The Linkielist

Linking ideas with the world

The Linkielist

Japanese robot could call last orders on human bartenders

Posted on by

The repurposed industrial robot serves drinks in is own corner of a Japanese pub operated by restaurant chain Yoronotaki. An attached tablet computer face smiles as it chats about the weather while preparing orders.

The robot, made by the company QBIT Robotics, can pour a beer in 40 seconds and mix a cocktail in a minute. It uses four cameras to monitors customers to analyze their expressions with artificial intelligence (AI) software.

“I like it because dealing with people can be a hassle. With this you can just come and get drunk,” Satoshi Harada, a restaurant worker said after ordering a drink.

“If they could make it a little quicker it would be even better.”

Finding workers, especially in Japan’s service sector, is set to get even more difficult.

The government has eased visa restrictions to attract more foreign workers but companies still face a labor shortage as the population shrinks and the number of people over 65 increases to more than a third of the total.

Source: Japanese robot could call last orders on human bartenders – Reuters

Neural Networks Upscale Film from 1896 to 4K, Make It Look Like It Was Shot on a Modern Smartphone

Posted on by

Denis Shiryaev wondered if it could be made more compelling by using neural network powered algorithms (including Topaz Labs’ Gigapixel AI and DAIN) to not only upscale the footage to 4K, but also increase the frame rate to 60 frames per second. You might yell at your parents for using the motion smoothing setting on their fancy new TV, but here the increased frame rate has a dramatic effect on drawing you into the action.

Aside from it still being black and white (which could be dismissed as simply an artistic choice) and the occasional visual artifact introduced by the neural networks, the upgraded version of L’Arrivée d’un train en gare de La Ciotat looks like it could have been shot just yesterday on a smartphone or a GoPro. Even the people waiting on the platform look like the costumed historical reenactors you’d find portraying an old-timey character at a pioneer village.

Source: Neural Networks Upscale Film from 1896 to 4K, Make It Look Like It Was Shot on a Modern Smartphone

Google’s Takeout App Leaked Videos To Unrelated Users

Posted on by

In a new privacy-related fuckup, Google told users today that it might’ve accidentally imported your personal photos into another Google user’s account. Whoopsie!

First flagged by Duo Security CTO Jon Oberheide, Google seems to be emailing users who plugged into the company’s native Takeout app to backup their videos, warning that a bug resulted in some of those (hopefully G-rated) videos being backed up to an unrelated user’s account.

For those who used the “download your data” service between November 21 and November 25 of last year, some videos were “incorrectly exported,” the note reads. “If you downloaded your data, it may be incomplete, and it may contain videos that are not yours.”

Source: Google’s Takeout App Leaked Videos To Unrelated Users

Google Says Developers Can Now Purchase Latest Smart Glasses, still look stupid

Posted on by

Google is making it easier for developers to purchase the latest version of its smart glasses, with the company saying on Tuesday that the Glass Enterprise Edition 2 is now available from some hardware resellers.

“We’ve seen strong demand from developers and businesses who are interested in building new, helpful enterprise solutions for Glass,“ Google said in a blog post, adding that the new headset was already being used by people with jobs in logistics, manufacturing and field services.”

Source: Google Says Developers Can Now Purchase Latest Smart Glasses – Bloomberg

Iowa has already won the worst IT rollout award of 2020: Rap for crap caucus app chaps in vote zap flap

Posted on by

It’s all so painfully familiar: with a crunch date of February 3, the Democratic Party in Iowa decided to charge ahead with an IT rollout that comprised an entirely new software system spread out across thousands of sites to record the result of the Democratic caucus for its presidential nominee.

It was, inevitably, a complete failure. The results from the Iowa caucus were supposed to come in nearly 24 hours ago. Instead, it has become a rolling news cycle of tech catastrophe.

We’re not even going to bother to dig into lessons learned because they are the same ones that every sysadmin since the dawn of time has dealt with – and spends their entire career warning the suits about, to greater and lesser degrees of success.

[…]

We could write pages and pages of reports about how differently people experienced this almighty IT cock-up but what’s the point? If you’re reading The Reg you already know what the problem is and the details quickly become irrelevant.

Here’s what’s happened: the suits hired a company because they were swayed by their CVs and sales talk and didn’t run it past anyone that knew what they were doing. Then the suits didn’t listen to all the people telling them it was a bad idea and they should delay rollout. And they didn’t allow sufficient time for testing and training.

Source: Iowa has already won the worst IT rollout award of 2020: Rap for crap caucus app chaps in vote zap flap • The Register

For details read the article – the amount of cockups will make you laugh, if not cry.

Researchers Find ‘Anonymized’ Data Is Even Less Anonymous Than We Thought

Posted on by

Dasha Metropolitansky and Kian Attari, two students at the Harvard John A. Paulson School of Engineering and Applied Sciences, recently built a tool that combs through vast troves of consumer datasets exposed from breaches for a class paper they’ve yet to publish.

“The program takes in a list of personally identifiable information, such as a list of emails or usernames, and searches across the leaks for all the credential data it can find for each person,” Attari said in a press release.

They told Motherboard their tool analyzed thousands of datasets from data scandals ranging from the 2015 hack of Experian, to the hacks and breaches that have plagued services from MyHeritage to porn websites. Despite many of these datasets containing “anonymized” data, the students say that identifying actual users wasn’t all that difficult.

“An individual leak is like a puzzle piece,” Harvard researcher Dasha Metropolitansky told Motherboard. “On its own, it isn’t particularly powerful, but when multiple leaks are brought together, they form a surprisingly clear picture of our identities. People may move on from these leaks, but hackers have long memories.”

For example, while one company might only store usernames, passwords, email addresses, and other basic account information, another company may have stored information on your browsing or location data. Independently they may not identify you, but collectively they reveal numerous intimate details even your closest friends and family may not know.

“We showed that an ‘anonymized’ dataset from one place can easily be linked to a non-anonymized dataset from somewhere else via a column that appears in both datasets,” Metropolitansky said. “So we shouldn’t assume that our personal information is safe just because a company claims to limit how much they collect and store.”

The students told Motherboard they were “astonished” by the sheer volume of total data now available online and on the dark web. Metropolitansky and Attari said that even with privacy scandals now a weekly occurrence, the public is dramatically underestimating the impact on privacy and security these leaks, hacks, and breaches have in total.

Previous studies have shown that even within independent individual anonymized datasets, identifying users isn’t all that difficult.

In one 2019 UK study, researchers were able to develop a machine learning model capable of correctly identifying 99.98 percent of Americans in any anonymized dataset using just 15 characteristics. A different MIT study of anonymized credit card data found that users could be identified 90 percent of the time using just four relatively vague points of information.

Another German study looking at anonymized user vehicle data found that that 15 minutes’ worth of data from brake pedal use could let them identify the right driver, out of 15 options, roughly 90 percent of the time. Another 2017 Stanford and Princeton study showed that deanonymizing user social networking data was also relatively simple.

Individually these data breaches are problematic—cumulatively they’re a bit of a nightmare.

Metropolitansky and Attari also found that despite repeated warnings, the public still isn’t using unique passwords or password managers. Of the 96,000 passwords contained in one of the program’s output datasets—just 26,000 were unique.

The problem is compounded by the fact that the United States still doesn’t have even a basic privacy law for the internet era, thanks in part to relentless lobbying from a cross-industry coalition of corporations eager to keep this profitable status quo intact. As a result, penalties for data breaches and lax security are often too pathetic to drive meaningful change.

