Category Archives: Global Domination

Apple sues Corellium for copyright – and sues everybody who talks about Corellium or is / was their customer. Strong arm much?

Posted on by

Last year, Apple accused a cybersecurity startup based in Florida of infringing its copyright by developing and selling software that allows customers to create virtual iPhone replicas. Critics have called the Apple’s lawsuit against the company, called Corellium, “dangerous” as it may shape how security researchers and software makers can tinker with Apple’s products and code.

The lawsuit, however, has already produced a tangible outcome: very few people, especially current and former customers and users, want to talk about Corellium, which sells the eponymous software that virtualizes iPhones and Android devices. During the lawsuit’s proceedings, Apple has sought information from companies that have used the tool, which emulates iOS on a computer, allowing researchers to probe potential iPhone vulnerabilities in a forgiving and easy-to-use environment.

[…]

“I don’t know if they intended it but when they name individuals at companies that have spoken in favor [of Corellium], I definitely believe retribution is possible,” the researcher added, referring to Apple’s subpoena to the spanish finance giant Santander Bank, which named an employee who had Tweeted about Corellium.

[…]

A security researcher, who specializes in offensive security and asked to remain anonymous, said that he would definitely “have legal look into it beforehand if I needed [Corellium’s] stuff,” arguing that he’d be wary of Apple getting involved.

Three other researchers who specialize in hacking Apple software declined to comment citing the risk of some sort of retaliation from Apple.

[…]

In January, Apple subpoenaed the defense contractor L3Harris and Santander Bank, requesting information on how they use Corellium, all communications they’ve had with the startup, internal communications about their products, and any contracts they’ve signed with the company, among other information.

Mark Dowd, the founder of Azimuth Security, a cybersecurity startup that specializes in developing hacking tools for governments that’s now part of L3Harris, said last year that he couldn’t comment about Corellium “because [Apple] mention[ed] us in the original filing.” (Dowd did not respond to a request for comment this week.)

[…]

Some researchers, however, are not afraid of Apple. Elias Naur uses Corellium to test code written in the Go language for mobile operating systems. Before Corellium, Naur said he had to test code on two busted old phones plugged in under his couch. Naur said he’s “not worried Apple will come after Corellium’s customers” and is still using the software.

[…]

In this David v. Goliath battle, as Forbes called it, many people are choosing to stay away from David even before seeing who wins.

Source: Apple’s Copyright Lawsuit Has Created a ‘Chilling Effect’ on Security Research – VICE

Researchers create a new system to protect users’ online data by checking if data entered is consistent with the privacy policy

Posted on by

Researchers have created a new a new system that helps Internet users ensure their online data is secure.

The software-based system, called Mitigator, includes a plugin users can install in their browser that will give them a secure signal when they visit a website verified to process its data in compliance with the site’s privacy policy.

“Privacy policies are really hard to read and understand,” said Miti Mazmudar, a PhD candidate in Waterloo’s David R. Cheriton School of Computer Science. “What we try to do is have a compliance system that takes a simplified model of the privacy policy and checks the code on the website’s end to see if it does what the privacy policy claims to do.

“If a website requires you to enter your email address, Mitigator will notify you if the privacy policy stated that this wouldn’t be needed or if the privacy policy did not mention the requirement at all.”

Mitigator can work on any computer, but the companies that own the website servers must have machines with a trusted execution environment (TEE). TEE, a secure area of modern server-class processors, guarantees the protection of code and data loaded in it with respect to confidentiality and integrity.

“The big difference between Mitigator and prior systems that had similar goals is that Mitigator’s primary focus is on the signal it gives to the user,” said Ian Goldberg, a professor in Waterloo’s Faculty of Mathematics. “The important thing is not just that the company knows their software is running correctly; we want the user to get this assurance that the company’s software is running correctly and is processing their data properly and not just leaving it lying around on disk to be stolen.

“Users of Mitigator will know whether their data is being properly protected, managed, and processed while the companies will benefit in that their customers are happier and more confident that nothing untoward is being done with their data.”

The study, Mitigator: Privacy policy compliance using trusted hardware, authored by Mazmudar and Goldberg, has been accepted for publication in the Proceedings of Privacy Enhancing Technologies.

Source: Researchers create a new system to protect users’ online data | Waterloo Stories | University of Waterloo

UK COVID-19 contact tracing app data may be kept for ‘research’ after crisis ends, MPs told

Posted on by

Britons will not be able to ask NHS admins to delete their COVID-19 tracking data from government servers, digital arm NHSX’s chief exec Matthew Gould admitted to MPs this afternoon.

Gould also told Parliament’s Human Rights Committee that data harvested from Britons through NHSX’s COVID-19 contact tracing app would be “pseudonymised” – and appeared to leave the door open for that data to be sold on for “research”.

The government’s contact-tracing app will be rolled out in Britain this week. A demo seen by The Register showed its basic consumer-facing functions. Key to those is a big green button that the user presses to send 28 days’ worth of contact data to the NHS.

Screenshot of the NHSX covid-19 contact tracing app

Screenshot of the NHSX COVID-19 contact tracing app … Click to enlarge

Written by tech arm NHSX, Britain’s contact-tracing app breaks with international convention by opting for a centralised model of data collection, rather than keeping data on users’ phones and only storing it locally.

In response to questions from Scottish Nationalist MP Joanna Cherry this afternoon, Gould told MPs: “The data can be deleted for as long as it’s on your own device. Once uploaded all the data will be deleted or fully anonymised with the law, so it can be used for research purposes.”

Source: UK COVID-19 contact tracing app data may be kept for ‘research’ after crisis ends, MPs told • The Register

OK, Landlord: If Copyright Supporters Are Going To Insist Copyright Is Property, Why Are They So Mad About Being Called Landlords?

Posted on by

Law professor Brian Frye has spent the last month or so making a really important point regarding the never-ending “is copyright property” debate — saying that if copyright is property, then copyright holders should be seen and treated as landlords. This whole approach can be summed up in the slightly snarky and trollish phrase: “OK, Landlord” used to respond to all sorts of nonsensical takes in support of more egregious copyright policies:

Like everyone, the copyright cops want to have their cake and eat it too. They claim that copyright is a kind of property, so the law should protect it just like any other kind of property. But they also claim that authors are morally entitled to copyright ownership because of their special contribution to society. I find both claims uncompelling, but in any case, they can’t have it both ways. If copyright is a property right, they have to own it and can’t claim the moral high ground.

What’s been most telling about this useful analogy is just how angry it seems to make copyright holders and copyright-system supporters. They react very negatively to the suggestion that they are “landlords” and any money they make from copyright licensing is a form of “rent.” But if you’re going to claim that your copyright is profit, then, well, the landlord moniker fits.

But the copyright cops persist, insisting that copyright is property, so copyright owners are entitled to the entire value of the works they create because that’s what property means. Accordingly, copying a work of authorship without permission is theft, even though it only increases the number of copies, because the copyright owner didn’t profit. And even consuming a work of authorship without permission is wrong because copyright owners are entitled to profit from every use of the work they own.

The circularity of these claims should be obvious: copyright is property because copyright owners receive exclusive rights, and copyright owners receive exclusive rights because copyright is property. But let’s run with it. Okay, copyright is property and copyright owners are property owners. Why are copyright owners entitled to profit from the use of their property?

Because they’re landlords. Copyright owners want to own the property metaphor? Then, let ‘em own it. If copyright is property, then they are landlords and copyright profits are rent. Just like landlords, copyright owners simply make a capital investment in creating or acquiring a property, then sit back and wait for the profits to roll in.

