Has the fear of Cyberwar finally got their attention?

Japan’s government to urge infrastructure data be kept on servers in Japan

The Yomiuri Shimbun reports:

From April at the earliest, the government will ask operators of crucial infrastructure (see below) such as power and water suppliers to store their electronic data on servers located in Japan, as part of security measures against the threat of cyberwar.

The measure is aimed at protecting information indispensable for the security of people’s lives and for industrial competitiveness, with an eye on possible cyber-attacks by China and other countries.

Read more on The Japan News.

Some timely resources for my Computer Security students.

Ransomware, phishing attacks top new HHS list of cyberthreats in healthcare

Eli Richman reports:

Email phishing attacks, ransomware attacks and attacks against connected medical devices are among the greatest cyberthreats that health systems need to protect against, according to new cybersecurity guidance for health systems from the Department of Health and Human Services.

Released last week, the Health Industry Cybersecurity Practices were released to help the industry identify ways to reduce its risk from cyberthreats. The result of a two-year effort between HHS and private entities, the guidance fulfills a mandate of the Cybersecurity Act of 2015.

Read more on Fierce Healthcare.

The main guidance is embedded below the following links, but also see:

• Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations: Technical Volume 1 discusses the ten Cybersecurity Practices along with Sub-Practices for small health care organizations.
• Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations: Technical Volume 2 discusses the ten Cybersecurity Practices along with Sub-Practices for medium and large health care organizations.
• Resources and Templates: The Resources and Templates portion includes a variety of cybersecurity resources and templates for end users to reference.
• Cybersecurity Practices Assessments Toolkit (Appendix E-1): This tool helps organizations prioritize their cyber threats and develop their own action plans using the assessment methodology outlined in the Resources and Templates volume. This tool is still under development. To receive an advance copy, please contact us at ​CISA405d@hhs.gov.

Companies are being paid to gather the DNA needed to identify Jack the Ripper (assuming we have any of his DNA)

https://www.wired.com/story/the-future-of-crime-fighting-is-family-tree-forensics/

The Future of Crime-Fighting Is Family Tree Forensics

In April, a citizen scientist named Barbara Rae-Venter used a little-known genealogy website called GEDMatch to help investigators find a man they’d been looking for for nearly 40 years: The Golden State Killer. In the months since, law enforcement agencies across the country have flocked to the technique, arresting a flurry of more than 20 people tied to some of the most notorious cold cases of the last five decades. Far from being a forensic anomaly, genetic genealogy is quickly on its way to becoming a routine police procedure. At least one company has begun offering a full-service genetic genealogy shop to law enforcement clients. And Rae-Venter’s skills are in such high demand that she’s started teaching her secrets to some of the biggest police forces in the US, including the Federal Bureau of Investigation.

For my Enterprise Architecture students.

https://www.techopedia.com/data-science-what-to-expect-in-2019/2/33690

Data Science: What to Expect in 2019

Data science is rapidly changing. New advances in AI and machine learning mean that data can be applied in brand new ways, and in unprecedented modeling systems, to do much more than was possible just a few years ago. The cloud is also ushering in a new era of data science by making software more portable and versatile.

Techopedia asked the experts what we might see in the year ahead. Here’s some of what’s likely to come our way in 2019.

For me? Sounds interesting.

https://fpf.org/2019/01/02/classes/

Digital Data Flows Masterclass: Emerging Technologies

Digital Data Flows Masterclass is a year-long educational program designed for regulators, policymakers, and staff seeking to better understand the data-driven technologies at the forefront of data protection law & policy. The program will feature experts on machine learning, biometrics, connected cars, facial recognition, online advertising, encryption, and other emerging technologies.

Sign up to receive email updates. https://www.fpf.org/classes-enroll

Visit the Digital Data Flows Masterclass Archive to view the relevant curriculum materials and resources for previous classes:

No doubt available in public kiosks (confessionals) provided by the ever caring Big Brother.

https://www.theguardian.com/lifeandstyle/shortcuts/2019/jan/02/woebots-ai-counselling-future-therapy-mental-health

Could AI counselling be the future of therapy?

Charities are considering switching to so-called ‘woebots’ to meet the growing demand for mental health treatment

[The last line of this article is terrifying:

“Have you tried switching your husband off and on again?”

China would love it. Is that sufficient reason to drop restrictions?

https://futurism.com/ai-export-restrictions-national-security

U.S. Plan to Restrict AI Exports Could Backfire

Right now, the position of world leader in artificial intelligence is up for grabs — but soon, it could be out of the United States’s reach.

… industry insiders worry that proposed rules limiting or even outright banning the export of American AI services and technologies will prevent the nation from dominating the global AI industry. And that wouldn’t just hurt the U.S. economy — it could also jeopardize the nation’s security.

On November 19, the U.S. Department of Commerce published a proposal listing various types of AI software that it thinks could benefit from export restrictions

… According to the proposal, the purpose of the restrictions would be to bolster the U.S.’s national security — after all, AI has many potential military uses, so why would the U.S. want to put that technology in the hands of nations such as China or North Korea?

Perspective.

https://www.reuters.com/article/us-norway-autos/norways-electric-cars-zip-to-new-record-almost-a-third-of-all-sales-idUSKCN1OW0YP

Norway's electric cars zip to new record: almost a third of all sales

Almost a third of new cars sold in Norway last year were pure electric, a new world record as the country strives to end sales of fossil-fueled vehicles by 2025.

In a bid to cut carbon emissions and air pollution, Norway exempts battery-driven cars from most taxes and offers benefits such as free parking and charging points to hasten a shift from diesel and petrol engines.

Congratulations China. I hope the US goes back to the moon some day.

https://abcnews.go.com/International/chinas-lunar-probe-makes-history-landing-side-moon/story?id=60132931

China's lunar probe makes history with first-ever landing on far side of the moon

This won’t work for long. After all, it’s a guide to fixing these problems.

https://qz.com/1510746/how-to-identify-fake-faces-generated-by-ai/

AI can generate fake faces now. Here’s how to spot them

… AI-generated faces bear some telltale signs. This week, computational artist Kyle McDonald published a guide on how to identify a fake. These tips probably won’t be reliable forever, and they’re certainly not applicable to every picture—some generated images are extraordinarily convincing. But every little bit of information helps.