Harvard’s researchers told Motherboard there’s several restrictions a meaningful U.S. privacy law could implement to potentially mitigate the harm, including restricting data access to unauthorized employees, maininting better records on data collection and retention, and decentralizing data storage (not keeping corporate and consumer data on the same server).

Until then, we’re left relying on the promises of corporations who’ve repeatedly proven their privacy promises aren’t worth all that much.

Source: Researchers Find ‘Anonymized’ Data Is Even Less Anonymous Than We Thought – VICE

Firefox now shows what telemetry data it’s collecting about you (if any)

Posted on by

There is now a special page in the Firefox browser where users can see what telemetry data Mozilla is collecting from their browser.

Accessible by typing about:telemetry in the browser’s URL address bar, this new section is a recent addition to Firefox.

The page shows deeply technical information about browser settings, installed add-ons, OS/hardware information, browser session details, and running processes.

The information is what you’d expect a software vendor to collect about users in order to fix bugs and keep a statistical track of its userbase.

A Firefox engineer told ZDNet the page was primarily created for selfish reasons, in order to help engineers debug Firefox test installs. However, it was allowed to ship to the stable branch also as a PR move, to put users’ minds at ease about what type of data the browser maker collects from its users.

The move is in tune with what Mozilla has been doing over the past two years, pushing for increased privacy controls in its browser and opening up about its practices, in stark contrast with what other browser makers have been doing in the past decade.

Source: Firefox now shows what telemetry data it’s collecting about you | ZDNet

CIA Employee Accused Of Leaking Vault 7 cyber security tooling To WikiLeaks in 2017 Goes On Trial

Posted on by

The trial of a former Central Intelligence Agency software engineer who allegedly leaked thousands of pages of documents to WikiLeaks was set to begin Monday in federal court in New York. The leak has been described as one of the largest in the CIA’s history.

Joshua Schulte has pleaded not guilty to 11 criminal counts, including illegal transmission of unlawfully possessed national defense information and theft of government property.

WikiLeaks started publishing the documents, which it called “Vault 7,” in March 2017. Many of the documents are highly technical, and appear to describe agency practices for hacking a number of different targets.

As NPR’s Camila Domonoske and Greg Myre reported at the time, the documents are said to be to be internal guides to creating and using many kinds of hacking tools, “from turning smart TVs into bugs to designing customized USB drives to extract information from computers.”

Schulte’s lawyers did not respond to NPR’s requests for comment about the case.

In court filings ahead of the trial, they have expressed frustration at the pace with which they are required to review materials surfaced during the discovery process.

Some of the charges against Schulte stem from the Espionage Act, and defense lawyers say they are unconstitutionally overbroad and vague. They also said the law was intended to be used to prosecute those who transmit government secrets to foreign governments, and that it shouldn’t apply to leaking to WikiLeaks. The judge rejected those arguments.

“As alleged, Schulte utterly betrayed this nation and downright violated his victims,” William F. Sweeney Jr., the assistant director-in-charge of the FBI’s New York Field Office, said in a statement when the charges were announced. “As an employee of the CIA, Schulte took an oath to protect this country, but he blatantly endangered it by the transmission of Classified Information.”

Prosecutors have said that when Schulte was working at the CIA, he developed classified cyber tools, including tools to covertly gather data from computers.

The leak allegedly happened during a time of rising tension between Schulte and his CIA colleagues.

In the summer of 2015, according to prosecutors, Schulte started having “significant problems” in his group that stemmed from a feud with one of his colleagues. The feud deepened after the colleague reportedly complained about Schulte to management. Prosecutors say Schulte accused the employee of making a death threat against him and eventually filed a protective order against that person. They were reassigned to different teams.

Because of his reassignment, Schulte’s access to previous projects was revoked. But prosecutors say he reinstated his own administrative privileges. Management at the Center for Cyber Intelligence discovered it, and they attempted to revoke privileges and change passwords. But they missed credentials for one computer network, according to prosecutors, and in April 2016, Schulte allegedly stole vast quantities of information from the network and passed the data along to WikiLeaks.

The judge has granted measures to protect the anonymity of certain witnesses from the CIA who are expected to testify. During those sessions, the courtroom will be closed to press, except for two pool reporters who have agreed not to disclose the physical characteristics of these witnesses. Other reporters in an adjoining courtroom will be able to see a video feed that won’t show images of the witnesses.

Federal prosecutors originally indicted Schulte in 2017 on charges of receiving and possessing child pornography. They said they discovered more than 10,000 images and videos of child pornography encrypted on Schulte’s personal computer.

One of the prosecutors, Matthew Laroche, said at a hearing in 2017 that Schulte is “someone who’s shown himself to condone sexually dangerous behavior and has shown a proclivity to collect thousands of images of child pornography.”

In July 2019, the court severed the child pornography-related charges from the rest of the case, meaning that those accusations will be addressed at a separate trial.

Source: Ex-CIA Employee Accused Of Leaking Documents To WikiLeaks Goes On Trial : NPR

Twitter Helps Spread Disinformation During Iowa Caucuses

Posted on by

The Washington Post’s Tony Romm reported on Monday night that Twitter has decided it will allow certain right-wing accounts to spread disinformation about the Iowa Democratic Caucuses, including tweets that suggest the results are being “rigged.”

Trump campaign manager Brad Pascal tweeted on Monday, “Quality control = rigged?,” citing a second Trump campaign official who had used the hashtag #RiggedElection.

There is no evidence of vote tampering in Iowa and the Trump campaign’s claims are entirely baseless. (Technical issues with an app used by election officials have caused delays in tallying the results.)

Twitter’s decision would seem to provide political fraudsters with a clear message: deceiving voters into believing U.S. election results have been falsified is an acceptable use of Twitter’s platform.

Twitter did not respond to Gizmodo’s request for comment.

Earlier in the day, Charlie Kirk, the leader of a college-focused conservative group called Turning Point USA, tweeted that Iowa election officials were involved in “voter fraud” citing a debunked report by the right-wing activist group Judicial Watch.

The Judicial Watch report falsely claimed that the number of registered voters in Iowa exceeded the number of voting-age residents in each county. Judicial Watch’s fake figures were quickly shot down by Iowa’s Republican secretary of state, Paul D. Pate.

“It’s unfortunate this organization continues to put out inaccurate data regarding voter registration, and it’s especially disconcerting they chose the day of the Iowa Caucus to do this,” Pate said in a statement.

Pate continued: “My office has told this organization, and others who have made similar claims, that their data regarding Iowa is deeply flawed and their false claims erode voter confidence in elections. They should stop this misinformation campaign immediately and quit trying to disenfranchise Iowa voters.”

The Iowa secretary of state’s office pointed to “actual data” from the U.S. Census Bureau to say Judicial Watch’s claims about Iowa’s population are “greatly underestimated.”

Nevertheless, the tweet by Kirk invoking the debunked claim had over 42,500 retweets at press time.

Twitter spokesman Brandon Borrman told the Washington Post that the company would take no action against users working to sow mistrust in the official election results, which were not expected until Tuesday.

“The tweet is not in violation of our election integrity policy as it does not suppress voter turnout or mislead people about when, where, or how to vote,” Borrman told the Post, regarding tweets by prominent conservatives claiming the Democratic caucuses were “rigged.”

Twitter’s claim that such tweets do not “suppress voter turnout” is unlikely to go unchallenged by federal lawmakers who view this particular form of deception as an attempt to discourage participation in a “rigged” election.

The underlying message being propagated by the Trump campaign, Judicial Watch, and Turning Point USA seems an obvious one: Your vote doesn’t count, so why bother?