As Frye notes, the whole idea that copyright holders are landlords (even as they claim that they are holding property that you need to pay them to use), shows the sort of emotional trickery that copyright holders use in also claiming some sort of moral right to their works as “creators.” They’re picking and choosing which arguments to use when — and, have long tried to imbue some sort of magical mystical status on holding the copyright to creativity (which is often quite different than creating itself).

Of course, the real issue at play is that many of the most vocal copyright system supporters want to believe that they’re “artists” who are fighting the system and speaking for the oppressed… and being a “landlord” who is renting out their property goes against that self-image. But as Frye notes, they can’t really have it both ways. If they want to declare that they have property rights, they should be perfectly find with recognizing that they are the current landlords for that “property.”

Source: OK, Landlord: If Copyright Supporters Are Going To Insist Copyright Is Property, Why Are They So Mad About Being Called Landlords? | Techdirt

The Dot Org Sale Has Been Rejected – now what?

Posted on by

When I began writing about the dot-org sale, it was out of concern for the loss of what I felt strongly was long understood to be a unique place in the Internet’s landscape. Like a national park, dot-org deserved special protection. It turns out lots of people and organizations agreed.

On April 30th, 2020, The ICANN Board upheld these values. They unanimously withheld consent for a change of control of the Public Interest Registry to a private equity firm. There were real questions about public support, financial stability and ultimately about whether the proposal was in the best interest of those most affected, dot-org domain owners.

Ethos, PIR and ISOC failed to respond to any in a convincing manner. They failed to gather any material support for their approach. As of today, the #savedotorg campaign has nearly 27,000 supporters and 2,000 nonprofits behind it. It dwarfs any campaign Internet governance has ever seen. There’s no way to de-legitimize such an outpouring of concern.

[…]

ISOC and PIR’s announcements seem to imply that things will simply go back to the way they were. PIR will continue to run dot-org and ISOC will continue to do what it does. This is the same kind of magical thinking that led to the idea that dot-org could be sold to a private equity firm. It is not grounded in the reality of how decisions that impact massive global communities are made.

Here’s what needs to be done:

First, ISOC and PIR leadership must recognize and apologize for the harm and uncertainty that they have caused both nonprofits and Internet governance. There never should have needed to be a #savedotorg campaign, because dot-org should never have been put at risk.

Second, The ISOC board should invite the leadership of the organizations that led the #SaveDotOrg campaign to an open dialogue to understand their concerns and priorities for the future of dot-org. This dialogue should recognize that it may be agreed that ISOC and PIR may no longer be the appropriate stewards for dot-org.

Third, the leadership of the #SaveDotOrg campaign needs to recognize that this was a closeted decision by a few actors, taken in secret. There are many skilled professionals that work at both PIR and ISOC. While ISOC and PIR may have to change dramatically, solutions must be sought that consider the value and future of these organizations, their staff, and their members.

Fourth, all parties should agree to work together with ICANN to chart a course of action that builds confidence and faith in the multi-stakeholder model of Internet governance. While there are many challenges with this model, one being how messy it seems, in the end the right decisions were taken. We must all come together to defend the model that has built and will continue to sustain a single global Internet.

Source: The Dot Org Sale Has Been Rejected – savedotorg – Medium

New Firefox service will generate unique email aliases to enter in online forms

Posted on by

Browser maker Mozilla is working on a new service called Private Relay that generates unique aliases to hide a user’s email address from advertisers and spam operators when filling in online forms.

The service entered testing last month and is currently in a closed beta, with a public beta currently scheduled for later this year, ZDNet has learned.

Private Relay will be available as a Firefox add-on that lets users generate a unique email address — an email alias — with one click.

The user can then enter this email address in web forms to send contact requests, subscribe to newsletters, and register new accounts.

“We will forward emails from the alias to your real inbox,” Mozilla says on the Firefox Private Relay website.

“If any alias starts to receive emails you don’t want, you can disable it or delete it completely,” the browser maker said.

The concept of an email alias has existed for decades, but managing them has always been a chore, or email providers didn’t allow users access to such a feature.

Through Firefox Private Relay, Mozilla hopes to provide an easy to use solution that can let users create and destroy email aliases with a few button clicks.

Source: New Firefox service will generate unique email aliases to enter in online forms | ZDNet

Brave accuses European governments of GDPR resourcing failure

Posted on by

Brave, a maker of a pro-privacy browser, has lodged complaints with the European Commission against 27 EU Member States for under resourcing their national data protection watchdogs.

It’s asking the European Union’s executive body to launch an infringement procedure against Member State governments, and even refer them to the bloc’s top court, the European Court of Justice, if necessary.

“Article 52(4) of the GPDR [General Data Protection Regulation] requires that national governments give DPAs the human and financial resources necessary to perform their tasks,” it notes in a press release.

Brave has compiled a report to back up the complaints — in which it chronicles a drastic shortage of tech expertise and budget resource among Europe’s privacy agencies to enforce the region’s data protection framework.

Lack of proper resource to ensure the regulation’s teeth are able to clamp down on bad behavior — as the law drafters’ intended — has been a long standing concern.

In the Irish data watchdog’s annual report in February — AKA the agency that regulates most of big tech in Europe — the lack of any decisions in major cross-border cases against a roll-call of tech giants loomed large, despite plenty of worthy filler, with reams of stats included to illustrate the massive case load of complaints the agency is now dealing with.

Ireland’s decelerating budget and headcount in the face of rising numbers of GDPR complaints is a key concern highlighted by Brave’s report.

Per the report, half of EU data protection agencies have what it dubs a small budget (sub €5M), while only five of Europe’s 28 national GDPR enforcers have more than 10 “tech specialists”, as it describes them.

“Almost a third of the EU’s tech specialists work for one of Germany’s Länder (regional) or federal DPAs,” it warns. “All other EU countries are far behind Germany.”

“Europe’s GDPR enforcers do not have the capacity to investigate Big Tech,” is its top-line conclusion.

“If the GDPR is at risk of failing, the fault lies with national governments, not with the data protection authorities,” said Dr Johnny Ryan, Brave’s chief policy & industry relations officer, in a statement. “Robust, adversarial enforcement is essential. GDPR enforcers must be able to properly investigate ‘big tech’, and act without fear of vexatious appeals. But the national governments of European countries have not given them the resources to do so. The European Commission must intervene.”

It’s worth noting that Brave is not without its own commercial interest here. It absolutely has skin in the game, as a provider of privacy-sensitive adtech.

[…]

Source: Brave accuses European governments of GDPR resourcing failure | TechCrunch

Surprise surprise, Xiaomi web browser and music player are sending data about you to China

Posted on by

When he looked around the Web on the device’s default Xiaomi browser, it recorded all the websites he visited, including search engine queries whether with Google or the privacy-focused DuckDuckGo, and every item viewed on a news feed feature of the Xiaomi software. That tracking appeared to be happening even if he used the supposedly private “incognito” mode.

The device was also recording what folders he opened and to which screens he swiped, including the status bar and the settings page. All of the data was being packaged up and sent to remote servers in Singapore and Russia, though the Web domains they hosted were registered in Beijing.

Meanwhile, at Forbes’ request, cybersecurity researcher Andrew Tierney investigated further. He also found browsers shipped by Xiaomi on Google Play—Mi Browser Pro and the Mint Browser—were collecting the same data. Together, they have more than 15 million downloads, according to Google Play statistics.

[…]

And there appear to be issues with how Xiaomi is transferring the data to its servers. Though the Chinese company claimed the data was being encrypted when transferred in an attempt to protect user privacy, Cirlig found he was able to quickly see just what was being taken from his device by decoding a chunk of information that was hidden with a form of easily crackable encoding, known as base64. It took Cirlig just a few seconds to change the garbled data into readable chunks of information.

