Skip to content

IT News

China back at hacking

Note to Trump – sometimes diplomacy is better than chest thumping.

QUOTE

The Obama-era cyber détente with China was nice, wasn’t it? Yeah well it’s obviously over now
Middle Kingdom is a rising threat once again – research

Infosec pros might have already noticed some familiar IP address ranges in their system logs – China has returned to the cyber-attack arena.

That’s the conclusion of threat intel outfit CrowdStrike, which released its midyear threat report this week (downloadable here with free registration). The firm’s Falcon OverWatch team said that from January to June, state actors were responsible for 48 per cent of intrusion cases, and China is climbing back up the charts.

CTO and co-founder Dmitri Alperovitch tweeted: “CrowdStrike can now confirm that China is back (after a big drop-off in activity in 2016) to being the predominant nation-state intrusion threat in terms of volume of activity against Western industry. MSS is now their #1 cyber actor.”

MSS refers to the Ministry of State Security, which will likely be even more motivated to digitally disrupt the US since a deputy division director was arrested in Belgium in April and extradited to face charges in America.

Alperovitch said that the 2015 Obama-era non-hacking pact had led to a decline in hostile activity, at least at the state level.

Alex Stamos, formerly CSO at Facebook, concurred with Alperovitch: “Most IR professionals I have spoken to believed that there was a real drop in commercially-motivated hacking from the Chinese after the deal.”

That was then. The increasing political hostility between China and the US (and countries like Australia which have followed the US’s lead) is reflected in the online world, CrowdStrike reckoned. “OverWatch data identifies China as the most prolific nation-state threat actor during the first half of 2018.”

Intrusions were attempted against “biotech, defence, mining, pharmaceutical, professional services, transportation, and more”, the report claimed.

The “Chinese threat” has been a CrowdStrike theme for some time: in September, Alperovitch made the same point to Fox Business in a TV interview. He said “every major sector of the economy is being targeted” by the Middle Kingdom.

“Primarily they’re focused on stealing intellectual property… in order to counteract in part the trade tariffs we’re putting into place on them.”

By comparison to the rising Chinese attack traffic, the report’s other key findings were relatively unremarkable: online crims are turning to crack networks to install cryptocurrency miners, with legal and insurance industries a favourite target; the biotech sector is a favoured target for industrial espionage; and criminal actors who once may have used less sophisticated tools are now adopting “tactics, techniques and procedures” learned from nation-state actors.

New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

One needs to wonder about all those routers and firewalls from the majors that are produced in China.
Also, I think this will do more damage to “Brand China” than dubious tariffs.
And in case you missed it, Bloomberg’s original story “The Big Hack” (excellent read), can he had here

The discovery shows that China continues to sabotage critical technology components bound for America.

A major U.S. telecommunications company discovered manipulated hardware from Super Micro Computer Inc. in its network and removed it in August, fresh evidence of tampering in China of critical technology components bound for the U.S., according to a security expert working for the telecom company.

The security expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery following the publication of an investigative report in Bloomberg Businessweek that detailed how China’s intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015.

Appleboum previously worked in the technology unit of the Israeli Army Intelligence Corps and is now co-chief executive officer of Sepio Systems in Gaithersburg, Maryland. His firm specializes in hardware security and was hired to scan several large data centers belonging to the telecommunications company. Bloomberg is not identifying the company due to Appleboum’s nondisclosure agreement with the client. Unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server’s Ethernet connector, a component that’s used to attach network cables to the computer, Appleboum said.

The executive said he has seen similar manipulations of different vendors’ computer hardware made by contractors in China, not just products from Supermicro. “Supermicro is a victim — so is everyone else,” he said. Appleboum said his concern is that there are countless points in the supply chain in China where manipulations can be introduced, and deducing them can in many cases be impossible. “That’s the problem with the Chinese supply chain,” he said.


The more recent manipulation is different from the one described in the Bloomberg Businessweek report last week, but it shares key characteristics: They’re both designed to give attackers invisible access to data on a computer network in which the server is installed; and the alterations were found to have been made at the factory as the motherboard was being produced by a Supermicro subcontractor in China.

….

The manipulation of the Ethernet connector appeared to be similar to a method also used by the U.S. National Security Agency, details of which were leaked in 2013. In e-mails, Appleboum and his team refer to the implant as their “old friend,” because he said they had previously seen several variations in investigations of hardware made by other companies manufacturing in China.