Source: Twitter Helps Spread Disinformation During Iowa Caucuses

 

Twitter had a flaw allowing the discovery of phone numbers attached to accounts en masse. And it’s been used in the wild multiple times.

Posted on by

Twitter has admitted a flaw in its backend systems was exploited to discover the cellphone numbers of potentially millions of twits en masse, which could lead to their de-anonymization.

In an advisory on Monday, the social network noted it had “became aware that someone was using a large network of fake accounts to exploit our API and match usernames to phone numbers” on December 24.

That is the same day that security researcher Ibrahim Balic revealed he had managed to match 17 million phone numbers to Twitter accounts by uploading a list of two billion automatically generated phone numbers to Twitter’s contact upload feature, and match them to usernames.

The feature is supposed to be used by tweeters seeking their friends on Twitters, by uploading their phone’s address book. But Twitter seemingly did not fully limit requests to its API, deciding that preventing sequential numbers from being uploaded was sufficiently secure.

It wasn’t, and Twitter now says that, as well as Balic’s probing, it “observed a particularly high volume of requests coming from individual IP addresses located within Iran, Israel, and Malaysia,” adding that “it is possible that some of these IP addresses may have ties to state-sponsored actors.”

Being able to connect a specific phone number to a Twitter account is potentially enormously valuable to a hacker, fraudster, or spy: not only can you link the identity attached to that number to the identity attached to the username, and potentially fully de-anonymizing someone, you now know which high-value numbers to hijack, via SIM swap attacks, for example, to gain control of accounts secured by SMS or voice-call two-factor authentication.

In other words, this Twitter security hole was a giant intelligence gathering opportunity,

Twitter says that it initially only saw one person “using a large network of fake accounts to exploit our API and match usernames to phone numbers,” and suspended the accounts. But it soon realized the problem was more widespread: “During our investigation, we discovered additional accounts that we believe may have been exploiting this same API endpoint beyond its intended use case.”

For what it’s worth Twitter apologized for its self-imposed security cock-up: “We’re very sorry this happened. We recognize and appreciate the trust you place in us, and are committed to earning that trust every day.”

It’s worth noting that users who did not add their phone number to their Twitter account or not allow it to be discovered via the API were not affected. Which points to a painfully obvious lesson: don’t trust any company with more personal information than they need to have.

Source: Twitter says a certain someone tried to discover the phone numbers used by potentially millions of twits • The Register

F-35: a $400 Billion Stealth Fighter That Can’t Climb, accellerate, shoot straight or be resupplied using the mandatory software

Posted on by

Here’s something the public didn’t know until today: If one of the U.S. military’s new F-35 stealth fighters has to climb at a steep angle in order to dodge an enemy attack, design flaws mean the plane might suddenly tumble out of control and crash.

Also, some versions of the F-35 can’t accelerate to supersonic speed without melting their own tails or shedding the expensive coating that helps to give the planes their radar-evading qualities.

The Pentagon’s $400-billion F-35 Joint Strike Fighter program, one of the biggest and most expensive weapons programs in history, has come under fire, so to speak, over more than a decade for delays, rising costs, design problems and technical glitches.

But startling reports by trade publication Defense News on Wednesday revealed flaws that previously only builder Lockheed Martin, the military, and the plane’s foreign buyers knew about.

[…]

The test reports Defense News obtained also reveal a second, previously little-known category 1 deficiency in the F-35B and F-35C aircraft. If during a steep climb the fighters exceed a 20-degree “angle of attack”—the angle created by the wing and the oncoming air—they could become unstable and potentially uncontrollable.

To prevent a possible crash, pilots must avoid steeply climbing and other hard maneuvers. “Fleet pilots agreed it is very difficult to max perform the aircraft” in those circumstances, Defense News quoted the documents as saying.

Source: America Is Stuck With a $400 Billion Stealth Fighter That Can’t Fight

Add a gun that can’t shoot straight to the problems that dog Lockheed Martin Corp.’s $428 billion F-35 program, including more than 800 software flaws.

The 25mm gun on Air Force models of the Joint Strike Fighter has “unacceptable” accuracy in hitting ground targets and is mounted in housing that’s cracking, the Pentagon’s test office said in its latest assessment of the costliest U.S. weapons system.

The annual assessment by Robert Behler, the Defense Department’s director of operational test and evaluation, doesn’t disclose any major new failings in the plane’s flying capabilities. But it flags a long list of issues that his office said should be resolved — including 13 described as Category 1 “must-fix” items that affect safety or combat capability — before the F-35’s upcoming $22 billion Block 4 phase.

The number of software deficiencies totaled 873 as of November, according to the report obtained by Bloomberg News in advance of its release as soon as Friday. That’s down from 917 in September 2018, when the jet entered the intense combat testing required before full production, including 15 Category 1 items. What was to be a year of testing has now been extended another year until at least October.

“Although the program office is working to fix deficiencies, new discoveries are still being made, resulting in only a minor decrease in the overall number” and leaving “many significant‘’ ones to address, the assessment said.

Cybersecurity ‘Vulnerabilities’

In addition, the test office said cybersecurity “vulnerabilities” that it identified in previous reports haven’t been resolved. The report also cites issues with reliability, aircraft availability and maintenance systems.

The assessment doesn’t deal with findings that are emerging in the current round of combat testing, which will include 64 exercises in a high-fidelity simulator designed to replicate the most challenging Russian, Chinese, North Korean and Iranian air defenses.

Despite the incomplete testing and unresolved flaws, Congress continues to accelerate F-35 purchases, adding 11 to the Pentagon’s request in 2016 and in 2017, 20 in fiscal 2018, 15 last year and 20 this year. The F-35 continues to attract new international customers such as Poland and Singapore. Japan is the biggest foreign customer, followed by Australia and the U.K.

[…]

Brett Ashworth, a spokesman for Bethesda, Maryland-based Lockheed, said that “although we have not seen the report, the F-35 continues to mature and is the most lethal, survivable and connected fighter in the world.” He said “reliability continues to improve, with the global fleet averaging greater than 65% mission capable rates and operational units consistently performing near 75%.”

Still, the testing office said “no significant portion” of the U.S.’s F-35 fleet “was able to achieve and sustain” a September 2019 goal mandated by then-Defense Secretary Jim Mattis: that the aircraft be capable 80% of the time needed to perform at least one type of combat mission. That target is known as the “Mission Capable” rate.

“However, individual units were able to achieve the 80% target for short periods during deployed operations,” the report said. All the aircraft models lagged “by a large margin” behind the more demanding goal of “Full Mission Capability.”

The Air Force’s F-35 model had the best rate at being fully mission capable, while the Navy’s fleet “suffered from a particularly poor” rate, the test office said. The Marine Corps version was “roughly midway” between the other two.

[…]

the Air Force model’s gun is mounted inside the plane, and the test office “considers the accuracy, as installed, unacceptable” due to “misalignments” in the gun’s mount that didn’t meet specifications.

The mounts are also cracking, forcing the Air Force to restrict the gun’s use.

Source: F-35’s Gun That Can’t Shoot Straight Adds to Its Roster of Flaws – Bloomberg

The F-35’s problematic Autonomic Information Logistics System, or ALIS, will be replaced by a new system starting later this year, which it is hoped will be more user-friendly, more secure, and less prone to error. It’s also to be re-branded as ODIN, for Operational Data Integrated Network.

