers ton saving life or helping
EV-07 for tracking children, and bribes to cell compa- to extract someone from
pets and the elderly. The ny or government employ- danger.
device operates on a wire- ees. When the “SOS” button is
less network, has a built-in Office of National Protec- pressed, it notifies a 24/7
microphone and receiver tion Director Diego Mora operations center at the
and can be mapped re- called the flaws identified In this March 16, 2017 photo, an Associated Press employee in office’s Bogota headquar-
motely with geo-location in the AP audit overblown. Bogota, Colombia holds a GPS-enabled “panic button” that ters. Operators place a
software. A button marked He said activists given the Colombia’s government has issued to labor, community and call to the user and, if the
“SOS” calls for help when device are at such low risk human rights activists in risky environments. person is in danger, notify
pressed. there would be little inter- Associated Press police.
But some features could est in eavesdropping on Instructions for resetting er, cellular carrier Comcel Campos was not carry-
be turned against the user, them. the Colombia-issued pan- S.A., “made the neces- ing a device in September
the security audit done “It’s a very, very basic ic button and activating sary modifications so that when two men on a mo-
for the AP by the Boston- protection measure for its “silent phone” function one could not activate the torcycle tried to topple her
based security firm Rapid7 people whose risks aren’t were easy to find. They microphone or know the motorbike at a stoplight.
found. The AP tested two very complex,” said Mora. are spelled out in a user device’s location without One pulled a gun, and she
devices issued in Colom- “Supreme Court judges, manual posted online by pressing the button,” he sped away to a nearby po-
bia, while Rapid7 bought ministers, prosecutors, they the manufacturer, Eview said. lice post, bending forward
don’t have this device.” to make a smaller target.q