The End Of Ownership: How Big Companies Are Trying To Turn Everyone Into Renters

We’ve talked a lot on Techdirt about the end of ownership, and how companies have increasingly been reaching deep into products that you thought you bought to modify them… or even destroy them. Much of this originated in the copyright space, in which modern copyright law (somewhat ridiculously) gave the power to copyright holders to break products that people had “bought.” Of course, the legacy copyright players like to conveniently change their language on whether or not you’re buying something or simply “licensing” it temporarily based on what’s most convenient (i.e., what makes them the most money) at the time.

Over at the Nation, Maria Bustillos, recently wrote about how legacy companies — especially in the publishing world — are trying to take away the concept of book ownership and only let people rent books. A little over a year ago, picking up an idea first highlighted by law professor Brian Frye, we highlighted how much copyright holders want to be landlords. They don’t want to sell products to you. They want to retain an excessive level of control and power over it — and to make you keep paying for stuff you thought you bought. They want those monopoly rents.

As Bustillos points out, the copyright holders are making things disappear, including “ownership.”

Maybe you’ve noticed how things keep disappearing—or stop working—when you “buy” them online from big platforms like Netflix and Amazon, Microsoft and Apple. You can watch their movies and use their software and read their books—but only until they decide to pull the plug. You don’t actually own these things—you can only rent them. But the titanic amount of cultural information available at any given moment makes it very easy to let that detail slide. We just move on to the next thing, and the next, without realizing that we don’t—and, increasingly, can’t—own our media for keeps.

And while most of the focus on this space has been around music and movies, it’s happening to books as well:

Unfortunately, today’s mega-publishers and book distributors have glommed on to the notion of “expiring” media, and they would like to normalize that temporary, YouTube-style notion of a “library.” That’s why, last summer, four of the world’s largest publishers sued the Internet Archive over its National Emergency Library, a temporary program of the Internet Archive’s Open Library intended to make books available to the millions of students in quarantine during the pandemic. Even though the Internet Archive closed the National Emergency Library in response to the lawsuit, the publishers refused to stand down; what their lawsuit really seeks is the closing of the whole Open Library, and the destruction of its contents. (The suit is ongoing and is expected to resume later this year.) A close reading of the lawsuit indicates that what these publishers are looking to achieve is an end to the private ownership of books—not only for the Internet Archive but for everyone.

[…]

The big publishers and other large copyright holders always insist that they’re “protecting artists.” That’s almost never the case. They regularly destroy and suppress creativity and art with their abuse of copyright law. Culture shouldn’t have to be rented, especially when the landlords don’t care one bit about the underlying art or cultural impact.

Source: The End Of Ownership: How Big Companies Are Trying To Turn Everyone Into Renters | Techdirt

Boffins propose Pretty Good Phone Privacy to end pretty invasive location data harvesting by telcos

[…] In “Pretty Good Phone Privacy,” [PDF] a paper scheduled to be presented on Thursday at the Usenix Security Symposium, Schmitt and Barath Raghavan, assistant professor of computer science at the University of Southern California, describe a way to re-engineer the mobile network software stack so that it doesn’t betray the location of mobile network customers.

“It’s always been thought that since cell towers need to talk to phones then all users have to accept the status quo in which mobile operators track our every movement and sell the data to data brokers (as has been extensively reported),” said Schmitt. “We show how it’s possible to protect users’ mobile privacy while at the same time providing normal connectivity, and to do so without changing any of the hardware in mobile networks.”

In recent years, mobile carriers have been routinely selling and leaking location data, to the detriment of customer privacy. Efforts to alter the status quo have been hampered by an uneven regulatory landscape, the resistance of data brokers that profit from the status quo, and the assumption that cellular network architecture requires knowing where customers are located.

[…]

The purpose of Pretty Good Phone Privacy (PGPP) is to avoid using a unique identifier for authenticating customers and granting access to the network. It’s a technology that allows a Mobile Virtual Network Operator (MVNO) to issue SIM cards with identical SUPIs for every subscriber because the SUPI is only used to assess the validity of the SIM card. The PGPP network can then assign an IP address and a GUTI (Globally Unique Temporary Identifier) that can change in subsequent sessions, without telling the MVNO where the customer is located.

“We decouple network connectivity from authentication and billing, which allows the carrier to run Next Generation Core (NGC) services that are unaware of the identity or location of their users but while still authenticating them for network use,” the paper explains. “Our architectural change allows us to nullify the value of the user’s SUPI, an often targeted identifier in the cellular ecosystem, as a unique identifier.”

[…]

Its primary focus is defending against the surreptitious sale of location data by network providers.

[…]

Schmitt argues PGPP will help mobile operators comply with current and emerging data privacy regulations in US states like California, Colorado, and Virginia, and post-GDPR rules in Europe

Source: Boffins propose Pretty Good Phone Privacy to end pretty invasive location data harvesting by telcos • The Register

Hackers return around half of stolen $600 million in Poly Network hack

Hackers have returned nearly half of the $600 million they stole in what’s likely to be one of the biggest cryptocurrency thefts ever.

The cybercriminals exploited a vulnerability in Poly Network, a platform that looks to connect different blockchains so that they can work together.

Poly Network disclosed the attack Tuesday and asked to establish communication with the hackers, urging them to “return the hacked assets.”

[…]

In a strange turn of events Wednesday, the hackers began returning some of the funds they stole.

They sent a message to Poly Network embedded in a cryptocurrency transaction saying they were “ready to return” the funds. The DeFi platform responded requesting the money be sent to three crypto addresses.

As of 7 a.m. London time, more than $4.8 million had been returned to the Poly Network addresses. By 11 a.m. ET, about $258 million had been sent back.

[…]

Source: Cryptocurrency theft: Hackers steal $600 million in Poly Network hack

Apple App Store, Google Play Store Targeted by Open App Markets Act

The Open App Markets Act, which is being spearheaded by Sens. Richard Blumenthal, and Marsha Blackburn, is designed to crack down on some of the scummiest tactics tech players use to rule their respective app ecosystems, while giving users the power to download the apps they want, from the app stores they want, without retaliation.

