TT-964 -- How the Japanese are Accidentally Good at Data Security, ebiz news from Japan

* * * * * * * * TERRIE'S TAKE - BY TERRIE LLOYD * * * * * *
A weekly roundup of news & information from Terrie Lloyd, a long-term
technology and media entrepreneur living in Japan.
(http://www.terrielloyd.com)

General Edition Sunday, Oct 07, 2018, Issue No. 964

- What's New -- How the Japanese are Accidentally Good at Data Security
- News -- Child abuse statistics get worse in 2017
- Upcoming Events
- Corrections/Feedback - Mercari billboards on Highway 101
- Travel Picks -- Art Deco in Meguro, Craft Center in Shizuoka
- News Credits

SUBSCRIBE to, UNSUBSCRIBE from Terrie's Take at:
http://mailman.japaninc.com/mailman/listinfo/terrie

BACK ISSUES
http://www.japaninc.com/terries_take, or,
http://mailman.japaninc.com/pipermail/terrie/

+++ How the Japanese are Accidentally Good at Data Security

There have been two big data security breach stories in the news over
the last week, one in Europe, involving Russian hackers, and one out of
the USA (via Bloomberg), about Chinese infiltration methods with large
US companies and various government agencies there. Although we normally
focus on how ill-prepared Japanese websites are against hacking, and how
computer and data security overall here is lagging behind, we believe
these two incidents comprise an infiltration trend that the Japanese are
actually (accidentally) very good at defending against.

The first story was about four Russian intelligence officers who were
caught red-handed by the Dutch police hacking into the computer systems
of the Organization for the Prohibition of Chemical Weapons (OPCW),
announced last week. Two of the four were arrested while in a van parked
just around the corner from the OPCW headquarters, and were using their
proximity to access the organization's WiFi network, to do whatever
hackers do. They apparently needed to be present in person, because
their traditional online efforts to find anyone senior enough (i.e.,
with the necessary security clearances) had failed. By being within WiFi
range, they were able to spoof server connections to office users, and
then through perseverance hook a big fish and eventually gain the
necessary access credentials.

The story link is here: http://bit.ly/2E6B4UL

The take away is that they needed to be local and physically present to
do a successful hack.

The second story was a blockbuster article (it's a long read) by
Bloomberg a couple of days ago, detailing a reporter investigation they
have been doing for months now, about compromised servers used by
Amazon, Apple, the Department of Defense, and even the CIA. In this
exploit, apparently motherboard manufacturing subcontractors in China
had cooperated with a government espionage group there to fit the
US-bound server boards with a pin-head sized device that opened up the
server's operating system and provided access to outside hackers to
forage for interesting data. Amazon and Apple both deny the Bloomberg
story has any substance, but Bloomberg says that it has spoken to more
than a dozen people who provided cross-referenceable stories about the
attack (which started in 2016 and which was discovered earlier this year
by Amazon).

The story link is here: https://bloom.bg/2OLdLEi

Again, for this attack to work, the hackers needed to be physically
present on the servers and intercept the basic operations of the server.

[Article continues below...]

------- Portable News from SKY Perfect JSAT Corp. ---------

Travel is a chance to escape the stress and demands of daily life. But
the world doesn't wait while we vacation, and many travelers want to
stay in touch with what is happening back home. Mobile devices and
streaming video have made this easier, and a new app from SKY PerfecTV
puts the world at your fingertips while in Japan.

Delivering content in English and 12 other languages, Portable News
brings together live news broadcasts from Australia, Congo, France,
Germany, Indonesia, Qatar, and South Korea, as well as info about
Japan's entertainment scene through Club TV.

In addition to programming from abroad, Portable News keeps you well
informed during earthquakes, tsunamis, typhoons, and other disasters
that may occur while you are in Japan.

