Tails 3.0 – anonymous live OS is out

Tails is a live operating system that you can start on almost any computer from a DVD, USB stick, or SD card.

It aims at preserving your privacy and anonymity, and helps you to:

use the Internet anonymously and circumvent censorship;
all connections to the Internet are forced to go through the Tor network;
leave no trace on the computer you are using unless you ask it explicitly;
use state-of-the-art cryptographic tools to encrypt your files, emails and instant messaging.

https://tails.boum.org/index.en.html

Facebook’s Emotion Tech: Patents Show New Ways For Detecting And Responding To Users’ Feelings

Facebook’s newest patent, granted May 25, aims to monitor users’ typing speed to predict emotions and adapt messages in response.

We took a look at some of Facebook’s emotion-based patents to understand how the company is thinking about capturing and responding to people’s emotional reactions, which has been a tricky area for consumer tech companies but key to their future. On the one hand, they want to identify which content is most engaging and respond to audience’s reactions, on the other emotion-detection is technically difficult, not to mention a PR and ethical minefield.

Source: Facebook’s Emotion Tech: Patents Show New Ways For Detecting And Responding To Users’ Feelings

Dutch Usenetprovider Eweka forced by judge to hand over personal details to BREIN without judicial oversight

A Dutch judge has said that the usenet provider needs to hand over personal details to BREIN (the Dutch version of the RIAA) without any reason other than that BREIN wants them or face a fine of EUR 1000,- per day. It’s pretty bizarre that some commercial entity can raid anyones private data because they feel like it, but it looks like the North Holland judge prefers cash money to personal interests and judicial oversight.

De rechtbank Noord-Holland heeft vonnis gewezen in een zaak tussen BREIN en Usenetprovider Eweka. Eweka handelt onrechtmatig door BREIN niet terstond – zonder gerechtelijk vonnis – identificerende gegevens te verschaffen van een uploader van auteursrechtelijk beschermd materiaal. Dat moet alsnog gebeuren op verbeurte van een dwangsom van 1000 euro per dag.

Source: Usenetprovider Eweka moet persoonsgegevens overleggen – Emerce

Chinese Windows 10 doesn’t spy on you

Weg met telemetrie en ruime dataverzameling – het kan dus wel.

Source: Wil je privacy? Gebruik dan de Chinese Windows 10!

Microsoft has released a version of Windows 10 for the Chinese (!) market that doesn’t send all sorts of telemetry and private data to itself. This version is not available for the rest of us, in the rest of the world, Microsoft still has you as a secondary product.

Apple Rolls Out New Feature That Permanently Associates Devices with Apps, Even After Deletion

Tim Cook once scolded Travis Kalanick about Uber’s practice of tracking users even after they deleted the app from their iPhones. But in its newest operating system, iOS 11, Apple is rolling out a feature that will allow the same type of tracking—but with fewer privacy implications.

Apple’s new feature is called DeviceCheck and, if developers choose to use it, it will allow them to fingerprint and persistently track users’ iPhones, even if a user deletes the app or wipes their phone completely, using Apple as an intermediary.

To be clear, this kind of fingerprinting does not allow for location tracking. It lets developers keep track of former users’ devices so that, if they ever come back to the app, the developers will know they’ve been there before.

Source: Apple Rolls Out New Feature That Permanently Associates Devices with Apps, Even After Deletion

So what happens if you buy a second hand iphone?

Google now mingles everything you’ve bought with everywhere you’ve been

The credit card companies began to monetise the histories a few years ago. Facebook signed deals with data companies including Experian, allowing it to mingle third party offline and online data, something it also calls “closing the loop”. Last year Facebook was reported to combine six or seven data sources to create its “Facebook Graph”.

Last year too, Google created “super profiles” of its users, breaking an earlier promise never to mingle data from your search history, YouTube viewing history or GPS location (constantly tracked by Android) with DoubleClick cookie information unless you explicitly opted in. Super profiles have prompted an antitrust complain from Oracle, arguing that the combined data hoard creates an insurmountable barrier to entry for any ad competitor to Google.