“For years, Apple and Google have squashed competitors and kept consumers in the dark—pocketing hefty windfalls while acting as supposedly benevolent gatekeepers of this multibillion-dollar market,” Blumenthal told the Wall Street Journal. As he put it, this bill is tailor-made to “break these tech giants’ ironclad grip open the app economy to new competitors and give mobile users more control over their own devices.”

The antitrust issues facing both of these companies—along with fellow tech giants like Facebook and Amazon—have come to a boiling point on Capitol Hill over the past year. We’ve seen lawmakers roll out bill after bill meant to target some of the most lucrative monopolies these companies hold: Amazon’s marketplace, Facebook’s collection of platforms, and, of course, Apple and Google’s respective app stores. Last month, three dozen state attorneys general levied a fresh antitrust suit against Google for the Play Store fees forced on app developers. Meanwhile, Apple is still in a heated legal battle with Epic Games over its own mandated commissions, which can take up to 30% from every in-app purchase users make.

Blumenthal and Blackburn target these fees specifically. The bill would prohibit app stores from requiring that developers use their payment systems, for example. It would also prevent app stores from retaliating against developers who try to implement payment systems of their own, which is the exact scenario that got Epic booted from the App Store last summer.

On top of this, the bill would require that devices allow app sideloading by default. Google’s allowed this practice for a while, but this month started taking steps to narrow the publishing formats developers could use. Apple hardware, meanwhile, has never been sideload-friendly—a choice that’s meant to uphold the “privacy initiatives” baked into the App Store, according to Apple CEO Tim Cook.

Here are some other practices outlawed by the Open App Markets Act: Apple, Google, or any other app store owner would be barred from using a developer’s proprietary app intel to develop their own competing product. They’d also be barred from applying ranking algorithms that rank their own apps over those of their competitors. Users, meanwhile, would (finally) need to be given choices of the app store they can use on their device, instead of being pigeonholed into Apple’s App Store or Google’s Play Store.

Like all bills, this new legislation still needs to go through the regulatory churn before it has any hope of passing, and it might look like a very different set of rules by the time it finally does. But at this point, antitrust action is going to come for these companies whether they like it or not.

Source: Apple App Store, Google Play Store Targeted by Open App Markets Act

I have been talking about this since early in 2019 and it’s great to see all the action around this

Amazon Drops Policy claiming ownership of Games made by employees After Work Hours

Amazon.com Inc. withdrew a set of staff guidelines that claimed ownership rights to video games made by employees after work hours and dictated how they could distribute them, according to a company email reviewed by Bloomberg.

[…]

The old policies mandated that employees of the games division who were moonlighting on projects would need to use Amazon products, such as Amazon Web Services, and sell their games on Amazon digital stores. It also gave the company “a royalty free, worldwide, fully paid-up, perpetual, transferable license” to intellectual property rights of any games developed by its employees.

[…]

The games division has struggled practically since its inception in 2012 and can hardly afford another reputational hit. It has never released a successful game, and some current and former employees have placed the blame with Frazzini. Bloomberg reported in January that Frazzini had hired veteran game developers and executives but largely dismissed or ignored their advice.

Source: Amazon Drops ‘Draconian’ Policy on Making Games After Work Hours – Bloomberg

So tbh if they can’t make games during work hours, what difference is it that their incompentence after work hours can’t be sold outside of Amazon. Or are the employees ripping the Amazon Games division off?

China stops networked vehicle data going offshore under new infosec rules

China has drafted new rules required of its autonomous and networked vehicle builders.

Data security is front and centre in the rules, with manufacturers required to store data generated by cars – and describing their drivers – within China. Data is allowed to go offshore, but only after government scrutiny.

Manufacturers are also required to name a chief of network security, who gets the job of ensuring autonomous vehicles can’t fall victim to cyber attacks. Made-in-China auto-autos are also required to be monitored to detect security issues.

Over-the-air upgrades are another requirement, with vehicle owners to be offered verbose information about the purpose of software updates, the time required to install them, and the status of upgrades.

Behind the wheel, drivers must be informed about the vehicle’s capabilities and the responsibilities that rest on their human shoulders. All autonomous vehicles will be required to detect when a driver’s hands leave the wheel, and to detect when it’s best to cede control to a human.

If an autonomous vehicle’s guidance systems fail, it must be able to hand back control.

[…]

Source: China stops networked vehicle data going offshore under new infosec rules • The Register

And again China is doing what the EU and US should be doing to a certain extent.

Have you made sure you have changed these Google Pay privacy settings?

Google Pay is an online paying system and digital wallet that makes it easy to buy anything on your mobile device or with your mobile device. But if you’re concerned about what Google is doing with all your data (which you probably should be), Google doesn’t make it easy for Google Pay has some secret settings to manage your settings.

 

A report from Bleeping Computer shows that privacy settings aren’t available through the main Google Pay setting page that is accessible through the navigation sidebar.

The URL for that settings page is:

https://pay.google.com/payments/u/0/home#settings

 

On that page, users can change general settings like address and payment users.

But if users want to change privacy settings, they have to go to a separate page:

https://pay.google.com/payments/u/0/home?page=privacySettings#privacySettings

 

On that screen, users can adjust all the same settings available on the other settings page, but they can also address three additional privacy settings—controlling whether Google Pay is allowed to share account information, personal information, and creditworthiness.

Here’s the full language of those three options:

-Allow Google Payment Corporation to share third party creditworthiness information about you with other companies owned and controlled by Google LLC for their everyday business purposes.

-Allow your personal information to be used by other companies owned and controlled by Google LLC to market to you. Opting out here does not impact whether other companies owned and controlled by Google LLC can market to you based on information you provide to them outside of Google Payment Corporation.

-Allow Google LLC or its affiliates to inform a third party merchant, whose site or app you visit, whether you have a Google Payments account that can be used for payment to that merchant. Opting out may impact your ability to use Google Payments to transact with certain third party merchants.

 

According to Bleeping Computer, the default of Google Pay is to enable all the above settings. In order to opt out, users have to go to the special URL that is not accessible through the navigation bar.