“My main concern for privacy is that the data sent to their servers can be very easily correlated with a specific user,” warned Cirlig.

[…]

But, as pointed out by Cirlig and Tierney, it wasn’t just the website or Web search that was sent to the server. Xiaomi was also collecting data about the phone, including unique numbers for identifying the specific device and Android version. Cirlig said such “metadata” could “easily be correlated with an actual human behind the screen.”

Xiaomi’s spokesperson also denied that browsing data was being recorded under incognito mode. Both Cirlig and Tierney, however, found in their independent tests that their web habits were sent off to remote servers regardless of what mode the browser was set to, providing both photos and videos as proof.

[…]

Both Cirlig and Tierney said Xiaomi’s behavior was more invasive than other browsers like Google Chrome or Apple Safari. “It’s a lot worse than any of the mainstream browsers I have seen,” Tierney said. “Many of them take analytics, but it’s about usage and crashing. Taking browser behavior, including URLs, without explicit consent and in private browsing mode, is about as bad as it gets.”

[…]

Cirlig also suspected that his app use was being monitored by Xiaomi, as every time he opened an app, a chunk of information would be sent to a remote server. Another researcher who’d tested Xiaomi devices, though was under an NDA to discuss the matter openly, said he’d seen the manufacturer’s phone collect such data. Xiaomi didn’t respond to questions on that issue.

[…]

Late in his research, Cirlig also discovered that Xiaomi’s music player app on his phone was collecting information on his listening habits: what songs were played and when.

Source: Exclusive: Warning Over Chinese Mobile Giant Xiaomi Recording Millions Of People’s ‘Private’ Web And Phone Use

It’s a bit of a puff piece, as American software also records all this data and sends it home. The article also seems to suggest that the whole phone is always sending data home, but only really talks about the browser and a music player app. So yes, you should have installed Firefox and used that as a browser as soon as you got the phone, but that goes for any phone that comes with Safari or Chrome as a browser too. A bit of anti Chinese storm in a teacup

Australian contact-tracing app leaks telling info and increases chances of third-party tracking, say security folks. That’s OK says maker, you download worse stuff as games.

Posted on by

The design of Australia’s COVIDSafe contact-tracing app creates some unintended surveillance opportunities, according to a group of four security pros who unpacked its .APK file.

Penned by independent security researcher Chris Culnane, University of Melbourne tutor, cryptography researcher and masters student Eleanor McMurtry, developer Robert Merkel and Australian National University associate professor and Thinking Security CEO Vanessa Teague and posted to GitHub, the analysis notes three concerning design choices.

The first-addressed is the decision to change UniqueIDs – the identifier the app shares with other users – once every two hours and for devices to only accept a new UniqueID if the app is running. The four researchers say this will make it possible for the government to understand if users are running the app.

“This means that a person who chooses to download the app, but prefers to turn it off at certain times of the day, is informing the Data Store of this choice,” they write.

The authors also suggest that persisting with a UniqueID for two hours “greatly increases the opportunities for third-party tracking.”

“The difference between 15 minutes’ and two hours’ worth of tracking opportunities is substantial. Suppose for example that the person has a home tracking device such as a Google home mini or Amazon Alexa, or even a cheap Bluetooth-enabled IoT device, which records the person’s UniqueID at home before they leave. Then consider that if the person goes to a shopping mall or other public space, every device that cooperates with their home device can share the information about where they went.”

The analysis also notes that “It is not true that all the data shared and stored by COVIDSafe is encrypted. It shares the phone’s exact model in plaintext with other users, who store it alongside the corresponding Unique ID.”

That’s worrisome as:

“The exact phone model of a person’s contacts could be extremely revealing information. Suppose for example that a person wishes to understand whether another person whose phone they have access to has visited some particular mutual acquaintance. The controlling person could read the (plaintext) logs of COVIDSafe and detect whether the phone models matched their hypothesis. This becomes even easier if there are multiple people at the same meeting. This sort of group re-identification could be possible in any situation in which one person had control over another’s phone. Although not very useful for suggesting a particular identity, it would be very valuable in confirming or refuting a theory of having met with a particular person.”

The authors also worry that the app shares all UniqueIDs when users choose to report a positive COVID-19 test.

“COVIDSafe does not give them the option of deleting or omitting some IDs before upload,” they write. “This means that users consent to an all-or-nothing communication to the authorities about their contacts. We do not see why this was necessary. If they wish to help defeat COVID-19 by notifying strangers in a train or supermarket that they may be at risk, then they also need to share with government a detailed picture of their day’s close contacts with family and friends, unless they have remembered to stop the app at those times.”

The analysis also calls out some instances of UniqueIDs persisting for up to eight hours, for unknown reasons.

The authors conclude the app is not an immediate danger to users. But they do say it presents “serious privacy problems if we consider the central authority to be an adversary.”

None of which seems to be bothering Australians, who have downloaded it more than two million times in 48 hours and blown away adoption expectations.

Atlassian co-founder Mike Cannon-Brookes may well have helped things along, by suggestingit’s time to “turn the … angry mob mode off. He also offered the following advice:

When asked by non technical people “Should I install this app? Is my data / privacy safe? Is it true it doesn’t track my location?” – say “Yes” and help them understand. Fight the misinformation. Remind them how little time they think before they download dozens of free, adware crap games that are likely far worse for their data & privacy than this ever would be!

Source: Australian contact-tracing app leaks telling info and increases chances of third-party tracking, say security folks • The Register

UNESCO Suggests COVID-19 Is A Reason To Create… Eternal Copyright

Posted on by

Yes, we’ve seen lots of folks using COVID-19 to push their specific agendas forward, but this one is just bizarre. UNESCO (the United Nations Educational, Scientific and Cultural Organization) is an organization that is supposed to be focused on developing education and culture around the globe. From any objective standpoint, you’d think it would be in favor of things like more open licensing and sharing of culture, but, in practice, the organization has long been hijacked by copyright maximalist interests. Almost exactly a decade ago, we were perplexed at the organization’s decision to launch an anti-piracy organization. After all, “piracy” (or sharing of culture) is actually how culture and ideas frequently spread in the developing countries where UNESCO focuses.

So, I guess it isn’t so surprising a decade later that UNESCO is using COVID-19 to float the idea of an eternal copyright. I only wish I was kidding:

They phrase this as “just started the conversation,” but that’s a trollish setup for a terrible, terrible idea. In case you can’t see the video, it’s electronic music creator Jean-Michel Jarre suggesting eternal copyright as a way to support future artists:

Why not going to the other way around, and to create the concept of eternal copyright. And I mean by this that after a certain period of time, the rights of movies, of music, of everything, would go to a global fund to help artists, and especially artists in emerging countries.

First, we can all agree that helping to enable and support artists in emerging countries is a good general idea. I’ve seen a former RIAA executive screaming about how everyone criticizing this idea is showing their true colors in how they don’t want to support artists. But that’s just silly. The criticism of this idea is that it doesn’t “support” artists at all, and will almost certainly make creativity and supporting artists more difficult. And that’s because art and creativity has always relied on building upon the works of those who came before — and locking up everything for eternity would make that cost prohibitive for all but the wealthiest of creators. Indeed, the idea that we need copyright and copyright alone to support artists shows (yet again) just how uncreative the people who claim to support copyright can be.