“The new credit-card data enables the tech giant to connect these digital trails to real-world purchase records in a far more extensive way than was possible before,” the WaPo reports. “Neither gets to see the encrypted data that the other side brings.”

Source: Google now mingles everything you’ve bought with everywhere you’ve been • The Register

Pretty scary that your credit card history is being sold – i was not aware of that fact!

In the US Net Neutrality race, fake comments are being placed in their thousands, supporting the inane idea of getting rid of net neutrality.

Fourteen Americans (with the help of an advocacy group) are complaining to the FCC that their names were used without permission to file fake comments on the proposed net neutrality overhaul.

A letter [PDF] sent to FCC Chairman Ajit Pai and signed by the 14 people claims that their names and addresses were used to post comments in support of the planned Title II elimination for ISPs.

“We are disturbed by reports that indicate you have no plans to remove these fraudulent comments from the public docket,” they write.

“Whoever is behind this stole our names and addresses, publicly exposed our private information without our permission, and used our identities to file a political statement we did not sign onto.”

The letter does not name any specific company or group as being behind the filings.

A quick check of the names on the letter with the FCC’s comment site found that nearly all were indeed used to file form comments. One of the signed names does not appear to be associated with any comments on file right now, while another name was connected with eight identical comments.

The letter is part of a campaign being conducted by digital rights group Fight for the Future to expose what it claims are hundreds of thousands of fake comments posted by or on behalf of telcos who support Ajit Pai’s planned overhauls.

Source: US citizens complain their names were used for FCC robo-comments • The Register

EU axes geo-blocking: Upsets studios, delights consumers

The European Parliament has approved a draft law that geo-blocking, the act of offering an online content service in one European Union (EU) country and that country alone, will be scrapped in the first half of next year.

Coupled with the recent law to end mobile roaming charges in the EU as of next month, the OTT industry as a whole stands to flourish in Europe over the next few years. However, the losers here will be the content creators, which argue that the removal of geo-blocking will weaken the financial value of content, as well as the pay TV operators, as the ruling will trigger a small spate of cord cutting for consumers with two or more properties in multiple EU countries. But the move is also a hammer blow to content pirates.

Source: EU axes geo-blocking: Upsets studios, delights consumers • The Register

There is a lot more worthwhile on the pros and cons – overall I am happy to see the digital single market catch up to the physical single market.

EU wants content filtering by entertainment industry on everything posted online

De Europese Commissie wil dat internetaanbieders en hostingpartijen, maar ook platformen zoals Facebook, monitoren wat hun gebruikers publiceren. Elke tekst, foto en filmpje dat gebruikers wil zetten zou dan eerst door een filter van de entertainmentindustrie gehaald moeten worden. Hoe zoiets in de praktijk zou moeten werken is volstrekt onduidelijk.

Source: Massaal verzet tegen omstreden EU contentfilters – Emerce

They want ISPs and hosts as well as content providers such as Facebook to filter all posted content through an entertainment industry filter before posting online. How this will work – technically as well as who has oversight over what the entertainment industry deems inappropriate – is unclear. This kind of censorship on a massive scale is exactly why we fought the Nazis and the Cold War: for a free and open society.

Netgear ‘fixes’ Nighthawk router by adding phone-home features that record your IP and MAC address

Netgear NightHawk R7000 users who ran last week’s firmware upgrade need to check their settings, because the company added a remote data collection feature to the units.

A sharp-eyed user posted the T&Cs change to Slashdot.

Netgear lumps the slurp as routine diagnostic data.

“Such data may include information regarding the router’s running status, number of devices connected to the router, types of connections, LAN/WAN status, WiFi bands and channels, IP address, MAC address, serial number, and similar technical data about the use and functioning of the router, as well as its WiFi network.”

Much of this is probably benign, but posters to the Slashdot thread were concerned about IP address and MAC address being collected by the company.

The good news is that you can turn it off: the instructions are here.