It’s a good day for free stuff.

https://www.freetech4teachers.com/2019/01/how-to-find-download-and-borrow-books.html

How to Find, Download, and Borrow Books from the Internet Archive

On Tuesday hundreds of thousands of works entered the public domain. That includes early movies, pictures, early audio recordings, and many pieces of literature. Many of those works are available through the Internet Archive. The Internet Archive offers millions of texts that can be borrowed and or downloaded for free. In the following video I demonstrate how you can borrow ebooks and download ebooks through the Internet Archive.

https://www.youtube.com/watch?time_continue=1&v=jU8iFBTZ8YM

Free stuff from Apple?

Apple Releases Free Audiobooks Read by Celebrities

Apple has released six exclusive audiobooks just for Apple Books users. Five are classic titles newly narrated by celebrities, while the sixth is a collection of Winnie the Pooh stories as told in the style of Disney. All of them are available for free.

A “free stuff” resource.

https://www.oreilly.com/free/

O’Reilly Media

Get free book samplers, ebooks, webcasts, tutorials and more

Consider yourself (or your selfie) scanned.

Google Wins Lawsuit Over Face-Scanning Technology

Lorraine Bailey reports:

A federal judge ruled Saturday that Google does not violate Illinois privacy laws by automatically creating a face template when Android users upload photos taken on their smartphone to the company’s cloud-based photo service.

Read more on Courthouse News.

[From the article:

“The Seventh Circuit has definitively held that retention of an individual’s private information, on its own, is not a concrete injury sufficient” to establish standing, the 28-page opinion states.

Further, there are no allegations that hackers have stolen the plaintiffs’ information or that there has been other unauthorized access to the Google Photos accounts.

“Plaintiffs cannot show – and do not argue – that Google ‘intruded into a private place’ by receiving photographs of plaintiffs voluntarily uploaded to Google photos” by themselves or others, Judge Chang said.

He added, “Plaintiffs do not offer evidence to dispute that their faces are public – just that their facial biometrics are. This is consistent with Fourth Amendment case law that rejects an expectation of privacy in a person’s face.” (Emphasis in original.)

3 business days to provide notice of a breach.

Ohio Moves on Insurance Cybersecurity

Josephine Cicchetti of Carlton Fields writes:

Ohio has joined South Carolina in becoming the next state to adopt a variation of the NAIC Insurance Data Security Model Law (“MDL-668”). This legislation makes a number of changes to Ohio’s insurance law, including the addition of a new Chapter 3965, which establishes “standards for data security and for the investigation of and notification to the Superintendent of Insurance of a cybersecurity event” (containing new Sections 3965.01 through 3965.11). Licensees will have one year to come into compliance with the new requirements, with the exception of the third party service provider provisions (Section 3965.02(F)), which have been granted a two-year implementation date.

Read more on The National Law Review.

[From the article:

The law provides an affirmative defense to any tort cause of action that "alleges that the failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information." [See Section 3965.08]. Section 3965.02(J) also states that "a licensee that meets the requirements of this chapter shall be deemed to have implemented a cybersecurity program that reasonably conforms to an industry-recognized cybersecurity framework for purposes of Chapter 1354 of the Revised Code.

Perspective.

https://www.bespacific.com/economists-calculate-the-true-value-of-facebook-to-its-users-in-new-study/

Economists calculate the true value of Facebook to its users in new study

Corrigan JR, Alhabash S, Rousu M, Cash SB (2018) How much is social media worth? Estimating the value of Facebook by paying users to stop using it. PLoS ONE 13(12): e0207101. https://doi.org/10.1371/journal.pone.0207101

“Facebook, the online social network, has more than 2 billion global users. Because those users do not pay for the service, its benefits are hard to measure. We report the results of a series of three non-hypothetical auction experiments where winners are paid to deactivate their Facebook accounts for up to one year. Though the populations sampled and the auction design differ across the experiments, we consistently find the average Facebook user would require more than $1000 to deactivate their account for one year. While the measurable impact Facebook and other free online services have on the economy may be small, our results show that the benefits these services provide for their users are large.”

For the next time I teach Statistics.

https://www.bespacific.com/seeing-theory-making-statistics-more-accessible-through-vizualizations/

Seeing Theory – Making statistics more accessible through vizualizations

“Seeing Theory was created by Daniel Kunin while an undergraduate at Brown University. The goal of this website is to make statistics more accessible through interactive visualizations.”

Chapters –

• Basic Probability
• Compound Probability
• Probability Distributions
• Frequentist Inference
• Bayesian Inference
• Regression Analysis

Should be interesting.

thedarkoverlord releases files related to 9/11 investigations and litigation; threatens to release more if companies don’t pay up

While most people in the U.K. and U.S. might have been preparing for New Year’s Eve celebrations, the hackers known as thedarkoverlord had their own plans for the evening, and their plans seemed to involve spoiling the plans of a number of corporative executives on both sides of the Atlantic.

Earlier in the day, the hackers, whose past hacks and extortion demands have been covered extensively on this site, announced that a law firm hack earlier in 2018 that had not garnered much notice had been one of their hacks. That hack, they claim, had reportedly given them access to files from major insurers such as Hicsox Group and Lloyd’s of London.

But it was in poring through the files they obtained that the hackers realized that they had acquired a treasure trove of files concerning the World Trade Center attacks and post-attack litigation. And as you might expect with such complex litigation involving subrogation, there were files containing Sensitive Security Information “from the likes of the FBI, CIA, TSA, FAA, DOD, and others.”

By the time they were done pillaging, thedarkoverlord had acquired what they described as 18,000 files relating to the litigation.

Consistent with their past methods, thedarkoverlord claims that they had offered to keep the files out of the public’s eye if their victim paid them . And the victim did pay, they say, but as in the Larson Studio case, the victim then allegedly cooperated with law enforcement, which thedarkoverlord viewed as a breach of their contract. When the victim was unwilling to pay an additional penalty, thedarkoverlord went public with a sample of files, a new Twitter account (@tdo_h4ck3rs) to tweet out some files, and some threats.

