Apparently, management is unable to learn from their mistakes. 

https://www.enterprisetimes.co.uk/2017/04/19/nothing-new-uk-govt-cyber-security-survey/

Nothing new in UK Govt cyber security survey

The 2017 UK Govt produced Cyber Security Breaches Survey is out and it says nothing new.  Across 66 pages it repeats what businesses and the industry already know.  Businesses are under prepared, under skilled and prone to cyber security breaches.  What is worrying is that this is a situation that is not getting better.

…   The numbers from the report say that 46% of all UK businesses identified at least one cyber security breach or attack.  The larger the business the more attacks they reported.  The number was 66% for medium-sized business and 68% for large companies.

[British Chambers of Commerce report:   BCC Digital Economy Survey Part 3

Might be educational.

Feds seek 30-year sentence for Russian master hacker convicted in Seattle

Mike Carter reports:

In Russian cybercrime mastermind Roman Seleznev, the Department of Justice is boasting it finally caught and convicted a big fish in the often impenetrable world of global computer theft — and now the agency intends to make a lesson of him.

Federal prosecutors will ask a Seattle judge Friday to sentence the 32-year-old Seleznev to 30 years in prison for operating a massive — maybe unprecedented — credit-card theft scheme from behind keyboards in Vladivostok, Russia, and Bali, Indonesia.  Over a decade, Seleznev stole and sold on the black market more than 2 million credit-card numbers, resulting in losses of at least $170 million, and maybe into the billions, according to documents filed in U.S. District Court in Seattle.

Read more on Seattle Times. It’s a good read with a lot of background on Seleznev.

What were they thinking?

30,000 London gun owners hit by Met Police ‘data breach’

Gareth Corfield reports:

London gun owners are asking questions of the Metropolitan Police after the force seemingly handed the addresses of 30,000 firearm and shotgun owners to a direct mail marketing agency for a commercial firm’s advertising campaign.

The first any of the affected people knew about the blunder was when the leaflet (pictured below) landed on their doormats in Tuesday’s post.

Read more on The Register.

Should be amusing to watch.

http://fortune.com/2017/04/19/bose-headphones-privacy/

These Popular Headphones Spy on Users, Lawsuit Says

The audio maker Bose, whose wireless headphones sell for up to $350, uses an app to collect the listening habits of its customers and provide that information to third parties—all without the knowledge and permission of the users, according to a lawsuit filed in Chicago on Tuesday.

The complaint accuses Boston-based Bose of violating the WireTap Act and a variety of state privacy laws, adding that a person's audio history can include a window into a person's life and views.

"Indeed, one’s personal audio selections – including music, radio broadcast, Podcast, and lecture choices – provide an incredible amount of insight into his or her personality, behavior, political views, and personal identity," says the complaint, noting a person's audio history may contain files like LGBT podcasts or Muslim call-to-prayer recordings.

Are articles like this appearing around the world?  Probably.

https://www.theregister.co.uk/2017/02/14/reg_guide_to_data_security_when_entering_us/

The Register's guide to protecting your data when visiting the US

Summary: You're (mostly) screwed without preparation

Perspective.

http://www.networkworld.com/article/3147892/internet/one-autonomous-car-will-use-4000-gb-of-dataday.html?google_editors_picks=true

Just one autonomous car will use 4,000 GB of data/day

Two real-life, practical, semi-autonomous vehicle launches next year are an indication that the self-driving car is really happening.

Audi is expected to make its up-to-35-mph hands-free driving system available late next year in some 2018 vehicles.

And Volvo will start testing Drive Me, an autopilot that will introduce 100 Swedish XC90 owners to autonomous driving, according to an Automotive News supplement produced for the Los Angeles Auto Show last month.

Two mega-strides forward.  But if you’re impatient and wondering why it’s taking so long for car makers to offer full autonomy, as in eye-free driving, one clue is in the data.  The amounts of datasets that need to be produced and then shared in real time to make it all work are absolutely staggering.

Vehicles will generate and consume roughly 40 terabytes of data for every eight hours of driving, according to Intel CEO Brian Krzanich, speaking at the auto show’s technology pavilion, Automobility.  [1 TB = 1000 GB so, either this paragraph or the headline is wrong.  Bob]  

We need an in-car App that blocks/jams phone reception when the car is in gear. 

http://www.bespacific.com/motor-vehicle-fatalities-increase-as-drivers-continue-phone-use/

Motor vehicle fatalities increase as drivers continue phone use

by Sabrina I. Pacifici on Apr 19, 2017

Axios: “…Zendrive studied actual device use among 3.1 million drivers over 5.6 billion miles of driving and found that in 88 percent of trips, drivers made at least some use of their phones.  On average, drivers spent 3.5 minutes per hour on their device.  Some important context: The number of traffic deaths has been increasing since 2015 after a 40-year decline, with more than 40,000 people dying on the roads last year for the first time in a decade.  It is estimated that a 2-second distraction increases the risk of a collision by 20 times.”