Source: Netgear ‘fixes’ router by adding phone-home features that record your IP and MAC address

Lib Dems pledge to end ‘Orwellian’ snooping powers in manifesto

The Liberal Democrats have pledged to end the “Orwellian nightmare” of mass-snooping powers in the Investigatory Powers Act ahead of their manifesto launch.

They will propose to roll back state surveillance powers by ending the indiscriminate bulk collection of communications data and internet connection records.

The party also committed to fighting Conservative attempts to undermine encryption, which it warned will put people’s online security at risk.

It comes as a recent leaked draft document from the Home Office has revealed that government aims to be able to access anyone’s communications within 24 hours and to bring an end to encrypted messages under the recently passed Investigatory Powers Bill.

Under the plans, companies would be legally required to introduce a backdoor to their systems so authorities can read all correspondence if required.

Source: Lib Dems pledge to end ‘Orwellian’ snooping powers in manifesto

Finally someone who cares!

Google AI has access to 1.6m NHS patients data – without permission

The document – a data-sharing agreement between Google-owned artificial intelligence company DeepMind and the Royal Free NHS Trust – gives the clearest picture yet of what the company is doing and what sensitive data it now has access to.

The agreement gives DeepMind access to a wide range of healthcare data on the 1.6 million patients who pass through three London hospitals run by the Royal Free NHS Trust – Barnet, Chase Farm and the Royal Free – each year. This will include information about people who are HIV-positive, for instance, as well as details of drug overdoses and abortions. The agreement also includes access to patient data from the last five years.

Source: Revealed: Google AI has access to huge haul of NHS patient data | New Scientist

It goes beyond belief that this much patient data is given (sold?) to a commercial entity by the NHS without agreement from the people involved.

Bloke charged under UK terror law for refusing to cough up passwords without cause

British police have charged a man under antiterror laws after he refused to hand over his phone and laptop passwords.

Muhammad Rabbani, international director of CAGE, was arrested at Heathrow in November after declining to unlock his devices, claiming they contained confidential testimony describing torture in Afghanistan as well as information on high-ranking officials. CAGE positions itself as a non-profit organization that represents and supports families affected by the West’s TWAT (aka The War Against Terror).

On Wednesday this week, he was charged under Schedule 7 of the Terrorism Act 2000: specifically, he is accused of obstructing or hampering an investigation by refusing to cough up his login details.

“On 20 November 2016, at Heathrow Airport, he did willfully obstruct, or sought to frustrate, an examination or search under Schedule 7 of the Terrorism Act 2000, contrary to paragraph 18(1)(c) of that Schedule,” London’s Metropolitan Police alleged. “He is due to appear in Westminster Magistrates’ Court on 20 June.”

If found guilty, Rabbani could face up to three months in prison and a fine of £2,500 (US$3,242). He has said he will fight the case and is hopeful of winning. He claims he has been stopped under Schedule 7 about 20 times and has always refused to hand over his passwords. However, it appears that the Met is now ready to test this case in court, so formal charges have been brought.
[…]
What makes Schedule 7 rather tricksy is that no evidence is required to pull someone over for questioning under the law. Usually, Brit officers must have at least reasonable suspicion of a crime before collaring a suspect, but under these antiterror rules, they can hold and quiz people for up to nine hours with no evidence at all.

Source: Bloke charged under UK terror law for refusing to cough up passwords

Welcome to the Brexit concentration camp

Banking association calls for end of ‘screen-scraping’

The European Banking Federation (EBF) has asked the EU Commission to support a ban on “screen scraping”.

Screen-scraping services, seen as a first-generation direct access technology, allow third parties to access bank accounts on a client’s behalf using the client’s access credentials.

The Revised Directive on Payment Services (PSD2) introduces a general security upgrade for third-party access to a client’s data.

Earlier this month, 65 European fintech firms made their opposition to this known, stating in a manifesto (PDF) that “[T]he only functioning technology used for bank-independent [payment initiation services] and [account information services] must not be foreclosed.”

Privacy of client data, cybersecurity and innovation are all at risk if European Banking Authority (EBA) standards are dismissed and screen scraping continues, the EBF argues.