[…]

Source: UNESCO Suggests COVID-19 Is A Reason To Create… Eternal Copyright | Techdirt

Can you imagine – every time s omeone read your email, you asked them for $0,10 because that email is your copyright? What a complete scam

Why should the UK pensions watchdog be able to spy on your internet activities? Same reason as the Environment Agency and more than 50 more

Posted on by

It has been called the “most extreme surveillance in the history of Western democracy.” It has not once but twice been found to be illegal. It sparked the largest ever protest of senior lawyers who called it “not fit for purpose.”

And now the UK’s Investigatory Powers Act of 2016 – better known as the Snooper’s Charter – is set to expand to allow government agencies you may never have heard of to trawl through your web histories, emails, or mobile phone records.

In a memorandum [PDF] first spotted by The Guardian, the British government is asking that five more public authorities be added to the list of bodies that can access data scooped up under the nation’s mass-surveillance laws: the Civil Nuclear Constabulary, the Environment Agency, the Insolvency Service, the UK National Authority for Counter Eavesdropping (UKNACE), and the Pensions Regulator.

The memo explains why each should be given the extraordinary powers, in general and specifically. In general, the five agencies “are increasingly unable to rely on local police forces to investigate crimes on their behalf,” and so should be given direct access to the data pipe itself.

Five Whys

The Civil Nuclear Constabulary (CNC) is a special armed police force that does security at the UK’s nuclear sites and when nuclear materials are being moved. It should be given access even though “the current threat to nuclear sites in the UK is assessed as low” because “it can also be difficult to accurately assess risk without the full information needed.”

The Environment Agency investigates “over 40,000 suspected offences each year,” the memo stated. Which is why it should also be able to ask ISPs to hand over people’s most sensitive communications information, in order “to tackle serious and organised waste crime.”

The Insolvency Service investigates breaches of company director disqualification orders. Some of those it investigates get put in jail so it is essential that the service be allowed “to attribute subscribers to telephone numbers and analyse itemised billings” as well as be able to see what IP addresses are accessing specific email accounts.

UKNACE, a little known agency that we have taken a look at in the past, is home of the real-life Qs, and one of its jobs is to detect attempts to eavesdrop on UK government offices. It needs access to the nation’s communications data “in order to identify and locate an attacker or an illegal transmitting device”, the memo claimed.

And lastly, the Pensions Regulator, which checks that companies have added their employees to their pension schemes, need to be able to delve into anyone’s emails so it can “secure compliance and punish wrongdoing.”

Taken together, the requests reflect exactly what critics of the Investigatory Powers Act feared would happen: that a once-shocking power that was granted on the back of terrorism fears is being slowly extended to even the most obscure government agency for no reason other that it will make bureaucrats’ lives easier.

None of the agencies would be required to apply for warrants to access people’s internet connection data, and they would be added to another 50-plus agencies that already have access, including the Food Standards Agency, Gambling Commission, and NHS Business Services Authority.

Safeguards

One of the biggest concerns remains that there are insufficient safeguards in place to prevent the system being abused; concerns that only grow as the number of people that have access to the country’s electronic communications grows.

It is also still not known precisely how all these agencies access the data that is accumulated, or what restrictions are in place beyond a broad-brush “double lock” authorization process that requires a former judge (a judicial commissioner, or JCs) to approve a minister’s approval.

Source: Why should the UK pensions watchdog be able to spy on your internet activities? Same reason as the Environment Agency and many more • The Register

Stripe Payment Provider is Silently Recording Your Movements On its Customers’ Websites

Posted on by

Among startups and tech companies, Stripe seems to be the near-universal favorite for payment processing. When I needed paid subscription functionality for my new web app, Stripe felt like the natural choice. After integration, however, I discovered that Stripe’s official JavaScript library records all browsing activity on my site and reports it back to Stripe. This data includes:

  1. Every URL the user visits on my site, including pages that never display Stripe payment forms
  2. Telemetry about how the user moves their mouse cursor while browsing my site
  3. Unique identifiers that allow Stripe to correlate visitors to my site against other sites that accept payment via Stripe

This post shares what I found, who else it affects, and how you can limit Stripe’s data collection in your web applications.

Source: Stripe is Silently Recording Your Movements On its Customers’ Websites · mtlynch.io

Zoom sex party moderation: app uses machine-learning to patrol nudity – will it record them to put up on the web?

Posted on by

As Rolling Stone reported, the app is now playing host to virtual sex parties,  “play parties,” and group check-ins which have become, as one host said, “the mutual appreciation jerk-off society.”

According to Zoom’s “acceptable use” policy, users may not use the technology to “engage in any activity that is harmful, obscene, or indecent, particularly as such would be understood in the context of business usage.” The policy specifies that this includes “displays of nudity, violence, pornography, sexually explicit material, or criminal activity.”

Zoom says that the platform uses ‘machine learning’ to identify accounts in violation of its policies — though it has remained vague about its methods for identifying offending users and content.

“We encourage users to report suspected violations of our policies, and we use a mix of tools, including machine learning, to proactively identify accounts that may be in violation,” a spokesperson for Zoom told Rolling Stone.

While Zoom executives did not respond to the outlet’s questions about the specifics of the machine-learning tools or how the platform might be alerted to nudity and pornographic content, a spokesperson did add that the company will take a “number of actions” against people found to be in violation of the specified acceptable use.

When reached for comment, a spokesperson for Zoom referred Insider to the “acceptable use” policy as well as the platform’s privacy policy which states that Zoom “does not monitor your meetings or its contents.”

The spokesperson also pointed to Yuan’s message in which he addressed how the company has “fallen short” of users’ “privacy and security expectations,” referencing instances of harassment and Zoom-bombing, and laid out the platform’s action plan going forward.

Source: Zoom sex party moderation: app uses machine-learning to patrol nudity – Insider

It’s not unthinkable that they will record the videos and them just leave them on the web for anyone to download. After all, they’ve left thousands of video calls just lying about before.

TalkTalk customers unable to opt out of ISP’s ad-jacking DNS – just like six years ago

Posted on by

TalkTalk broadband users are complaining they can’t opt out of its Error Replacement Service, which swaps NXDomain DNS results with an IP address. And if that sounds familiar, it should. Users of the budget ISP complained about the very same issue back in 2014.

The Error Replacement Service redirects links to DNS addresses that don’t exist, like those created by fat-fingered address bar typos, to a TalkTalk-run webpage. El Reg reader Louis described it thusly:

“If I type a non-existing domain in the browser, instead of getting the proper ‘Hmm. We’re having trouble finding that site’ message, I get a list of ‘search results’ vaguely linked to the the non-existing domain. This is mildly annoying, as I’d rather not send my typos to some random advertiser,” he said.

His woes don’t stop there – the “service” also prevents him from logging into his work VPN. “During connection, instead of seeing the login window, I see a TalkTalk-branded page with ‘search results’ and I can’t complete the login process,” he complained.

This isn’t an isolated problem. The TalkTalk support forum is flooded with similar complaints, no doubt partially thanks to the rise in home working caused by the COVID-19 epidemic.

TalkTalk offers a way to opt out of the service, requiring users to visit a specific web page and then restart their router. But this appears to be somewhat ineffective, with both Twitter and the TalkTalk forum filled with complaints.

Source: Baby, I swear it’s déjà vu: TalkTalk customers unable to opt out of ISP’s ad-jacking DNS – just like six years ago • The Register

US Judge rules Twitter can’t be transparent about amount of surveillance requests processed per year due to “national security” of the 4th Reich

Posted on by

Six years ago, Twitter sued the US government in an attempt to detail surveillance requests the company had received, but a federal judge on Friday ruled in favor of the government’s case that detailing the requests would jeopardize the country’s safety.