Even the government is going mobile and using social media!  

http://www.bespacific.com/gpo-launches-new-gpo-gov-website/

GPO Launches New GPO.gov website

by Sabrina I. Pacifici on Apr 19, 2017

“The U.S. Government Publishing Office (GPO) launches a newly designed, user-friendly agency website for customers, vendors, Federal agencies, libraries and the public looking for access to Government information, the latest GPO news, and GPO products and services.  The beta site features a simple, mobile-friendly structure that connects the user in a more streamlined digital manner with GPO.  Once out of beta, this site will replace the current site that was launched in 2009.  Try our new site: https://beta.gpo.gov/

Some of the new features include:

• mobile friendly
• improved internal site search
• improved user experience
• easy access to GPO products and services
• easy access events and training
• easy access to GPO social media platforms
• locating Federal Depository Libraries”

Perspective.  (And something my spreadsheet class could do for Denver light rail?) 

https://www.renthop.com/studies/nyc/new-york-city-subway-median-rent

New York City Rents By Subway Stop 2017

Venezuela announces it no longer needs foreign inventors. 

http://www.bbc.com/news/business-39654125

GM says Venezuelan car plant is seized by government

This could be huge.  Why are some franchise owners refusing to have their systems examined? 

InterContinental Hotel Chain Breach Expands

Brian Krebs reports:

In December 2016, KrebsOnSecurity broke the news that fraud experts at various banks were seeing a pattern suggesting a widespread credit card breach across some 5,000 hotels worldwide owned by InterContinental Hotels Group (IHG).  In February, IHG acknowledged a breach but said it appeared to involve only a dozen properties.  Now, IHG has released data showing that cash registers at more than 1,000 of its properties were compromised with malicious software designed to siphon customer debit and credit card data.

Read more on KrebsonSecurity.com.

New rules!  Better?

States Take Action! New Mexico, Tennessee and Virginia Pass New Data Breach Legislation

Michael B. Katz and Cynthia J. Larose of  Mintz Levin write:

After a quiet winter there has been significant activity in state legislatures to enact, strengthen or clarify their data breach notification statutes.  The latest happenings are summarized below and we have updated our “Mintz Matrix” to reflect these new and pending laws.

Read more on Privacy & Security Matters Blog.  The authors also link to the full text of the new statutes.

https://daily.jstor.org/why-cant-we-end-spam-ask-an-economist/

Why Can’t We End Spam? Ask An Economist

Last week, Russian hacker Pyotr Levashov was arrested in Barcelona in an operation jointly undertaken by Spain and the US FBI.  Levashov is allegedly the hacker behind the Kelihos botnet, a network of up to 100,000 compromised computers that have been used to run a giant, distributed spam operation (all unknownst to the owners of the computers in the network.)

…   Security expert Brian Krebs estimated that Levashov’s botnet was capable of sending 1.5 billion emails a day, and attributes more than $438,000 in revenue from online pharmacy spam sent through that botnet over a 3-year period.  Economics research suggest that the scale and the profitability of spam are inseparable: in their article on “The Economics of Online Crime,” Moore et al. cite the results of a research project that

infiltrated a large botnet and altered the spam e-mails sent out so that they linked to a benign duplicate website under the researchers’ control.  They were able to provide the first independent answer to a long-standing question: how many people respond to spam?  It turns out that 28 sales resulted from 350 million spam e-mails advertising pharmaceuticals—a conversion rate of 0.00001 percent.

Now that is quotable!

The First Wave of Corporate AI Is Doomed to Fail

Artificial intelligence is a hot topic right now.  Driven by a fear of losing out, companies in many industries have announced AI-focused initiatives.  Unfortunately, most of these efforts will fail.  They will fail not because AI is all hype, but because companies are approaching AI-driven innovation incorrectly.  And this isn’t the first time companies have made this kind of mistake.

Today exit, tomorrow entry and eventually at every embassy and consulate? 

http://www.theverge.com/2017/4/18/15332742/us-border-biometric-exit-facial-recognition-scanning-homeland-security

Facial recognition is coming to US airports, fast-tracked by Trump

…   Called Biometric Exit, the project would use facial matching systems to identify every visa holder as they leave the country.  Passengers would have their photos taken immediately before boarding, to be matched with the passport-style photos provided with the visa application.  If there’s no match in the system, it could be evidence that the visitor entered the country illegally.  The system is currently being tested on a single flight from Atlanta to Tokyo, but after being expedited by the Trump administration, it’s expected to expand to more airports this summer, eventually rolling out to every international flight and border crossing in the US.

…   “We currently have everyone’s photo, so we don’t need to do any sort of enrollment.  We have access to the Department of State records so we have photos of US Citizens, we have visa photos, we have photos of people when they cross into the US and their biometrics are captured into [DHS biometric database] IDENT.”

…   Homeland Security estimates that roughly half a million visitors to the US overstay their visas each year — but without a verifiable exit process, the government has no way to determine how many visitors are actually overstaying or who they are.

…   Those systems also raise serious civil rights questions that agencies still haven’t answered.  Under the FBI, facial recognition has become a powerful and controversial tool for tracking criminals.  If that tool extends to face photos taken at airports, it could mean a subtle but profound change in law enforcement’s powers at the airport.

“Right now, other than the no-fly list, you do not have law enforcement checks on who can fly,” says Alvaro Bedoya, who studies facial recognition at Georgetown Law’s Center on Privacy & Technology.  “But once you take that high-quality photograph, why not run it against the FBI database?  Why not run it against state databases of people with outstanding warrants?  Suddenly you’re moving from this world in which you’re just verifying identity to another world where the act of flying is cause for a law enforcement search.”