Downloads:
* iOS: https://goo.gl/8fPuvq
* Android: http://bit.ly/2QOV9RT
* Browsers: http://bit.ly/2QOZ8Or
-----------------------------------------------------------

[...Article continues]

In this second instance, we spoke to an electronics expert and asked
whether he thought the Bloomberg story had any merit, especially given
that there seems to be a battle raging on some engineering bulletin
boards that the Bloomberg story is not technically feasible. Our source,
who has more than 30 years of very deep design and experience in
chip-level security says:

**************************

"The pin-head sized chip that Bloomberg referred to was described in the
article as "built to look like a signal conditioning coupler." The units
shown had 6 pins. My guess is that the Chinese replacement chips really
were signal conditioning couplers and probably did their basic job of
protecting the motherboard against ESD strikes (jolts of static
electricity) - something that only requires two pins. This means that
the other four device pins were probably common input/output
connections, which could support two or more comms channels.

This is a really smart choice of component to target if you wanted to
compromise the hardware. The thing is, once the factory engineers have
done the ESD testing on a motherboard, because most engineers just
assume that such basic parts operate, they don't give them a second
thought. Furthermore, the parts are low cost - typically a few cents
each - and a factory would just follow the Bill-Of-Materials (BOM) that
it was supplied with. So I disagree with the article's arguments that
bribery or threats were needed to get factory workers to fit these
parts. Instead the bad guys from Chinese Intelligence would simply need
to access and change the BOM to say, 'Part number XYZ-1233234B, from
company PQR-BB2' and the factory would automatically order, fit, and
forget - that's normal.

Kudos to the guys who picked this up (Canadian, as it happens). The next
level attack will be inside the chips, rather than a separate part, such
as this one. And next time, rather than have the chip "dial out" to a
rogue IP address (an obvious giveaway that allowed the good guys in this
case to discover that something, somewhere, in the hardware was amiss)
they will probably use steganography to hide the comms."

**************************

So where does Japan come in to this story?

Thinking about the types of vulnerabilities exploited in both cases, the
bad guys had to have phsyical or near-physical access to the systems
they were trying to compromise. As anyone living in Japan will tell you,
any foreigner loitering in a car parked in almost any neighborhood would
be quickly spied by a nosy local or the local police - and you'd soon
get a warning to move on.

Secondly, the Japanese are very aware of the need to preserve some basic
engineering capabilities in-country, rather than simply off-shoring
everything to China (hardware) or India (software). We (the writers)
have seen this first hand - that while there are much better security
devices available from foreign companies, the Japanese Self Defense
Force (SDF) stubbornly requires its main security contractor (NEC) to
create such devices in Japan, despite the cost. This is one instance
where the Galapagos syndrome works in Japan's favor.

Thirdly, most advanced engineering and security, especially government
security, is done in Japanese and requires the participants to be
conversant in the language. As the Bloomberg story stated, much of the
interaction between the design engineers and contractors happened in
Chinese, and so the local Americans were unaware of what was going on.
Japanese firms are much more choosey about working with subcontractors
who can speak to them in their own language, and so there wouldn't have
been the same unmonitored second channel of communication.

This brings us to the fourth point. We are not saying that NEC and
others don't get their server motherboards made in China. In fact, they
may well have them produced there. But at the same time, Japanese
supplier factories are more likely than US ones to actually be owned and
controlled by the Japanese parent, or at least to have QC officers
present as products come off the line. This is something the Japanese
have learned after 30 hard years of off-shoring/outsourcing. And if
there's one thing we know about Japanese hardware QC, they are very
picky. Thus, Japanese manufacturer = tighter control.

Admittedly, Japan's overall security competence is suspect, as is proven
by the so-far two major cybercurrency hacks that have happened this
year. However, we would say that those hacks were typically in the
software domain, upon start-ups that anyway were not subject to much
oversight, and which were building their own services and thus not being
monitored by larger companies or government organizations with deep QC
experience. Certainly we believe that the folks at NEC in charge of
making communications devices for the SDF have a high awareness of
chip-level security, and would see this as a core competence - given
that they and their long-term Japanese suppliers make many of the chips
as well.