If Twitter revealed the number of surveillance requests it received each calendar quarter, it “would be likely to lead to grave or imminent harm to the national security,” US District Judge Yvonne Gonzalez Rogers concluded after reviewing classified information from the government. See below for the full ruling.

“While we are disappointed with the court’s decision, we will continue to fight for transparency,” Twitter said in a statement Saturday.

The ruling shows the difficulties of balancing privacy and and security on the internet. Public posts and private communications have opened up a treasure trove of information that law enforcement and intelligence services can investigate, and people may not suspect the government is listening in. On the other hand, encryption technology also has opened up communication conduits that are fundamentally impenetrable to government and law enforcement.

In Twitter’s transparency report, now updated for six-month periods, the company publishes numbers on law enforcement information requests, copyright infringement allegations, attempts to spread disinformation, reports of abuse, and other goings-on. The company argued in its 2014 lawsuit it shouldn’t be barred from revealing detailed tallies of national security-related information requests.

“We think the government’s restriction on our speech not only unfairly impacts our users’ privacy, but also violates our First Amendment right to free expression and open discussion of government affairs,” Twitter argued at the time.

Six years later, Twitter says transparency is still important to show how it interacts with governments.

Source: Judge rules against Twitter transparency effort, citing national security – CNET

Edit: You can find some goverment requests here: https://comparite.ch/tech-giant-censorship

Disney Plus’ butt cover-up hides a much bigger problem – corporations feel free to put out revisionist histories

Posted on by

There’s a scene in Touchstone Pictures’ 1984 movie Splash where a young Tom Hanks watches a beautiful naked mermaid run off into the ocean from which she came. In the original version, the camera follows Hanks’ gaze, showing a brief glimpse of a naked butt. Splash received a PG rating because of the shot (and the insinuation that came with it), but people watching the movie on Disney Plus are greeted with an entirely different version of the scene.

In the re-edited version, which went viral, thanks to the tweet below, Disney used CGI hair to cover actress Daryl Hannah’s body. A Disney representative confirmed to The Verge that a “few scenes” from Splash were “slighted edited to remove nudity,” but they did not specify when the edits were made.

The representative also confirmed that Splash’s rating would revert from PG-13 on Disney Plus (different from the original) back to PG. It’s likely that the original film (with its brief nudity) would have been rated PG-13 if it came out a few months later, but Splash was released in March 1984, and the PG-13 rating didn’t exist until July 1984.

The change has bewildered social media users. If nudity was the issue, why not bring Splash to Hulu, Disney’s other streaming service geared toward older adults? Others have asked why Disney felt the need to re-edit the scene at all; Disney Plus allows movies up to a PG-13 rating on its service, and Splash was only rated PG. Another person pointed out that a scene in Thor: Ragnarok that includes Hulk’s naked butt wasn’t censored when it was brought to Disney Plus. (Although, there’s likely a difference in perception between actual nudity and nudity as it pertains to a completely CGI character.)

Splash is the most egregious, albeit hysterical example of movies being re-edited for Disney Plus, but it’s not a unique case. A new version of Star Wars: A New Hope appeared on Disney Plus the day the streaming service launched, one that was “made by George made prior to the Disney acquisition,” the company confirmed to The Verge at the time.

Disney has also instituted pre-roll messages that play before certain movies to inform viewers that scenes have been edited for specific reasons. The company removed the word “fuck” from movies like Adventures in Babysitting and Free Solo, took out racial slurs that appeared in older titles like The Adventures of Bullwhip Griffin, and edited other material in movies like Empire of Dreams that Disney no longer found suitable.

Splash has found itself in the middle of an ongoing debate over media being altered in digital spaces. It’s a debate that’s raged for decades; fans were upset when George Lucas edited A New Hope, making it so Greedo shot first instead of Han. People bemoaned Lucas and 20th Century Fox for not releasing the original version of the film anywhere, either. The only legal versions of A New Hope that exist for people to buy, download, or stream today feature Greedo shooting first. It wasn’t just that Lucas and Fox replaced the original scene with a slightly altered one, but the original also wasn’t available to purchase when reprints were made.

Last March, Simpsons producer James L. Brooks announced that future syndication packages, streaming, and future DVD releases will not include the season 3 premiere episode, “Stark Raving Dad.” The episode includes voice acting from Michael Jackson, and after renewed allegations against Jackson surfaced, The Simpsons’ team and Fox decided to effectively erase the episode. “This is our book, and we’re allowed to take out a chapter,” Brooks told The Wall Street Journal at the time.

“As physical media gives way to streaming, large corporations have greater and greater control over what we can and cannot see,” Slate’s Isaac Butler wrote on the issue. “This gives them unprecedented power to disappear bothersome work. Whether we agree with a particular instance of memory-holing or not, this practice is deeply troubling, its history even more so.”

Disney is more than just a large corporation. It is arguably the monolith. Disney bought 21st Century Fox, the same corporation that Butler wrote his concerns about. Disney also built an entire sales campaign around the idea of restricting access to physical versions of its films — something it referred to for years as “The Vault.” Now, scenes are being edited for its streaming service, and all people are getting is a message explaining why. Subscribers can’t watch the original films the way they were intended.

It’s an effort from companies to be better or more appropriate, but it doesn’t always work. There are better alternatives. Take Tom and Jerry, for example. The Warner Bros. cartoon series from the 1940s came with a disclaimer about the context of certain scenes when it was originally released on DVD by Warner Home Video and then again in 2014 when the episodes were made available digitally on iTunes and Amazon Prime. Warner Bros. didn’t erase or edit the show; instead, the company decided to give it a critical examination. History can’t be erased, but people can learn from it.

Retroactively editing films to suit a certain narrative or niche is an ongoing problem that’s caused concern in movie, television, and music circles. And as more people turn to streaming services, where files can be edited on the fly, concerns over the original presentation continue to grow. What may just be bad CGI hair over a butt in an old Tom Hanks movie today could be more elaborate edits and alterations tomorrow.

Source: Disney Plus’ butt cover-up hides a much bigger problem – The Verge

India says ‘Zoom is a not a safe platform’ and bans government users

Posted on by

India has effectively banned videoconferencing service Zoom for government users and repeated warnings that consumers need to be careful when using the tool.

The nation’s Cyber Coordination Centre has issued advice (PDF) titled “Advisory on Secure use of Zoom meeting platform by private individuals (not for use by government offices/officials for official purpose)”.

The document refers to past advisories that offered advice on how to use Zoom securely and warned that Zoom has weak authentication methods. Neither of those notifications mentioned policy about government use of the tool, meaning the new document is a significant change in position!

The document is otherwise a comprehensive-if-dull guide to using Zoom securely.

[…]

Source: India says ‘Zoom is a not a safe platform’ and bans government users • The Register

ICANN’s founding CEO and chair accuse biz of abandoning principles in push for billion-dollar .org sale

Posted on by

ICANN has been accused by its founding CEO and original chair of abandoning the organization’s core principles and accepting commitments it knows it cannot enforce in order to push through the sale of the .org registry later this week.

In a furious letter [PDF] from Mike Roberts and Esther Dyson to the attorney generals of California and Pennsylvania, the DNS overseer is also accused of circumventing its own decision-making processes and using the coronavirus pandemic to push through the $1.13bn sale.

The two internet veterans ask the state’s top legal representatives to step in and suspend any sale for another six months “to permit your offices, ICANN and the US Congress, to revisit the questions of ICANN’s process and public-interest regulatory duty at a point when the pandemic is no longer the public’s principal concern”.