A good backgrounder for my students. (Have someone read this to a Congressman)

https://www.theguardian.com/commentisfree/2019/jan/01/the-guardian-view-on-the-future-of-ai-great-power-great-irresponsibility

Artificial intelligence can’t save us from human stupidity | Editorial

Looking over the year that has passed, it is a nice question whether human stupidity or artificial intelligence has done more to shape events. Perhaps it is the convergence of the two that we really need to fear.

… It is possible to make them represent their reasoning in ways that humans can understand. In fact, in the EU and Britain it may be illegal not to in certain circumstances: the General Data Protection Regulation (GDPR) gives people the right to know on what grounds computer programs make decisions that affect their future, although this has not been tested in practice. This kind of safety check is not just a precaution against the propagation of bias and wrongful discrimination: it’s also needed to make the partnership between humans and their newest tools productive.

Background for my Computer Security students.

8 Ways Google Can Track You and How to Stop or View it

A job my students should consider. (And some skills I have to teach.)

https://www.cpomagazine.com/2019/01/01/the-new-and-misunderstood-role-of-the-gdpr-data-protection-officer/

The New (And Misunderstood) Role of the GDPR Data Protection Officer

… Core competencies

Three areas of significant experience are absolute requirements for this position:

• Knowledge of how GDPR regulations and all applicable national data protection law apply to the organization’s data processing practices;
• Significant experience with IT security audits and threat assessment; and
• Strong communication skills across a variety of organizational positions and departments.

Interesting and worth thinking about.

https://www.cpomagazine.com/2018/12/31/look-beyond-the-regulations-to-see-what-2019-has-in-store-for-the-privacy-industry/

Look Beyond the Regulations to See What 2019 Has in Store for the Privacy Industry

… here are my predictions concerning data privacy in 2019:

The Rise of the CISO and CTO – Privacy is a data issue, and that’s the responsibility of the CTO and sometimes the CISO.

The Data Protection Continuum – Privacy and security will start to be seen as a Data Protection Continuum, with privacy telling you “what” is important and “why,” and security telling you “how” to protect it

Privacy vs. Data Industrial Complex – In 2019, organizations will recognize they need to be concerned about the private data they hold – even if they themselves don’t intend to monetize it.

Growth of Data Privacy Automation – People will realize that automation at the data layer is the only feasible way to ensure continuous compliance related to data privacy laws. [This is why I changed so many of my lectures on Security and Software Architecture. Bob]

Perspective. The Luddites of 2019?

https://www.nytimes.com/2018/12/31/us/waymo-self-driving-cars-arizona-attacks.html

Wielding Rocks and Knives, Arizonans Attack Self-Driving Cars

… “They didn’t ask us if we wanted to be part of their beta test,”

At least 21 such attacks have been leveled at Waymo vans in Chandler, as first reported by The Arizona Republic. Some analysts say they expect more such behavior as the nation moves into a broader discussion about the potential for driverless cars to unleash colossal changes in American society. The debate touches on fears ranging from eliminating jobs for drivers to ceding control over mobility to autonomous vehicles.

“People are lashing out justifiably," said Douglas Rushkoff, a media theorist at City University of New York and author of the book “Throwing Rocks at the Google Bus.” He likened driverless cars to robotic incarnations of scabs — workers who refuse to join strikes or who take the place of those on strike.

If you really, really love movies…

The 5 Best Sites for Public Domain Movies

Think of it as a work in progress.

https://www.theverge.com/2018/12/31/18162541/vein-authentication-wax-hand-hack-starbug

Hackers use a fake wax hand to fool vein authentication security

Vein authentication, a biometric security method that scans the veins in your hand, has been cracked, reports Motherboard. Using a fake hand made out of wax, Jan Krissler and Julian Albrecht demonstrated how they were able to bypass scanners made by both Hitachi and Fujitsu, which they claim covers around 95 percent of the vein authentication market. The method was demonstrated at Germany’s annual Chaos Communication Congress.

While imprints of fingerprints can often be left behind on surfaces just by touching them, vein patterns cannot, and are considered to be much more secure as a result.

Is this in time to ensure the 2020 election is influence free?

https://www.bespacific.com/measuring-the-filter-bubble-how-google-is-influencing-what-you-click-2/

Measuring the “Filter Bubble”: How Google is influencing what you click

DuckDuckGo Blog: “Over the years, there has been considerable discussion of Google’s “filter bubble” problem. Put simply, it’s the manipulation of your search results based on your personal data. In practice this means links are moved up or down or added to your Google search results, necessitating the filtering of other search results altogether. These editorialized results are informed by the personal information Google has on you (like your search, browsing, and purchase history), and puts you in a bubble based on what Google’s algorithms think you’re most likely to click on. The filter bubble is particularly pernicious when searching for political topics. That’s because undecided and inquisitive voters turn to search engines to conduct basic research on candidates and issues in the critical time when they are forming their opinions on them. If they’re getting information that is swayed to one side because of their personal filter bubbles, then this can have a significant effect on political outcomes in aggregate…

Now, after the 2016 U.S. Presidential election and other recent elections, there is justified new interest in examining the ways people can be influenced politically online. In that context, we conducted another study to examine the state of Google’s filter bubble problem in 2018…”

Facebook is certainly being vilified like they are responsible.

https://www.nytimes.com/2018/12/30/technology/facebook-data-privacy-ftc.html

Facebook Data Scandals Stoke Criticism That a Privacy Watchdog Too Rarely Bites

Last spring, soon after Facebook acknowledged that the data of tens of millions of its users had improperly been obtained by the political consulting firm Cambridge Analytica, a top enforcement official at the Federal Trade Commission drafted a memo about the prospect of disciplining the social network.

Lawmakers, consumer advocates and even former commission officials were clamoring for tough action against Facebook, arguing that it had violated an earlier F.T.C. consent decree barring it from misleading users about how their information was shared.