ODIN “incorporates a new integrated data environment,” according to the F-35 Joint Program Office, which put out a release about the change Jan. 21, just a few days after Pentagon acquisition and sustainment czar Ellen Lord told reporters about it outside a Capitol Hill hearing. The system will be “a significant step forward to improve the F-35 fleet’s sustainment and readiness performance,” the JPO said. ODIN is intended to reduce operator and administrator workload, increase F-35 mission readiness rates, and “allow software designers to rapidly develop and deploy updates in response” to operator needs.

The first “ODIN-enabled” hardware will be delivered to the various F-35 fleets late in 2020, with full operational capability planned by December, 2022, the JPO said, “pending coordination with user deployment schedules.” Some ALIS systems being used on aircraft carriers or with deployed units at that time may not get ODIN until they return.

ALIS is the vast information-gathering system that tracks F-35 data in-flight, relaying to maintainers on the ground the performance of various systems in near-real time. It’s meant to predict part failures and otherwise keep maintainers abreast of the health of each individual F-35. By amassing these data centrally for the worldwide F-35 fleet, prime contractor Lockheed Martin expected to better manage spare parts production, detect trends in performance glitches and the longevity of parts, and determine optimum schedules for servicing various elements of the F-35 engine and airframe. However, the system was afflicted by false alarms—leading to unnecessary maintenance actions—laborious data entry requirements and clumsy interfaces. The system also took long to boot up and be updated, and tablets used by maintainers were perpetually behind the commercial state of the art.

[…]

The Government Accountability Office published a number of reports faulting ALIS for adding unnecessary man-hours and complexity to the F-35 enterprise, saying in a November, 2019 report that USAF maintainers in just one unit reported “more than 45,000 hours per year performing additional tasks and manual workarounds because ALIS was not functioning” the way it was supposed to.

In early versions, ALIS also proved vulnerable to hacking and data theft, another reason for the overhaul of the system, to meet new cyber security needs.

Source: F-35 Program Dumps ALIS for ODIN – Air Force Mag

US’s secret spy payload offloaded: Rocket Lab demos missile muscle with second Electron guided home

Posted on by

Small-sat flinger Rocket Lab beat the winds to get the mysterious National Reconnaissance Office (NRO) payload off the New Zealand launchpad this morning.

After multiple holds due to ground winds, the Electron lifted off at 02:56 UTC on 31 January from the company’s Launch Complex 1 on the New Zealand Mahia Peninsula.

Dubbed “Birds of a Feather”, the mission was the 11th of the company’s Electron booster. While the details of the payload were light (NRO doesn’t like talking too much about its toys), the launch represented the second time Rocket Lab attempted to steer the spent booster back to Earth.

The launch itself went nominally, with main engine cut-off occurring just after two minutes, 30 seconds. The first stage then separated and began its journey back home while the second stage ignited to send the payload to orbit. Rocket Labs’ Kick Stage was then used to shepherd the satellite to the desired orbit.

Chief exec Peter Beck is keen on recovering those first stages and, like the previous mission, the Electron was fitted with the equipment necessary to survive a return to Earth (right up until smacking into the sea).

A reaction control system on the first stage spun the booster around 180 degrees at the six minute, 30 second mark and then maintained the correct angle of attack during the descent. A minute later, the spent booster encountered what Rocket Lab calls “The Wall” as the atmosphere became denser and the rocket decelerated from supersonic to subsonic speeds.

Beck described the aerodynamic forces involved as akin to “perching three elephants atop the Electron stack” in a chat with The Register back in August last year.

As with its predecessor, the booster made it back to Earth and disintegrated upon impact with the ocean – as planned – approximately nine minutes after launch.

Those hoping for a SpaceX-style propulsive landing on legs will be disappointed. Rocket Labs’ plans will see the returning booster eventually equipped with a parachute and snatched by helicopter.

The gang will then recycle the things to augment the production lines should the launch frequency ramp up in the way Beck hopes.

Source: US’s secret spy payload offloaded: Rocket Lab demos missile muscle with second Electron guided home

Alias Privacy “Parasite” 2.0 Adds a Layer of Security to Your Home Assistant

Posted on by

Alias is a teachable “parasite” that gives you more control over your smart assistant’s customization and privacy. Through a simple app, you can train Alias to react to a self-chosen wake-word; once trained, Alias takes control over your home assistant by activating it for you. When you’re not using it, Alias makes sure the assistant is paralyzed and unable to listen to your conversations.

When placed on top of your home assistant, Alias uses two small speakers to interrupt the assistant’s listening with a constant low noise that feeds directly into the microphone of the assistant. When Alias recognizes your user-created wake-word (e.g., “Hey Alias” or “Jarvis” or whatever), it stops the noise and quietly activates the assistant by speaking the original wake-word (e.g., “Alexa” or “Hey Google”).

From here the assistant can be used as normal. Your wake-word is detected by a small neural network program that runs locally on Alias, so the sounds of your home are not uploaded to anyone’s cloud.

Source: Alias Privacy “Parasite” 2.0 Adds a Layer of Security to Your Home Assistant | Make:

Top Streamers Are Leaving Twitch Amidst Big Money And Shady Deals

Posted on by

Let’s say you’re an up-and-coming streamer. You’ve done it for a while and you make decent money, although you’re no Tyler “Ninja” Blevins. But you’re on your way there, or so you hope. A while back, you got the opportunity to sign with an agency that promised to help you set up deals to advertise brands on your streams. Today, that’s finally paying off. The agency calls you to offer a $10,000 deal. You don’t think twice. That’s a handsome chunk of change. Time to pop a bottle of champagne and celebrate. There’s just one problem. Turns out the agency pocketed $90,000.

The above hypothetical scenario is based on a true story told by former CEO of esports organization CLG and current CMO of streaming company N3rdfusion Devin Nash, who opted to keep the streamer and agency’s identities anonymous. According to Nash’s story, which echoes others that Kotaku heard in the course of reporting, the initial deal was $100,000 for a single streamer to represent a big brand. But the agency was in full control of negotiations, so it just conveniently omitted the part about the remaining $90,000, because hey, $10,000 sounds pretty good in isolation, right? So the agency drew up a limited partnership agreement, and that was that. Nash went on to tell Kotaku that the streamer didn’t even get to keep the full $10,000.

“[The agency] also took the ten percent they had contractually,” Nash said in a Discord voice call. “So they took $1,000 and also pocketed the $90,000. They made $91,000, the streamer made $9,000, and nobody was the wiser.”

Streaming is big business now, and that means big money. But it also means that the world of streaming is transforming, and streamers are having to learn on the fly how to do more than just entertain. They’re having to strike deals with companies, agencies, and now entire platforms. Toward the end of last year, the deals grew bigger than ever, with blue-haired Fortnite megastar Tyler “Ninja” Blevins jumping ship from Twitch to Microsoft-owned streaming platform Mixer in a high-profile exclusivity deal that was soon followed by countless others. The business of video game streaming is rapidly evolving into something that echoes Hollywood, with agents and managers negotiating on behalf of streamers who are increasingly treated like actors or TV shows, and who wind up on platforms that stand in for more traditional networks.

Source: Top Streamers Are Leaving Twitch Amidst Big Money And Shady Deals

There is much much more to this article under the link

NSF’s newest solar telescope produces first images, most detailed images of the sun

Posted on by

This first images from NSF’s Inouye Solar Telescope show a close-up view of the sun’s surface, which can provide important detail for scientists. The image shows a pattern of turbulent “boiling” plasma that covers the entire sun. The cell-like structures—each about the size of Texas—are the signature of violent motions that transport heat from the inside of the sun to its surface. That hot solar plasma rises in the bright centers of “cells,” cools off and then sinks below the surface in dark lanes in a process known as convection. (See video available with this news release.)