ICANN is due to decide at a board meeting on Thursday whether to approve or block the sale of the registry from the Internet Society to private equity firm Ethos Capital.

But despite five months of discussions and repeat efforts by Ethos to tackle concerns, many in the internet community remain extremely skeptical of the deal, particularly its financing and the unusual corporate structure of Ethos, which comprises no less than six different companies, all of which were registered on the same day in 2019.

“We write to express our deep dismay at ICANN’s rejection of its defining public-interest regulatory purpose as demonstrated in the totally inappropriate proposed sale of the .ORG delegation,” the letter begins. “ICANN is failing to deliver on the purpose it was created to serve, and is abandoning its core duty to protect the public interest.”

Accountability fail

Roberts was ICANN’s first CEO and was in charge of the organization for its first three years as it attempted to put a structure around the domain name system (DNS).

Dyson was its chair for the first two years. Back then, ICANN was a semi-autonomous body overseen by the US government. That oversight ended in January 2017 after a number of new accountability measures were introduced to ensure ICANN would remain answerable to the internet community rather than itself.

The most important of those new measures is called “Empowered Community” and, in theory, allows the internet community to force the organization to hand over documents and pause decisions. It has failed on its first use, Roberts and Dyson note, referencing a letter from ICANN’s general counsel in February that rejected an effort to use the oversight.

The oversight request [PDF] asked for records covering ICANN’s consideration of the .org sale as well as details on the process it would use to gain the internet community’s approval of its decision. ICANN responded [PDF] by claiming the request “exceeded the permissible scope” of the mechanism and refused to hand over any documents.

Source: ICANN’s founding CEO and chair accuse biz of abandoning principles in push for billion-dollar .org sale • The Register

Apple: We respect your privacy so much we’ve revealed a little about what we can track when you use Maps

Posted on by

Apple has released a set of “Mobility Trends Reports” – a trove of anonymised and aggregated data that describes how people have moved around the world in the three months from 13 January to 13 April.

The data measures walking, driving and public transport use. And as you’d expect and as depicted in the image atop this story, human movement dropped off markedly as national coronavirus lockdowns came into effect.

Apple has explained the source of the data as follows:

This data is generated by counting the number of requests made to Apple Maps for directions in select countries/regions and cities. Data that is sent from users’ devices to the Maps service is associated with random, rotating identifiers so Apple doesn’t have a profile of your movements and searches. Data availability in a particular country/region or city is subject to a number of factors, including minimum thresholds for direction requests made per day.

Apple justified the release by saying it thinks it’ll help governments understand what its citizens are up to in these viral times. The company has also said this is a limited offer – it won’t be sharing this kind of analysis once the crisis passes.

But the data is also a peek at what Apple is capable of. And presumably also what Google, Microsoft, Waze, Mapquest and other spatial services providers can do too. Let’s not even imagine what Facebook could produce. ®

Source: Apple: We respect your privacy so much we’ve revealed a little about what we can track when you use Maps • The Register

Twitter Obliterates Its Users’ Privacy Choices

Posted on by

The EFF’s staff technologist — also an engineer on Privacy Badger and HTTPS Everywhere, writes: Twitter greeted its users with a confusing notification this week. “The control you have over what information Twitter shares with its business partners has changed,” it said. The changes will “help Twitter continue operating as a free service,” it assured. But at what cost?

Twitter has changed what happens when users opt out of the “Allow additional information sharing with business partners” setting in the “Personalization and Data” part of its site. The changes affect two types of data sharing that Twitter does… Previously, anyone in the world could opt out of Twitter’s conversion tracking (type 1), and people in GDPR-compliant regions had to opt in. Now, people outside of Europe have lost that option. Instead, users in the U.S. and most of the rest of the world can only opt out of Twitter sharing data with Google and Facebook (type 2).
The article explains how last August Twitter discovered that its option for opting out of device-level targeting and conversion tracking “did not actually opt users out.” But after fixing that bug, “advertisers were unhappy. And Twitter announced a substantial hit to its revenue… Now, Twitter has removed the ability to opt out of conversion tracking altogether.”

While users in Europe are protected by GDPR, “users in the United States and everywhere else, who don’t have the protection of a comprehensive privacy law, are only protected by companies’ self-interest…” BoingBoing argues that Twitter “has just unilaterally obliterated all its users’ privacy choices, announcing the change with a dialog box whose only button is ‘OK.’

Source: Twitter Accused of Obliterating Its Users’ Privacy Choices – Slashdot

Mozilla installs Scheduled Telemetry Task on Windows with Firefox 75 – if you had put telemetry on

Posted on by

Observant Firefox users on Windows who have updated the web browser to Firefox 75 may have noticed that the upgrade brought along with it a new scheduled tasks. The scheduled task is also added if Firefox 75 is installed on a Windows device.

The task’s name is Firefox Default Browser Agent and it is set to run once per day. Mozilla published a blog post on the official blog of the organization that provides information on the task and why it has been created.

firefox default browser agent

According to Mozilla, the task has been created to help the organization “understand changes in default browser settings”. At its core, it is a Telemetry task that collects information and sends the data to Mozilla.

Here are the details:

  • The Task is only created if Telemetry is enabled. If Telemetry is set to off (in the most recently used Firefox profile), it is not created and thus no data is sent. The same is true for Enterprise telemetry policies if they are configured. Update: Some users report that the task is created while Telemetry was set to off on their machine.
  • Mozilla collects information “related to the system’s current and previous default browser setting, as w2ell as the operating system locale and version”.
  • Mozilla notes that the data cannot be “associated with regular profile based telemetry data”.
  • The data is sent to Mozilla every 24 hours using the scheduled task.

Mozilla added the file default-browser-agent.exe to the Firefox installation folder on Windows which defaults to C:\Program Files\Mozilla Firefox\.

Firefox users have the following options if they don’t want the data sent to Mozilla:

  • Firefox users who opted-out of Telemetry are good, they don’t need to make any change as the new Telemetry data is not sent to Mozilla; this applies to users who opted-out of Telemetry in Firefox or used Enterprise policies to do so.
  • Firefox users who have Telemetry enabled can either opt-out of Telemetry or deal with the task/executable that is responsible.

Disable the Firefox Default Browser Agent task

firefox-browser agent task disabled

Here is how you disable the task:

  1. Open Start on the Windows machine and type Task Scheduler.
  2. Open the Task Scheduler and go to Task Scheduler Library > Mozilla.
  3. There you should find listed the Firefox Default Browser Agent task.
  4. Right-click on the task and select Disable.
  5. Note: Nightly users may see the Firefox Nightly Default Browser Agent task there as well and may disable it.

The task won’t be executed anymore once it is disabled.

Closing Words

The new Telemetry task is only introduced on Windows and runs only if Telemetry is enabled (which it is by default [NOTE: Is it? I don’t think so! It asks at install!]). Mozilla is transparent about the introduction and while that is good, I’d preferred if the company would have informed users about it in the browser after the upgrade to Firefox 75 or installation of the browser and before the task is executed the first time.

Source: Mozilla installs Scheduled Telemetry Task on Windows with Firefox 75 – gHacks Tech News

Go  to about:telemetry in Firefox to see what it’s collecting. In my case this was none, because when FF was installed it asked me whether I wanted it on or off and I said off.

Creepy Face Recognition Firm Clearview AI Sure Has a Lot of Ties to the Far Right – the extremist kinds of far right

Posted on by

Clearview AI, the dystopian face recognition company that claims to have amassed a database of billions of photos, signed contracts with hundreds of law enforcement agencies, and shopped its app around to the rich and powerful, has extensive links to the far right, according to a Huffington Post investigation. In fact, one of its associates claimed to have been working on a face recognition product explicitly designed to be useful for mass deportations.