As the Reddit post that inspired the Bleeping Computer report claims, this discrepancy makes it appear that Google Pay is hiding its privacy options. “Google is not walking the talk when it claims to make it easy for their users to control the privacy and use of their own data,” the Redditor surmised.

A Google spokesperson told Gizmodo they’re working to make the privacy settings more accessible. “The different settings views described here are an issue resulting from a previous software update and we are working to fix this right away so that these privacy settings are always visible on pay.google.com,” the spokesperson told Gizmodo.

“All users are currently able to access these privacy settings via the ‘Google Payments privacy settings page’ link in the Google Pay privacy notice.”

In the meantime, here’s that link again for the privacy settings. Go ahead and uncheck those three boxes, if you feel so inclined.

Source: How To Find Google Pay’s Hidden Privacy Settings

Here’s hoping that my bank can set up it’s own version of Google Pay instead of integrating with it. I definitely don’t want Google or Apple getting their grubby little paws on my financial data.

create virtual cards to pay with online with Privacy

Protect your card details and your money by creating virtual cards at each place you spend online, or for each purchase

Create single-use cards that close themselves automatically

browser extension to create and auto-fill card numbers at checkout

Privacy Cards put the control in your hands when you make a purchase online. Business or personal, one-time or subscription, now you decide who can charge your card, how much, how often, and you can close a card any time

Source: Privacy – Smarter Payments

Post-implementation review of the repeal of section 52 of the CDPA 1988 and associated amendments – Call for views – GOV.UK

The Copyright, Designs and Patents Act 1988 (CDPA) sets the term of protection for works protected copyright. For artistic works, the term of protection is life of the author plus 70 years. For more information on the term of copyright, see our Copyright Notice: Duration of copyright (term) on this subject. Section 52 CDPA previously reduced the term of copyright for industrially manufactured artistic works to 25 years.

In 2011, a judgment was made by the Court of Justice of the European Union (CJEU) in relation to copyright for design works. The government concluded that section 52 CDPA should be repealed to provide equal protection for all types of artistic work. This repeal was included in the Enterprise and Regulatory Reform Act 2013. The main copyright works affected were works of artistic craftsmanship. The primary types of work believed to be in scope were furniture, jewellery, ceramics, lighting and other homewares. This would be both the 3D manufacture and retail and the 2D representation in publishing.

[…]

The Copyright (Amendment) Regulations 2016 came into force on 6 April 2017. They amended Schedule 1 CDPA to allow works made before 1957 to attract copyright protection, whatever their separate design status. They also removed a compulsory licensing provision for works with revived copyright from the Duration of Copyright and Rights in Performances Regulations 1995 (1995 Regulations). Existing compulsory licences which had agreed a royalty or remuneration with the rights holder could continue. The relevant documents can be found in the Changes to Schedule 1 CDPA and duration of Copyright Regulations consultation.

[…]

Source: Post-implementation review of the repeal of section 52 of the CDPA 1988 and associated amendments – Call for views – GOV.UK

So if you are interested in copyright in the UK, make sure you fill in the questions at the bottom of the link and email them!

AI algorithms uncannily good at spotting your race from medical scans

Neural networks can correctly guess a person’s race just by looking at their bodily x-rays and researchers have no idea how it can tell.

There are biological features that can give clues to a person’s ethnicity, like the colour of their eyes or skin. But beneath all that, it’s difficult for humans to tell. That’s not the case for AI algorithms, according to a study that’s not yet been peer reviewed.

A team of researchers trained five different models on x-rays of different parts of the body, including chest and hands and then labelled each image according to the patient’s race. The machine learning systems were then tested on how well they could predict someone’s race given just their medical scans.

They were surprisingly accurate. The worst performing was able to predict the right answer 80 per cent of the time, and the best was able to do this 99 per cent, according to the paper.

“We demonstrate that medical AI systems can easily learn to recognise racial identity in medical images, and that this capability is extremely difficult to isolate or mitigate,” the team warns [PDF].

“We strongly recommend that all developers, regulators, and users who are involved with medical image analysis consider the use of deep learning models with extreme caution. In the setting of x-ray and CT imaging data, patient racial identity is readily learnable from the image data alone, generalises to new settings, and may provide a direct mechanism to perpetuate or even worsen the racial disparities that exist in current medical practice.”

Source: AI algorithms uncannily good at spotting your race from medical scans, boffins warn • The Register

Chinese scientists develop world’s strongest glass that’s harder than diamond

Scientists in China have developed the hardest and strongest glassy material known so far that can scratch diamond crystals with ease.

The researchers, including those from Yanshan University in China, noted that the new material – tentatively named AM-III – has “outstanding” mechanical and electronic properties, and could find applications in solar cells due to its “ultra-high” strength and wear resistance.

Analysis of the material, published in the journal National Science Review, revealed that its hardness reached 113 gigapascals (GPa) while natural diamond stone usually scores 50 to 70 on the same test.

[…]

Using fullerenes, which are materials made of hollow football-like arrangements of carbon atoms, the researchers produced different types of glassy materials with varying molecular organisation among which AM-III had the highest order of atoms and molecules.

To achieve this order of molecules, the scientists crushed and blended the fullerenes together, gradually applying intense heat and pressure of about 25 GPa and 1,200 degrees Celsius in an experimental chamber for about 12 hours, spending an equal amount of time cooling the material.

[…]

 

Source: Chinese scientists develop world’s strongest glass that’s as hard as diamond | The Independent

Ancestry.com Gave Itself the Rights to Your Family Photos

The Blackstone-owned genealogy giant Ancestry.com raised a ton of red flags earlier this month with an update to its terms and conditions that give the company a bit more power over your family photos. From here on out, the August 3 update reads, Ancestry can use these pics for any reason, at any time, forever.

[…]

By submitting User Provided Content through any of the Services, you grant Ancestry a perpetual, sublicensable, worldwide, non-revocable, royalty-free license to host, store, copy, publish, distribute, provide access to, create derivative works of, and otherwise use such User Provided Content to the extent and in the form or context we deem appropriate on or through any media or medium and with any technology or devices now known or hereafter developed or discovered. This includes the right for Ancestry to copy, display, and index your User Provided Content. Ancestry will own the indexes it creates.