Solar magnetic fields constantly get twisted and tangled by the motions of the sun’s plasma. Twisted magnetic fields can lead to solar storms that can negatively affect our technology-dependent modern lifestyles. During 2017’s Hurricane Irma, the National Oceanic and Atmospheric Administration reported that a simultaneous space weather event brought down radio communications used by first responders, aviation and maritime channels for eight hours on the day the hurricane made landfall.

Finally resolving these tiny magnetic features is central to what makes the Inouye Solar Telescope unique. It can measure and characterize the sun’s magnetic field in more detail than ever seen before and determine the causes of potentially harmful solar activity.

“It’s all about the magnetic field,” said Thomas Rimmele, director of the Inouye Solar Telescope. “To unravel the sun’s biggest mysteries, we have to not only be able to clearly see these tiny structures from 93 million miles away but very precisely measure their strength and direction near the surface and trace the field as it extends out into the million-degree corona, the outer atmosphere of the sun.”

Better understanding the origins of potential disasters will enable governments and utilities to better prepare for inevitable future space weather events. It is expected that notification of potential impacts could occur earlier—as much as 48 hours ahead of time instead of the current standard, which is about 48 minutes. This would allow for more time to secure power grids and critical infrastructure and to put satellites into safe mode.

he Inouye Solar Telescope combines a 13-foot (4-meter) mirror—the world’s largest for a —with unparalleled viewing conditions at the 10,000-foot Haleakalā summit.

Focusing 13 kilowatts of solar power generates enormous amounts of heat—heat that must be contained or removed. A specialized cooling system provides crucial heat protection for the telescope and its optics. More than seven miles of piping distribute coolant throughout the observatory, partially chilled by ice created on site during the night.

00:00
00:00
The Daniel K. Inouye Solar Telescope has produced the highest resolution observations of the sun’s surface ever taken. In this movie, taken at a wavelength of 705 nanometers (nm) over a period of 10 minutes, we can see features as small as 30km (18 miles) in size for the first time ever. The movie shows the turbulent, Credit: NSO/AURA/NSF

The dome enclosing the telescope is covered by thin cooling plates that stabilize the temperature around the telescope, helped by shutters within the dome that provide shade and air circulation. The “heat-stop” (a high-tech, liquid-cooled metal donut) blocks most of the sunlight’s energy from the main mirror, allowing scientists to study specific regions of the sun with unparalleled clarity.

[…]

“This image is just the beginning,” said David Boboltz, program director in NSF’s division of astronomical sciences and who oversees the facility’s construction and operations. “Over the next six months, the Inouye telescope’s team of scientists, engineers and technicians will continue testing and commissioning the telescope to make it ready for use by the international solar scientific community. The Inouye Solar Telescope will collect more information about our sun during the first 5 years of its lifetime than all the solar data gathered since Galileo first pointed a telescope at the sun in 1612.”

Source: NSF’s newest solar telescope produces first images, most detailed images of the sun

Don’t use online DNA tests! If You Ever Used Promethease, Your DNA Data Might Be on MyHeritage – and so will your family’s

Posted on by

When it comes to ways to learn about your DNA, Promethease’s service seemed like one of the safest. They promised anonymity, and to delete your report after 45 days. But now that MyHeritage has bought the company, users are being notified that their DNA data is now on MyHeritage. Wait, what?

It turns out that even though Promethease deleted reports as promised after 45 days, if you created an account, the service held onto your raw data. You now have a MyHeritage account, which you can delete if you like. Check your email. That’s how I found out about mine.

What Promethease does

A while back, I downloaded my raw data from 23andme and gave it to Promethease to find out what interesting things might be in my DNA. Ever since 23andme stopped providing detailed health-related results in 2013, Promethease was a sensible alternative. They used to charge $5 (now up to $12, but that’s still a steal) and they didn’t attempt to explain your results to you. Instead, you could just see what SNPs you had—those are spots where your DNA differs from other people’s—and read on SNPedia, a sort of genetics wikipedia, about what those SNPs might mea

So this means Promethease had access to the raw file you gave it (which you would have gotten from 23andme, Ancestry, or another service), and to the report of SNPs that it created for you. You had the option of paying your fee, downloading your report, and never dealing with the company again; or you could create an account so that you could “regenerate” your report in the future without having to pay again. That means they stored your raw DNA file.

Source: If You Ever Used Promethease, Your DNA Data Might Be on MyHeritage Now

Because your DNA contains information about your whole family, by uploading your DNA you also upload their DNA, making it a whole lot easier to de-anonymise their DNA. It’s a bit like uploading a picture of your family to Facebook with the public settings on and then tagging them, even though the other family members on your picture aren’t on Facebook.

UN didn’t patch SharePoint, got mega-hacked, covered it up, kept most staff in the dark, finally forced to admit it, accident waiting to happen

Posted on by

The United Nations’ European headquarters in Geneva and Vienna were hacked last summer, putting thousands of staff records at miscreants’ fingertips. Incredibly, the organization decided to cover it up without informing those affected nor the public.

[…]

A senior IT official dubbed the attack a “major meltdown,” in which personnel records – as well as contract data covering thousands of individuals and organizations – was accessed. The hackers were able to get into user-management systems and past firewalls; eventually compromising over 40 servers, with the vast majority at the European headquarters in Geneva.

But despite the size and extent of the hack, the UN decided to keep it secret. Only IT teams and the heads of the stations in question were informed.

[…]

Employees whose data was within reach of the hackers were told only that they needed to change their password and were not informed that their personal details had been compromised. That decision not to disclose any details stems from a “cover-up culture” the anonymous IT official who leaked the internal report told the publication.

The report notes it has been unable to calculate the extent of damage but one techie – it’s not clear it is the same one that leaked the report – estimated that 400GB had been pulled from United Nations servers.

Most worrying is the fact the UN Office of the High Commissioner for Human Rights (OHCHR) was one of those compromised. The OHCHR deals with highly sensitive information from people who put their lives at risk to uncover human rights abuses.

Making matters worse, IT specialists had warned the UN for years that it was at risk from hacking. An audit in 2012 identified an “unacceptable level of risk,” and resulted in a restructure that consolidated servers, websites, and typical services like email, and then outsourced them to commercial providers at a cost of $1.7bn.

But internal warnings about lax security continued, and an official audit in 2018 was full of red flags. “The performance management framework had not been implemented,” it stated, adding that there were “policy gaps in areas of emerging concern, such as the outsourcing of ICT services, end-user device usage, information-sharing, open data and the reuse and safe disposal of decommissioned ICT equipment.”

There were lengthy delays in security projects, and, internally, departments were ignoring compliance efforts. The audit “noted with concern” that 28 of the 37 internal groups hadn’t responded at all and that over the nearly 1,500 websites and web apps identified only a single one had carried out a security assessment.

The audit also found that less than half of the 38,105 staff had done a compulsory course in basic IT security that had been designed to help reduce overall security risks. In short, this was an accident waiting to happen, especially given the UN’s high-profile status.

As to the miscreants’ entry point, it was a known flaw in Microsoft SharePoint (CVE-2019-0604) for which a software patch had been available for months yet the UN had failed to apply it.

The hole can be exploited by a remote attacker to bypass logins and issue system-level commands – in other words, a big problem from a security standpoint. The hackers broke into a vulnerable SharePoint deployment in Vienna and then, with admin access, moved within the organization’s networks to access the Geneva headquarters and then the OHCHR.