In Bloomberg Businessweek’s report, one official said investigators found that the Chinese infiltration through Supermicro reached almost 30 companies, including Amazon.com Inc. and Apple Inc. Both Amazon and Apple also disputed the findings. The U.S. Department of Homeland Security said it has “no reason to doubt” the companies’ denials of Bloomberg Businessweek’s reporting.

People familiar with the federal investigation into the 2014-2015 attacks say that it is being led by the FBI’s cyber and counterintelligence teams, and that DHS may not have been involved. Counterintelligence investigations are among the FBI’s most closely held and few officials and agencies outside of those units are briefed on the existence of those investigations.

Appleboum said that he’s consulted with intelligence agencies outside the U.S. that have told him they’ve been tracking the manipulation of Supermicro hardware, and the hardware of other companies, for some time.
….
Hardware manipulation is extremely difficult to detect, which is why intelligence agencies invest billions of dollars in such sabotage. The U.S. is known to have extensive programs to seed technology heading to foreign countries with spy implants, based on revelations from former CIA employee Edward Snowden. But China appears to be aggressively deploying its own versions, which take advantage of the grip the country has over global technology manufacturing.

Three security experts who have analyzed foreign hardware implants for the U.S. Department of Defense confirmed that the way Sepio’s software detected the implant is sound. One of the few ways to identify suspicious hardware is by looking at the lowest levels of network traffic. Those include not only normal network transmissions, but also analog signals — such as power consumption — that can indicate the presence of a covert piece of hardware.

In the case of the telecommunications company, Sepio’s technology detected that the tampered Supermicro server actually appeared on the network as two devices in one. The legitimate server was communicating one way, and the implant another, but all the traffic appeared to be coming from the same trusted server, which allowed it to pass through security filters.

In other words – by passing the firewall

Appleboum said one key sign of the implant is that the manipulated Ethernet connector has metal sides instead of the usual plastic ones. The metal is necessary to diffuse heat from the chip hidden inside, which acts like a mini computer. “The module looks really innocent, high quality and ‘original’ but it was added as part of a supply chain attack,” he said.

The goal of hardware implants is to establish a covert staging area within sensitive networks, and that’s what Appleboum and his team concluded in this case. They decided it represented a serious security breach, along with multiple rogue electronics also detected on the network, and alerted the client’s security team in August, which then removed them for analysis. Once the implant was identified and the server removed, Sepio’s team was not able to perform further analysis on the chip.

The threat from hardware implants “is very real,” said Sean Kanuck, who until 2016 was the top cyber official inside the Office of the Director of National Intelligence. He’s now director of future conflict and cyber security for the International Institute for Strategic Studies in Washington. Hardware implants can give attackers power that software attacks don’t.

“Manufacturers that overlook this concern are ignoring a potentially serious problem,” Kanuck said. “Capable cyber actors — like the Chinese intelligence and security services — can access the IT supply chain at multiple points to create advanced and persistent subversions.”

One of the keys to any successful hardware attack is altering components that have an ample power supply to them, a daunting challenge the deeper into a motherboard you go. That’s why peripherals such as keyboards and mice are also perennial favorites for intelligence agencies to target, Appleboum said.

In the wake of Bloomberg’s reporting on the attack against Supermicro products, security experts say that teams around the world, from large banks and cloud computing providers to small research labs and startups, are analyzing their servers and other hardware for modifications, a stark change from normal practices. Their findings won’t necessarily be made public, since hardware manipulation is typically designed to access government and corporate secrets, rather than consumer data.

National security experts say a key problem is that, in a cybersecurity industry approaching $100 billion in revenue annually, very little of that has been spent on inspecting hardware for tampering. That’s allowed intelligence agencies around the world to work relatively unimpeded, with China holding a key advantage.

“For China, these efforts are all-encompassing,” said Tony Lawrence, CEO of VOR Technology, a Columbia, Maryland-based contractor to the intelligence community. “There is no way for us to identify the gravity or the size of these exploits — we don’t know until we find some. It could be all over the place — it could be anything coming out of China. The unknown is what gets you and that’s where we are now. We don’t know the level of exploits within our own systems.”

Trump’s axing of cyber czar role has left gaping holes in US defence

Damning report shows Uncle Sam falling behind

Quote

Is this stupid or deliberate? I mean, more lax security makes it easier for others to hack and influence US opinion and elections.

