Hacker News new | past | comments | ask | show | jobs | submit login
Serious security breach hits EU police agency (politico.eu)
112 points by isaacfrond on March 27, 2024 | hide | past | favorite | 46 comments



I find myself wondering if Russia, China, Iran, North Korea, wherever see the same security breaches that the West seems to be suffering.

Probably wouldn't hear as much about it due to their governments clamping down on any media that suggests these places have any sort of flaws, but you'd think the CIA/DIA, MI6, DGSE, etc. would be having at least some success.


There have been notable examples recently in Russia [0][1], and most likely similar attempts in China as well.

A lot of Iran's nuclear scientists keep finding bullets in their heads for some mysterious reason.

> Probably wouldn't hear as much about it due to their governments clamping down on any media that suggests these places have any sort of flaws

It comes up but most western news organizations skimp on translation services now and don't really follow Russian/Mandarin/Farsi/etc language media. There's a reason why American news channels keep quoting English speaking Global Times instead of Mandarin language sources

[0] - https://www.reuters.com/technology/russias-fsb-says-us-nsa-p...

[1] - https://www.reuters.com/world/us-justice-department-says-it-...


Navalny and many others used leaked databases of banks, mobile companies, airlines, delivery companies and even law enforcement for many years to run their investigations.

Such leaks were pervasive in Russia until very recently, when the risks to leakers accrued.

Most of the time, these databases were leaked not to independent investigators but to crooks of all kinds to take on credits, spy on cheaters, steal property from the elderly, etc.

This went even further in Belarus, where the civil society crowd-sourced an online database of pretty much everyone who was involved in 2020 rigged elections, from school officials to members of special forces. Check for yourself at https://blackmap.org/


I would encourage everyone to use translate on https://blackmap.org/ and judge for themselves.

In my humble opinion its just a politically charged map where everyone not sharing the same political affiliation are being doxxed. I can read a bit Cyrillic and the language is informal and full of prejudice, stuff like:

> sniched so hard he got recognised by the regime

And the link leads to https://t.me/nexta_tv/21342 where the text translates:

> Cops began to reward informers with certificates. This is done in order to encourage Christianity.

> The regime cultivates the worst in people. No one likes informers and traitors, but for the junta they are useful fools who help them in the war against the people.

> It was such "Stakhanovites" as Anatoly Bambiza, who received a certificate for denunciations of BCH flags in windows, who betrayed Jews and partisans to the Nazis. Everyone knows what awaited them at the end of the war.

> So a jar of jam and a pack of cookies from punishers is a mark, as well as state awards to rapists and propagandists. When Lukashenko plays in the box, such a letter certainly does not bode well.

This is neither civil nor objective and just illustrates the pettiness of both sides.


Yikes. It's hard to believe the people who compiled this list were careful and diligent with their research before leveling accusations when they're outright threatening to enact vigilante justice.


You just don't know the situation on the ground, and it is so different from your personal experience, this could have easily been a political satire or science fiction to you.

People who compiled this are in exile, together with roughly 300,000 out of 9,000,000 population.

The state is engaged in a never ending, ever deepening violence against the rest of the population.

The above website is a weak deterrent, but better this than nothing.


> most western news organizations skimp on translation services now and don't really follow Russian/Mandarin/Farsi/etc language media

By what standard are they 'skimping'? Did they used to translate those sources? In the past I've done a lot of looking into non-English journalism and never found many translations, unless it was done by the publication itself (e.g., it might translate some articles or have an English edition).


American (and also British, Canadian, etc) News Bureaus used to have Foreign Offices in Beijing, Moscow, Tehran, etc that had staff that spoke the regional language and would monitor regional language news.

All this changed due to cost cutting in the 2000s-2010s. Most foreign news is now contracted out to freelancers or Press Bureaus like Reuters (who also use freelancers).


I see what you mean.

As a minor addition: The major national / international journalism orgs, such as the NY Times, CNN, etc., still have them. The NY Times publishes a Chinese-language edition.

https://cn.nytimes.com/


> major national / international journalism orgs, such as The NY Times

Barely.

The NYT's Beijing bureau has maybe 10-11 people total, of which only 4-6 are actually editors and journalists, and half of them are Westerners.

Most of the China related content is made in their HK outpost which itself only has like 13 reporters and editors, of whom almost all are Westerners.

Most of their China sourcing comes from their parntership with the SCMP for printing and publishing the NYT in Mainland China and HK [0], and most of NYT's China and HK staff are concurrently employed by the SCMP.

It's a similar story in their Russia (4-6) and India (4) bureaus.

These numbers are barely enough to report on a small town, let alone federalized countries in the hundreds of millions or even billions

Even the NYT depends on unnamed freelance reporters to source stories. The person who's name is on the byline basically stitched the research the freelancers did for them.

It's the same story for WaPo, CNN, BBC, Guardian, WSJ, etc.