These two incidents highlight why the USA and Europe should be trying to
foster close military and intelligence partnerships with the Japanese.
As one of the few countries with high-tech capability and yet no serious
ideological bones to pick, they make a perfect third party to entrust
sensitive manufacturing to. This could in fact become a major source of
revenue and a point of sustenance for Japanese electronics manufacturers
looking for a way to survive and fight the Chinese takeover of the industry.

...The information janitors/

***------------------------****-------------------------***

------------ One Day Only! Light Festival Ride ------------

Yokohama Rides & Rentals is proud to present a unique cycling tour
through the historical heart of Tokyo, ending at the 730 year old
Ikegami light festival. One day only! Friday October 12 at 2PM.

Highlights include -
- An exhilarating ride on electric assist bicycles through Ginza.
- The famous Nakagin capsule tower.
- Dare to climb the "Lucky steps" of Atago Shrine
- Shiga Park/Zozoji Temple, burial place of Shoguns - now in the shadow
of Tokyo Tower.
- Tokyo Bay waterfront.
- The historic Old Tokaido - still a very lively street that retains
it's original (human) scale meandering through neighborhoods with
centuries' old landmarks.

Finally, we arrive at one of Tokyo's hidden treasures, the Ikegami
Honmonji temple, where you can witness the famous the Ikegami light
festival. This ancient event involves 3,000 participants carry enormous,
cherry-blossom-decorated lanterns, accompanied by the hypnotic rhythms
of drummers and Edo-era banner carriers. Food and drink galore, with
over 100 food stands lining the streets!

For info and booking - http://bit.ly/2Rtrkqv
-----------------------------------------------------------

***------------------------****-------------------------***

+++ NEWS

- Child abuse statistics get worse in 2017
- Female Councillor thrown out for sucking a cough drop
- Japanese corporations look to exit UK over Brexit
- Tsukiji fish market closed on Friday
- USA bans two companies identified as Yakuza-owned

=> Child abuse statistics get worse in 2017

The Japanese stock market may be rising, but clearly there are plenty of
families struggling to keep their heads above water, and one of the
consequences is child abuse. In the first half of 2018, the number of
children taken into protective custody from abusive parents rose a full
22% over the same time last year. More than 71% of the cases (6,792
kids) involved direct abuse of the child, and 60% involved physical
violence between parents. Sexual abuse cases also rose by 15% to 111
kids. Cases are increasing particularly rapidly in urban renewal areas,
such as Tokyo Bay (lots of expensive, independent apartment blocks),
where neighborhood interaction is non-existent. ***Ed: An expert at the
Hokkaido Bunkyo University blames parents too busy with their jobs,
and an over-focus on cell phones and other devices, causing parents to
trivialize their relationships with their kids. We think for most
families, the economic situation is the critical factor. Both parents
working all the time is not symptomatic of a healthy middle class.
Instead, people are working those hours because family incomes are
inadequate. Yes, inflation generally is stable, but the cost of fresh
food (which is not included in inflation figures) is spiraling.**
(Source: TT commentary from scmp.com, 05 Oct, 2018)

http://bit.ly/2E4DjrV

=> Female Councillor thrown out for sucking a cough drop

It doesn't get more crazy than this. The Kumamoto city assembly in
Kyushu has once again ejected female Councillor Yuka Ogata, this time
for speaking to the assembly while sucking on a cough drop. Last time
they threw her out, it was because she showed up with a nursing baby and
complained about the lack of facilities for young mothers at the
organization. ***Ed: It's pretty clear that Ogata got the noses of some
of the old farts running Kumamoto city out of joint, and they were
looking for an excuse to get rid of her a second time. They may have
underestimated both her determination and also the large feminist group
behind her, though. The group has been relying on Ogata to get the
assembly sessions opened up to the public and it is now talking of suing
the assembly for making it impossible to have their submission heard
(since Ogata was presenting the petition). All we can say is "martial
the female voters and vote the bums out!"** (Source: TT commentary from
theguardian.com, 01 Oct, 2018)