A cybersecurity czar has been a long-established presence in US government – until recently. Against a rising tide of attacks on the nation’s infrastructure and election systems, Donald Trump eliminated the post through an executive order in May.

As if to highlight the deficiency of such a move, just two months later the US Government Accountability Office (GAO) told politicians that Uncle Sam had failed to implement 1,000 cyber protection recommendations from a list of 3,000 made since 2010 that it said are “urgent to protect the nation”. Further, 31 out of a total of 35 more recent priority recommendations were also not acted upon. That testimony was released in a report (PDF) this month.

In the infosec arms race, this does not make comfortable reading, particularly since the US cybersecurity coordinator post has been axed.

Despite progress in some areas such as identifying (if not yet filling) gaps in cybersecurity skills, the GAO reckoned that the security holes have left federal agencies’ information and systems “increasingly susceptible to the multitude of cyber-related threats”.

It told the Office of the President, the US Congress and federal agencies of all stripes to shape up and take cybersecurity seriously.

These omissions include having a more comprehensive cybersecurity strategy, better oversight, maintaining a qualified cybersecurity workforce, addressing security weaknesses in federal systems and information and enhancement of incident response efforts.

Nick Marinos, director of cybersecurity and data protection issues, and Gregory C Wilshusen, director of information security issues, signed off September’s report with a stark warning:

Until our recommendations are addressed and actions are taken to address the challenges we identified, the federal government, the national critical infrastructure, and the personal information of US citizens will be increasingly susceptible to the multitude of cyber-related threats that exist.

The risks to IT systems supporting the federal government and the nation’s critical infrastructure are increasing as security threats continue to evolve and become more sophisticated. These risks include insider threats from witting or unwitting employees, escalating and emerging threats from around the globe, steady advances in the sophistication of attack technology, and the emergence of new and more destructive attacks.

The GAO also blasted the IT sector for compounding these risks: “IT systems are often riddled with security vulnerabilities – both known and unknown.”

The report said in 2017 more than 35,000 cybersecurity incidents at civilian agencies had been reported by the Office of Management and Budget to Congress. A breakdown of these figures revealed that 31 per cent of these attacks were listed as “other”, saying: “If an agency cannot identify the threat vector (or avenue of attack), it could be difficult for that agency to define more specific handling procedures to respond to the incident and take actions to minimize similar future attacks.”

Other incidences listed were improper usage (22 per cent), email/phishing (21 per cent), loss or theft of equipment (12 per cent), web site or web app origin based attacks (11 per cent).

Attacks cited include a March 2018 threat when the Mayor of Atlanta, Georgia, reported that the city was being victimised by a ransomware attack.

In March the Department of Justice indicted nine Iranians for conducting a “massive cyber security theft campaign” on behalf of the Islamic Revolutionary Guard Corps. That indictment alleged they stole more than 31TB of documents and data from more than 140 American universities, 30 US companies, and five federal government agencies.

The Russians were also called out for targeting critical systems in nuclear, energy, water and aviation.

But, of course, Trump is a little confused when it comes to Russia’s cyber-dabbling in the US.

You can argue the US government fell behind under the watch of the cyber czar and that action was needed, but that hardly necessitated the elimination of this central post.

The GAO testimony and this month’s report rightly questions whether the US was doing enough to protect its citizens and critical infrastructure. The answer seemed to be a “must try harder” – but that’s OK, because improvement can only come through such transparency and self-assessment.

Trump’s May decision and this report taken together suggest that if the West was already slipping behind in the cyber war, things can only get worse now that the supposed leader of the free world has deliberately, and carelessly, taken his eye off the ball on the home front.

Microsoft: The Kremlin’s hackers are already sniffing, probing around America’s 2018 elections

Why wouldn’t it be them?

QUOTE

Microsoft says it has already uncovered evidence of Russian government-backed hacking gangs attempting to interfere in the 2018 US mid-term elections.

“Earlier this year we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks, and we saw metadata that suggested those phishing attacks were being directed at three candidates that were all standing for election this year,” Burt said.

“These are all people who, because of their positions, might be interesting targets from an espionage standpoint as well as an election disruption standpoint.”