[…]

The company also noted that it added a helpful clause to clarify that, yes, deleting your documents from Ancestry’s site would also remove any rights Ancestry holds over them. But there’s a catch: if any other Ancestry users copied or saved your content, then Ancestry still holds those rights until these other users delete your documents, too.

[…]

Source: Ancestry.com Gave Itself the Rights to Your Family Photos

Cross-Chain DeFi Site Poly Network Hacked; Hundreds of Millions Potentially Lost

Cross-chain decentralized finance (DeFi) platform Poly Network was attacked on Tuesday, with the alleged hacker draining roughly $600 million in crypto.

Poly Network, a protocol launched by the founder of Chinese blockchain project Neo, operates on the Binance Smart Chain, Ethereum and Polygon blockchains. Tuesday’s attack struck each chain consecutively, with the Poly team identifying three addresses where stolen assets were transferred.

At the time that Poly tweeted news of the attack, the three addresses collectively held more than $600 million in different cryptocurrencies, including USDC, wrapped bitcoin (WBTC, -1.45%), wrapped ether (ETH, -0.7%) and shiba inu (SHIB), blockchain scanning platforms show.

[…]

About one hour after Poly announced the hack on Twitter, the hacker tried to move assets including USDT through the Ethereum address into liquidity pool Curve.fi, records show. The transaction was rejected.

Meanwhile, close to $100 million has been moved out of the Binance Smart Chain address in the past 30 minutes and deposited into liquidity pool Ellipsis Finance.

[…]

BlockSec, a China-based blockchain security firm, said in an initial attack analysis report that the hack may be triggered by the leak of a private key that was used to sign the cross-chain message.

But it also added that another possible reason is a potential bug during Poly’s singing process that may have been “abused” to sign the message.

According to another China-based blockchain security firm, Slowmist, the attackers’ original funds were in monero (XMR, -2.9%), a privacy-centric cryptocurrency, and were then exchanged for BNB, ETH, MATIC (+0.86%) and a few other tokens.

The attackers then initiated the attacks on Ethereum, BSC and Polygon blockchains. The finding was supported by Slowmist’s partners, including China-based exchange Hoo.

“Based on the flows of the funds and multiple fingerprint information, it is likely a long-planned, organized, and well-prepared attack,” Slowmist wrote.

[…]

The Poly Network incident shows how nascent cross-chain protocols are particularly vulnerable to attacks. In July, cross-chain liquidity protocol Thorchain suffered two exploits in two weeks. Rari Capital, another cross-chain DeFi protocol, was hit by an attack in May, losing funds worth nearly $11 million in ETH.

[…]

Source: Cross-Chain DeFi Site Poly Network Hacked; Hundreds of Millions Potentially Lost – CoinDesk

Oppo’s latest under-screen camera may finally be capable of good photos – I hate the notch!

Until recently, there was only one smartphone on the market equipped with an under-screen camera: last year’s ZTE Axon 20 5G. Other players such as Vivo, Oppo and Xiaomi had also been testing this futuristic tech, but given the subpar image quality back then, it’s no wonder that phone makers largely stuck with punch-hole cameras for selfies.

Despite much criticism of its first under-screen camera, ZTE worked what it claims to be an improved version into its new Axon 30 5G, which launched in China last week. Coincidentally, today Oppo unveiled its third-gen under-screen camera which, based on a sample shot it provided, appears to be surprisingly promising — no noticeable haziness nor glare. But that was just one photo, of course, so I’ll obviously reserve my final judgement until I get to play with one. Even so, the AI tricks and display circuitry that made this possible are intriguing.

Oppo's next-gen under-screen camera
Oppo

In a nutshell, nothing has changed in terms of how the under-screen camera sees through the screen. Its performance is limited by how much light can travel through the gaps between each OLED pixel. Therefore, AI compensation is still a must. For its latest under-screen camera, Oppo says it trained its own AI engine “using tens of thousands of photos” in order to achieve more accurate corrections on diffraction, white balance and HDR. Hence the surprisingly natural-looking sample shot.

Oppo's next-gen under-screen camera
Oppo

Another noteworthy improvement here lies within the display panel’s consistency. The earlier designs chose to lower the pixel density in the area above the camera, in order to let sufficient light into the sensor. This resulted in a noticeable patch above the camera, which would have been a major turn-off when you watched videos or read fine text on that screen.

But now, Oppo — or the display panel maker, which could be Samsung — figured out a way to boost light transmittance by slightly shrinking each pixel’s geometry above the camera. In order words, we get to keep the same 400-ppi pixel density as the rest of the screen, thus creating a more consistent look.

Oppo added that this is further enhanced by a transparent wiring material, as well as a one-to-one pixel-circuit-to-pixel architecture (instead of two-to-one like before) in the screen area above the camera. The latter promises more precise image control and greater sharpness, with the bonus being a 50-percent longer panel lifespan due to better burn-in prevention.

Oppo didn’t say when or if consumers will get to use its next-gen under-screen camera, but given the timing, I wouldn’t be surprised if this turns out to be the same solution on the ZTE Axon 30 5G. In any case, it would be nice if the industry eventually agreed to dump punch-hole cameras in favor of invisible ones.

Source: Oppo’s latest under-screen camera may finally be capable of good photos | Engadget

WhatsApp head says Apple’s child safety update is a ‘surveillance system’

One day after Apple confirmed plans for new software that will allow it to detect images of child abuse on users’ iCloud photos, Facebook’s head of WhatsApp says he is “concerned” by the plans.

In a thread on Twitter, Will Cathcart called it an “Apple built and operated surveillance system that could very easily be used to scan private content for anything they or a government decides it wants to control.” He also raised questions about how such a system may be exploited in China or other countries, or abused by spyware companies.

[…]

Source: WhatsApp head says Apple’s child safety update is a ‘surveillance system’ | Engadget

Pots and kettles – but he’s right though. This is a very serious lapse of privacy for Apple

Hundreds of AI tools have been built to catch covid. None of them helped.