But the enforcement official, James A. Kohm, took a different view. In a previously undisclosed memo in March, Mr. Kohm — echoing Facebook’s own argument — cautioned that Facebook was not responsible for the consulting firm’s reported abuses. The social network seemed to have taken reasonable steps to address the problem, he wrote, according to someone who read the memo, and most likely had not broken its promises to the F.T.C.

Perspective.

https://techcrunch.com/2018/12/28/smart-speakers-hit-critical-mass-in-2018/

Smart speakers hit critical mass in 2018

... The smart speaker market reached critical mass in 2018, with around 41 percent of U.S. consumers now owning a voice-activated speaker, up from 21.5 percent in 2017.

This was the activity on my blog yesterday. Strange that once again more Russians are reading the blog than anyone else. And why can’t Google identify the country 116 users are connecting from?

Pageviews by countries.

Not sure I would notice if the Denver Post wasn’t being delivered. I canceled my subscription years ago. (Practice for cyberwar?)

https://www.latimes.com/local/lanow/la-me-ln-times-delivery-disruption-20181229-story.html

Malware attack disrupts delivery of L.A. Times and Tribune papers across the U.S.

What first arose as a server outage was identified Saturday as a malware attack, which appears to have originated from outside the United States and hobbled computer systems and delayed weekend deliveries of the Los Angeles Times and other newspapers across the country.

Technology teams worked feverishly to quarantine the computer virus, but it spread through Tribune Publishing’s network and reinfected systems crucial to the news production and printing process. Multiple newspapers around the country were affected because they share a production platform.

Seems an awful long time to identify a bad card…

https://www.geekwire.com/2018/report-huge-centurylink-outage-caused-bad-networking-card-colorado/

Report: Huge CenturyLink outage caused by bad networking card in Colorado

… Brian Krebs, a veteran security journalist, posted a copy of a notice sent to CenturyLink’s “core customers” to his Twitter feed Saturday that blamed a card at its data center in Colorado for “propagating invalid frame packets across devices,” causing a series of issues that forced the company to reboot much of its networking equipment. It took CenturyLink more than two days from when it first identified the issues to sound the all-clear on Saturday morning, a period during which 911 services in several states including Washington were down or spotty.

… By the standards of modern cloud service providers, a two-day outage is an eternity. And it’s not clear how a single piece of equipment could cause an outage of such magnitude given the layers of redundancy that cloud providers build into their systems.

An FCC investigation into the outage might turn up some answers, unless CenturyLink is willing to post a moew detailed post-mortem on the outage, which is becoming a standard part of incident response.

So why are ‘innocent’ drones coming to Gatwick to die? Something fishy here.

https://www.thetimes.co.uk/article/two-drones-found-at-gatwick-but-still-no-arrests-hdk2mqfl7

Two drones found at Gatwick airport but still no arrests

Sussex police have found two drones at the perimeter of Gatwick airport but neither is the one responsible for last week’s runway closures and travel chaos, the force’s chief constable has revealed.

Probably cheap.

https://www.cnn.com/2018/12/28/business/wells-fargo-settlement/index.html

Wells Fargo is paying $575 million to states to settle fake account claims

Over the past two years, Wells Fargo has faced numerous lawsuits and government investigations stemming from a cascade of business scandals.

On Friday, it took a step to put one batch of accusations behind it.

The bank agreed to pay $575 million to all 50 states and the District of Columbia to settle civil charges related to the bank's fake-accounts scandals.

The agreement, which applies to charges brought by states' attorneys general, follows other fines and settlements Wells Fargo (WFC) has paid out since September 2016. That's when the bank admitted its employees opened as many as 3.5 million fake bank and credit card accounts without customers' knowledge.

Overreaction? If you can’t spend the day texting, perhaps you will vote?

https://www.aljazeera.com/news/2018/12/bangladesh-shuts-mobile-internet-lead-election-day-181229111353218.html

Bangladesh shuts down mobile internet in lead up to election day

Bangladesh's telecoms regulator has ordered mobile operators to shut down high-speed mobile internet services until midnight Sunday, the day of a national election.

… "The decision has been taken to prevent rumours and propaganda surrounding the vote," Zakir Hussain Khan said.

As Bangladeshis get set for Sunday's parliamentary elections, there are fears that violence and intimidation could keep many voters away.

… A spokesman for the RAB, Bangladesh's elite security force, said on Saturday they had arrested eight men for spreading rumours on social media before the poll.

EU approved free software? I use some of them, perhaps I should use more.

https://juliareda.eu/2018/12/eu-fossa-bug-bounties/

In January, the EU starts running Bug Bounties on Free and Open Source Software

… In January the European Commission is launching 14 out of a total of 15 bug bounties on Free Software projects that the EU institutions rely on.

… Here is the list of Software projects and the bug bounties:

When your failures are immediately obvious…

https://www.npr.org/2018/12/28/680747866/fcc-investigates-widespread-centurylink-outage-that-disrupted-911-service

FCC Investigates Widespread CenturyLink Outage That Disrupted 911 Service

… The telecommunications giant CenturyLink, based in Monroe, La., says the outage began at 8:18 a.m. ET on Thursday. The website Down Detector says it primarily affected Western states, but emergency service providers on both coasts reported disruptions. CenturyLink has said "a network element ... was impacting customer services" but has offered no further details on the cause of the outage or the number of customers affected.

… The FCC says its last investigation of a 911 outage was launched in March of last year. It fined AT&T $5.25 million for two nationwide outages in March and May 2017 that lasted a total of approximately six hours and resulted in the failure of 15,200 failed 911 calls.

In addition to disrupting 911 services, the CenturyLink outage also caused outages of Verizon network services in at least two states, New Mexico and Montana. Some ATMs in Montana and Idaho also failed to work, and at the North Colorado Medical Center in Greeley, Colo., doctors and nurses for a time had difficulty accessing patient records.

These skills will be back home in a year.

https://www.securityweek.com/national-guard-4-states-will-help-cyber-operations

National Guard From 4 States Will Help With Cyber Operations

National Guard soldiers from Colorado, North Dakota, South Dakota and Utah are deploying to Fort Meade, Maryland, as part of a cyber protection team supporting U.S. military operations in Afghanistan.

The Colorado guard said Thursday Cyber Protection Team 174 will help the Defense Department with network security and cyber defensive operations.