Perspective.  Is the Internet going to the dogs?

https://www.recode.net/2017/4/18/15339208/petsmart-chewy-acquisition-price-3-35-billion

PetSmart is acquiring Chewy.com for $3.35 billion in the largest e-commerce acquisition ever

…   The deal is a huge one by any standard — bigger than Walmart’s $3.3 billion deal for Jet.com last year — and especially for a retail company like PetSmart, which was itself valued at only $8.7 billion when private equity investors took it over in 2015.

But Chewy.com has been one of the fastest-growing e-commerce sites on the planet, registering nearly $900 million in revenue last year, in what was only its fifth year in operation.  The company had been a potential IPO candidate for this year or next, but was taken out by its brick-and-mortar competitor before that.  It was not profitable last year. [My students always find this amazing.  Bob]

Yet another opportunity to expand the intellect of my students.

http://gadgets.ndtv.com/games/news/starcraft-and-starcraft-brood-war-free-download-for-windows-pc-and-macos-1683323

Starcraft and Starcraft: Brood War Free Download for Windows PC and macOS

Free is good!

https://www.macrumors.com/2017/04/18/apple-imovie-garageband-iwork-free-for-all-users/

Apple Makes iMovie, GarageBand, and iWork Apps for Mac and iOS Free for All Users

I try not to be repetitious or redundant, but allow me to reiterate: Determining how big your breach was is not that difficult if you keep adequate records!

JP: GMO Payment Gateway submits report with Japan’s Ministry of Economy, Trade and Industry over data leakage

Maria Nikolova reports:

More than a month has passed since Japanese provider of payment processing services GMO Payment Gateway Inc confirmed that personal data leakage that had affected the websites of two of its clients – the Tokyo Metropolitan Government and the Japan Housing Finance Agency.

[…]

At the end of last week, GMO Payment Gateway updated the numbers for the data leaked, referring to “doubling of information”.

Read more on FinanceFeeds.

[From the article: 

According to the initial assessments, the number of “units of information” leaked through the Tokyo Metropolitan Government website was 676,290, including 614,629 email addresses, as well as 61,661 credit card numbers and credit card expiration dates.  The number of “units” of credit card information reportedly leaked from the Japan Housing Finance Agency was 43,540, including credit card numbers, credit card expiration dates, security codes, credit card payment registration dates, addresses, email addresses, names, phone numbers, as well as dates of birth and payment joining dates.  The revised data lowers the numbers nearly two times.

Another oft repeated meme.  “Hey!  Let’s put all of the data on a portable device without encryption and then leave it in the car!” 

Breaking: Voters’ personal data at risk in Cobb theft

Aaron Gould Sheinin reports on yet another breach involving Georgia voters’ information:

State officials are investigating the theft last week of equipment from a Cobb County precinct manager’s car that could make every Georgia voters’ personal information vulnerable to theft.

The equipment, used to check-in voters at the polls, was stolen Saturday evening, Secretary of State Brian Kemp said Monday.

Read more on AJC.

Sources for my Computer Security students.

http://www.csoonline.com/article/3189752/leadership-management/cybercrime-diaries-all-the-hacks-and-data-breaches-in-one-place.html?google_editors_picks=true

Cybercrime diaries: All the hacks and data breaches in one place

Global cybercrime damages are predicted to exceed $6 trillion annually by 2021, up from $3 trillion in 2015.  The first quarter cybercrime diaries, published by Cybersecurity Ventures, have hit the stands, breaking down cybercriminal activity by category.

Reading through the diaries, one might wonder if the $6 trillion figure is an underestimate.  The cybercrime diaries are a series of blogs that provide CIOs, CSOs, CISOs and IT security teams with bulleted datelines and high-level summary commentary on the most noteworthy cybercriminal activity in a quarterly period.

Cyberwarfare.com diary

Data Breach Report diary.

DDoS Attack Diary.

Hack Blotter diary.

Password News diary.

RansomwareReport.com

Zero Day Diary.

Talking points for my Computer Security students.

http://www.csoonline.com/article/3188971/security/how-cisos-can-explain-privacy-to-the-c-suite.html?google_editors_picks=true

How CISOs can explain privacy to the C-suite

…    It’s the CISO’s role to help inform the C-suite, investors and board of directors about potential security.

If CISOs are wondering where to start, Malcolm Harkins, chief security and trust officer at Cylance and Ruby Zefo, vice president of the Law and Policy Group at Intel Corporation have put together four privacy and security topics to talk with stakeholders about.

1.      Privacy is not equal to security

2.      Blind spots do exist:

3.      Prep execs for tough questions

4.      BYOD and monitoring:

Not ‘amateur’ surveillance.

Inside the ‘Stalkerware’ Surveillance Market, Where Ordinary People Tap Each Other’s Phones

Lorenzo Franceschi-Bicchierai and Joseph Cox report:

Morgan Marquis-Boire is a security researcher who has spent months digging into the consumer spyware industry, and has seen it used in domestic violence cases first hand.  He has also spent years researching spyware used by governments.  For him, the former kind of surveillance, which can be also called stalkerware or spouseware, deserves more attention because it’s more common and widespread than many may think, and “the victims are everyday people,” he said.