The proposal requires banks to opt for either creating a “dedicated interface” that lets third parties access bank accounts on behalf of clients, or to upgrade their client interface. The EBF wants to see PSD2 delivered within the framework of (EBA) standards and the end of screen-scraping.

The European Commission appears to be willing to go against the EBA advice and allow screen-scraping to continue.

Source: Banking association calls for end of ‘screen-scraping’

Then there is some ridiculous analogy to putting a diesel engine on an aircraft. Having to recode your fintech software to PSD2 – which may be incomplete and missing important functionality – is expensive and thus weeds out the crop of fintech companies. In my experience it’s usually better for customers to have large amounts of competing products than to be locked into a mono- or duopoly.

Tesla factory workers reveal pain, injury and stress: ‘Everything feels like the future but us’

Ambulances have been called more than 100 times since 2014 for workers experiencing fainting spells, dizziness, seizures, abnormal breathing and chest pains, according to incident reports obtained by the Guardian. Hundreds more were called for injuries and other medical issues.
[…]
However, some Tesla workers argue the company’s treatment of injured workers discourages them from reporting their injuries. If workers are assigned to “light duty” work because of an injury, they are paid a lower wage as well as supplemental benefits from workers’ compensation insurance, a practice that Tesla said was in line with other employers and California law. Tesla said some injured employees are also able to undertake “modified work” on regular pay.

“I went from making $22 an hour to $10 an hour,” said a production worker, who injured his back twice while working at Tesla. “It kind of forces people to go back to work.”

Source: Tesla factory workers reveal pain, injury and stress: ‘Everything feels like the future but us’ | Technology | The Guardian

Uber Doesn’t Want You to See This Document About Its Vast Data Surveillance System

The ever-expanding operations of Uber are defined by two interlocking and zealously guarded sets of information: the things the world-dominating ride-hailing company knows about you, and the things it doesn’t want you to know about it. Both kinds of secrets have been in play in the Superior Court of California in San Francisco, as Ward Spangenberg, a former forensic investigator for Uber, has pursued a wrongful-termination lawsuit against the company.

Source: Uber Doesn’t Want You to See This Document About Its Vast Data Surveillance System

It’s a good rundown on the Uber stories and privacy invasions that have been happening recently.

Cop fakes body cam footage through re-enactment, prosecutors drop drug charges

Prosecutors in Pueblo, Colorado are dropping felony drug and weapon-possession charges after an officer involved in the case said he staged body cam footage so he could walk “the courts through” the vehicle search that led to the arrest.

The development means that defendant Joseph Cajar, 36, won’t be prosecuted on allegations of heroin possession and of unlawful possession of a handgun. The evidence of the contraband was allegedly found during a search of Cajar’s vehicle, which was towed after he couldn’t provide an officer registration or insurance during a traffic stop. Officer Seth Jensen said he found about seven grams of heroin and a .357 Magnum in the vehicle at the tow yard. But the actual footage of the search that he produced in court was a reenactment of the search, the officer told prosecutors.

Cajar’s attorney said the development, which comes as more and more police agencies are deploying body cams, is a disturbing use of technology.

“Everyone who looked at the video believed it was in-time documentation of what actually happened,” lawyer Joe Koncilja told Ars. The video, he said, shows the officer is “surprised by the fact that he found the gun. It’s tampering with evidence.” The video was shown in court during a March preliminary hearing where a judge found sufficient evidence to prosecute Cajar.

Source: Cop fakes body cam footage, prosecutors drop drug charges

On the plus side, the officer did mention it was a re-enactment. Dropping the charges sounds strange though, because it’s still the word of 2 cops vs 1 crim and that alone should carry enough weight. If it doesn’t, where’s the trust in law enforcement? Especially as the cop mentions it’s a re-enactment.

Leaked: The UK’s secret blueprint with telcos for mass spying on internet, phones – and backdoors

The UK government has secretly drawn up more details of its new bulk surveillance powers – awarding itself the ability to monitor Brits’ live communications, and insert encryption backdoors by the backdoor.