[…]

Source: UN didn’t patch SharePoint, got mega-hacked, covered it up, kept most staff in the dark, finally forced to admit it • The Register

Lab-Grown Heart Muscles Have Been Transplanted Into a Human For The First Time

Posted on by

On Monday, researchers from Japan’s Osaka University announced the successful completion of a first-of-its-kind heart transplant.

Rather than replacing their patient’s entire heart with a new organ, these researchers placed degradable sheets containing heart muscle cells onto the heart’s damaged areas – and if the procedure has the desired effect, it could eventually eliminate the need for some entire heart transplants.

To grow the heart muscle cells, the team started with induced pluripotent stem (iPS) cells. These are stem cells that researchers create by taking an adult’s cells – often from their skin or blood – and reprogramming them back into their embryonic-like pluripotent state.

At that point, researchers can coax the iSP cells into becoming whatever kind of cell they’d like. In the case of this Japanese study, the researchers created heart muscle cells from the iSP cells before placing them on small sheets.

The patient who received the transplant suffers from ischemic cardiomyopathy, a condition in which a person’s heart has trouble pumping because its muscles don’t receive enough blood.

In severe cases, the condition can require a heart transplant, but the team from Osaka University hopes that the muscle cells on the sheet will secrete a protein that helps regenerate blood vessels, thereby improving the patient’s heart function.

The researchers plan to monitor the patient for the next year, and they hope to conduct the same procedure on nine other people suffering from the same condition within the next three years.

If all goes well, the procedure could become a much-needed alternative to heart transplants – not only is sourcing iPS cells far easier than finding a suitable donor heart, but a recipient’s immune system is more likely to tolerate the cells than a new organ.

Source: Lab-Grown Heart Muscles Have Been Transplanted Into a Human For The First Time

Swarm Drones Demonstrate Tactics to Conduct Urban Raid

Posted on by

In its third field experiment, DARPA’s OFFensive Swarm-Enabled Tactics (OFFSET) program deployed swarms of autonomous air and ground vehicles to demonstrate a raid in an urban area. The OFFSET program envisions swarms of up to 250 collaborative autonomous systems providing critical insights to small ground units in urban areas where limited sight lines and tight spaces can obscure hazards, as well as constrain mobility and communications.

In an interactive urban raid scenario, Swarm Systems Integrator teams deployed their assets in the air and on the ground to conduct the DARPA-designed mission, seeking multiple simulated items of interest located in the buildings at the Combined Arms Collective Training Facility (CACTF) at the Camp Shelby Joint Forces Training Center in Mississippi.

The initial phase of the OFFSET swarm’s mission is to gather intelligence about the urban area of operations. In the field experiment scenario, AprilTags – a type of 2D bar code often used in robotics – were placed on and in buildings and throughout the urban environment to represent items of interest requiring further investigation and/or hazards to avoid or render safe. As the swarm relayed information acquired from the tags, human swarm tacticians adaptively employed various swarm tactics their teams had developed to isolate and secure the building(s) containing the identified items. Concurrently, separate subswarms also were often tasked to maintain situational awareness and continue observation of the surrounding environment. The complex scenario is designed to inspire and incentivize such dynamic employment of large-scale heterogeneous robotic teams to carry out these diverse tasks.

OFFSET includes two main performer types: Swarm Systems Integrators and Swarm Sprinters. The integrators, Northrop Grumman and Raytheon BBN, create OFFSET architectures, interfaces, and their respective Swarm Tactics Exchanges, which house tools to help performers design tactics by composing collective behaviors, algorithms, and existing swarm tactics. The sprinters perform focused tasks and deliver additional technologies to merge with system integrators.

In the Camp Shelby experiment, Swarm Sprinters Charles River Analytics, Inc., Case Western University, and Northwestern University demonstrated the ability to integrate novel interactions and interface modalities for enhanced human-swarm teaming, which allows the human operator to use interactions such as gestures or haptic touch to direct the swarm. Carnegie Mellon University and Soar Technology incorporated their developments in operational swarm tactics, such as providing the swarm the capability to search and map a building or automate resource allocation.

“It has been fascinating to watch the Swarm Sprinters, who may not have been previously exposed to realistic operational settings, begin to understand why it’s so difficult to operate in dense, urban environments,” says Timothy Chung, the OFFSET program manager in DARPA’s Tactical Technology Office (TTO). “The Swarm Sprinters brought a number of novel technologies they have developed over the last 6-9 months and successfully integrated and tested their developments on physical platforms in real-world environments, which was exciting to see.”

Previous field experiments took place at the U.S. Army’s Camp Roberts in Paso Robles, California, and the Selby Combined Arms Collective Training Facility in Fort Benning, Georgia. Additional field experiments are targeted at six-month intervals.

More information about OFFSET and swarm sprint thrust areas is available on DARPA’s YouTube channel and website: https://youtu.be/c7KPBHPEMM0 and http://www.darpa.mil/work-with-us/offensive-swarm-enabled-tactics.

Source: OFFSET Swarm Systems Integrators Demonstrate Tactics to Conduct Urban Raid

In ‘Sophisticated’ Incident, Dozens of U.N. Servers Hacked including their active directory server

Posted on by

An internal confidential document from the United Nations, leaked to The New Humanitarian and seen by The Associated Press, says that dozens of servers were “compromised” at offices in Geneva and Vienna.

Those include the U.N. human rights office, which has often been a lightning rod of criticism from autocratic governments for its calling-out of rights abuses.

One U.N. official told the AP that the hack, which was first detected over the summer, appeared “sophisticated” and that the extent of the damage remains unclear, especially in terms of personal, secret or compromising information that may have been stolen. The official, who spoke only on condition of anonymity to speak freely about the episode, said systems have since been reinforced.

The level of sophistication was so high that it was possible a state-backed actor might have been behind it, the official said.

There were conflicting accounts about the significance of the incursion.

“We were hacked,” U.N. human rights office spokesman Rupert Colville. “We face daily attempts to get into our computer systems. This time, they managed, but it did not get very far. Nothing confidential was compromised.”

The breach, at least at the human rights office, appears to have been limited to the so-called active directory – including a staff list and details like e-mail addresses – but not access to passwords. No domain administration’s account was compromised, officials said.

The United Nations headquarters in New York as well as the U.N.’s sprawling Palais des Nations compound in Geneva, its European headquarters, did not immediately respond to questions from the AP about the incident.

Sensitive information at the human rights office about possible war criminals in the Syrian conflict and perpetrators of Myanmar’s crackdown against Rohingya Muslims were not compromised, because it is held in extremely secure conditions, the official said.

The internal document from the U.N. Office of Information and Technology said 42 servers were “compromised” and another 25 were deemed “suspicious,” nearly all at the sprawling United Nations offices in Geneva and Vienna. Three of the “compromised” servers belonged to the Office of the High Commissioner for Human Rights, which is located across town from the main U.N. office in Geneva, and two were used by the U.N. Economic Commission for Europe.

Technicians at the United Nations office in Geneva, the world body’s European hub, on at least two occasions worked through weekends in recent months to isolate the local U.N. data center from the Internet, re-write passwords and ensure the systems were clean.

The hack comes amid rising concerns about computer or mobile phone vulnerabilities, both for large organizations like governments and the U.N. as well as for individuals and businesses.

Source: In ‘Sophisticated’ Incident, Dozens of U.N. Servers Hacked | Time

They are downplaying the importance of an Active Directory server – it contains all the users and their details, so it’s a pretty big deal.

Social media scrapers Clearview Lied About Its Crime-Solving Power In Pitches To Law Enforcement Agencies

Posted on by

A very questionable facial recognition tool being offered to law enforcement was recently exposed by Kashmir Hill for the New York Times. Clearview — created by a developer previously best known for an app that let people put Trump’s “hair” on their own photos — is being pitched to law enforcement agencies as a better AI solution for all their “who TF is this guy” problems.