Founder Hoan Ton-That’s has links to the far-right movement that move right past suspicious into obvious, according to HuffPo. He reportedly attended a 2016 dinner with white supremacist Richard Spencer and organized by alt-right financier Jeff Giesea, an associate of Palantir founder and Trump-supporting billionaire Peter Thiel. (Thiel secretly bankrolled a lawsuit that bankrupted Gizmodo’s former parent company, Gawker Media.) Ton-That was also a member of a Slack channel run by professional troll Chuck Johnson for his now-defunct WeSearchr, a crowdfunding platform primarily used by white supremacists; that channel included people like the webmaster of neo-Nazi site Daily Stormer, Andrew Auernheimer, and conspiracy theorist Mike Cernovich,

Per HuffPo, in January 2017 Johnson posted on Facebook that he was working on “building algorithms to ID all the illegal immigrants for the deportation squads.” Another source told HuffPo that they had seen him bragging about that work to “a whole bunch of really important people” at Trump’s DC hotel that spring, introducing them to a man the source identified as almost certainly being Ton-That.

Johnson, who was involved with Trump’s transition team, also hit up then-Breitbart employee Katie McHugh, who at that time was a white supremacist but has since left the movement. McHugh told HuffPo that Johnson asked to be put in contact with ghoulish Trump adviser Stephen Miller so he could tout a “way to identify every illegal alien in the country.” (It’s unclear whether that happened, but Clearview’s clients include Immigration and Customs Enforcement and the FBI.) That same year, Thiel invested $200,000 in Clearview.

Smartcheckr’s labor pool also included many ethnonationalists who believe in purging the U.S. of nonwhites, according to HuffPo. One of those was hardcore racist and Johnson associate Tyler Bass, who described himself as an “investigator” doing “remote software testing” for the app and whose LinkedIn posts suggest may have had access to law enforcement data associated with criminal investigations as late as 2018. Bass also claimed to McHugh to have been in attendance at a disastrous far-right rally in Charlottesville, Virginia in 2017, where a neo-Nazi terror attack killed protester Heather Heyer and wounded scores of others.

Another was Douglass Mackey, the overseer of a vast online racist propaganda operation under the moniker “Ricky Vaughn,” had a role as a contract consultant for Smartcheckr. While there, he touted the use of its face recognition tools to anti-Semitic congressional candidate Paul Nehlen for extreme campaign opposition research. (Ton-That told HuffPo that Mackey was only a contractor for three weeks and his offer to Nehlen was unauthorized, though Smartcheckr employees took steps to distance themselves from Mackey after he was outed as “Ricky Vaughn” in 2018.)

There was also Marko Jukic, HuffPo wrote, a Clearview AI employee who marketed its products to police departments and had a history as a prolific contributor to extremist blogs, including a post where he advocated “segregation and separation” of Jews. One of Clearview’s lawyers, Tor Ekeland, is best known for representing far-right provocateurs and racists like Auernheimer.

Johnson appears to have had access to WeSearchr until at least January 2020, when he showed a fellow passenger on a flight to Boston a powerful face recognition app on his phone, according to a BuzzFeed report. In a statement to HuffPo, Ton-That denied that Johnson was an “executive, employee, consultant” or board member of Clearview, though he didn’t clarify whether Johnson holds equity in the company. He also told the site that Clearview has severed ties with Bass and Jukic, claiming he was “shocked by and completely unaware of Marko Jukic’s online writings under a different name.” (Jukic used the same pseudonym to talk with Ton-That on Slack and email that he did in his racist blog posts, HuffPo noted.)

Ton-That also told the site that he grew up on the internet, which “not always served me well” during his upbringing, ad“There was a period when I explored a range of ideas—not out of belief in any of them, but out of a desire to search for self and place in the world. I have finally found it, and the mission to help make America a safer place. To those who have read my words in the Huffington Post article, I deeply apologize for them.”

Clearview built its face recognition database by scraping photos en masse from public social media posts, a practice that is technically legal but could expose it to significant civil liability from rights holders. While scraping is legal, Clearview’s business practices have resulted in cease-and-desists from Silicon Valley giants like Google, and may have run afoul of other laws. The state attorney general of Vermont filed a lawsuit against the company last month alleging violations of the Vermont Consumer Protection Act and a state data broker law, while the AG of New Jersey ordered all police in the state to stop using Clearview products. Canadian privacy commissioners are investigating the company; it is also facing two class action lawsuits, one of which alleges that the company violated Illinois biometrics laws.

Source: Creepy Face Recognition Firm Clearview AI Sure Has a Lot of Ties to the Far Right

Facebook asks users about coronavirus symptoms, releases friendship data to researchers

Posted on by

Facebook Inc said on Monday it would start surveying some U.S. users about their health as part of a Carnegie Mellon University research project aimed at generating “heat maps” of self-reported coronavirus infections.

The social media giant will display a link at the top of users’ News Feeds directing them to the survey, which the researchers say will help them predict where medical resources are needed. Facebook said it may make surveys available to users in other countries too, if the approach is successful.

Alphabet Inc’s Google, Facebook’s rival in mobile advertising, began querying users for the Carnegie Mellon project last month through its Opinion Rewards app, which exchanges responses to surveys from Google and its clients for app store credit.

Facebook said in a blog post that the Carnegie Mellon researchers “won’t share individual survey responses with Facebook, and Facebook won’t share information about who you are with the researchers.”

The company also said it would begin making new categories of data available to epidemiologists through its Disease Prevention Maps program, which is sharing aggregated location data with partners in 40 countries working on COVID-19 response.

Researchers use the data to provide daily updates on how people are moving around in different areas to authorities in those countries, along with officials in a handful of U.S. cities and states.

In addition to location data, the company will begin making available a “social connectedness index” showing the probability that people in different locations are Facebook friends, aggregated at the zip code level.

Laura McGorman, who runs Facebook’s Data for Good program, said the index could be used to assess the economic impact of the new coronavirus, revealing which communities are most likely to get help from neighboring areas and others that may need more targeted support.

New “co-location maps” can similarly reveal the probability that people in one area will come in contact with people in another, Facebook said.

Source: Facebook asks users about coronavirus symptoms, releases friendship data to researchers – Reuters

This might actually be a good way to use all that privacy invading data

Dr. Drew Pinsky Played Down COVID-19, Then Tries To DMCA Away The Evidence

Posted on by

Update: The full video is now back up and it’s even worse than the original clip we posted. It’s unclear if it went back up thanks to YouTube deciding it was fair use, or Pinsky removing the bogus takedown. Either way, watch it here:

Copyright system supporters keep insisting to me that copyright is never used for censorship, and yet over and over again we keep seeing examples that prove that wrong. The latest is Dr. Drew Pinsky, the somewhat infamous doctor and media personality, who has been one of the more vocal people in the media playing down the impact of the coronavirus. In a video that had gone viral on Twitter and YouTube, it showed many, many, many clips of Dr. Drew insisting that COVID-19 was similar to the flu, and that it wouldn’t be that bad. Assuming it hasn’t been taken down due to a bogus copyright claim, you can hopefully see it below:

As you can see, for well over a month, deep into March when it was blatantly obvious how serious COVID-19 was, he was playing down the threat. Beyond incorrectly comparing it to the flu (saying that it’s “way less virulent than the flu” on February 4th — by which time it was clearly way more virulent than the flu in China), he said the headlines should say “way less serious than influenza,” he insisted that the lethality rate was probably around “0.02%” rather than the 2% being reported. On February 7th, he said your probability of “dying from coronavirus — much higher being hit by an asteroid.” He also mocked government officials for telling people to stay home, even at one point in March saying he was “angry” about a “press-induced panic.” On March 16th, the same day that the Bay Area in California shut down, he insisted that if you’re under 65 you have nothing to worry about, saying “it’s just like the flu.” This was not in the distant past. At one point, a caller to his show, again on March 16th, said that because it’s called COVID-19 that means there were at least 18 others of them, and that’s why no one should worry — and Drew appeared to agree, making it appear he didn’t even know that the 19 refers to the year not the number of coronaviruses, and even though there are other coronaviruses out there, this one was way more infectious and deadly, so it doesn’t matter.