Burt declined to name the candidates being targeted, citing Microsoft’s policy of preserving the anonymity of its clients. In the past, Fancy Bear largely focused its efforts on targeting computers belonging to the Democrats and Hillary Clinton’s campaign, and leaking the Dems’ internal emails in the hope of swinging the balance of Congress for the GOP, and the White House race for Donald Trump.
Redmond is a tool for Russia

Microsoft’s services play a prominent role in Fancy Bear’s meddling, Burt said. To help make its phishing pages more believable, the GRU-backed hacking crew often registers domains whose names resemble Microsoft services and then uses those to create fake login or download pages impersonating Redmond’s own. These pages can trick victims into installing malware, or handing over the usernames and passwords for their email inboxes and other sensitive accounts. Additionally, the domains are used for the command and control servers for data-harvesting spyware.

Because of that, Burt explained, Microsoft has made a habit of tracking the group, and using its legal team to have those domains seized and either shut down or handed over to Microsoft’s security team, who then use them to gather information about the inner-workings of the operation.

Burt said that, after two years of tracking the gang, Microsoft has become efficient enough that a new domain can be challenged and seized in as little as 24 to 48 hours. “The goal here is to say stop using Microsoft domain names,” Burt said. “If you keep using them, we are going to make it more costly for you.”

This is also why securing your Microsoft Office 365 accounts with multi-factor authentication is crucial, to help thwart password phishing attempts.

Burt’s comments also come as the US Department of Justice issued a report warning that attacks on the mid-term elections are all but assured. The report notes that the government has created a task force, including multiple agencies and states attorney generals, that will focus on detecting and prosecuting attempts to affect the outcome of the mid-term vote.

Whois is dead as Europe hands DNS overlord ICANN its arse

Quote

In a letter [PDF] sent this week to DNS overseer ICANN, Europe’s data protection authorities have effectively killed off the current service, noting that it breaks the law and so will be illegal come 25 May, when GDPR comes into force.

The letter also has harsh words for ICANN’s proposed interim solution, criticizing its vagueness and noting it needs to include explicit wording about what can be done with registrant data, as well as introduce auditing and compliance functions to make sure the data isn’t being abused.

ICANN now has a little over a month to come up with a replacement to the decades-old service that covers millions of domain names and lists the personal contact details of domain registrants, including their name, email and telephone number.

AT&T/Verizon lobbyists to “aggressively” sue states that enact net neutrality

Quote

The dangers of oligopolies. More than anything else the internet needs is trust busters.

A lobby group that represents AT&T, Verizon, and other telcos plans to sue states and cities that try to enforce net neutrality rules.

USTelecom, the lobby group, made its intentions clear yesterday in a blog post titled, “All Americans Deserve Equal Rights Online.”

Yeah – All Americans == all their fellow oligopolists

“Broadband providers have worked hard over the past 20 years to deploy ever more sophisticated, faster and higher-capacity networks, and uphold net neutrality protections for all,” USTelecom CEO Jonathan Spalter wrote. “To continue this important work, there is no question we will aggressively challenge state or municipal attempts to fracture the federal regulatory structure that made all this progress possible.”

The USTelecom board of directors includes AT&T, Verizon, Frontier, CenturyLink, Windstream, and other telcos. The group’s membership “ranges from the nation’s largest telecom companies to small rural cooperatives.”

Washington state: Comcast was “even more deceptive” than we thought

Quote

The attorney general of Washington has filed a new amended complaint in an ongoing lawsuit against Comcast, claiming that “new evidence” reveals “even more deceptive conduct than previously alleged.”

The lawsuit, which was initially submitted in August 2016, alleged that hundreds of thousands of Washington residents were “deceived” into paying “at least $73 million in subscription fees over the last five years for a near-worthless ‘protection plan.’”

According to the amended complaint, which was filed in King County Superior Court on Thursday, newly obtained recorded calls between Comcast and its Washington customers who subscribed to its “Service Protection Plan” show “that Comcast may have signed up more than half of all SPP subscribers without their consent. Comcast deceived consumers even when mentioning the SPP, telling them the SPP plan was ‘free’ when they signed up, when in fact, Comcast would automatically charge them every month after the first month.”

This what happens in monopolies and oligopolies. Unfortunately, senior executives will never go to jail and business will be as usual. That is because of the very corrupt lobbyist ridden culture in the states and in Washington. Is it time for citizens to deliver justice to those guilty directly? Perhaps. But that assumes they will involved and get organized to form the type of organizations capable of effecting real change. Given the fact the civic understanding and participation is poor in the U.S., I doubt things will change. But enough is enough, to is time to get involved.