http://bit.ly/2E30dQ7

=> Japanese corporations look to exit UK over Brexit

The exodus of international corporations from the UK due to disappearing
access to European markets has included a number of Japanese
heavyweights. Currently there are over 1,000 Japanese companies
employing more than 160,000 people in the UK. Of these about 47% have
been looking at moving their headquarters or future operations to other
locations in the EU, rather than continue in the UK. Companies who are
looking at moving or who expect "severe disruption" to their UK
operations include: Toyota, Muji (the Seibu company), Nomura, Daiwa,
Mitsubishi UFJ, and possibly Nissan and Hitachi. ***Ed: After the USA,
the UK has been Japanese companies' largest investment destination, with
about US$153bn invested there as of 2017.** (Source: TT commentary from
bloomberg.com, 03 Oct, 2018)

https://bloom.bg/2PfbsGh

=> Tsukiji fish market closed on Friday

Friday marked the end of an institution, with the closing of the famed
Tsukiji fish market. Never fear, however, because next week the fish
auctions will resume a half kilometer to the east, as the new Toyosu
market. The move is long-term beneficial to the hundreds of fish
sellers, who will now be able to function in fully air conditioned
facilities, and not have to worry about premature melting of frozen tuna
in the middle of summer. The internal temperature of the auction areas
will be maintained at 10.5 Celsius. ***Ed: The big question everyone has
been asking is about tourist access. We can confirm that the new site
gives visual overview of the trading floor, but only through heavy duty
windows, and thus no interaction in the newly sterile environment. Will
this work as a tourist drawing card? Probably not. Looking at fish will
get dropped from the "must-do" list.** (Source: TT commentary from
the-japan-news.com, 05 Oct, 2018)

http://bit.ly/2y7b6eC

=> USA bans two companies identified as Yakuza-owned

The US Treasury Department has banned two Japanese firms from doing
business with Americans. They are Yamaki KK and Toyo Shinyo Jitsugyo,
both of which own and manage golf driving ranges and other entertainment
properties, and which are related to the Yamaguchi-gumi. This is the
first time that the US Treasury has targeted Yakuza-related companies.
***Ed: It's not the first time for overseas authorities to go after
Yakuza assets and businesses, though. The Australian Tax Office has long
coordinated with the Japanese Tax Office, to seize or bar the movement
of Yakuza assets to that country.** (Source: TT commentary from
asia.nikkei.com, 03 Oct, 2018)

https://s.nikkei.com/2RwyAlj

NOTE: Broken links
Some online news sources remove their articles after just a few days of
posting them, thus breaking our links -- we apologize for the inconvenience.

***------------------------****-------------------------***

+++ UPCOMING EVENTS

No upcoming events this week.

***------------------------****-------------------------***

------- Japan Travel Cherry Blossom Photography Tour ------

If you've ever wanted to travel through Japan with your camera, now is
your chance! Join professional photographer Les Taylor in 2019 on this
12-day photography adventure exploring the beauty of Japan's cherry
blossom season. You'll visit some of Japan's best locations, ride the
shinkansen (bullet train), try delicious Japanese food, and see the
beautiful cherry blossom trees all along the way. As you take in the
sights, Les will be there to guide you and to offer professional
photography instruction to help you create the best possible images. Les
Taylor's work has been featured in publications such as National
Geographic Traveler and Jetstar Magazine, and with years of experience
living in and traveling through Japan, he is the perfect guide for this
exciting photography adventure.

To buy tickets or learn more: http://bit.ly/2QwNbvG [www.japantravel.com
webshop]
-----------------------------------------------------------

***------------------------****-------------------------***

+++ CORRECTIONS/FEEDBACK

=> In Terrie's Take 958, we covered what we thought were some of the
challenges facing Mercari and their expensive effort to get a foothold
in the US market.