… The team's assignment is to help commanders operate freely in the cyber domain as well as on the ground while denying adversaries that ability.

Facebook corrects all the things the Times got wrong.

https://newsroom.fb.com/news/2018/12/content-review-facts/

Facts About Content Review on Facebook

… Our policies are public, not “secret” or “closely held.”

For years, we’ve published our Community Standards, the overarching guide that outlines what is and isn’t allowed on Facebook. Earlier this year we went a step further and published the internal guidelines we use to enforce those standards. Anyone can view them at facebook.com/communitystandards.

Did you ever wonder where President Trump looks for his brainstorm?

https://www.aljazeera.com/news/2018/12/russia-builds-border-fence-crimea-ukraine-proper-181228145700919.html

Russia builds border fence between Crimea and Ukraine proper

Russia has built a 60km fence on the border with Ukraine on the north of the Russian-annexed Crimea, according to the de facto Crimean authorities.

… "to protect the local population from the crazy antics of the current Ukrainian government".

GDPR inspired laws are coming closer.

Are You Ready for Brazil’s New Data Protection Law?

Isabel Carvalho, Rafael Loureiro, and Daniel Crespo of Hogan Lovells write:

The Brazilian General Data Protection Law (“Lei Geral de Proteção de Dados” or “LGPD”), passed by Congress on 14 August 2018, will come into effect on 15 February 2020. The new data protection law significantly improves Brazil’s existing legal framework by regulating the use of personal data by the public and private sectors. Very similar to the General Data Protection Regulation (“GDPR”) implemented in the European Union, the LGPD imposes strict regulations on the collection, use, processing, and storage of electronic and physical personal data. In conjunction with the passing of the LGPD, the National Data Protection Authority will be created in order to adequately implement the new legislation.

Read more on Chronicle of Data Protection.

Yeah, it’s tough. Deal with it.

https://www.nytimes.com/2018/12/27/world/facebook-moderators.html

Inside Facebook’s Secret Rulebook for Global Political Speech

… The company, which makes about $5 billion in profit per quarter, has to show that it is serious about removing dangerous content. It must also continue to attract more users from more countries and try to keep them on the site longer.

How can Facebook monitor billions of posts per day in over 100 languages, all without disturbing the endless expansion that is core to its business? The company’s solution: a network of workers using a maze of PowerPoint slides spelling out what’s forbidden.

… The closely held rules are extensive, and they make the company a far more powerful arbiter of global speech than has been publicly recognized or acknowledged by the company itself, The New York Times has found.

The Times was provided with more than 1,400 pages from the rulebooks by an employee who said he feared that the company was exercising too much power, with too little oversight — and making too many mistakes.

Perspective.

https://www.cbsnews.com/news/amazons-rise-forces-laundry-detergents-to-shrink/

Amazon's rise forces laundry detergents to shrink

Tide and Seventh Generation have introduced redesigned laundry detergents that are several pounds lighter by cutting down on plastic in their packaging and using less water in their formulas. Why? To please Amazon and other online stores: Lighter packaging means retailers pay less to ship the detergent to shopper's doorsteps, making each sale more profitable.

… The downsized detergents are a sign of Amazon's growing influence. Companies that have designed products for decades to stand out on store shelves are now being pressured by online retailers to make their packaging lighter to cut down on shipping costs, said Gary Liu, vice president of marketing at Boomerang Commerce, which makes software for consumer goods companies.

For the Research toolkit.

https://www.bespacific.com/instagram-viewer-search-engine/

Instagram viewer search engine

“Pikbee is the best Instagram online web viewer on the Internet. Discovering top trending media on Instagram…”

An article I missed. Could this be a shot at Hillary?

https://fcw.com/articles/2018/12/14/fec-wyden-personal-cyber.aspx

FEC: Lawmakers and staff may use campaign funds for personal cybersecurity

… FEC Commissioner Caroline Hunter wrote on behalf of the commission that spending on cyber hygiene and protective services would not constitute, "impermissible conversion of campaign funds to personal use."

… The unanimous vote Thursday will allow members of Congress and staff to use campaign funds to purchase a range of hardware and software products to bolster their own security, including cell phones and computers, home routers, personal software and applications, firewalls, antivirus software, security keys, secure cloud services, password management tools, consulting, incident response services and others.

"With growing threats posed by foreign governments, it's crucial that elected officials get smarter about their cybersecurity," said Wyden on Twitter.

… While members of Congress can draw from cybersecurity resources at the House and Senate Sergeant-At-Arms to protect their official devices and accounts, they were unable to do so for personal ones or those of their families.

(Related) Apparently, this is an approved use of campaign funds. “I didn’t know what they did but I gave them $750,000.”

https://www.businessinsider.com/reid-hoffman-misinformation-alabama-senate-race-2018-12

Linkedin founder Reid Hoffman apologizes after $750,000 campaign donation linked to misinformation in Alabama senate race

Linkedin co-founder and Greylock Partner's investor Reid Hoffman apologized Wednesday for funding a group linked to a misinformation campaign during Alabama's 2017 special election for the US Senate.

… Hoffman donated $750,000 to AET, according to the Washington Post, who first reported Hoffman's statement Wednesday.

Hoffman, a vocal democratic donor, said in the statement that he was not aware of the group's work with New Knowledge before it was reported last week.

Another article I missed. Fake news is even dangerous to robots (algorithms).

https://www.zdnet.com/article/market-volatility-fake-news-spooks-trading-algorithms/

Market volatility: Fake news spooks trading algorithms

Fake news and inaccurate headlines may have contributed to recent stock market volatility, as trading algorithms try to interpret market-related news.

Hugh Son, at CNBC reported that in a note written to clients by J.P. Morgan Chase's top quant, Marko Kolanovic, blamed a media landscape that's a mix of real and fake news, which makes it easy for others to amplify negative news. The effects can be seen that, in spite of a booming economy and positive signals, the markets are reacting strongly to this mix of negative news.

(Related)

http://nymag.com/intelligencer/2018/12/how-much-of-the-internet-is-fake.html

How Much of the Internet Is Fake? Turns Out, a Lot of It, Actually.