Google Chrome vows to carpet bomb meddling Windows antivirus tools

Quote

Browser will block third-party software from mucking around with pages next year.

By mid-2018 Google Chrome will no longer allow outside applications – cough, cough, antivirus packages – to run code within the browser on Windows.

“In the past, this software needed to inject code in Chrome in order to function properly; unfortunately, users with software that injects code into Windows Chrome are 15 per cent more likely to experience crashes.”

In particular, the target here seems to be poorly coded AV tools can not only crash the browser or cause slowdowns, but also introduce security vulnerabilities of their own for hackers to exploit.

Rather than accept injected code, Chrome will require applications to use either Native Messaging API calls or Chrome extensions to add functionality to the browser. Google believes both methods can be used to retain features without having to risk browser crashes. With Chrome 68, the browser will block third-party code in all cases except when the blocking itself would cause a crash. In that case, Chrome will reload, allow the code to run, and then give the user a warning that the third-party software will need to be removed for Chrome to run properly. The warning will be removed and nearly all code injection will be disabled in January of 2019.

“While most software that injects code into Chrome will be affected by these changes, there are some exceptions,” said Hamilton.

“Microsoft-signed code, accessibility software, and IME software will not be affected.”

Small Business Should Be Worried about Net Neutrality Rollback Efforts

Quote

David Callicott needs to be online to run his small company, GoodLight Natural Candles in San Francisco.

Dozens of orders from wholesale customers like Whole Foods and Bed Bath & Beyond are relayed online each day to fulfillment warehouses, which send out Mr. Callicott’s paraffin-free candles. The GoodLight website accounts for 15 percent of its sales, which could reach $1.5 million this year; the e-commerce behemoth Amazon makes up another 10 percent. And many of the company’s business documents are stored in cloud-based data centers.

Without those regulations, GoodLight and other smaller businesses fear they may not have a level digital playing field to compete against deep-pocketed industry giants that could pay to get an edge online.

“For such an analog product, we’re heavily reliant on the digital world and the internet for our day-to-day operations,” said Mr. Callicott, who helped found the company nearly eight years ago and now works with three other full-time employees. “The internet, the speed of it, our entire business revolves around that.”


A good Video on What is Net Neutrality



For small businesses, a rollback could fundamentally change how, and whether, they do business. Many started online or turned to e-commerce to expand their thin margins.

“Things are already difficult enough as it is for a small businesses,” Mr. Callicott said. “You’re busy enough just keeping your company running, trying to grow and succeed or just stay alive, that you don’t have the resources or the time to contemplate how to prepare for something like this.”

In the United States, 99.7 percent of all businesses have fewer than 500 employees, according to government statistics. Of those, nearly 80 percent, or more than 23 million enterprises, are one-person operations.

In August, the American Sustainable Business Council and other small business groups published an open letter to the F.C.C. on behalf of more than 500 small businesses in the country. Weakening or undoing net neutrality protections would be “disastrous” for American businesses, according to the letter.

“The open internet has made it possible for us to rely on a free market where each of us has the chance to bring our best business ideas to the world without interference or seeking permission from any gatekeeper first,” the groups wrote.

Many entrepreneurs worried that, without net neutrality provisions, internet providers would wield their increased power to control how businesses reach consumers.

Online consumers are a demanding crowd. Research from a Google subsidiary suggested that visitors who have to wait more than 3 seconds for a mobile site to load will abandon their search 53 percent of the time.

Changes in net neutrality regulations could also affect the freelancers, franchisees and temporary workers who earn a living doing piecemeal work in the so-called gig economy. Nearly a quarter of American adults made money last year using digital platforms to take on a job or a task, selling something online or renting out their properties using a home-sharing site like Airbnb, according to the Pew Research Center.

A pay-for-play internet system could also be problematic for Codecademy, an education company founded in 2011. Its services include courses on tech-related subjects like data analysis, website design and coding language — all conducted online.

But Zach Sims, the company’s chief executive, said that students, many of whom are aspiring entrepreneurs, would suffer most.

“They’ll perceive it as an unfair playing field,” he said. “As every industry is upended by tech, the barrier to entry is knowing what technology is and how to implement it, but this adds another level of confusion, making the hurdle even higher for normal businesses to participate.”