To give him a tiny bit of credit, on Saturday, Pinsky posted a series of choppy videos on Twitter in which he flat out said that he was wrong and he was sorry for his earlier statements, and said that he regretted his earlier statements. He also claimed that he signed up to help in California and NY if he was needed. But, even that apology seems weak in the face of what else he said in those videos… and, more importantly, his actions. In terms of what he said, he kept saying that he always said to listen to Dr. Fauci and to listen to your public health officials. Amazingly, at one point in his apology video, he insists that he thinks the real reason why New York got hit so bad is because of hallways and trains. Yet, in the video above, at one point he literally mocks NYC Mayor de Blasio for telling people to avoid crowded trains, saying: “de Blasio told them not to ride the trains! So they’re not riding the trains! So I am! [guffaw] I mean, it’s ridiculous.”

Given that, it’s a bit difficult to take him seriously when he claims that all along he always said to listen to your public officials, when just a few weeks ago he was mocking them. Indeed, as multiple people have pointed out, the issue here isn’t so much that Pinsky was wrong — in the early days, when there wasn’t as much info, lots of people got things wrong about COVID-19 (though Pinsky kept it up way way after most others recognized how serious it was), but that he acted so totally sure about his opinions that this was nothing to worry about. It was the certainty with which he said what he said that was so much of the problem, including deep into it already being a pandemic with local officials warning people to stay home.

But, even worse, just as he was doing the right thing and mostly apologizing… he was trying to hide those earlier clips that made him look so, so, so bad. His organization began sending out DMCA notices. If you went to the original YouTube upload you got this:

That says: “This video is no longer available due to a copyright claim by Drew Pinsky Inc.” Now, some might argue that it was just some clueless staffer working for Dr. Drew sending off bogus DMCAs, or maybe an automated bot… but nope. Drew himself started tweeting nonsense about copyright law at people. I originally linked to that tweet, but sometime on Sunday, after thousands of people — including some of the most famous lawyers in the country — explained to him why it was nonsense, he deleted it. But I kept a screenshot:

That says, amazingly:

Infringing copywrite laws is a crime. Hang onto your retweets. Or erase to be safe.

The wrongness-to-words ratio in that tweet is pretty fucking astounding. First of all, the layup: it’s copyright, Drew, not copywrite. Make sure you know the name of the fucking law you’re abusing to censor someone before tossing it out there. Second, no, infringing copyright is not a crime. Yes, there is such a thing as criminal copyright infringement, but this ain’t it. Someone posting a video of you would be, at best, civil infringement. For it to be criminal, someone would have to be making copies for profit — like running a bootleg DVD factory or something. Someone posting a 2 minute clip of your nonsense is not that.

Most important, however, this isn’t even civil infringement, thanks to fair use. Putting up a 2 minute video showing a dozen or so clips of Drew making an ass of himself is not infringing. It’s classic fair use — especially given the topic at hand.

So it’s really difficult to believe that Drew is really owning up to his mistakes when at the same time he says he’s sorry, he’s actively working to abuse the law to try to silence people from highlighting his previous comments. Also, someone should point him to Lenz v. Universal in which a court said that before sending a takedown, you need to take fair use into consideration. It certainly appears that Drew hasn’t the foggiest idea how copyright law works, so it seems unlikely he considered fair use at all.

I certainly understand that he likely regrets his earlier comments. And I appreciate his willingness to admit that he was wrong. But to really take ownership of your previous errors, you shouldn’t then be working doubletime to try to delete them from the internet and hide them from view. That’s not taking ownership of your mistakes, that’s trying to sweep them under the rug.

Source: Dr. Drew Pinsky Played Down COVID-19, Then Tries To DMCA Away The Evidence | Techdirt

For the past five years, every FBI secret spy court request to snoop on Americans has sucked, says watchdog

Posted on by

Analysis The FBI has not followed internal rules when applying to spy on US citizens for at least five years, according to an extraordinary report [PDF] by the Department of Justice’s inspector general.

The failure to follow so-called Woods Procedures, designed to make sure the FBI’s submissions for secret spying are correct, puts a question mark over more than 700 approved applications to intercept and log every phone call and email made by named individuals.

Under the current system, the Feds apply to the Foreign Intelligence Surveillance Court (FISC), which can then grant the investigative agency extraordinary spying powers. These can also be granted retroactively if the agency needs to move quickly.

Back in 2001, however, a number of FISA warrants were found to have been granted on unverified information, driving the creation of the Woods Procedures, named after the FBI official who drew them up, Michael Woods.

Following a review last year of one of those successful applications that targeted a Trump campaign staffer called Carter Page, the FBI was found to have made “fundamental and serious errors” in its application. Inspector general Michael Horowitz then expanded his review to another 29 applications dated from October 2014 to September 2019 out of a pool of over 700 and found the same problems in every single other case he looked at, pointing to a systemic problem.

As a result, more than five years’ worth of secret spying activities by the US government may be illegitimate. Horowitz found the same “basic and fundamental errors” in every application.

Unaccountable

The FISA Court has long been highlighted by critics as an unaccountable body with extraordinary powers. Except for very rare occasions, only one side – the government – can present its case to the judges and as a result the court has approved almost every application. The process is wide open to abuse, critics have argued, and so it turns out to have been the case.

The Woods Procedures include things like sufficient supporting documentation of any assertions, a second review of any facts and assertions, and a re-verification of facts whenever an extension is applied for. They are a check and balance on power.

“We do not have confidence that the FBI has executed its Woods Procedures in compliance with FBI policy,” the report states.

It says that it couldn’t review files for four of the 29 selected FISA applications because the FBI has not been able to locate them and, in three of these instances, did not know if the files ever existed.

All of the 25 applications reviewed had “inadequately supported facts,” and “FBI and NSD officials we interviewed indicated to us that there were no efforts by the FBI to use existing FBI and NSD oversight mechanisms.”

Ah yeah but it’s all fixed now

Somewhat amazingly, the FBI doesn’t dispute the findings. The inspector general provided his report to the FBI and prosecutors for their feedback, and appended their responses to the report.

Neither the Feds nor the Dept of Justice denies the assertion that the FBI has not followed its own rules. And both argue that recent proposed changes, prompted solely by the inspector general’s previous report and which critics assert do not go far enough, have effectively fixed the issues.

There is no mention in either response or in the inspector general’s report of what the implications are for the hundreds of people that have been subject to secret spying orders that allow federal agents to track everything that person does and says.

But then, there may not be any implications because under the FISA rules, the person subjected to the spying is not informed of the order against them, even when the spying is over. And they are not even entitled to know or see any evidence compiled against them as a result of the spying operation, even if they are charged as a result of the spying.

It is, in short, a sign that the FBI cannot be trusted to follow its own rules even when those rules apply to the most invasive powers it can be given

Source: For the past five years, every FBI secret spy court request to snoop on Americans has sucked, says watchdog • The Register