[…]

The AI community, in particular, rushed to develop software that many believed would allow hospitals to diagnose or triage patients faster, bringing much-needed support to the front lines—in theory.

In the end, many hundreds of predictive tools were developed. None of them made a real difference, and some were potentially harmful.

That’s the damning conclusion of multiple studies published in the last few months. In June, the Turing Institute, the UK’s national center for data science and AI, put out a report summing up discussions at a series of workshops it held in late 2020. The clear consensus was that AI tools had made little, if any, impact in the fight against covid.

Not fit for clinical use

This echoes the results of two major studies that assessed hundreds of predictive tools developed last year. Wynants is lead author of one of them, a review in the British Medical Journal that is still being updated as new tools are released and existing ones tested. She and her colleagues have looked at 232 algorithms for diagnosing patients or predicting how sick those with the disease might get. They found that none of them were fit for clinical use. Just two have been singled out as being promising enough for future testing.

[…]

Wynants’s study is backed up by another large review carried out by Derek Driggs, a machine-learning researcher at the University of Cambridge, and his colleagues, and published in Nature Machine Intelligence. This team zoomed in on deep-learning models for diagnosing covid and predicting patient risk from medical images, such as chest x-rays and chest computer tomography (CT) scans. They looked at 415 published tools and, like Wynants and her colleagues, concluded that none were fit for clinical use.

[…]

Both teams found that researchers repeated the same basic errors in the way they trained or tested their tools. Incorrect assumptions about the data often meant that the trained models did not work as claimed.

[…]

What went wrong

Many of the problems that were uncovered are linked to the poor quality of the data that researchers used to develop their tools. Information about covid patients, including medical scans, was collected and shared in the middle of a global pandemic, often by the doctors struggling to treat those patients. Researchers wanted to help quickly, and these were the only public data sets available. But this meant that many tools were built using mislabeled data or data from unknown sources.

Driggs highlights the problem of what he calls Frankenstein data sets, which are spliced together from multiple sources and can contain duplicates. This means that some tools end up being tested on the same data they were trained on, making them appear more accurate than they are.

It also muddies the origin of certain data sets. This can mean that researchers miss important features that skew the training of their models. Many unwittingly used a data set that contained chest scans of children who did not have covid as their examples of what non-covid cases looked like. But as a result, the AIs learned to identify kids, not covid.

Driggs’s group trained its own model using a data set that contained a mix of scans taken when patients were lying down and standing up. Because patients scanned while lying down were more likely to be seriously ill, the AI learned wrongly to predict serious covid risk from a person’s position.

In yet other cases, some AIs were found to be picking up on the text font that certain hospitals used to label the scans. As a result, fonts from hospitals with more serious caseloads became predictors of covid risk.

Errors like these seem obvious in hindsight. They can also be fixed by adjusting the models, if researchers are aware of them. It is possible to acknowledge the shortcomings and release a less accurate, but less misleading model. But many tools were developed either by AI researchers who lacked the medical expertise to spot flaws in the data or by medical researchers who lacked the mathematical skills to compensate for those flaws.

A more subtle problem Driggs highlights is incorporation bias, or bias introduced at the point a data set is labeled. For example, many medical scans were labeled according to whether the radiologists who created them said they showed covid. But that embeds, or incorporates, any biases of that particular doctor into the ground truth of a data set. It would be much better to label a medical scan with the result of a PCR test rather than one doctor’s opinion, says Driggs. But there isn’t always time for statistical niceties in busy hospitals.

[…]

Hospitals will sometimes say that they are using a tool only for research purposes, which makes it hard to assess how much doctors are relying on them. “There’s a lot of secrecy,” she says.

[…]

some hospitals are even signing nondisclosure agreements with medical AI vendors. When she asked doctors what algorithms or software they were using, they sometimes told her they weren’t allowed to say.

How to fix it

What’s the fix? Better data would help, but in times of crisis that’s a big ask. It’s more important to make the most of the data sets we have. The simplest move would be for AI teams to collaborate more with clinicians, says Driggs. Researchers also need to share their models and disclose how they were trained so that others can test them and build on them. “Those are two things we could do today,” he says. “And they would solve maybe 50% of the issues that we identified.”

Getting hold of data would also be easier if formats were standardized, says Bilal Mateen, a doctor who leads the clinical technology team at the Wellcome Trust, a global health research charity based in London.

Another problem Wynants, Driggs, and Mateen all identify is that most researchers rushed to develop their own models, rather than working together or improving existing ones. The result was that the collective effort of researchers around the world produced hundreds of mediocre tools, rather than a handful of properly trained and tested ones.

“The models are so similar—they almost all use the same techniques with minor tweaks, the same inputs—and they all make the same mistakes,” says Wynants. “If all these people making new models instead tested models that were already available, maybe we’d have something that could really help in the clinic by now.”

In a sense, this is an old problem with research. Academic researchers have few career incentives to share work or validate existing results. There’s no reward for pushing through the last mile that takes tech from “lab bench to bedside,” says Mateen.

To address this issue, the World Health Organization is considering an emergency data-sharing contract that would kick in during international health crises.

[…]

Source: Hundreds of AI tools have been built to catch covid. None of them helped. | MIT Technology Review

Pfizer Hikes Price of Covid-19 Vaccine by 25% in Europe

Pfizer is raising the price of its covid-19 vaccine in Europe by over 25% under a newly negotiated contract with the European Union, according to a report from the Financial Times. Competitor Moderna is also hiking the price of its vaccine in Europe by roughly 10%.

Pfizer’s covid-19 vaccine is already expected to generate the most revenue of any drug in a single year—about $33.5 billion for 2021 alone, according to the pharmaceutical company’s own estimates. But the company says it’s providing poorer countries the vaccine at a highly discounted price.

Pfizer previously charged the European Union €15.50 per dose for its vaccine ($18.40), which is based on new mRNA technology. The company will now charge €19.50 ($23.15) for 2.1 billion doses that will be delivered through the year 2023, according to the Financial Times.