Why the Courts Will Have to Save Net Neutrality

Here is what started net neutrality

Back in 2005, a small phone company based in North Carolina named Madison River began preventing its subscribers from making phone calls using the internet application Vonage. As Vonage was a competitor in the phone call market, Madison River’s action was obviously anticompetitive. Consumers complained, and the Federal Communications Commission, under Michael Powell, its Republican-appointed chairman, promptly fined the company and forced it to stop blocking Vonage.

But it may be tough?

On Tuesday, the F.C.C. chairman, Ajit Pai, announced plans to eliminate even the most basic net neutrality protections — including the ban on blocking — replacing them with a “transparency” regime enforced by the Federal Trade Commission. “Transparency,” of course, is a euphemism for “doing nothing.” Companies like Madison River, it seems, will soon be able to block internet calls so long as they disclose the blocking (presumably in fine print). Indeed, a broadband carrier like AT&T, if it wanted, might even practice internet censorship akin to that of the Chinese state, blocking its critics and promoting its own agenda.

Allowing such censorship is anathema to the internet’s (and America’s) founding spirit. And by going this far, the F.C.C. may also have overplayed its legal hand. So drastic is the reversal of policy (if, as expected, the commission approves Mr. Pai’s proposal next month), and so weak is the evidence to support the change, that it seems destined to be struck down in court.

The problem for Mr. Pai is that government agencies are not free to abruptly reverse longstanding rules on which many have relied without a good reason, such as a change in factual circumstances. A mere change in F.C.C. ideology isn’t enough. As the Supreme Court has said, a federal agency must “examine the relevant data and articulate a satisfactory explanation for its action.” Given that net neutrality rules have been a huge success by most measures, the justification for killing them would have to be very strong.

It isn’t. In fact, it’s very weak. From what we know so far, Mr. Pai’s rationale for eliminating the rules is that cable and phone companies, despite years of healthy profit, need to earn even more money than they already do — that is, that the current rates of return do not yield adequate investment incentives. More specifically, Mr. Pai claims that industry investments have gone down since 2015, the year the Obama administration last strengthened the net neutrality rules.

Setting aside whether industry investments should be the dominant measure of success in internet policy (what about improved access for students? or the emergence of innovations like streaming TV?), Mr. Pai is not examining the facts: Security and Exchange Commission filings reveal an increase in internet investments since 2015, as the internet advocacy group Free Press has demonstrated.

Moreover, the F.C.C. is acting contrary to public sentiment, which may embolden the judiciary to oppose Mr. Pai. Telecommunications policy does not always attract public attention, but net neutrality does, and polls indicate that 76 percent of Americans support it. The F.C.C., in short, is on the wrong side of the democratic majority.

But Mr. Pai faces a more serious legal problem. Because he is killing net neutrality outright, not merely weakening it, he will have to explain to a court not just the shift from 2015 but also his reasoning for destroying the basic bans on blocking and throttling, which have been in effect since 2005 and have been relied on extensively by the entire internet ecosystem.

This will be a difficult task. What has changed since 2004 that now makes the blocking or throttling of competitors not a problem? The evidence points strongly in the opposite direction: There is a long history of anticompetitive throttling and blocking — often concealed — that the F.C.C. has had to stop to preserve the health of the internet economy. Examples include AT&T’s efforts to keep Skype off iPhones and the blocking of Google Wallet by Verizon. Services like Skype and Netflix would have met an early death without basic net neutrality protections. Mr. Pai needs to explain why we no longer have to worry about this sort of threat — and “You can trust your cable company” will not suffice.

Moreover, the F.C.C. is acting contrary to public sentiment, which may embolden the judiciary to oppose Mr. Pai. Telecommunications policy does not always attract public attention, but net neutrality does, and polls indicate that 76 percent of Americans support it. The F.C.C., in short, is on the wrong side of the democratic majority.

In our times, the judiciary has increasingly become a majoritarian force. It alone, it seems, can prevent narrow, self-interested factions from getting the government to serve unseemly and even shameful ends. And so it falls to the judiciary to stop this latest travesty.

Source: This article is by Tim Wu is a law professor at Columbia, the author of “The Attention Merchants: The Epic Struggle to Get Inside Our Heads” and a contributing opinion writer. Published in NYT today Here