Sophisticated government malware or cyberattacks on individuals are like “a rare bloodborne pathogen,” whereas consumer spyware is more like “the common cold” or flu.  It’s not as exotic, but “it does kill a lot of people every year,” Marquis-Boire told Motherboard.

Read more on Motherboard.

When Troy goes on a rant, he is fun to read!

https://www.troyhunt.com/mandatory-isp-data-retention-and-the-law-of-unintended-consequences/

Mandatory ISP data retention and the law of unintended consequences

Well, good one Australia, UK and whoever else has embarked on this hare-brained scheme, you've just made things a whole lot worse.  Our respective governments (in all their ivory-towered wisdom), have decided that because one of us could one day decide to become a terrorist, they'd better keep a big whack of our internet browsing history just in case.  The theory these genius policy makers have is that if they can probe into all our lives far enough, they'll be able to see when we're doing terrorist kinda stuff.  And really, what better way is there than siphoning up info on the websites we go to?  Job done, beer o'clock, glad we solved that one.

In the UK, you have to be able to Follow your car’s directions!  (Obey your computer overlords?)  

https://venturebeat.com/2017/04/17/u-k-learner-drivers-will-soon-have-to-follow-directions-from-a-sat-nav-as-part-of-their-driving-test/?google_editors_picks=true

U.K. driving tests will soon add GPS navigation as a required skill

If your car doesn’t already have GPS navigation technology built directly into the dashboard, then you probably at least have a smartphone mount for your windshield so you can use Google Maps for turn-by-turn directions.  Put simply, if you own a car, computer-based navigation likely plays a central role in your journeys.

And this is why the U.K. government will soon require all learner drivers to follow directions from a sat nav as part of their driving test.  The Driver and Vehicle Standards Agency (DVSA) will provide all driving examiners with a sat nav unit to give to budding drivers for their test — but this isn’t about having an ability to search for a route through a sat nav, it’s purely about being able to follow directions.  From December 4, 2017, learners will be expected to follow a pre-set route provided by the examiner.

(Related). 

https://www.wired.com/2017/04/turns-horrifying-number-people-use-phones-driving/

Turns Out, a Horrifying Number of People Use Their Phones While Driving

…   a new study indicates that damn near everybody uses their phone while behind the wheel, damn near all the time.  Using sensor data from more than 3 million drivers and 5.6 billion miles of trips, driving analytics company Zendrive found drivers are using their phones on 88 percent of their journeys.  The average driver spends 3.5 minutes on the phone per one hour trip, a stat that sounds worse when you realize just a two-second distraction increases your risk of crashing by 20 percent.

Model laws?

Montana Governor Signs Laws to Limit License Plate Tracking and Warrantless Electronic Data Collection

Mike Maharrey writes:

On Friday, Montana Gov. Steve Bullock signed two bills into law that will increase privacy protections in the state and hinder at least two federal surveillance programs.  The new laws will ban warrantless collection of data from an electronic device in most situations, and limit the use of Automated License Plate Readers (ALPRs) in the state.

Rep. Daniel Zolnikov (R-Billings) sponsored both House Bill 149 (HB149) and House Bill 147 (HB147).

Read more on Tenth Amendment Center.

Montana is looking more and more attractive these days, isn’t it?

A reaction to potential federal crackdown?

OR: Personal info no longer recorded at pot shops; dispensaries to destroy info already on file

Ariana Rakhshani reports:

Some worried about the federal implications of marijuana are rejoicing.

Governor Kate Brown signed a bill protecting those who shop at pot retailers.  Dispensaries have been required to keep customers’ personal information; it allowed the state to audit dispensaries to make sure they were only selling the legal amount to someone within a 24 hour period.

Now, dispensaries are not allowed to keep any personal information.

Read more on KTVL.

Perspective.  For those who can’t read? 

http://fortune.com/2017/04/17/netflix-q1-earnings/

Netflix Touts U.S. Growth—and the Market Believes It

Can Netflix keep adding U.S. subscribers quarter after quarter?  The company's CEO seems to think so, painting a rosy picture of growth even as the streaming service hits 50 million customers and faces stiff competition from Amazon.

…   In a letter to investors and in the video, Netflix also dropped other nuggets of good news.  These included claims that the much-hyped Dave Chappelle exclusive, which premiered in March, was the "most viewed comedy special ever," and that subscribers have spent more than half a billion hours "enjoying" specials involving actor Adam Sandler.

(Related).  A different number?

http://variety.com/2017/digital/news/netflix-q1-2017-nears-100-million-subscribers-1202032579/

Netflix Nears 100 Million Subscribers, But Q1 Gains Fall Short of Expectations

Netflix added fewer subscribers than expected for the first three months of 2017, while the No. 1 subscription-video provider said it will surpass the 100-million mark this coming weekend.

…   In 2017, the company plans to spend more than $1 billion marketing its content, Netflix said in the shareholder letter.

Perspective.  For those who can read. 

http://www.seattletimes.com/business/amazon/mass-marketer-amazon-makes-big-imprint-in-highbrow-literary-translation-niche/?utm_source=news.google.com&utm_medium=Referral&utm_campaign=rss_editors_picks_feed_technology&google_editors_picks=true

Amazon expands its literary horizons, making big imprint in translation niche

The literary translation community in the U.S. has a tradition of being highbrow, a carefully tended yet narrow reflection of the stirrings of global culture beyond the Anglosphere.