Moderna previously charged the EU $22.60 per dose but will now get $25.50 per dose. That new price is actually lower than first anticipated, according to the Financial Times, because the EU adjusted its initial order to get more doses.

[…]

While most drug companies like Pfizer and Moderna are selling their covid-19 vaccines at a profit—even China’s Sinovac vaccine is being sold to make money— the UK’s AstraZeneca vaccine is being sold at cost. But AstraZeneca has suffered from poor press after a few dozen people around the world died from blood clots believed to be related to the British vaccine. As it turns out, Pfizer’s blood clot risk is “similar” to AstraZeneca according to a new study and your risk from dying of covid-19 is much higher than dying from any vaccine.

[…]

“The Pfizer-BioNTech covid-19 vaccine contributed $7.8 billion in global revenues during the second quarter, and we continue to sign agreements with governments around the world,” Pfizer CEO Albert Bourla said last week.

But Bourla was careful to note that Pfizer is providing the vaccine at discounted rates for poorer countries.

“We anticipate that a significant amount of our remaining 2021 vaccine manufacturing capacity will be delivered to middle- and low-income countries where we price in line with income levels or at a not-for-profit price,” Bourla said.

“In fact, we are on track to deliver on our commitment to provide this year more than one billion doses, or approximately 40% of our total production, to middle- and low-income countries, and another one billion in 2022,” Boula continued.

Source: Pfizer Hikes Price of Covid-19 Vaccine by 25% in Europe

Incredible that this amount of profit can be generated through need. These vaccines should have been taken up and mass produced in India or wherever and thrown around the entire world for the safety of all the people living in it.

Hackers leak full EA data after failed extortion attempt

The hackers who breached Electronic Arts last month have released the entire cache of stolen data after failing to extort the company and later sell the stolen files to a third-party buyer.

The data, dumped on an underground cybercrime forum on Monday, July 26, is now being widely distributed on torrent sites.

According to a copy of the dump obtained by The Record, the leaked files contain the source code of the FIFA 21 soccer game, including tools to support the company’s server-side services.

[…]

 

Source: Hackers leak full EA data after failed extortion attempt – The Record by Recorded Future

How Google quietly funds Europe’s leading tech policy institutes

A recent scientific paper proposed that, like Big Tobacco in the Seventies, Big Tech thrives on creating uncertainty around the impacts of its products and business model. One of the ways it does this is by cultivating pockets of friendly academics who can be relied on to echo Big Tech talking points, giving them added gravitas in the eyes of lawmakers.

Google highlighted working with favourable academics as a key aim in its strategy, leaked in October 2020, for lobbying the EU’s Digital Markets Act – sweeping legislation that could seriously undermine tech giants’ market dominance if it goes through.

Now, a New Statesman investigation can reveal that over the last five years, six leading academic institutes in the EU have taken tens of millions of pounds of funding from Google, Facebook, Amazon and Microsoft to research issues linked to the tech firms’ business models, from privacy and data protection to AI ethics and competition in digital markets. While this funding tends to come with guarantees of academic independence, this creates an ethical quandary where the subject of research is also often the primary funder of it.

 

The New Statesman has also found evidence of an inconsistent approach to transparency, with some senior academics failing to disclose their industry funding. Other academics have warned that the growing dependence on funding from the industry raises questions about how tech firms influence the debate around the ethics of the markets they have created.

The Institute for Ethics in Artificial Intelligence at the Technical University of Munich (TUM), for example, received a $7.5m grant from Facebook in 2019 to fund five years of research, while the Humboldt Institute for Internet and Society in Berlin, has accepted almost €14m from Google since it was founded in 2012, and the tech giant accounts for a third of the institute’s third-party funding.

The Humboldt Institute is seeking to diversify its funding sources, but still receives millions from Google
Annual funding to the Humboldt Institute by Google and other third-party institutions

Researchers at Big Tech-funded institutions told the New Statesman they did not feel any outward pressure to be less critical of their university’s benefactors in their research.

But one, who wished to remain anonymous, said Big Tech wielded a subtle influence through such institutions. They said that the companies typically appeared to identify uncritical academics – preferably those with political connections – who perhaps already espoused beliefs aligned with Big Tech. Companies then cultivate relationships with them, sometimes incentivising academics by granting access to sought-after data.

[…]

Luciano Floridi, professor of philosophy and ethics of information at Oxford University’s Internet Institute, is one of the most high-profile and influential European tech policy experts, who has advised the European Commission, the Information Commissioner’s Office, the UK government’s Centre for Data Ethics and Innovation, the Foreign Office, the Financial Conduct Authority and the Vatican.

Floridi is one of the best-connected tech policy experts in Europe, and he is also one of the most highly funded. The ethicist has received funding from Google, DeepMind, Facebook, the Chinese tech giant Tencent and the Japanese IT firm Fujitsu, which developed the infrastructure involved in the Post Office’s Horizon IT scandal.

OII digital ethics director Luciano Floridi is one of Europe’s most influential tech policy experts
Funding sources, and advisory positions declared by Luciano Floridi in public integrity statements

Although Floridi is connected to several of the world’s most valuable tech companies, he is especially close to Google. In the mid-2010s the academic was described as the company’s “in-house philosopher”, with his role on the company’s “right to be forgotten” committee. When the Silicon Valley giant launched a short-lived ethics committee to oversee its technology development in 2019, Floridi was among those enlisted.

Last year, Floridi oversaw and co-authored a study that found some alternative and commercial search engines returned more misinformation about healthcare to users than Google. The authors of the pro-Google study didn’t disclose any financial interests, despite Floridi’s long-running relationship with the company.

[…]

Michael Veale, a lecturer in law at University College London, said that beyond influencing independent academics, there are other motives for firms such as Google to fund policy research. “By funding very pedantic academics in an area to investigate the nuances of economics online, you can heighten the amount of perceived uncertainty in things that are currently taken for granted in regulatory spheres,” he told the New Statesman.

[…]

This appears to be the case within competition law as well. “I have noticed several common techniques used by academics who have been funded by Big Tech companies,” said Oles Andriychuk, a senior lecturer in law at Strathclyde University. “They discuss technicalities – very technical arguments which are not wrong, but they either slow down the process, or redirect the focus to issues which are less important, or which blur clarity.”