In its draft technical capability notices paper [PDF], all communications companies – including phone networks and ISPs – will be obliged to provide real-time access to the full content of any named individual within one working day, as well as any “secondary data” relating to that person.

That includes encrypted content – which means that UK organizations will not be allowed to introduce true end-to-end encryption of their users’ data but will be legally required to introduce a backdoor to their systems so the authorities can read any and all communications.
[…]
This act of stripping away safeguards on people’s private data is also fantastic news for hackers, criminals, and anyone else who wants to snoop on Brits. The seals are finally coming off.

“This lays bare the extreme mass surveillance this Conservative government is planning after the election,” Liberal Democrat President Sal Brinton told us in a statement.

“It is a full frontal assault on civil liberties and people’s privacy. The security services need to be able to keep people safe. But these disproportionate powers are straight out of an Orwellian nightmare and have no place in a democratic society.”

Source: Leaked: The UK’s secret blueprint with telcos for mass spying on internet, phones – and backdoors

234 Android Applications Are Currently Using Ultrasonic Beacons to Track Users

uXDT is the practice of advertisers hiding ultrasounds in their ads. When the ad plays on a TV or radio, or some ad code runs on a mobile or computer, it emits ultrasounds that are picked up by the microphone of nearby laptops, desktops, tablets or smartphones.

SDKs embedded in apps installed on those devices relay the beacon back to the online advertiser, who then knows that the user of TV “x” is also the owner of smartphone “Y” and links their two previous advertising profiles together, creating a broader picture of the user’s interests, device portfolio, home, and even family members.
[…]
Their results revealed Shopkick ultrasonic beacons at 4 of 35 stores in two European cities. The situation isn’t that worrisome, as users have to open an app with the Shopkick SDK for the beacon to be picked up.

Source: 234 Android Applications Are Currently Using Ultrasonic Beacons to Track Users

The Burger King Hello Google ad is an example of this, except without advertiser feedback. Creepy.

MS Win10S locks you in to windows store, Edge browser and Bing searches

If developers do start leveraging the Windows Store, the Windows 10 S experiment could take off, as users won’t find a need to install legacy programs. This will largely depend on web browsers being available there, as many users dislike Edge. Thankfully, Microsoft is allowing third-party browser installs from the Windows Store. Unfortunately, there is a big catch — you cannot change the default. Buried in the Windows 10 S FAQ, the following question is presented — “Are there any defaults that I cannot change on my Windows 10 S PC?” Microsoft provides the answer: “Yes, Microsoft Edge is the default web browser on Microsoft 10 S. You are able to download another browser that might be available from the Windows Store, but Microsoft Edge will remain the default if, for example, you open an .htm file. Additionally, the default search provider in Microsoft Edge and Internet Explorer cannot be changed.”

NSA collected Americans’ phone records (151 million of them!) despite law change

The U.S. National Security Agency collected more than 151 million records of Americans’ phone calls last year, even after Congress limited its ability to collect bulk phone records, according to an annual report issued on Tuesday by the top U.S. intelligence officer.

The report from the office of Director of National Intelligence Dan Coats was the first measure of the effects of the 2015 USA Freedom Act, which limited the NSA to collecting phone records and contacts of people U.S. and allied intelligence agencies suspect may have ties to terrorism.

It found that the NSA collected the 151 million records even though it had warrants from the secret Foreign Intelligence Surveillance court to spy on only 42 terrorism suspects in 2016, in addition to a handful identified the previous year.

The NSA has been gathering a vast quantity of telephone “metadata,” records of callers’ and recipients’ phone numbers and the times and durations of the calls – but not their content – since the September 11, 2001, attacks.

Source: NSA collected Americans’ phone records despite law change: report

UK gov forces porn sites to gather personal info and allows gov depts to share citizens data despite being hugely unsafe

ISPs may be forced to block sites which fail to do so, and the fact that many such sites are not based in the UK nor subject to British law shall pose plenty of difficulties for the law’s implementation, as will its provisions forcing ISPs to prohibit access to “non-conventional sex acts”, which has provoked plenty of criticism from the less vanilla members of society.