Then Amazon.com jumped in, like a whale into a koi pond.

…   AmazonCrossing, the publishing unit devoted to scouring the world for good tales, has in a short time become the most prominent interpreter of foreign fiction into English, accounting for 10 percent of all translations in 2016, more than any other publishing house in a field populated by small imprints.

…   Yet Amazon’s shine has been tarnished by a contentious relationship with New York publishing houses, bookstores and some authors.  Many bookstores — hurt by the online retailer’s dominance in book sales and its pricing power — have boycotted titles published by Amazon.  They’re also less likely to get reviewed by the traditional literary outlets, experts say.

This could be amusing just for the potential comparisons!  

https://www.nytimes.com/2017/04/17/business/dealbook/steve-ballmer-serves-up-a-fascinating-data-trove.html?_r=0

Steve Ballmer Serves Up a Fascinating Data Trove

…   On Tuesday, Mr. Ballmer plans to make public a database and a report that he and a small army of economists, professors and other professionals have been assembling as part of a stealth start-up over the last three years called USAFacts.  The database is perhaps the first nonpartisan effort to create a fully integrated look at revenue and spending across federal, state and local governments.

…   Using his website, USAFacts.org, a person could look up just about anything: How much revenue do airports take in and spend?  What percentage of overall tax revenue is paid by corporations?

For my geeks.

Try Python in Your Browser With These Free Online Interactive Shells

If you’re thinking of learning Python, you might be overwhelmed by the initial setup process.  You need to install Python on your system, then learn how to use the command line to process code, or learn how to use the interactive shell, or learn how to set up a Python IDE.

Ignore all of that. It’s unnecessary until you know whether Python is right for you.

Instead, we recommend using an online interactive shell, which is just a website that lets you write and execute Python code and instantly see the results.  No need to install anything.

Worth a look?

These Online Bookstores Are Better Than Amazon

Any action?  Like activating the motion sensors or the GPS by moving the phone? 

http://www.bespacific.com/answering-what-constitutes-a-search-of-a-cellphone-after-riley-through-a-use-based-approach/

Answering What Constitutes a Search of a Cellphone after Riley Through a ‘Use-Based’ Approach

by Sabrina I. Pacifici on Apr 16, 2017

Jacobsen, Kristen M., Let’s Get Physical, Physical: Answering What Constitutes a Search of a Cellphone after Riley Through a ‘Use-Based’ Approach (January 24, 2017).  Criminal Law Bulletin Volume 53, Issue 4, 2017.  Available at SSRN: https://ssrn.com/abstract=2952497

“Investigating and prosecuting in the twenty-first century requires that the government have clear and workable rules to determine what action constitutes a Fourth Amendment search of a cellphone.  The use-based approach provides this guidance.  The use-based approach, which will substitute for the physical trespass doctrine, holds that any physical manipulation of the cellphone or any act that requires, or prompts, internal action on the part of the cellphone internally constitutes a Fourth Amendment search.  This approach prevents advancements in technology from eradicating Fourth Amendment protections, while the already-established exceptions allow law enforcement the latitude necessary to conduct investigations.”

(Related?) 

http://www.bespacific.com/many-smartphone-owners-dont-take-steps-to-secure-their-devices/

Many smartphone owners don’t take steps to secure their devices

by Sabrina I. Pacifici on Apr 16, 2017

“Cybersecurity experts recommend that smartphone owners take a number of steps to keep their mobile devices safe and secure.  These include using a pass code to gain access to the phone, as well as regularly updating a phone’s apps and operating system.  Many Americans, however, are not adhering to these best practices, [No surprise.  Bob] according to a Pew Research Center report released earlier this year.”

(Related).  Works for lawyers, too.

http://www.bespacific.com/secure-computing-for-journalists/

Secure computing for journalists

by Sabrina I. Pacifici on Apr 16, 2017

Matthew Green: “…Classical (desktop and laptop) operating systems were designed primarily to support application developers.  This means they offer a lot of power to your applications.  An application like Microsoft Word can typically read and write all the files available to your account.  If Word becomes compromised, this is usually enough to pwn you in practice.  And in many cases, these applications have components with root (or Administrator) access, which makes them even more dangerous.  Modern phone operating systems like Android and iOS were built on a different principle.  Rather than trusting apps with much power, each app runs in a “sandbox” that (mainly) limits it to accessing its own files.  If the sandbox works, even a malicious application shouldn’t be able to reach out to touch other apps’ files or permanently modify your system.  This approach — combined with other protections such as in-memory code signing, hardware secret storage and routine use of anti-exploitation measures — makes your system vastly harder to compromise…”

Are you willing to face an unethical car? 

http://www.bespacific.com/incorporating-ethics-into-artificial-intelligence/

Incorporating Ethics into Artificial Intelligence

by Sabrina I. Pacifici on Apr 16, 2017

“This article reviews the reasons scholars hold that driverless cars and many other AI equipped machines must be able to make ethical decisions, and the difficulties this approach faces.  It then shows that cars have no moral agency, and that the term ‘autonomous’, commonly applied to these machines, is misleading, and leads to invalid conclusions about the ways these machines can be kept ethical.  The article’s most important claim is that a significant part of the challenge posed by AI-equipped machines can be addressed by the kind of ethical choices made by human beings for millennia.  Ergo, there is little need to teach machines ethics even if this could be done in the first place.  Finally, the article points out that it is a grievous error to draw on extreme outlier scenarios—such as the Trolley narratives—as a basis for conceptualizing the ethical issues at hand.  Published in the Journal of Ethics; click here for the full text (fee).” 