For anything Asia, I prefer reading Japanese, Singaporean, or HK sourced business news as organizations like Nikkei/FT, Straits Times, and SCMP have a massive presence across Asia, and built networks since the 1970s when Japan began it's "Flying Geese" policy.

[0] - https://corp.scmp.com/scmp-enters-printing-deal-with-interna...


Thanks for the indside knowledge. Are you in that field?

> SCMP

Do you still believe in them? They must comply with CPC at this point, I expect.

> The person who's name is on the byline basically stitched the research the freelancers did for them.

When I read about the NYT coverage of sexual violence on Oct 7, the story said a NYT reporter had two locals doing the legwork. Maybe that's efficient, but I'd think an experienced, high-skill reporter would find things that the freelancers might not.

In the past I looked hard for quality English non-Anglo journalism. It's tough anywhere; most news is of course in local languages and I also want high-quality journalism that fits my priorities (e.g., not the local mayor's scandal) - not a criticism of local journalism, it's just my narrow requirements. There were some good independent ones in the mainland in the 2000s but it seems nobody can be independent there anymore. Sinocism is pretty good, but it's written by a westerner and they left Beijing years ago.


> Are you in that field?

Not anymore but I am friends with people who have climbed up the ladder of business journalism to Bureau Chief or Editor.

> Do you still believe in them? They must comply with CPC at this point, I expect.

I recognize where the biases may lie.

I steer clear of op-eds, but I'd still trust it for non-controversial domestic news. Chinese language media can actually get quite heated in their opposition.

So long as you don't advocate the overthrow of the CCP and make sure your criticism has a "constructive" tone, Chinese reporting is good enough.

Who knows if that somewhat openness will exist in the next 5-10 years though. For example, Russia in 2019 was way more open a society than Russia in 2024.

I just cross validate with friends who still live there and work there.

> I'd think an experienced, high-skill reporter would find things that the freelancers might not

Imo, sourcing and recognizing what is a story and what isn't matters more, and you don't need someone at NYT doing that when freelancers are clearly equally as competent.

> quality English non-Anglo journalism

Reuters, Axios, Politico, and a couple niche trade papers and regional papers are more than enough. NYT's Washington Bureau is on point though and I can attest to that, but Politico sources way faster and gives more internal details.


Thanks again. I miscommunicated it seems: by "quality English non-Anglo journalism" I meant quality journalism from perspectives outside the Anglo sphere (UK, US, Canada, Australia, NZ).

Examples, though not necessarily current: The Hindu (India), Haaretz and the Jerusalem Post (Israel), ... Egypt had an explosion of them, but it's become a repressive state. The East African in Kenya is/was pretty good.


There's no point reading non-Western English language news if you don't know the owners and their biases.

If you think political connected oligarch ownership of media is bad in the US, wait til you see Israel, India, Africa, ASEAN, etc.

I just go straight to a handful of top think tanks and friends of mine who work in those markets if I want information.

Personally, it's all useless tbh.


> There's no point reading non-Western English language news if you don't know the owners and their biases.

You can see biases to a degree by reading different sources covering the same object. And I find the non-Western sources reveal the Western biases to a surprising degree, and there is much going on that isn't covered. My perspective on Israel and Africa are very different after reading some of the sources above.

It's not that much harder than in the West: Rupert Murdoch's biases are clear but what are A. G. Sulzberger's? I can take a shot at some, but I don't really know much.

> think tanks

I read those directly too. One day I realized: instead of reading the NYT (or Washington Post or FT, etc.) article for a few paragraphs of expert knowledge, just read the think tank report - they are just as readable (a surprise to me, at the time), provide a whole different perspective, a different magnitude of knowledge, and do it much more efficiently. Still their biases can be hard to read - donors, etc.

> There's no point ... it's all useless ...

I've heard that too many times about everything in the last few years. I can't change the world by my lonesome self - nobody can - but people do change it. Plus, knowledge has a value in itself and understanding the world has applications to everything. And my mind is sharpened by reading the best - why waste that time on anything less?

Great talking to you. I can go on if you like.


There is no evidence that the West has ever suffered anything as serious and sophisticated as STUXNET.


The article really does not add much interesting info beyond the headline


The article told me it was a hard copy; the headline don't.


To be fair, the article probably gives all the details it can, what do people expect? They can't share information that they don't have or that the police aren't willing to divulge. Not every piece of news will have an in-depth look at a recent event.


So they have no cameras in that room? crazy


Will they pay a GDPR fine as well?


to whom would they pay it?


Government agencies exempted themselves from GDPR and similar. That was discussed on HN in context of the break in Ireland.