… For a period of time in 2013, the Times reported this year, a full half of YouTube traffic was “bots masquerading as people,” a portion so high that employees feared an inflection point after which YouTube’s systems for detecting fraudulent traffic would begin to regard bot traffic as real and human traffic as fake. They called this hypothetical event “the Inversion.”

I guess they never heard of Fake News. (Sounds like a business opportunity, but keep your plans off social media.)

https://www.bespacific.com/irs-wants-to-use-social-media-to-catch-tax-cheats/

IRS wants to use social media to catch tax cheats

Quartz: “The Internal Revenue Service is looking for ways to scour social media platforms like Facebook, Instagram, and Twitter in its ongoing quest to catch tax cheats. That’s according to a request for information issued December 18 by the IRS’s National Office of Procurement. The mining of social media data by the agency has been suspected in the past, but the IRS has never before confirmed the practice.

“Businesses and individuals increasingly use social media to advertise, promote, and sell products and services,” the IRS solicitation reads. “For example, taxpayers can create ‘online stores’ on social networking sites free of cost. Much of this information is unrestricted, allowing the public, businesses and various governmental agencies to discover taxpayers’ locations and income sources. But the IRS currently has no formal tool to access this public information, compile social media feeds, or search multiple social media sites.”…

An interesting approach. (So, Flipkart can’t sell anything from Walmart?)

https://www.reuters.com/article/us-india-ecommerce-idUSKCN1OP14M

India tightens e-commerce rules, likely to hit Amazon, Flipkart

India will ban e-commerce companies such as Amazon.com and Walmart-owned Flipkart Group from selling products from companies in which they have an equity interest.

… The All India Online Vendors Association (AIOVA) in October filed a petition with the anti-trust body Competition Commission of India (CCI) alleging that Amazon favours merchants that it partly owns, such as Cloudtail and Appario. The lobby group filed a similar petition against Flipkart in May, alleging violation of competition rules through preferential treatment for select sellers.

Perspective. We practiced hiding from nuclear weapons. I guess every generation needs to learn what their parents fear.

https://www.bespacific.com/more-than-4-1m-students-were-in-a-school-lockdown-last-year/

More than 4.1M students were in a school lockdown last year

Washington Post: “School shootings remain rare, even after 2018, a year of historic carnage on K-12 campuses. What’s not rare are lockdowns, which have become a hallmark of American education and a byproduct of this country’s inability to curb its gun violence epidemic. Lockdowns save lives during real attacks, but even when there is no gunman stalking the hallways, the procedures can inflict immense psychological damage on children convinced that they’re in danger. And the number of kids who have experienced these ordeals is extraordinary. More than 4.1 million students endured at least one lockdown in the 2017-2018 school year alone, according to a first-of-its-kind analysis by The Washington Post that included a review of 20,000 news stories and data from school districts in 31 of the country’s largest cities…”

Timely. Computer Security class starts January 2^nd.

https://www.bespacific.com/teaching-cybersecurity-law-and-policy-revised-62-page-syllabus-primer/

Teaching Cybersecurity Law and Policy: Revised 62-Page Syllabus/Primer

Teaching Cybersecurity Law and Policy: My Revised 62-Page Syllabus/Primer (Bobby Chesney, Charles I. Francis Professor in Law and Associate Dean for Academic Affairs at the University of Texas School of Law) – “Cybersecurity law and policy is a fun subject to teach. There is vast room for creativity in selecting topics, readings and learning objectives. But that same quality makes it difficult to decide what to cover, what learning objectives to set, and which reading assignments to use. With support from the Hewlett Foundation, I’ve spent a lot of time in recent years wrestling with this challenge, and last spring I posted the initial fruits of that effort in the form of a massive “syllabus” document. Now, I’m back with version 2.0. At 62 pages (including a great deal of original substantive content, links to readings, and endless discussion prompts), it is probably most accurate to describe it as a hybrid between a syllabus and a textbook. Though definitely intended in the first instance to benefit colleagues who teach in this area or might want to do so, I think it also will be handy as a primer for anyone—practitioner, lawyer, engineer, student, etc.—who wants to think deeply about the various substrands of this emergent field and how they relate to one another.”

Here’s the document.

(Related)

https://www.bespacific.com/cellphones-law-enforcement-and-the-right-to-privacy/

Cellphones, Law Enforcement, and the Right to Privacy

Brennan Center for Social Justice: How the Government Is Collecting and Using Your Location Data

“Cell phones are ubiquitous. As of 2017, there were more cell phones than people in the United States. Nearly 70 percent of those were smartphones, with 94 percent of millennials carrying a smart device. Cell phones go nearly everywhere, and users are increasingly dependent on smartphone applications for daily activities, such as texting, email, and location-assisted direction services.. This white paper surveys the landscape of government acquisition of location data about cell phone users — from cellular providers’ collection of location information to the use of technologies that pinpoint where individuals and cell phones are located. It describes how cell phones operate, how that location information is accrued and disseminated, and the technologies that can be used to establish where a phone is, where it has been, and what other users have been in proximity…The paper then analyzes both the legal and policy landscape: how courts have ruled on these issues, how they can be expected to rule in the future, and how agencies have addressed these issues internally, if at all. It adds to concerns that cell phone-based monitoring could violate the constitutional privacy rights of millions of ordinary Americans…”

Preparing for the 2020 election.

https://www.psychologytoday.com/us/blog/friction/201812/why-americans-fell-russian-internet-trolls

Why Americans Fell for Russian Internet Trolls

… Researchers found an average of 1.73 likes, retweets or replies for Russian trolls’ posts in Russian or any language other than English; for English-language posts, the rate was nine times that high (15.25). Americans, it turned out, were easy targets for the Russian propaganda.

… What remains unclear is why Americans were so much more vulnerable than other targets.

An answer proposed by the study’s authors was that the former Soviets were “immunized” against the Russian propaganda. Because of their history, they expect to be lied to, and so are generally more cynical than Americans.