Something for my Security and Forensics students. 

http://www.express.co.uk/life-style/science-technology/792350/Amazon-Echo-Alexa-Update-Delete-Voice-Recording

Amazon Echo - Here's how to listen to EVERYTHING your Echo has EVER heard

…   If you want to check-out your old recordings, you’ll need to download the Alexa companion app on your Android or iOS smartphone.

Launch the app, then tap on the Settings menu, then History.

…   Tap on any of the recordings, which are listed in chronological order, to listen to the audio, review what Alexa thought you asked, and delete the file from Amazon’s servers.

If you want to delete more than one audio file, Amazon does provide a quick way to delete your entire back catalogue of voice commands.

To do this, head to amazon.com/mycd in your web browser.

From the list of devices registered to your Amazon account, select your chosen Alexa device, then tap Manage Voice Recordings, followed by Delete.

Interesting question. 

Should Antitrust Regulators Stop Companies from Collecting So Much Data?

…   there is an emerging debate over the competitive implications of big data.  Some observers argue that companies amassing too much data might inhibit competition, so antitrust regulators should preemptively take action to cut “big data” down to “medium data.”  Others say there is nothing new here, and existing competition law is more than capable of dealing with any problems.

A video manifesto?

http://www.theverge.com/2017/4/16/15321282/cleveland-murder-facebook-live-steve-stephens

Cleveland manhunt underway after video of murder uploaded to Facebook

A Cleveland man is at large after reportedly killing someone and uploading the footage to Facebook.  The video appears to show a man identified by police as 37-year-old Steve Stephens approaching a 74-year-old man, before asking him to say a name and shooting him in the head.  Some time after the murder, Stephens also began broadcasting on Facebook Live.  The video and broadcast were among multiple Facebook posts made by Stephens on Sunday afternoon, in which he claimed to have killed up to 15 people as part of an “Easter Day slaughter.”

…   Facebook has removed the video and Stephens’ account, but it took the company several hours to take them down after Stephens started his attack at around 2PM local time.

…   It’s not clear whether Facebook acted on its own to remove the posts, or reacted to requests from local law enforcement officials to take them down.

"The laddie doth protest too much, methinks,"  Or, is a trustworthy personality as important for a CEO as it is for a Presidential candidate?  (Last election notwithstanding.)  

https://www.buzzfeed.com/nitashatiku/how-mark-zuckerberg-is-writing-the-playbook-for-the-modern?utm_term=.qvXvxlwwb#.fn3b39JJK

Selling Mark Zuckerberg

The Facebook CEO’s likability blitz isn’t a presidential campaign, it’s a focus group for his 1.8 billion constituents — and part of a high stakes campaign to win your likes.

…   Zuckerberg, now a 32-year-old dad with one daughter and another on the way, has evolved considerably in the intervening decade.  He hired speechwriters.  He spruced up his uniform from Valley schlub to monochrome minimalism.  He took on a series of annual self-improvement challenges that made him into a “lifestyle guru” for some male tech workers, according to the New York Times Style section.  (The paper said his announcements “sometimes have the feel of software upgrades,” but disciples admire Zuckerberg’s ability to reinvent himself “as a better human being.”)

“One of the things I’ve noticed over the years, he has improved his EQ,” Swisher told BuzzFeed News.  (EQ is shorthand for emotional quotient, a popular rubric for measuring interpersonal skills in Silicon Valley.)  “He was super, super awkward to talk to and he knew that he had a problem and he was fully aware.  He cared about changing it.”  He may even have challenged himself to improve.  “I’m really shy, I should learn not to be so shy!  I can see him saying that,” Swisher said.

Want to be a Congressman?

http://www.bespacific.com/updates-to-the-my-congressional-district-tool/

Updates to the My Congressional District Tool

by Sabrina I. Pacifici on Apr 16, 2017

“The U.S. Census Bureau recently updated the My Congressional District web application for the 115th Congress. Other updates include:

• Statistics from the 2015 American Community Survey and maps for the congressional districts within the states that were redistricted in September 2016 (Florida, Minnesota, North Carolina and Virginia).
• Embeddable functionality.
• Re-enabled ability to download a .csv file for a single district or all districts within a state.

My Congressional District allows quick and easy access to statistics from the 2015 American Community Survey and 2014 County Business Patterns for the nation’s 435 congressional districts.  The American Community Survey provides detailed demographic, social, economic and housing statistics every year for the nation’s communities.  County Business Patterns provide annual statistics for businesses with paid employees at a detailed geography and industry level.  To see previous updates to the My Congressional District web application, click here.”

Sources and uses of funds is a useful intelligence tool.

http://www.reuters.com/article/us-usa-cyber-swift-idUSKBN17H0NX?il=0

Hacker documents show NSA tools for breaching global money transfer system

Documents and computer files released by hackers provide a blueprint for how the U.S. National Security Agency likely used weaknesses in commercially available software to gain access to the global system for transferring money between banks, a review of the data showed.

…   Belgium-based SWIFT on Friday downplayed the risk of attacks employing the code released by hackers and said it had no evidence that the main SWIFT network had ever been accessed without authorization.

It was possible that the local messaging systems of some SWIFT client banks had been breached, SWIFT said in a statement, which did not specifically mention the NSA.

Because tracking sources of terrorist financing and money flows among criminal groups is a high priority, SWIFT transfers would be a natural espionage target for many national intelligence agencies.

Does the IRS have the right to release any tax return?  

http://thehill.com/homenews/administration/328978-privacy-group-sues-irs-for-not-disclosing-trumps-taxes

Privacy group sues IRS for not disclosing Trump's taxes

A privacy group is suing the IRS for not disclosing President Trump's tax returns. 

…   In a FOIA request dated March 29, EPIC called on the IRS to release Trump's tax returns from 2010 onward in an effort to find out if the president has any financial ties to Russia. 

Easier than using AI.

https://motherboard.vice.com/en_us/article/princetons-ad-blocking-superweapon-may-put-an-end-to-the-ad-blocking-arms-race

Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race

…   The ad blocker they've created is lightweight, evaded anti ad-blocking scripts on 50 out of the 50 websites it was tested on, and can block Facebook ads that were previously unblockable.

…   The Federal Trade Commission regulations require advertisements to be clearly labeled so that a human can recognize them, which has created a built-in advantage for consumers and, now, ad blockers.  The team used several computer vision techniques to detect ads the same way that a human would, which they call "perceptual ad blocking."  Because advertisers must comply with these regulations, the authors imagine an "end game" in which consumers—and ad blockers—ultimately win.

Because we should know what we’re talking about.

“The Mother of All Bombs”: Understanding the Massive Ordnance Air Blast Weapon

Has it truly come to this?  

https://www.entrepreneur.com/article/292850?utm_source=google-news&utm_medium=syndication&utm_campaign=google-editors-pick&google_editors_picks=true

A Guide to Social Media Customer Care (Infographic)

Customer service can make or break your business.  That’s why it’s more important than ever to make sure your company is providing the best experiences for its customers.  And a great way to do this is through social media.

Today, many consumers take to social media to express their views about a brand or seek help about a company’s product or service.  When someone publicly tweets about a brand or writes on its Facebook page, the company is put to the test.  How it responds and handles the situation will impact how people view the business.

https://assets.entrepreneur.com/images/misc/1492116121_A-Guide-to-Social-Media-Customer-Care-1.png?_ga=1.107549895.493328153.1486130346

An interesting approach to security.

http://www.csoonline.com/article/3188917/application-security/can-ai-and-ml-slay-the-healthcare-ransomware-dragon.html?google_editors_picks=true

Can AI and ML slay the healthcare ransomware dragon?

It’s common knowledge that healthcare organizations are prime – and relatively easy – targets for ransomware attacks.  So it is no surprise that those attacks have become rampant in the past several years.  The term “low-hanging fruit” is frequently invoked.

But according to at least one report, and some experts, it doesn’t have to be that way. ICIT – the Institute for Critical Infrastructure Technology – contends in a recent whitepaper that the power of artificial intelligence and machine learning (AI/ML) can “crush the health sector’s ransomware pandemic.”

…   The AI/ML model, Bathurst said, doesn’t need specific signatures.  “It’s very good at answering questions like: ‘Is this file going to potentially harm my computer if it’s allowed to execute?’  It doesn’t need one-to-one matches with signatures,” he said.

It is obvious that the healthcare sector needs better security.  One of the reasons it is such a popular target is that, as the report notes, the victims are more likely to pay, since, “every second a critical system remains inaccessible risks the lives of patients and the reputation of the institution.  Hospitals whose patients suffer as a result of deficiencies in their cyber-hygiene are subject to immense fines and lawsuits.”

…   AI/ML can be three times the cost of anti-virus solutions, he said, “and healthcare organizations are already fighting for every budget dollar they have.

“If the average cost of a ransomware attack is $300 – which was reported by the ICIT in 2016 – why would I spend tens of thousands of dollars more per year to prevent that risk?  I’d need 30 or 40 successful attacks before the cost makes sense.”

(Related)

How Companies Are Already Using AI

…   In fact, although we saw examples of companies using AI in computer-to-computer transactions such as in recommendation engines that suggest what a customer should buy next or when conducting online securities trading and media buying, we saw that IT was one of the largest adopters of AI.  And it wasn’t just to detect a hacker’s moves in the data center.  IT was using AI to resolve employees’ tech support problems, automate the work of putting new systems or enhancements into production, and make sure employees used technology from approved vendors.  Between 34% and 44% of global companies surveyed are using AI in in their IT departments in these four ways, monitoring huge volumes of machine-to-machine activities.

In stark contrast, very few of the companies we surveyed were using AI to eliminate jobs altogether.  For example, only 2% are using artificial intelligence to monitor internal legal compliance, and only 3% to detect procurement fraud (e.g., bribes and kickbacks).

What about the automation of the production line?  Whether assembling automobiles or insurance policies, only 7% of manufacturing and service companies are using AI to automate production activities.  Similarly, only 8% are using AI to allocate budgets across the company. Just 6% are using AI in pricing.

Making crime safe?  Social media for the anti-social? 

http://factordaily.com/darknet-whatsapp-black-market-scam-otp/

Move over darknet, WhatsApp is where India’s new digital black market is at

…   groups offering items, mostly electronics, bought from ecommerce sites using stolen credit card details at heavily discounted prices.

Till some time ago, it was just the deep web or the darknet — which not everyone knows about and which is not easy to access — where contraband, porn, fake IDs, credit card details and other hacked user data were sold.

By moving to the chatting app, such illegal trade is becoming mainstream, allowing cybercriminals to reach out to India’s huge userbase of 200 million WhatsApp users.

What’s more, traders can be brazen in their dealings as they have no fear of being caught.  Data privacy laws and WhatsApp’s encryption policy make it next to impossible for cybercrime authorities to track such black markets.  The fact that most users on these groups sign up with virtual numbers — use-and-throw proxy numbers that can be generated using apps — makes it even more difficult.  India’s national encryption policy draft excludes WhatsApp users from the mandate of keeping a 90-day record of all their encrypted communications.

Will we even recognize when an AI makes a bad decision? 

https://www.technologyreview.com/s/604087/the-dark-secret-at-the-heart-of-ai/

The Dark Secret at the Heart of AI

No one really knows how the most advanced algorithms do what they do.  That could be a problem.

Last year, a strange self-driving car was released onto the quiet roads of Monmouth County, New Jersey.  The experimental vehicle, developed by researchers at the chip maker Nvidia, didn’t look different from other autonomous cars, but it was unlike anything demonstrated by Google, Tesla, or General Motors, and it showed the rising power of artificial intelligence.  The car didn’t follow a single instruction provided by an engineer or programmer.  Instead, it relied entirely on an algorithm that had taught itself to drive by watching a human do it.

Getting a car to drive this way was an impressive feat.  But it’s also a bit unsettling, since it isn’t completely clear how the car makes its decisions.  Information from the vehicle’s sensors goes straight into a huge network of artificial neurons that process the data and then deliver the commands required to operate the steering wheel, the brakes, and other systems.  The result seems to match the responses you’d expect from a human driver.  But what if one day it did something unexpected—crashed into a tree, or sat at a green light?  As things stand now, it might be difficult to find out why.  The system is so complicated that even the engineers who designed it may struggle to isolate the reason for any single action.  And you can’t ask it: there is no obvious way to design such a system so that it could always explain why it did what it did. [Not sure I agree with this.  Bob] 

…   In 2015, a research group at Mount Sinai Hospital in New York was inspired to apply deep learning to the hospital’s vast database of patient records.  This data set features hundreds of variables on patients, drawn from their test results, doctor visits, and so on.  The resulting program, which the researchers named Deep Patient, was trained using data from about 700,000 individuals, and when tested on new records, it proved incredibly good at predicting disease.  Without any expert instruction, Deep Patient had discovered patterns hidden in the hospital data that seemed to indicate when people were on the way to a wide range of ailments, including cancer of the liver.  There are a lot of methods that are “pretty good” at predicting disease from a patient’s records, says Joel Dudley, who leads the Mount Sinai team. But, he adds, “this was just way better.”

At the same time, Deep Patient is a bit puzzling.  It appears to anticipate the onset of psychiatric disorders like schizophrenia surprisingly well.  But since schizophrenia is notoriously difficult for physicians to predict, Dudley wondered how this was possible.  He still doesn’t know.  The new tool offers no clue as to how it does this.  If something like Deep Patient is actually going to help doctors, it will ideally give them the rationale for its prediction, to reassure them that it is accurate and to justify, say, a change in the drugs someone is being prescribed.  “We can build these models,” Dudley says ruefully, “but we don’t know how they work.”

For my cable-cutting students.

What Are Kodi Boxes and Is It Legal to Own One?

…   With those unfamiliar with Kodi, you can run it on your desktop, install the Android version from the Play Store, or even follow a workaround to get it running on your iOS gadget.

As for Kodi boxes, they are becoming increasingly common as people look to slash their cable bill or cut the cord completely.

…   Formerly known as XMBC, Kodi is a free-to-use open source media player.  It acts as a single centralized hub for all your locally-saved entertainment.  It also lets you watch live TV thanks to its support for most well-known back-ends, including MediaPortal, MythTV, NextPVR, Tvheadend, and VDR.

…   Is Kodi Illegal?

The answer is a resounding No.  Kodi is not illegal now and will almost certainly never become illegal in the future.

In simple terms, Kodi is nothing more than a media app.  When you install it on your device, it’s empty.  It’s nothing more than a shell waiting for you, the user, to populate it with content.  No add-ons come pre-packaged, and even if they did, there is no way the developers would release the app with the illegal ones baked in.

Kodi even has an official repository for add-ons.  Every single one of the add-ons you will find in it are entirely legal to download and use in every jurisdiction.

Many of my students use WhatsApp.

https://www.labnol.org/internet/whatsapp-private-store-documents/29272/

Using WhatsApp as a Private Store for your Documents and Notes

WhatsApp is more than just a messaging app.  Use the app to quick transfer files between computer and phone.  Or make it a private storehouse for your notes, voice memos, documents and more.