*** Reader Says: Another data point, recently Mercari has had a bunch of
billboards on 101, the main highway through SF which is a prime spot for
vanity billboards. They are poorly designed and executed, clearly done
by someone who knows nothing about marketing in the U.S. When I saw
those, for me they were a huge red flag that something was very wrong
there.

***------------------------****-------------------------***

+++ TRAVEL DESTINATIONS PICKS

=> Exotic x Modern, Meguro
French Art Deco and inspiration from afar

This special exhibit explores how French artists and designers were
influenced and inspired by African, Middle Eastern and Asian cultures
and ideas in the period between the two world wars. Known as Art Deco,
this style of visual arts is evident in a broad range of materials, from
paintings to furniture, sculpture to fashion and jewelry.

Post World War One, there was a growing interest in the African music,
dance and art that were eagerly brought to France. Then the discovery of
King Tut's tomb in 1922 further stimulated this fascination with
non-Western cultures. There couldn't be a better venue for this show
than the Tokyo Metropolitan Teien Art Museum, which is an Art Deco
mansion built in 1933. The former residence of Prince Asaka, it is the
perfect backdrop for more than 80 Art Deco pieces, most of which are
shown in Japan for the very first time.

Venue: Tokyo Metropolitan Teien Art Museum When: Oct06-Jan14, 2019,
10:00am-5:30pm

http://bit.ly/2y6616j

=> Sumpu Takumi-Shuku Craft Center,
Try some traditional craft workshops in Shizuoka

A short drive or bus ride from central Shizuoka city, the Mariko
district is a pleasant, leafy place to spend a day away from the
downtown bustle. There's some attractive scenery, charming temples such
as Togeppo Saioku-ji and Kansho-in, and the Sumpu Takumi Shuku, a craft
center where you can learn about traditional local handicrafts, and try
your hand yourself if you feel so inclined.

It's a very stylish place, with an understated design that fits in well
with the surroundings. The low buildings are spread out around a central
yard with a gentle water feature, a nice place to relax with a snack
after a workshop or the journey from downtown. Oh, and there's also a
shelter for when the weather isn't so clement.

The main attraction is the galleries and atelier spaces, showcasing a
whole range of crafts: indigo dye, items made from turned wood or woven
bamboo, ceramics and glassware. If I understood the staff correctly (all
the information is only in Japanese), it's possible to take workshops on
a walk-in basis, even just for one or two people. I'd say it's better to
make a reservation to guarantee a place, though, because on the
afternoon I visited, a large party of schoolchildren arrived shortly
after I did.

http://bit.ly/2NuFwMB

***------------------------****-------------------------***

***********************************************************
END

SUBSCRIBERS: 6,075 members as of October 07, 2018 (We purge our list
regularly.)

+++ ABOUT US

STAFF
Written by: Terrie Lloyd (terrie.lloyd@japaninc.com)

HELP: E-mail Terrie-request@mailman.japaninc.com with the word 'help' in
the subject or body (don't include the quotes), and you will get back a
message with instructions.

FEEDBACK
Send letters (Feedback, Inquiries & Information) to the editor to
terrie.lloyd@japaninc.com.

ADVERTISING INFORMATION
For more information on advertising in this newsletter, contact
ads@japaninc.com.

SUBSCRIBE
Get Terrie's Take by giving your name and email address at
http://www.japaninc.com/newsletters/free_sign_up, or go straight to
Mailman at:
http://mailman.japaninc.com/mailman/listinfo/terrie

BACK ISSUES
http://www.japaninc.com/terries_take or,
http://mailman.japaninc.com/pipermail/terrie/

Copyright 2018 Japan Inc. Communications Inc.

----------------- Japan Inc opens up Japan ----------------

J@pan Inc authoritatively chronicles business trends in Japan. Each
posting brings you in-depth analysis of business, people and technology
in the world's third largest economy.

Visit www.japaninc.com for the best business insight on Japan available.
-----------------------------------------------------------

_______________________________________________
Terrie mailing list
Terrie@mailman.japaninc.com
http://mailman.japaninc.com/mailman/listinfo/terrie