Perspective. This neatly sums up what we’ve been saying all along. (Is there an opportunity here?)

https://www.bespacific.com/new-on-llrx-the-bullshit-algorithm/

New on LLRX – The Bullshit Algorithm

Via LLRX.com – The Bullshit Algorithm – Jason Voiovich goes directly to the heart of the matter with his statements that are a lessons learned guide that no researcher can afford to ignore – “Wasn’t the promise of data-driven, search engine and social media algorithms that they would amplify the truth and protect us from misinformation by tapping the wisdom of crowds? The fact is that they do not. And cannot. Because that is not what they are designed to do. At the heart of every social media algorithm is a fatal flaw that values persuasion over facts. Social media platforms (as well as search engines) are not designed for truth. They are designed for popularity. They are bullshit engines.”

“They’re skilled at avoiding (not evading) taxes. They make a lot of money. We should take it from them.” This was inevitable – tax laws have to change to reflect global business.

https://www.france24.com/en/20181217-france-tax-large-internet-tech-gafa-company-usa

France to introduce tax on large internet, tech firms

France has been pushing hard for a new so-called "GAFA tax" -- named after Google, Apple, Facebook and Amazon -- to ensure the global giants pay a fair share of taxes on their massive business operations in Europe.

"The tax will be introduced whatever happens on January 1 and it will be for the whole of 2019 for an amount that we estimate at 500 million euros ($570 million)," Le Maire told a press conference in Paris.

… Policymakers across the world have had difficulty in taxing the US-based giants who dominate their sectors internationally, but who often route their revenues and profits via low-tax jurisdictions to reduce their liabilities.

France's move to introduce the tax on January 1 could be driven by domestic budget concerns, with the finance ministry looking for new sources of revenues and savings.

… Some other EU member states such as Britain, Spain and Italy are also working on national versions of a digital tax, with Singapore and India also planning their own schemes.

Perspective. For some reason, this astonishes my students. “Didn’t Amazon kill all the bookstores?”

https://www.vox.com/the-goods/2018/12/19/18146500/independent-bookstores-instagram-social-media-growth

Instagram is helping save the indie bookstore

The internet is killing independent bookstores. Right? Maybe not.

For years, that’s been the prevailing narrative: The internet is killing IRL bookstores, particularly your beloved mom-and-pop local independent bookstore. Since Amazon launched in 1995, it has been lamented as earth-shattering for the brick-and-mortar bookstore business. And when Amazon subsequently launched the Kindle e-reader device in 2007, it sold out immediately. People fretted that it was ushering in the death of the print book in favor of the e-book.

… Between 2009 and 2015, the number of independent bookstores grew by 35 percent, according to the American Booksellers Association. Print book sales are on the rise too: Sales of physical books have increased every year since 2013. In 2017, print book sales were up 10.8 percent from 2013, while sales of traditionally published e-books actually dropped 10 percent from 2016 to 2017.

To share with all my students.

https://medium.freecodecamp.org/2018s-most-popular-free-online-courses-f4bc54e3ff2f

The Top Free Online University Courses of 2018, Ranked by Popularity

… At the end of every year, I do an extensive analysis of the MOOC space. To help me with analysis, I send the top MOOC providers a set of questions, one of them being the top enrolled courses of 2018.

The list below contains the top enrolled courses from the major MOOC providers: Coursera, edX, Udacity, and FutureLearn. Combined, these providers represent a big chunk of the MOOC learners (70+ million!).

[I selected a few...

• Introduction to Computer Science and Programming Using Python from Massachusetts Institute of Technology ★★★★☆(119)

• Algorithms, Part I from Princeton University ★★★★★(58)
• Introduction to Cyber Security from The Open University ★★★★☆(20)
• Analyzing and Visualizing Data with Excel from Microsoft ★★★★☆(13)

• Data Science: R Basics from Harvard University ★★★★★(5)

• Introduction to Data Analysis using Excel from Microsoft ★★★★☆(5)
• Introduction to Python: Absolute Beginner from Microsoft ★★★★★(1)
• Programming Foundations with Python

A Christmas gift for hackers.

https://www.fifthdomain.com/congress/2018/12/21/how-a-government-shutdown-affects-americas-cybersecurity-workforce/

How a government shutdown affects America’s cybersecurity workforce

… Among the heaviest hit agencies would be the National Institute of Standards and Technology, which would have 85 percent of its staff furloughed. Only 435 employees are considered “essential,” according to a planning document from the Department of Commerce.

… Also seeing sharp reductions are the Director of National Intelligence’s analysis and operations workforce, which would see a 60 percent reduction in active workforce to just 345 employees, according to documents.

… It appears that the Department of Homeland Security’s new Cybersecurity and Infrastructure Security Agency, created just last month, is among the most protected in the event of a government shutdown. The agency would only have 45 percent of its workforce furloughed, with 2,008 employees exempt.

For my Software Architecture students to ponder.

https://www.nytimes.com/2018/12/21/technology/amazon-last-minute-gifts-shopping.html

Last-Minute Shoppers Increasingly Trust Only Amazon to Deliver

Olivia Zimmermann started her holiday shopping early this year, buying a Bluetooth speaker from Best Buy for her sister. It was supposed to arrive by Dec. 10, two weeks before Christmas.

The speaker never showed up — and the post office said it had delivered the package to a different town. Best Buy apologized and offered to reship it. But Ms. Zimmermann, who works in marketing in Chicago, was over it.

“I just want a refund,” she told the retailer, and then added: “At this point, I have already ordered from Amazon because I know for a fact it will be here when they say it will.”

Perspective. How tight do you get before you reach Big Brotherhood?

https://www.justsecurity.org/62023/russias-tightening-control-cyberspace-borders/

Russia’s Tightening Control of Cyberspace Within its Borders

Russian federal lawmakers have just drafted legislation that would ban the publication of online materials that “blatantly disrespect Russian society, the state, official state symbols, the Russian Constitution, and law enforcement agencies.” Such a law would exacerbate the severity of existing laws, which Human Rights Watch has said already “sought to stigmatize criticism or alternative views of government policy as disloyal, foreign-sponsored, or even traitorous” and crack down on physical mechanisms of protest like public assembly.