Clearview doesn’t limit itself to law enforcement databases — ones (partially) filled with known criminals and arrestees. Instead of using known quantities, Clearview scrapes the internet for people’s photos. With the click of an app button, officers are connected to Clearview’s stash of 3 billion photos pulled from public feeds on Twitter, LinkedIn, and Facebook.

Most of the scrapees have already objected to being scraped. While this may violate terms of service, it’s not completely settled that scraping content from public feeds is actually illegal. However, peeved companies can attempt to shut off their firehoses, which is what Twitter is in the process of doing.

Clearview has made some bold statements about its effectiveness — statements that haven’t been independently confirmed. Clearview did not submit its software to NIST’s recent roundup of facial recognition AI, but it most likely would not have fared well. Even more established software performed poorly, misidentifying minorities almost 100 times more often than it did white males.

The company claims it finds matches 75% of the time. That doesn’t actually mean it finds the right person 75% of the time. It only means the software finds someone that matches submitted photos three-quarters of the time. Clearview has provided no stats on its false positive rate. That hasn’t stopped it from lying about its software and its use by law enforcement agencies.

A BuzzFeed report based on public records requests and conversations with the law enforcement agencies says the company’s sales pitches are about 75% bullshit.

Clearview AI, a facial recognition company that says it’s amassed a database of billions of photos, has a fantastic selling point it offers up to police departments nationwide: It cracked a case of alleged terrorism in a New York City subway station last August in a matter of seconds. “How a Terrorism Suspect Was Instantly Identified With Clearview,” read the subject line of a November email sent to law enforcement agencies across all 50 states through a crime alert service, suggesting its technology was integral to the arrest.

Here’s what the NYPD had to say about Clearview’s claims in its marketing materials:

“The NYPD did not use Clearview technology to identify the suspect in the August 16th rice cooker incident,” a department spokesperson told BuzzFeed News. “The NYPD identified the suspect using the Department’s facial recognition practice where a still image from a surveillance video was compared to a pool of lawfully possessed arrest photos.”

The NYPD also said it had no “institutional relationship” with Clearview, contradicting the company’s sales pitch insinuations. The NYPD was not alone in its rejection of Clearview’s claims.

Clearview also claimed to be instrumental in apprehending a suspect wanted for assault. In reality, the suspect turned himself in to the NYPD. The PD again pointed out Clearview played no role in this investigation. It also had nothing to do with solving a subway groping case (the tip that resulted in an arrest was provided to the NYPD by the Guardian Angels) or an alleged “40 cold cases solved” by the NYPD.

The company says it is “working with” over 600 police departments. But BuzzFeed’s investigation has uncovered at least two cases where “working with” simply meant submitting a lead to a PD tip line. Most likely, this is only the tip of the iceberg. As more requested documents roll in, there’s a very good chance this “working with” BS won’t just be a two-off.

Clearview’s background appears to be as shady as its public claims. In addition to its founder’s links to far right groups (first uncovered by Kashmir Hill), its founder pumped up the company’s reputation by deploying a bunch of sock puppets.

Ton-That set up fake LinkedIn profiles to run ads about Clearview, boasting that police officers could search over 1 billion faces in less than a second.

These are definitely not the ethics you want to see from a company pitching dubious facial recognition software to law enforcement agencies. Some agencies may perform enough due diligence to move forward with a more trustworthy company, but others will be impressed with the lower cost and the massive amount of photos in Clearview’s database and move forward with unproven software created by a company that appears to be willing to exaggerate its ability to help cops catch crooks.

If it can’t tell the truth about its contribution to law enforcement agencies, it’s probably not telling the truth about the software’s effectiveness. If cops buy into Clearview’s PR pitches, the collateral damage will be innocent people’s freedom.

Source: Facial Recognition Company Clearview Lied About Its Crime-Solving Power In Pitches To Law Enforcement Agencies | Techdirt

MIDI 2.0 overhauls the music interface for the first time in 35 years

Posted on by

About 35 years after the MIDI 1.0 Detailed Specification was established, instrument manufacturers voted unanimously on January 18th to adopt the new MIDI 2.0 spec. So what’s changing for audio interfaces? The “biggest advance in music technology in decades” brings two-way communication, among many other new features while remaining backwards compatible with the old spec.

Companies like Roland, Native Instruments, Korg and Yamaha are part of the MIDI Manufacturers Association behind the update, and we’ve already seen Roland’s A-88MKII keyboard that will be ready for the spec when it goes on sale in March.

MIDI

And it’s about time for a new standard, while the 5-bit DIN cables used in the 1980s couldn’t handle high resolution audio, the MIDI 2.0 spec is ready for any digital connector you’d like to use, and will start by targeting USB ports. That allows for far more accurate timing, and far more resolution by upgrading messages from seven bits to as much as 32-bit.

It should also make instruments easier to use, with profiles that will automatically set up gear for its intended use and a feature called Property Exchange that uses JSON (JavaScript Object Notation) to send over more detailed configuration info. You’ll spend less time shuffling through presets and more time simply making music, plus some of these features can be used even on older MIDI 1.0-spec hardware. As Reverb.com notes, there’s still room for improvement on things like networking multiple devices, but it represents a massive upgrade over the old standard, and will be useful for anyone trying to make a Grammy-winning album, whether it’s in their bedroom or a fully-kitted studio.

Source: MIDI 2.0 overhauls the music interface for the first time in 35 years | Engadget

Mozilla moves to monetize Thunderbird, transfers project to new subsidiary

Posted on by

The Mozilla Foundation announced today that it was moving the Thunderbird email client to a new subsidiary named the MZLA Technologies Corporation.

Mozilla said that Thunderbird will continue to remain free and open source, but by moving the project away from its foundation into a corporate entity they will be able to monetize the product and pay for its development easier than before.

Currently, Thunderbird is primarily being kept alive through charitable donations from the product’s userbase.

“Moving to MZLA Technologies Corporation will not only allow the Thunderbird project more flexibility and agility, but will also allow us to explore offering our users products and services that were not possible under the Mozilla Foundation,” said Philipp Kewisch, Mozilla Product Manager.

“The move will allow the project to collect revenue through partnerships and non-charitable donations, which in turn can be used to cover the costs of new products and services,” Kewisch added.

Source: Mozilla moves to monetize Thunderbird, transfers project to new subsidiary | ZDNet

Google to translate and transcribe conversations in real time

Posted on by

Google on Tuesday unveiled a feature that’ll let people use their phones to both transcribe and translate a conversation in real time into a language that isn’t being spoken. The tool will be available for the Google Translate app in the coming months, said Bryan Lin, an engineer on the Translate team.

Right now the feature is being tested in several languages, including Spanish, German and French. Lin said the computing will take place on Google’s servers and not on people’s devices.

Source: Google to translate and transcribe conversations in real time – CNET

Clearview AI Told Cops To “Run Wild” With Its Creepy Face database, access given away without checks and sold to private firms despite claiming otherwise

Posted on by

Clearview AI, the facial recognition company that claims to have amassed a database of more than 3 billion photos scraped from Facebook, YouTube, and millions of other websites, is scrambling to deal with calls for bans from advocacy groups and legal threats. These troubles come after news reports exposed its questionable data practices and misleading statements about working with law enforcement.

Following stories published in the New York Times and BuzzFeed News, the Manhattan-based startup received cease-and-desist letters from Twitter and the New Jersey attorney general. It was also sued in Illinois in a case seeking class-action status.

Despite its legal woes, Clearview continues to contradict itself, according to documents obtained by BuzzFeed News that are inconsistent with what the company has told the public. In one example, the company, whose code of conduct states that law enforcement should only use its software for criminal investigations, encouraged officers to use it on their friends and family members.

“To have these technologies rolled out by police departments without civilian oversight really raises fundamental questions about democratic accountability,” Albert Fox Cahn, a fellow at New York University and the executive director of the Surveillance Technology Oversight Project, told BuzzFeed News.

In the aftermath of revelations about its technology, Clearview has tried to clean up its image by posting informational webpages, creating a blog, and trotting out surrogates for media interviews, including one in which an investor claimed Clearview was working with “over a thousand independent law enforcement agencies.” Previously, Clearview had stated that the number was around 600.

Clearview has also tried to allay concerns that its technology could be abused or used outside the scope of police investigations. In a code of conduct that the company published on its site earlier this month, it said its users should “only use the Services for law enforcement or security purposes that are authorized by their employer and conducted pursuant to their employment.”

It bolstered that idea with a blog post on Jan. 23, which stated, “While many people have advised us that a public version would be more profitable, we have rejected the idea.”

“Clearview exists to help law enforcement agencies solve the toughest cases, and our technology comes with strict guidelines and safeguards to ensure investigators use it for its intended purpose only,” the post stated.

But in a November email to a police lieutenant in Green Bay, Wisconsin, a company representative encouraged a police officer to use the software on himself and his acquaintances.

“Have you tried taking a selfie with Clearview yet?” the email read. “It’s the best way to quickly see the power of Clearview in real time. Try your friends or family. Or a celebrity like Joe Montana or George Clooney.

“Your Clearview account has unlimited searches. So feel free to run wild with your searches,” the email continued. The city of Green Bay would later agree on a $3,000 license with Clearview.

Via Obtained by BuzzFeed News

An email from Clearview to an officer in Green Bay, Wisconsin, from November 2019.

Hoan Ton-That, the CEO of Clearview, claimed in an email that the company has safeguards on its product.

“As as [sic] safeguard we have an administrative tool for Law Enforcement supervisors and administrators to monitor the searches of a particular department,” Ton-That said. “An administrator can revoke access to an account at any time for any inappropriate use.”

Clearview’s previous correspondence with Green Bay police appeared to contradict what Ton-That told BuzzFeed News. In emails obtained by BuzzFeed News, the company told officers that searches “are always private and never stored in our proprietary database, which is totally separate from the photos you search.”

“So feel free to run wild with your searches.”

“It’s certainly inconsistent to, on the one hand, claim that this is a law enforcement tool and that there are safeguards — and then to, on the other hand, recommend it being used on friends and family,” Clare Garvie, a senior associate at the Georgetown Law’s Center on Privacy and Technology, told BuzzFeed News.

Clearview has also previously instructed police to act in direct violation of the company’s code of conduct, which was outlined in a blog post on Monday. The post stated that law enforcement agencies were “required” to receive permission from a supervisor before creating accounts.

But in a September email sent to police in Green Bay, the company said there was an “Invite User” button in the Clearview app that can be used to give any officer access to the software. The email encouraged police officers to invite as many people as possible, noting that Clearview would give them a demo account “immediately.”

“Feel free to refer as many officers and investigators as you want,” the email said. “No limits. The more people searching, the more successes.”

“Rewarding loyal customers”

Despite its claim last week that it “exists to help law enforcement agencies,” Clearview has also been working with entities outside of law enforcement. Ton-That told BuzzFeed News on Jan. 23 that Clearview was working with “a handful of private companies who use it for security purposes.” Marketing emails from late last year obtained by BuzzFeed News via a public records request showed the startup aided a Georgia-based bank in a case involving the cashing of fraudulent checks.

Earlier this year, a company representative was slated to speak at a Las Vegas gambling conference about casinos’ use of facial recognition as a way of “rewarding loyal customers and enforcing necessary bans.” Initially, Jessica Medeiros Garrison, whose title was stated on the conference website as Clearview’s vice president of public affairs, was listed on a panel that included the head of surveillance for Las Vegas’ Cosmopolitan hotel. Later versions of the conference schedule and Garrison’s bio removed all mentions of Clearview AI. It is unclear if she actually appeared on the panel.

A company spokesperson said Garrison is “a valued member of the Clearview team” but declined to answer questions on any possible work with casinos.

Cease and desist

Clearview has also faced legal threats from private and government entities. Last week, Twitter sent the company a cease-and-desist letter, noting that its claim to have collected photos from its site was in violation of the social network’s terms of service.

“This type of use (scraping Twitter for people’s images/likeness) is not allowed,” a company spokesperson told BuzzFeed News. The company, which asked Clearview to cease scraping and delete all data collected from Twitter, pointed BuzzFeed News to a part of its developer policy, which states it does not allow its data to be used for facial recognition.

On Friday, Clearview received a similar note from the New Jersey attorney general, who called on state law enforcement agencies to stop using the software. The letter also told Clearview to stop using clips of New Jersey Attorney General Gurbir Grewal in a promotional video on its site that claimed that a New Jersey police department used the software in a child predator sting late last year.

[…]

Clearview declined to provide a list of law enforcement agencies that were on free trials or paid contracts, stating that it was more than 600.

“We do not have to be hidden”

That number is lower than what one of Clearview’s investors bragged about on Saturday. David Scalzo, an early investor in Clearview through his firm, Kirenaga Partners, claimed in an interview with Dilbert creator and podcaster Scott Adams that “over a thousand independent law enforcement agencies” were using the software. The investor went on to contradict the company’s public statement that it would not make its tool available to the public, stating “it is inevitable that this digital information will be out there” and “the best thing we can do is get this technology out to everyone.”

[…]

EPIC’s letter came after an Illinois resident sued Clearview in a state district court last Wednesday, alleging the software violated the Illinois Biometric Information Privacy Act by collecting the “identifiers and information” — like facial data gathered from photos accumulated from social media — without permission. Under the law, private companies are not allowed to “collect, capture, purchase,” or receive biometric information about a person without their consent.

The complaint, which also alleged that Clearview violated the constitutional rights of all Americans, asked for class-action recognition on behalf of all US citizens, as well as all Illinois residents whose biometric information was collected. When asked, Ton-That did not comment on the lawsuit.

In legal documents given to police, obtained by BuzzFeed News through a public records request, Clearview argued that it was not subject to states’ biometric data laws including those in Illinois. In a memo to the Atlanta Police Department, a lawyer for Clearview argued that because the company’s clients are public agencies, the use of the startup’s technology could not be regulated by state law, which only governs private entities.

Cahn, the executive director of the Surveillance Technology Oversight Project, said that it was “problematic” for Clearview AI to argue it wasn’t beholden to state biometric laws.

“Those laws regulate the commercial use of these sorts of tools, and the idea that somehow this isn’t a commercial application, simply because the customer is the government, makes no sense,” he said. “This is a company with private funders that will be profiting from the use of our information.”

Under the attention, Clearview added explanations to its site to deal with privacy concerns. It added an email link for people to ask questions about its privacy policy, saying that all requests will go to its data protection officer. When asked by BuzzFeed News, the company declined to name that official.

To process a request, however, Clearview is requesting more personal information: “Please submit name, a headshot and a photo of a government-issued ID to facilitate the processing of your request.“ The company declined to say how it would use that information.

Source: Clearview AI Once Told Cops To “Run Wild” With Its Facial Recognition Tool