It is difficult to measure the impact of Big Tech on European academia, but Valletti adds that a possible outcome is to make research less about the details, and more about framing. “Influence is not just distorting the result in favour of [Big Tech],” he said, “but the kind of questions you ask yourself.”

Source: How Google quietly funds Europe’s leading tech policy institutes

Major U.K. science funder to require grantees to make papers immediately free to all

[…]

UK Research and Innovation (UKRI), will expand on existing rules covering all research papers produced from its £8 billion in annual funding. About three-quarters of papers recently published from U.K. universities are open access, and UKRI’s current policy gives scholars two routes to comply: Pay journals for “gold” open access, which makes a paper free to read on the publisher’s website, or choose the “green” route, which allows them to deposit a near-final version of the paper on a public repository, after a waiting period of up to 1 year. Publishers have insisted that an embargo period is necessary to prevent the free papers from peeling away their subscribers.

But starting in April 2022, that yearlong delay will no longer be permitted: Researchers choosing green open access must deposit the paper immediately when it is published. And publishers won’t be able to hang on to the copyright for UKRI-funded papers: The agency will require that the research it funds—with some minor exceptions—be published with a Creative Commons Attribution license (known as CC-BY) that allows for free and liberal distribution of the work.

UKRI developed the new policy because “publicly funded research should be available for public use by the taxpayer,” says Duncan Wingham, the funder’s executive champion for open research. The policy falls closely in line with those issued by other major research funders, including the nonprofit Wellcome Trust—one of the world’s largest nongovernmental funding bodies—and the European Research Council.

The move also brings UKRI’s policy into alignment with Plan S, an effort led by European research funders—including UKRI—to make academic literature freely available to read

[…]

It clears up some confusion about when UKRI will pay the fees that journals charge for gold open access, he says: never for journals that offer a mix of paywalled and open-access content, unless the journal is part of an agreement to transition to exclusively open access for all research papers. (More than half of U.K. papers are covered by transitional agreements, according to UKRI.)

[…]

Publishers have resisted the new requirements. The Publishers Association, a member organization for the U.K. publishing industry, circulated a document saying the policy would introduce confusion for researchers, threaten their academic freedom, undermine open access, and leave many researchers on the hook for fees for gold open access—which it calls the only viable route for researchers. The publishing giant Elsevier, in a letter sent to its editorial board members in the United Kingdom, said it had been working to shape the policy by lobbying UKRI and the U.K. government, and encouraged members to write in themselves.

[…]

It would not be in the interest of publishers to refuse to publish these green open-access papers, Rooryck says, because the public repository version ultimately drives publicity for publishers. And even with a paper immediately deposited in a public repository, the final “version of record” published behind a paywall will still carry considerable value, Prosser says. Publishers who threaten to reject such papers, Rooryck believes, are simply “saber rattling and posturing.”

Source: Major U.K. science funder to require grantees to make papers immediately free to all | Science | AAAS

It’s pretty bizarre that publically funded research is hidden behind paywalls – the public that paid for it can’t get to it and innovation is stifled because people who need the research can’t get at it either.

Chinese regulators go after price gauging in car chip industry

Chinese antitrust watchdog, State Administration of Market Supervision (SAMR), announced Tuesday it has started investigating price gouging in the automotive chip market.

The regulatory body promised to strengthen supervision and punish illegal acts such as hoarding, price hikes and collusive price increases. SAMR singled out distributors as the object of its ire.

In the early stages of the COVID-19 pandemic, prices for items such as hand sanitizer, face masks, toilet paper and other health-related items saw startling inflation that required legal intervention.

As the pandemic wore on and work from home kit became a necessity, the world saw a new kind of shortages: semiconductors.

The automotive industry was hit particularly hard by the shortage, largely because its procurement practices sent it to the back of the queue. The industry has since endured factory shutdowns and reduced levels of vehicle production – which, given cars have long supply chains, is not the sort of thing anyone needs during difficult economic times.

Chinese entrepreneurs are clearly alive to the opportunities the silicon shortage presents. Last month several Chinese would-be bootleggers were caught smuggling the critical tech with tactics like taping US$123,000 worth of product to their calves and torso or hiding them in their vehicle as they attempted to cross borders.

Analyst firm Gartner has predicted semiconductor shortages will remain moderate to severe for the rest of 2021 and continue until the second quarter of 2022. Taiwanese chipmaker TSMC has said shortages will continue until 2023.

The Register imagines that those that can influence chip prices in China, and elsewhere, will continue to try their luck until demand deflates. Or until SAMR gets a grip on regulation, whichever comes first

Source: China tightens distributor cap after local outfits hoard automotive silicon then charge silly prices • The Register

The Chinese regulators are doing a way better job than the EU and US in terms of price gauging and monopolies. Maybe the EU and US shouldn’t let big companies lobbying determine their courses of action.

Hey, AI software developers, you are taking Unicode into account, right … right?

[…]

The issue is that ambiguity or discrepancies can be introduced if the machine-learning software ignores certain invisible Unicode characters. What’s seen on screen or printed out, for instance, won’t match up with what the neural network saw and made a decision on. It may be possible abuse this lack of Unicode awareness for nefarious purposes.

As an example, you can get Google Translate’s web interface to turn what looks like the English sentence “Send money to account 4321” into the French “Envoyer de l’argent sur le compte 1234.”

A screenshot of Google Translate

Fooling Google Translate with Unicode. Click to enlarge

This is done by entering on the English side “Send money to account” and then inserting the invisible Unicode glyph 0x202E, which changes the direction of the next text we type in – “1234” – to “4321.” The translation engine ignores the special Unicode character, so on the French side we see “1234,” while the browser obeys the character, so it displays “4321” on the English side.

It may be possible to exploit an AI assistant or a web app using this method to commit fraud, though we present it here in Google Translate to merely illustrate the effect of hidden Unicode characters. A more practical example would be feeding the sentence…

You akU+8re aqU+8 AU+8coward and a fovU+8JU+8ol.