The legislation, which requires websites serving up adult content to verify users’ ages or be blocked by ISPs, was criticised as an “unworkable proposal” by Open Rights Group, among others, including feminist pornographer Pandora Blake:

On the passing of the bill, Open Rights Group’s executive director Jim Killock said: “Age verification is an accident waiting to happen. Despite repeated warnings, parliament has failed to listen to concerns about the privacy and security of people who want to watch legal adult content.

“As we saw with the Ashley Madison leaks, the hacking of private information about people’s sex lives, has huge repercussions for those involved. The UK government has failed to take responsibility for its proposals and placed the responsibility for people’s privacy into the hands of porn companies.”
[…]
Last year, the National Audit Office warned of government’s data-handling capabilities, noting that there were 9,000 data breaches over the reporting period and warning that “cuts to departmental budgets and staff numbers, and increasing demands form citizens for online public services, have changed the way government collects, stores and manages information.”

Samson said that large parts of the Digital Economy Bill regarding data sharing remained unclear, and noted that it received Royal Assent with a lot of information left to follow.

“We’ve been told throughout the process that everything will adhere to the Data Protection Act, but that will be redundant from May of next year when the EU’s General Data Protection Regulation comes in,” said Samson. “Whatever is drafted to comply with the DPA will have to change for the GDPR, which means ensuring the individual’s consent and knowledge regarding how their data is being used.”

Source: Just delete the internet – pr0n-blocking legislation receives Royal Assent

How Did Unroll.me Get Users to Allow It to Sell Their Inbox Data?

But a New York Times profile of Uber this weekend revealed, in passing, that Unroll.me, which is owned by a company called Slice Intelligence, isn’t just in the business of tidying up customers’ inboxes. Slice makes money by scanning its users’ email for receipts, then packaging that information into intel reports on consumer habits. Uber, for example, was paying Slice to find users’ Lyft receipts, so it could see how much they were spending each month, “as a proxy for the health of Lyft’s business.”

On its website, Slice brags that it has access to 4.2 million people’s inboxes, where it quietly sits looking at receipts from “hundreds of thousands of retailers.” Many Unroll.me users have been quite upset to learn about the extent of the data collection, which the service’s CEO, Jojo Hedaya, wrote in a blog post yesterday is “heartbreaking.”

“[W]hile we try our best to be open about our business model, recent customer feedback tells me we weren’t explicit enough,” Hedaya wrote.

Source: How Did Unroll.me Get Users to Allow It to Sell Their Inbox Data?

Hint – they used some nice tricks including the “for any purpose” line…

Nuh-uh, Google, you WILL hand over emails stored on foreign servers, says US judge

Google has been ordered by a US court to cough up people’s private Gmail messages stored overseas – because if that information can be viewed stateside, it is subject to American search warrants, apparently.

During a hearing on Wednesday in California, magistrate judge Laurel Beeler rejected [PDF] the advertising giant’s objections to a US government search warrant seeking data stored on its foreign servers. The Mountain View goliath had filed a motion to quash the warrant, and was denied.

The warrant, issued on June 30, 2016, ordered Google to hand over information on a number of specific Gmail accounts, including message content, attachments, metadata, and locational data.

While Google complied with the warrants and handed all of the requested records for several accounts over to Uncle Sam’s agents, it refused to cough up information on two accounts and declined to access attachments on two others, arguing that because the data was held outside the US it was not covered by the warrant, as was decided in the Microsoft email brouhaha.

Judge Beeler, however, disagreed with the Chocolate Factory’s assessment, reasoning that if Google was able to pull up the data on its own machines in the US, then it should fall under a US court’s jurisdiction and, because it would be pulled from Google’s HQ in Mountain View, it was not considered overseas content the way Microsoft’s Ireland-based info was.

Source: Nuh-uh, Google, you WILL hand over emails stored on foreign servers, says US judge

Because in the US, are your base are belong to US