At the same time as that new legislation, Russia’s internet “regulator,” Roskomnadzor, has proposed a law that would permit the agency to entirely block search engines that don’t comply with requests of state authorities.

Sometimes data has an immediate value.

Hackers Steal Thousands Of Files From M&A Giant Evercore

Tyler Durden reports:

We break from tonight’s episode of “Powell in turmoil” to let you know that an “unknown” hacker appears to have inside info on a substantial portion of the global pipeline of upcoming M&A deals. According to The Times, thousands of “sensitive documents” have been stolen by hackers in a cyber-attack on M&A and restructuring giant Evercore.

According to the report, one of the boutique bank’s junior administrators in London was the victim of a “phishing” attack – similar to the way in which John Podesta allegedly handed over control of his inbox to an unknown hacker – in which a recipient is lured into clicking on a corrupt link in an email. The hackers gained access to her inbox, leading to the theft of 160,000 “data objects” such as diary invitations, documents and emails. It is likely that among the tens of thousands of stolen objects was confidential data on the countless merger deals the company is currently working on.

Read more on ZeroHedge.

What my Computer Security students need to watch for.

https://hotforsecurity.bitdefender.com/blog/researcher-identifies-the-personalities-most-susceptible-to-fall-victim-to-cybercrime-20681.html

Impulsive personalities most likely to fall victim to cybercrime, research shows

New research from Michigan State University examining the behavior that leads someone to fall victim to cybercrime reveals that impulse online shopping, downloading music and compulsive email use are all signs of a certain personality trait that make you a target for malware attacks.

“People who show signs of low self-control are the ones we found more susceptible to malware attacks,” said Tomas Holt, professor of criminal justice and lead author of the research. “An individual’s characteristics are critical in studying how cybercrime perseveres, particularly the person’s impulsiveness and the activities that they engage in while online that have the greatest impact on their risk.”

Evidence based. Next we should demand facts!

https://e-pluribusunum.org/2018/12/21/congress-made-open-government-data-the-default-in-the-united-states/

Congress votes to make open government data the default in the United States

On December 21, 2018, the United States House of Representatives voted to enact H.R. 4174, the Foundations for Evidence-Based Policymaking Act of 2017, in a historic win for open government in the United States of America.

The Open, Public, Electronic, and Necessary Government Data Act (AKA the OPEN Government Data Act) is about to become law as a result. This codifies two canonical principles for democracy in the 21st century:

1. public information should be open by default to the public in a machine-readable format, where such publication doesn’t harm privacy or security
2. federal agencies should use evidence when they make public policy

Will 2019 be the year everyone finally learns their security lessons? I doubt it.

How Wellcome Trust Executives Got Whaled By Oldest Trick In The Fraud Playbook

Davey Winder writes:

It hasn’t been the greatest week for the non-profit sector with the revelation that two well-known charities have fallen victim to less than charitable cyber con-artists. In the same week that the Save the Children Federation confirmed it had been scammed out of $1 million by email fraudsters, so the Wellcome Trust has revealed the email of four senior executives was compromised and sensitive information monitored for several months. Without wishing to be uncharitable, both of these cyber-attacks fall firmly into the ‘oldest trick in the book’ category.

Let me start by saying that I am not in the habit of victim shaming; the focus must be on the threat actor when it comes to attributing bad guy status. That said, as we fast approach 2019, I also think the time for pussy-footing around the lack of security awareness issue within many large organizations has long since passed. The Wellcome Trust is most certainly a large organization any which way you look at it; in fact, with some £26 billion of assets, it is the biggest charity in Britain. So, when I read in my copy of the Times today that no less than four senior executives were “misled into entering their passwords when sent a link to click on” my will live to live starts fading away.

Read more on Forbes.

If the best you can do is identify “last year’s” election interference, the 2020 election is doomed!

https://www.nbcnews.com/tech/social-media/facebook-suspends-5-accounts-inauthentic-behavior-during-alabama-special-election-n951276

Facebook suspends 5 accounts for 'inauthentic behavior' during Alabama special election

… One of the accounts that Facebook suspended belonged to Jonathon Morgan, the chief executive of research firm New Knowledge. Morgan confirmed that his account had been suspended through a New Knowledge spokesperson.

Morgan told The Washington Post on Dec. 18 that he had engaged in an experiment with misleading online tactics during the 2017 special election in Alabama.

During race between Republican Roy Moore and Democrat Doug Jones, who was elected to serve in the U.S. Senate, Morgan told the Post he created a Facebook page under false pretenses to test his ability to appeal to conservative voters, according to the report.

A great summary.

https://www.insideprivacy.com/data-privacy/privacy-and-cybersecurity-a-global-year-end-review/

Privacy and Cybersecurity: A Global Year-End Review

Perspective. It is amazing that this did not happen much earlier. Implications for smartphone manufacturers.

https://techcrunch.com/2018/12/21/the-gps-wars-have-begun/

The GPS wars have begun

… Countries around the world, including China, Japan, India and the United Kingdom plus the European Union are exploring, testing and deploying satellites to build out their own positioning capabilities.

That’s a massive change for the United States, which for decades has had a practical monopoly on determining the location of objects through its Global Positioning System (GPS), a military service of the Air Force built during the Cold War that has allowed commercial uses since mid-2000 (for a short history of GPS, check out this article, or for the comprehensive history, here’s the book-length treatment).

… Today, the only global alternative to that system is Russia’s GLONASS, which reached full global coverage a couple of years ago following an aggressive program by Russian president Vladimir Putin to rebuild it after it had degraded following the break-up of the Soviet Union.

This seemed a little “off.” But it did help to ‘justify’ resuming flights.

https://www.bbc.com/news/uk-england-46665615

Gatwick drones pair 'no longer suspects'

The 47-year-old man and 54-year-old woman, from Crawley, West Sussex, were arrested on Friday night on suspicion of "the criminal use of drones".

Sussex Police said the pair were no longer suspects.

Meanwhile, Det Ch Supt Jason Tingley told Sky News officers had found a damaged drone near the airport.

… Det Ch Supt Tingley said the arrested man and woman had "fully co-operated" with inquiries and he was "satisfied that they are no longer suspects in the drone incidents at Gatwick".