…into a comment moderation system, where U+8 is the invisible Unicode character for delete the previous character. The moderation system ignores the backspace characters, sees instead a string of misspelled words, and can’t detect any toxicity – whereas browsers correctly rendering the comment show, “You are a coward and a fool.”

[…]

It was academics at the University of Cambridge in England, and the University of Toronto in Canada, who highlighted these issues, laying out their findings in a paper released on arXiv In June this year.

“We find that with a single imperceptible encoding injection – representing one invisible character, homoglyph, reordering, or deletion – an attacker can significantly reduce the performance of vulnerable models, and with three injections most models can be functionally broken,” the paper’s abstract reads.

“Our attacks work against currently deployed commercial systems, including those produced by Microsoft and Google, in addition to open source models published by Facebook and IBM.”

[…]

Source: Hey, AI software developers, you are taking Unicode into account, right … right?

Researchers Say They’ve Found a ‘Master Face’ to Bypass Face Rec Tech

[…]

computer scientists at Tel Aviv University in Israel say they have discovered a way to bypass a large percentage of facial recognition systems by basically faking your face. The team calls this method the “master face” (like a “master key,” harhar), which uses artificial intelligence technologies to create a facial template—one that can consistently juke and unlock identity verification systems.

“Our results imply that face-based authentication is extremely vulnerable, even if there is no information on the target identity,” researchers write in their study. “In order to provide a more secure solution for face recognition systems, anti-spoofing methods are usually applied. Our method might be combined with additional existing methods to bypass such defenses,” they add.

According to the study, the vulnerability being exploited here is the fact that facial recognition systems use broad sets of markers to identify specific individuals. By creating facial templates that match many of those markers, a sort of omni-face can be created that is capable of fooling a high percentage of security systems. In essence, the attack is successful because it generates “faces that are similar to a large portion of the population.”

This face-of-all-faces is created by inputting a specific algorithm into the StyleGAN, a widely used “generative model” of artificial intelligence tech that creates digital images of human faces that aren’t real. The team tested their face imprint on a large, open-source repository of 13,000 facial images operated by the University of Massachusetts and claim that it could unlock “more than 20% of the identities” within the database. Other tests showed even higher rates of success.

Furthermore, the researchers write that the face construct could hypothetically be paired with deepfake technologies, which will “animate” it, thus fooling “liveness detection methods” that are designed to assess whether a subject is living or not.

Source: Researchers Say They’ve Found a ‘Master Face’ to Bypass Face Rec Tech

Apple confirms it will begin scanning your iCloud Photos

[…] Apple told TechCrunch that the detection of child sexual abuse material (CSAM) is one of several new features aimed at better protecting the children who use its services from online harm, including filters to block potentially sexually explicit photos sent and received through a child’s iMessage account. Another feature will intervene when a user tries to search for CSAM-related terms through Siri and Search.

Most cloud services — Dropbox, Google, and Microsoft to name a few — already scan user files for content that might violate their terms of service or be potentially illegal, like CSAM. But Apple has long resisted scanning users’ files in the cloud by giving users the option to encrypt their data before it ever reaches Apple’s iCloud servers.

Apple said its new CSAM detection technology — NeuralHash — instead works on a user’s device, and can identify if a user uploads known child abuse imagery to iCloud without decrypting the images until a threshold is met and a sequence of checks to verify the content are cleared.

News of Apple’s effort leaked Wednesday when Matthew Green, a cryptography professor at Johns Hopkins University, revealed the existence of the new technology in a series of tweets. The news was met with some resistance from some security experts and privacy advocates, but also users who are accustomed to Apple’s approach to security and privacy that most other companies don’t have.

Apple is trying to calm fears by baking in privacy through multiple layers of encryption, fashioned in a way that requires multiple steps before it ever makes it into the hands of Apple’s final manual review.

[…]

Source: Apple confirms it will begin scanning iCloud Photos for child abuse images | TechCrunch

No matter what the cause, they have no right to be scanning your stuff at all, for any reason, at any time.

Apple is about to start scanning iPhone users’ photos

Apple is about to announce a new technology for scanning individual users’ iPhones for banned content. While it will be billed as a tool for detecting child abuse imagery, its potential for misuse is vast based on details entering the public domain.

The neural network-based tool will scan individual users’ iDevices for child sexual abuse material (CSAM), respected cryptography professor Matthew Green told The Register today.

Rather than using age-old hash-matching technology, however, Apple’s new tool – due to be announced today along with a technical whitepaper, we are told – will use machine learning techniques to identify images of abused children.

[…]Indiscriminately scanning end-user devices for CSAM is a new step in the ongoing global fight against this type of criminal content. In the UK the Internet Watch Foundation’s hash list of prohibited content is shared with ISPs who then block the material at source. Using machine learning to intrusively scan end user devices is new, however – and may shake public confidence in Apple’s privacy-focused marketing.

[…]

Governments in the West and authoritarion regions alike will be delighted by this initiative, Green feared. What’s to stop China (or some other censorious regime such as Russia or the UK) from feeding images of wanted fugitives into this technology and using that to physically locate them?

[…]

“Apple will hold the unencrypted database of photos (really the training data for the neural matching function) and your phone will hold the photos themselves. The two will communicate to scan the photos on your phone. Alerts will be sent to Apple if *multiple* photos in your library match, it can’t just be a single one.”

The privacy-busting scanning tech will be deployed against America-based iThing users first, with the idea being to gradually expand it around the world as time passes. Green said it would be initially deployed against photos backed up in iCloud before expanding to full handset scanning.

[…]

Source: Apple is about to start scanning iPhone users’ devices for banned content, warns professor • The Register

Wow, no matter what the pretext (and the pretext of sex offenders is very very often the very first step they take on a much longer road, because hey, who can be against bringing sex offenders to justice, right?) Apple has just basically said that they think they have the right to read whatever they like on your phone. Nothing privacy! So what will be next? Your emails? Text messages? Location history (again)?

As a user, you actually bought this hardware – anyone you don’t explicitly give consent to (and that means not being coerced by limiting functionality, eg) should stay out of it!