GDPR article 2.2-2.3 does define some exceptions. National law enforcement agencies etc. are subject to a similar directive (LED, https://eur-lex.europa.eu/eli/dir/2016/680/oj). Union bodies, just like in your link yet another (article 2.3), but also quite similar (Regulation (EU) 2018/1725, https://eur-lex.europa.eu/eli/reg/2018/1725/oj) Eurojust belongs to this one. It's a good thing to have EDPS, otherwise it would be much easier to legislate things nobody can comply with in practice. But for most countries, it doesn't make much sense to fine other authorities. (Unfortunately, national security services are not subject to GDPR or LED at all - the only place you can get protection from them is under national law, Charter of the Fundamental Rights, ECHR etc.)


> Unfortunately, national security services are not subject to GDPR or LED at all

They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?


The EU has no legal power to legislate on issues of national security under the treaties.

Article 4 of the Treaty on European Union states that "competences not conferred upon the Union in the Treaties remain with the Member States" and "[i]n particular, national security remains the sole responsibility of each Member State".

Article 2(2) of the GDPR states that "This Regulation does not apply to the processing of personal data [] in the course of an activity which falls outside the scope of Union law".

Article 3(3) of the LED includes similar text (with the word "Directive" replacing the word "Regulation").


Thank you for the clarification.


It's a myth that gets repeated here. In reality, it's more subtle. Laws can be the legal basis for some processing, if it is deemed proportional; and in some countries (eg. France), government agencies cannot be fined.

GDPR doesn't apply to EU activities related to foreign policy or law enforcement, but EUCFR articles 7 and 8 still apply, as does regulation 2018/1725 for the former, and directive 2016/680 for the latter–so in theory, some activities are indeed exempted from GDPR, in practice, they're still subject to data protection laws that require essentially the same measures as GDPR.

Source: GDPR article 2 and 6. On a more personal note, I've already requested my data under GDPR, cited WP29/EDPB guidelines, and filed complaints against various govt agencies.


[flagged]


Rust can make locks harder to pick, improving security. But it is a pain to deal with and it certainly doesn't solve all security problems, and it is vulnerable to the WD-40 attack.


ACID can help with Rust too.


That was amazing


> Before anyone jumps in with "Rust solves all security problems" evangelism (love the language, hate the evangelists)

Seems a bit odd to go out of your way to bash rust evangelists on a completely unrelated thread, especially when the nobody in the comments has mentioned rust at all.


> Before anyone jumps in with "Rust solves all security problems" evangelism

I have literally never seen this on a post not about memory corruption issues.


The people irritated by evangelists are morphing into some sort of evangelists themselves.


This is a big thing in YouTube comments. Many top comments warning about some expected "typical commenter response", with that response nowhere to be found.


They're generally much more prevalent than the originals.


Reminds me of a time long ago on World of Warcraft I complained about something exactly twice (2 times), and there was a guy who got bent out of shape, launching a diatribe about that I was "complaining about it again and again and never shutting up".

That came out of the blue for me, and offered no way for me to correct my behavior since he didn't make specific what he was really angry about.

I think it's the same story. Anti-Rustaceans get mixed up about why they reacted as they reacted. I'm guessing that in reality they had just reacted to the cultish/superior tone of some lone Rustacean at some point, but that's hard to put into words, so instead they generate the world-description that "there's evangelists everywhere" even though that wasn't what initially made them mad.

The original problem still lies with the Rustacean of course.


Perhaps basing your identity around what programming language you use (Rustacean) is part of the problem.


But there aren't that many people who do, at all, which was sort of OP's point.


Negative polarization is a hell of a drug. And key fuel of modern internet misbehavior.


"you were supposed to destroy evangelisms not join them!"


There are quite a few cases where people say "Rust wouldn't have fixed" this and they're a real mixed bag of whether that's right or wrong or hard to say, partly because in fact Rust's safety culture isn't just about memory safety.

So e.g. there are some logic bugs where you're like yeah, I'd totally write that same bug in Rust but there are also arithmetic bugs where the problem arises because C++ inherits C's um, exciting "integer promotion" rules and Rust doesn't have those, far more of such situations in a Rust codebase are going to cause a puzzled programmer to investigate what really is going on with these integers and not write the bug.

Or there are type safety bugs where in Rust that mistake just won't compile, but in C++ it will compile it just has astonishing results. Obviously you can't write those bugs in Rust.

There's also a lot of contribution from ergonomics considerations where Rust's "Empowering everyone" idea means they think about library and feature design not just from the perspective of an expert but also a beginner, someone learning or maybe familiar with the rest of the language but not this particular feature. In C++ sort() is the unstable sort, if you don't know what unstable sorting is, you're given no clue that this might have consequences which astonish you. In Rust that sort is still there, but it's named sort_unstable() -- cuing a novice to read up about this idea before they are surprised. If they just write sort() they get a stable sort instead.


It was a joke.


I guess their security practices had gotten a bit rusty


[flagged]


The companies are not allowed to abuse our data without our consent, how awful. Install uBlock Origin along with optional annoyance filters and you'll almost never see a banner again.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: