China wants to know as much about US (and Canadian) citizens as it does about its own.

https://www.bbc.com/news/world-us-canada-51449778

Equifax: US charges four Chinese military officers over huge hack

More than 147 million Americans were affected in 2017 when hackers stole sensitive personal data including names and addresses.

Some UK and Canadian customers were also affected.

China has denied the allegations and insisted it does not engage in cyber-theft.

Announcing the indictments on Monday, Attorney General William Barr called the hack "one of the largest data breaches in history".

According to court documents, the four - Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei - are allegedly members of the People's Liberation Army's 54th Research Institute, a component of the Chinese military.

They spent weeks in the company's system, breaking into security networks and stealing personal data, the documents said.

(Related) I really don’t agree with all of this.

https://www.nytimes.com/2020/02/10/opinion/equifax-breach-china-hacking.html

Opinion | Chinese Hacking Is Alarming. So Are Data Brokers.

Companies like Equifax threaten our personal privacy and our national security.

Would your organization handle a notice as well? Who should receive the notice?

https://www.databreaches.net/estee-lauder-exposed-440-million-records-online-researchers/

Estee Lauder Exposed 440 Million Records Online – Researchers

Jeremiah Fowler reports (typos are in the original):

On January 30th I discovered a non-password protected database that contained a massive amount of records totaling 440,336,852. Upon further review I was able to see connections to New York based cosmetic company Estée Lauder. I could see audit logs that contained a large number of email addresses in each doccument. I immediately sent a responsible disclosure notice Estée Lauder alerting them to the exposure.

As in most large companies when reporting a data exposure it is usually extremely difficult to get through the firewall of gate-keepes, but several hours later and multiple emails the data was still exposed. After calling every phone number I could find I was able to reach someone by phone who then promised to pass on the information. The company acted fast and professionally and restricted public access to the database on the same day as my notification.

Read more on Security Discovery.

I doubt the FBI ever considered something like this.(Don’t argue with Apple, BE Apple.)

https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/

‘The intelligence coup of the century’

For decades, the CIA read the encrypted communications of allies and adversaries.

For more than half a century, governments all over the world trusted a single company to keep the communications of their spies, soldiers and diplomats secret.

The company, Crypto AG, got its first break with a contract to build code-making machines for U.S. troops during World War II. Flush with cash, it became a dominant maker of encryption devices for decades, navigating waves of technology from mechanical gears to electronic circuits and, finally, silicon chips and software.

The Swiss firm made millions of dollars selling equipment to more than 120 countries well into the 21st century. Its clients included Iran, military juntas in Latin America, nuclear rivals India and Pakistan, and even the Vatican.

But what none of its customers ever knew was that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence. These spy agencies rigged the company’s devices so they could easily break the codes that countries used to send encrypted messages.

For my Architecture students.

https://sloanreview.mit.edu/article/the-future-of-platforms/

The Future of Platforms

Platforms power the world’s most valuable companies, but it will get harder and harder to capture and monetize their disruptive potential.

Should this law have been written by an AI?

Employers Using AI in Hiring Take Note: Illinois’ Artificial Intelligence Video Interview Act Is Now in Effect

Nicole Mormilo, Matthew Jedreski, K.C. Halm, and Jeffrey S. Bosley of Davis Wright Tremaine write:

On January 1, 2020, Illinois’ new Artificial Intelligence Video Interview Act(AIVIA) went into effect, meaning Illinois employers must now comply with the law if they use artificial intelligence (AI) to analyze video interviews by job candidates. As we outlined in a prior post, the AIVIA imposes duties of transparency, consent and data destruction on organizations using AI to evaluate interviewees for jobs that are “based” in Illinois.

While these concepts may be clear in the abstract, the Illinois law is a lesson in brevity and leaves several key terms undefined (including, for example, the term “artificial intelligence”). Nor is it clear what it means for a position to be “based” in Illinois. As a result, employers using AI-enabled analytics in interview videos must sort through these questions and take other affirmative steps to ensure compliance with the new law.

Read more on the firm’s blog.

Perspective.

https://www.cnet.com/news/netflix-dominates-viewing-on-tvs-over-all-other-streaming-services/

Netflix dominates viewing on TVs over all other streaming services

Netflix is big and it's getting bigger. And we're not just watching it on our phones and tablets: That dominance translates to the biggest screen in US homes too, according to a new study Tuesday from TV-measurement giant Nielsen. Netflix gobbles up 31% of streaming to TVs, beating every other service.

In what may come as a surprise, YouTube is a close second. The massive Google video service, most often associated with short clips you watch on your phone, commanded 21% of TV streaming in the last three months of 2019, Nielsen said. Hulu came in third with 12%, followed by Amazon at 8%.

Also, insurers are paying the ransom as the cheaper option. That means almost any attack will pay off.

https://www.cpomagazine.com/cyber-security/ransomware-attacks-are-causing-cyber-insurance-rates-to-go-through-the-roof-premiums-up-as-much-as-25-percent/

Ransomware Attacks Are Causing Cyber Insurance Rates to Go Through the Roof; Premiums up as Much as 25 Percent

… The central issue is the cost of fulfilling claims. When ransomware attacks lock a policyholder out of their network, there are effectively only two options; pay the ransom or restore from backups. If the client doesn’t have adequate backups, they’re locked into option A. The insurance policy may not need to cover just the ransom amount, but also costs of recovery if the hackers fail to make good on unlocking the compromised systems.

How to avoid CCPA convictions?

https://news.bloomberglaw.com/privacy-and-data-security/insight-first-ccpa-related-case-foreshadows-five-issues-5

INSIGHT: First CCPA-Related Case Foreshadows Five Issues

The first lawsuit to cite to the California Consumer Privacy Protection Act is unlikely to test the law’s limits, but should serve as a call for businesses to be ready, write Troutman Sanders attorneys. They offer five steps for preparing for more lawsuits.

Is there a more useful task for AI? (Okay, perhaps flagging those very rare moments when a politician speaks the truth?)

https://www.wsj.com/articles/in-the-eternal-quest-to-decode-fedspeak-here-come-the-computers-11581287394

In the Eternal Quest to Decode Fedspeak, Here Come the Computers

After taking the helm of the Federal Reserve in the 1980s, Alan Greenspan liked to say he had mastered the art of the strategic mumble. With financial markets prone to soar or dip based on what came out of his mouth, he learned to speak in an opaque and sometimes baffling fashion.

The idea, in part, was to avoid giving traders, politicians or anyone else any hint what the central bank was thinking of doing. “If I seem unduly clear to you, you must have misunderstood what I said,” he once joked.

Supplements.

https://www.bespacific.com/maryland-open-source-textbook-initiative-launches-tool-to-advance-adoption-of-open-educational-resources/

Maryland Open Source Textbook Initiative Launches Tool to Advance Adoption of Open Educational Resources

University of Maryland– “The Maryland Open Source Textbook (M.O.S.T.) initiative–a priority project for the University System of Maryland’s William E. Kirwan Center for Academic Innovation and state higher education partners-has launched M.O.S.T. Commons (https://most.oercommons.org/), a collaborative, online space designed to support faculty and staff in adopting, creating, and sharing open educational resources (OER). M.O.S.T. Commons serves as the foundation for the M.O.S.T. initiative, which is supporting statewide collaboration on affordable, high-quality educational resources that are openly licensed and fully accessible. Open educational resources (OER) are freely available, fully accessible instructional materials that either reside in the public domain or have been released under an intellectual property license that permits the use, revision, improvement, and redistribution by others. OER include full courses, course materials, modules, textbooks, streaming videos, tests, software, and any other tools, materials, or techniques used to support learning (adapted from the William and Flora Hewlett Foundation’s definition) …”

Should they be required to show the security improvements they have already implemented? This reads like they held off doing anything until required to by the settlement.

https://www.bloomberg.com/news/articles/2020-02-08/facebook-vows-to-improve-security-after-hack-of-29-million-users

Facebook Vows to Improve Security After Hack of 29 Million Users

Facebook Inc.pledged to improve security protocols to resolve a lawsuit blaming the company for a 2018 data breach that exposed personal data of 29 million users.

The company will check more frequently for suspicious patterns of user activity involving access tokens, the key cards that allow users to access their accounts, among other measures outlined in a proposal to settle a class-action suit filed late Friday in San Francisco federal court.

… The accord requires approval from U.S. District Judge William Alsup, who previously said that “Facebook’s repetitive losses of users’ privacy supplies a long-term need for supervision.”

Interesting idea. Some interesting questions for my students.

https://venturebeat.com/2020/02/08/an-ai-regulation-strategy-that-could-really-work/

An AI regulation strategy that could really work

… It is clear that our regulatory system needs an update. If we try to regulate 21st century technology and beyond with 20th century tools, we’ll get none of the benefits of regulation and all of the downsides.

… what we can do is try to use the best traits of markets — competition, transparency, rapid iteration — to reform our regulatory system. Specifically, this means pairing strong government oversight with private sector “regulatory markets.”

We are already seeing governments essentially outsource their roles as regulators, leaving matters to self-regulation on an increasing scale. European governments, for example, after creating the right to be forgotten on search engines that pre-dated GDPR, left the task of enforcing this right to search engines themselves. The reason? Governments lacked the technological competence, resources, and political coherence to do so themselves.

A regulatory marketis a new solution to the problem of the limited capacity of traditional regulatory agencies, invented for the nation-state manufacturing age, to keep up with the global digital age.

… So, instead of governments writing detailed rules, governments instead set the goals: What accident rates are acceptable in self-driving cars? What amount of leakage from a confidential data set is too much? What factors must be excluded from an algorithmic decision?

(Related)

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3530053

Algorithmic Fairness, Algorithmic Discrimination

Drawing on both the computer science and legal literature on algorithmic fairness, this paper makes four major contributions to the debate: First, it provides a legal response to arguments for incorporating “fairness” in algorithmic decisionmakers by demonstrating that legal rules generally apply in the form of side constraints, not fairness functions that can be optimized. Second, by looking at the problem through the lens of discrimination law, the paper recognizes that the problems posed by computational decisionmakers closely resemble the historical, institutional discrimination that discrimination law has evolved to control, a response to the claim that this problem is truly novel because it involves computerized decisionmaking. Third, the paper responds to calls for transparency in computational decisionmaking by demonstrating how transparency is unnecessary to providing accountability and that discrimination law itself provides a model for how to deal with cases of unfair algorithmic discrimination, with or without transparency. Fourth, the paper addresses a problem that has divided the literature on the topic: how to correct for discriminatory results produced by algorithms. Rather than seeing the problem as a binary one, I offer a third way, one that disaggregates the process of correcting algorithmic decisionmakers into two separate decisions: a decision to reject an old process and a separate decision to adopt a new one. Those two decisions are subject to different legal requirements, providing added flexibility to firms and agencies seeking to avoid the worst kinds of discriminatory outcomes.

Perspective. Why I have so many students from India?

https://www.npr.org/2020/02/08/801204777/a-university-built-from-scratch-in-5-months-wants-to-be-a-global-leader

A University Built From Scratch In 5 Months Wants To Be A Global Leader

… About 650 million Indians are under the age of 25. In other words, one-fifth of the world's young people live here. They want jobs, and they want an education. Enrollment in higher education here has been rising for the past decade, but in order to accommodate demand, and for the country's economy to continue to grow, the number of classroom seats has to leap forward at a dizzying rate. One author estimated in 2018 that the country needs to build at least 1,000 new universities, plus 50,000 technical colleges — in 10 years.

For my students..

https://feedly.com/i/welcome

Feedly now has an “AI tool” to help read and prioritize the articles in you RSS feed.

Another for my students.

https://www.makeuseof.com/tag/phone-interview-cheat-sheet/

The Phone Interview Cheat Sheet: Tips for Success

Add to the reference shelf.

https://www.makeuseof.com/tag/excel-free-ebook/

Download Excel For Dummies 2019 For FREE (Worth $30!)

If you’re looking for an ebook that covers all the fundamental techniques to master Microsoft Excel, this is it.

Update that Ransomware plan…

https://arstechnica.com/information-technology/2020/02/why-you-cant-bank-on-backups-to-fight-ransomware-anymore/

Why you can’t bank on backups to fight ransomware anymore

Ransomware operators stealing data before they encrypt means backups are not enough.

Just a few months after staging a ransomware exercise for its member credit unions, the Credit Union National Association (CUNA) experienced what a spokesperson described as a "business disruption issue"—caused by ransomware, according to a source that spoke with TechCrunch's Zack Whittaker.

… CUNA's recovery demonstrated that the organization had taken the threat of ransomware seriously internally as well as in the exercise it staged with member credit unions. But it also shows that even organizations that believe they're prepared for ransomware attacks can take painful business hits from ransomware, even when its effects are contained.

… Having good backups and responding quickly to the execution of ransomware malware can help limit the damage done by an attack, but ransomware operators are beginning to adapt as well—in ways that fundamentally change the model of ransomware attacks.

… Unfortunately, that sort of model is being blown up by the Maze and Sodinokibi (REvil) ransomware rings, which have adopted a model of using stolen data as leverage to ensure customers will make a payment. Even in cases where a victim can relatively quickly recover from a ransomware attack, they still will face demands for payment in order to avoid the publication or sale of information stolen by the attackers before the ransomware was triggered.

(Related) Makes me wonder what their operational logs actually log.

https://www.cbc.ca/news/canada/saskatchewan/ransomware-ehealth-update-suspicious-ip-1.5455764

eHealth discovers Sask. files sent to suspicious IP addresses in Europe

There's a chance that personal health data belonging to Saskatchewan residents could have been compromised in a ransomware attack.

Files from some of its servers have been sent to suspicious IP addresses, according to eHealth CEO Jim Hornell.

… This is the latest development in the ransomware saga. Initially, CBC News was told the attack began Jan. 5, 2020. However, Hornell revealed that the virus first entered the eHealth system on Dec. 20, 2019. Employees didn't discover there was a problem until they tried to open files on Jan. 6, 2020 and were asked for bitcoin in exchange for unlocking the files.

In January, Hornell said personal data was secure despite the ransomware hit. Now, it appears the organization can't be sure and "may never know" if personal data was affected.

The files exchanged were encrypted and password protected by the attacker, which means the exact content of those files is unknown.

Hornell said the affected server primarily contained administrative files, like emails. However, he said it's not clear if the affected server was in communication with other servers.

Testing today. What happens when they unleash everything?

https://www.databreaches.net/russia-unleashes-new-weapons-in-its-cyber-attack-testing-ground-report/

Russia Unleashes New Weapons In Its ‘Cyber Attack Testing Ground’: Report

Zak Doffman reports:

“Ukraine is, by and large, a Russian cyber attack testing ground,” Vitali Kremez tells me. The head of SentinelLabs has just penned a new reportinto the actions Russian cyber threat group “Gameredon” is taking against Ukraine, and the wider implications of this. “We assess with high confidence,” Kremez says, “that the Russian targeting and approach towards Ukraine is preparatory and will be replicated across other targets related to the Russian government.”

Read more on Forbes.

(Related) Is every hack a test of a cyber weapon?

https://edition.cnn.com/2020/02/07/tech/facebook-twitter-instagram-ourmine-hack/index.html

Facebook's official Twitter and Instagram accounts were hacked

Facebook's official social media accounts appear to have been hacked by a group that has previously compromised accounts belonging to HBO, the New York Times and, most recently, the NFL and a number of its football teams.

We’ll get it figured out soon.

https://www.hldataprotection.com/2020/02/articles/consumer-privacy/modified-ccpa-regulations-released-comments-due-february-24/

Modified CCPA Regulations Released—Comments Due February 24

On Friday, February 7, 2020, the California Attorney General (CA AG) released notice of changes to the California Consumer Privacy Act (CCPA) draft regulations. Initial draft regulations were published for public comment on October 11, 2019 (as previously covered by Hogan Lovells here).

… Redlineand cleanversions of the modified regulations, along with documents and other information the CA AG relied upon in modifying the draft regulations and the initial proposed regulations, are available on the CA AG’s CCPA website.

It could never happen here, could it?

https://www.reuters.com/article/us-china-health-surveillance-idUSKBN2011HO

Coronavirus brings China's surveillance state out of the shadows

… Chinese have long been aware that they are tracked by the world’s most sophisticated system of electronic surveillance. The coronavirus emergency has brought some of that technology out of the shadows, providing the authorities with a justification for sweeping methods of high tech social control.

Artificial intelligence and security camera companies boast that their systems can scan the streets for people with even low-grade fevers, recognize their faces even if they are wearing masks and report them to the authorities.

If a coronavirus patient boards a train, the railway’s “real name” system can provide a list of people sitting nearby.

Mobile phone apps can tell users if they have been on a flight or a train with a known coronavirus carrier, and maps can show them locations of buildings where infected patients live.

(Related) If you can’t get through an obstacle, go around.

https://www.nytimes.com/2020/02/07/opinion/dhs-cell-phone-tracking.html

Opinion | The Government Uses ‘Near Perfect Surveillance’ Data on Americans

“When the government tracks the location of a cellphone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user,” wrote John Roberts, the chief justice of the Supreme Court, in a 2018 ruling that prevented the government from obtaining location data from cellphone towers without a warrant.

“We decline to grant the state unrestricted access to a wireless carrier’s database of physical location information,” Chief Justice Roberts wrote in the decision, Carpenter v. United States.

With that judicial intent in mind, it is alarming to read a new report in The Wall Street Journal that found the Trump administration “has bought access to a commercial database that maps the movements of millions of cellphones in America and is using it for immigration and border enforcement.”

The data used by the government comes not from the phone companies but from a location data company, one of many that are quietly and relentlessly collecting the precise movements of all smartphone-owning Americans through their phone apps.

… Since that data is available for sale, it seems the government believes that no court oversight is necessary. “The federal government has essentially found a workaround by purchasing location data used by marketing firms rather than going to court on a case-by-case basis,” The Journal reported. “Because location data is available through numerous commercial ad exchanges, government lawyers have approved the programs and concluded that the Carpenter ruling doesn’t apply.”

Perspective.

https://apnews.com/2823946ed0ff770d48c8bb5523daa621

Corporate America has a 1%, too, more influential than ever

The five biggest U.S. stocks — Apple, Microsoft, Google’s parent company, Amazon and Facebook — have grown so explosively that they account for nearly 18% of the S&P 500 index by market value, when they make up just 1% of its population. Never before have five companies held such powerful sway over the index, according to Morgan Stanley strategists.

How not to respond. OR How to respond, not! Have we taken any effective action?

https://www.bespacific.com/senate-intel-releases-bipartisan-report-on-obama-admin-response-to-russian-election-interference/

Senate Intel Releases Bipartisan Report on Obama Admin Response to Russian Election Interference

“Senate Select Committee on Intelligence Chairman Richard Burr (R-NC) and Vice Chairman Mark Warner (D-VA) today released the third volume in the Committee’s bipartisan investigation into Russian election interference, “U.S. Government Response to Russian Activities.” The report examines the Obama Administration’s reaction to initial reports of election interference and the steps officials took or did not take to deter Russia’s activities. Today’s installment is the third of five volumes in the Committee’s bipartisan investigation. The first volume, “Russian Efforts Against Election Infrastructure” was released in July 2019. The second, “Russia’s Use of Social Media,” was released in September 2019. The two remaining installments will examine the 2017 Intelligence Community Assessment (ICA) on Russian interference and the Committee’s final counterintelligence findings.

After discovering the existence, if not the full scope, of Russia’s election interference efforts in late-2016, the Obama Administration struggled to determine the appropriate response. Frozen by ‘paralysis of analysis,’ hamstrung by constraints both real and perceived, Obama officials debated courses of action without truly taking one. Many of their concerns were understandable, including the fear that warning the public of the election threat would only alarm the American people and accomplish Russia’s goal of undermining faith in our democratic institutions. In navigating those valid concerns, however, Obama officials made decisions that limited their options, including preventing internal information-sharing and siloing cyber and geopolitical threats…”

(Related) Perhaps a few have taken some action. I suspect security is not universally ‘top level.’ We will see.

https://hotforsecurity.bitdefender.com/blog/fbi-outlines-technique-behind-ddos-attacks-on-us-voter-registration-website-22253.html

FBI Outlines Technique Behind DDoS Attacks on US Voter Registration Website

Hackers who unleashed DDoS attacks (Distributed Denial of Service) attacks on a state-level voter registration and voter information website in the US used a technique called Pseudo Random Subdomain Attack (PRSD,) which is a form of attack that uses DNS queries for nonexistent and randomized subdomains, according to the FBI.

… “The requests occurred over the course of at least one month in intervals of approximately two hours, with request frequency- peaking around 200,000 DNS requests during a period of time when less than 15,000 requests were typical for the targeted website.”

PRSD attacks can be dangerous if the DNS servers lack the tools to deal with such incidents. Fortunately, that wasn’t the case. The FBI said the DNS servers had rate-limiting algorithms in place, which help to filter incoming and outgoing traffic.

Targets for small, angry nations? (No details)

https://www.independent.co.uk/news/business/news/cyber-attack-financial-crisis-christine-lagarde-ecb-a9322556.html

Cyber attacks could cause financial crisis, says ECB chief Christine Lagarde

A combined cyber attack on important banks could trigger financial instability, the head of the European Central Bank has warned.

… “As an operator of critical infrastructures, the ECB obviously takes such threats very seriously,” she said in France on Wednesday evening. She said there were several “plausible channels” through which a cyber attack could morph into a serious financial crisis.

Ms Lagarde said an operational outage that destroyed or encrypted the balance accounts of a major financial institution could trigger a liquidity crisis. “History shows that liquidity crises can quickly become systemic crises,” she said. “The ECB is well aware that it has a duty to be prepared and to act pre-emptively.”

(Related)

https://www.hldataprotection.com/2020/02/articles/cybersecurity-data-breaches/sec-releases-cybersecurity-and-resiliency-observations-a-potentially-useful-guide-for-businesses/

SEC Releases Cybersecurity and Resiliency Observations: A Potentially Useful Guide for Businesses

In today’s connected world, businesses face constant pressure to improve their cybersecurity practices and to confirm that they are meeting industry standards. To continue helping businesses achieve those goals, the SEC Office of Compliance Inspections and Examination (OCIE) published on January 27 its latest Examination Observationsrelated to cybersecurity and operational resiliency practices.

The camera sees, and AI can recognize more than a face.

https://www.pogowasright.org/brief-cam-allows-police-to-identify-people-by-what-they-are-wearing-and-carrying/

“Brief Cam” Allows Police To Identify People By What They Are Wearing And Carrying

Joe Cadillic writes:

In the span oftwo years, law enforcement’s ability to identify the public using BriefCam has gone from disturbing to frightening.

A recentarticle in Twin Cities Pioneer Press revealed how the St. Paul Police Department uses Briefcam to identify people, cars, and physical objects.

Read more onMassPrivateI.

It’s not quite counter-surveillance, but more evidence that people (and that includes police officers) do not like to be photographed/videoed/recorded.

Lawsuit by man who recorded traffic stop in Pevely settles for $75,000

Robert Patrick reported:

A lawsuit by a man who said a Pevely police officer illegally detained him and seized his cellphone has been settled for $75,000, according to settlement documents obtained Monday.

Matthew Rankin, of Corpus Christi, Texas,sued in U.S. District Court in St. Louis in June, claiming that Officer Wayne Casey pried his phone out of his hand using a “thumb lock” and repeatedly threatened him with arrest after Casey spotted Rankin filming a traffic stop on Jan. 16, 2019.

Read more onSt. Louis Post-Dispatch.

Clear security issues. Will the database match the iPhone? Only your friendly neighborhood hacker knows for sure.

https://www.nytimes.com/2020/02/05/nyregion/nypd-memo-book.html

Why the N.Y.P.D. Dropped One of Its Oldest Crime-Fighting Tools

For more than a century, the New York City Police Department has required its officers to keep a detailed, handwritten memo book while on patrol.

… The department is retiring handwritten memo books by Feb. 17 in a transition to a digital version — an app on officers’ department-issued iPhones. Instead of making entries by hand, whether with flowery script from ink-dipped pens in Victorian-era New York or ballpoints today, officers will type in their notes, which the app will send to a department database.

The transition represents a major shift in the way the department regards this daily record keeping by more than 30,000 of its uniformed members, and it will vastly revamp how the department can access memo book information.

The debate heats up! So if I choose “public” for my photos the terms of service overrides that so no one can copy my photos?

https://www.cbsnews.com/news/clearview-ai-google-youtube-send-cease-and-desist-letter-to-facial-recognition-app/

Google, YouTube and Venmo send cease-and-desist letters to facial recognition app that helps law enforcement

Google, YouTube and Venmo have sent cease-and-desist letters to Clearview AI, a facial recognition app that scrapes images from websites and social media platforms, CBS News has learned. The tech companies join Twitter, which sent a similar letter in January, in trying to block the app from taking pictures from their platforms.

… "YouTube's Terms of Service explicitly forbid collecting data that can be used to identify a person. Clearview has publicly admitted to doing exactly that, and in response we sent them a cease and desist letter," YouTube Spokesperson Alex Joseph said in a statement to CBS News.

"Scraping Venmo is a violation of our terms of service and we actively work to limit and block activity that violates these policies," Venmo said in a statement to CBS News.

In addition to demanding that Clearview AI stop scraping content from Twitter, the social media platform demanded that the app delete all data already collected from Twitter, according to an excerpt of the cease-and-desist letter given to CBS News.

… CBS News has also learned Facebook sent Clearview multiple letters to clarify their policies, requested detailed information about their practices, and demanded they stop using data from Facebook's products. Although the company continues to evaluate its options, no formal cease and desist letter has been sent.

Ton-That argued that Clearview AI has a First Amendment right to access public data. "The way we have built our system is to only take publicly available information and index it that way," he said.

… Ton-That also argued that Clearview AI is essentially a search engine for faces. "Google can pull in information from all different websites," he said. "So if it's public and it's out there and could be inside Google search engine, it can be inside ours as well."

[Note: At the bottom of this page, there is a link “CA Do Not Sell My Info” which links to the first “Opt Out” page I’ve seen. Bob]

34 days and still counting? I expected lawyers to react faster.

https://www.insideprivacy.com/ccpa/ccpa-cited-for-the-first-time-in-litigation/

CCPA Cited for the First Time in Litigation

In a complaint filed on Monday involving an alleged data breach, Barnes v. Hanna Andersson, the California Consumer Privacy Act (CCPA)—the State’s comprehensive privacy law that went into effect on January 1, 2020—was cited for what appears to be the first time in a lawsuit. Importantly, however, the plaintiff in this case has not asserted a claim under the CCPA or alleged a violation of the CCPA as a predicate for a claim under the California Unfair Competition Law (UCL). This might be because, according to the complaint, the alleged data breach occurred between September–November 2019, before the CCPA went into effect.

Corn Husker privacy.

https://www.cpomagazine.com/data-protection/analyzing-the-2020-nebraska-consumer-data-privacy-act/

Analyzing the 2020 Nebraska Consumer Data Privacy Act

On January 8, 2020 Nebraska state Senator Carol Blood introduced the Nebraska Consumer Data Privacy Act (LB746 ) (the “Act”).

… The Act would apply to any Nebraska resident acting as an individual. The Act does not apply to persons acting in a commercial or employment context.

… In general, the Nebraska Act is a slimmed down version of the CCPA. Those who are familiar with the CCPA’s provisions will readily recognize many provisions of this proposed law.

I can hear the insurance industry scrambling to re-write their policies.

https://www.databreaches.net/maryland-court-finds-coverage-for-lost-data-and-slow-computers-after-ransomware-attack/

Maryland Court Finds Coverage for Lost Data and Slow Computers After Ransomware Attack

Seen on Hunton Andrews Kurth’s blog,

As previously posted on our Hunton Insurance Recovery blog, a Maryland federal court awarded summary judgment to policyholder National Ink in National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Company, finding coverage for a cyber attack under a non-cyber insurance policy after the insured’s server and networked computer system were damaged as a result of a ransomware attack. This is significant because it demonstrates that insureds can obtain insurance coverage for cyber attacks even if they do not have a specific cyber insurance policy.

Read more on Privacy & Information Security Law Blog.

Do they actually say “squash?”

https://www.wsj.com/articles/eu-deepens-antitrust-inquiry-into-facebooks-data-practices-11580994001

EU Deepens Antitrust Inquiry Into Facebook’s Data Practices

European Union antitrust investigators have sought internal documents related to Facebook Inc.’s alleged efforts to identify and squash potential rivals, deepening authorities’ preliminary probe into the social-media company, according to people familiar with the matter.

Voter lists were a major target in 2016 (and earlier), I guess they haven’t had time to secure any of these. Does not bode well for the 2020 election.
https://www.bleepingcomputer.com/news/security/fbi-warns-of-ddos-attack-on-state-voter-registration-site/
FBI Warns of DDoS Attack on State Voter Registration Site
The US Federal Bureau of Investigation (FBI) warned of a potential Distributed Denial of Service (DDoS) attack that targeted a state-level voter registration and information site in a Private Industry Notification (PIN) released today.



(Related) "Those who cannot remember the past are condemned to repeat it."
https://fivethirtyeight.com/features/iowa-democrats-should-have-known-better-than-to-use-an-app/
Iowa Democrats Should Have Known Better Than To Use An App
… Both Chisnell and MacAlpine questioned why the party didn’t simply use the caucuses as a chance to pilot an app, rather than diving into a full roll out. But in a way, the party already piloted using an app back in 2016. Both the Republican and Democratic parties in Iowa introduced apps built by Microsoft to report results during the caucuses in 2016. And it didn’t work last time, either, with multiple results not properly transmitted.






Technically, there is no reason to stop at pictures of faces. We could build a complete dossier on most social media users.
CEO of Creepy Face Recognition Firm Clearview AI Says He Has First Amendment Right to Billions of Photos
Hoan Ton-That, the CEO and founder of a face recognition company that he freely admits could help lead to a surveillance “nightmare” and a “dystopian future or something,” says he has a First Amendment right to scrape whatever images he damn well pleases off public websites like Twitter to pad out his company’s supposedly three billion photo database.
Clearview AI has licensed its face surveillance systems to over 600 law enforcement agencies ranging from the FBI and the Department of Homeland Security to local police departments. It operates with virtually next to no oversight, claims it’s exempt from biometric data laws, and marketed its tools to law enforcement as a sort of face recognition free for all while reportedly making false claims about its usefulness in cracking cases. Clearview’s database is built off images scraped from public sources on the internet like Facebook, Instagram, Twitter, Venmo, Google, and countless other websites.






Because we can’t ensure our own privacy?
https://www.nbcnews.com/tech/security/can-privacy-be-big-business-wave-startups-thinks-so-n1128626
Can privacy be big business? A wave of startups thinks so.
… The California Consumer Privacy Act, which took effect Jan. 1, gives people the right to know what large companies know about them and the right to block the sale of that information to others. In effect, it created a market for privacy expertise and software.
A wave of privacy-focused technology startups is offering a variety of services, from personal data scrubbing to business-focused software meant to help companies comply with the law.
A brief list of the nearly 300 companies now selling privacy services
… Personal privacy is still under threat from data breaches, data harvesting and elsewhere, but it may also finally be living up to its promise as a profitable business.
“We’ve just created a privacy industry,” said Alastair Mactaggart, head of Californians for Consumer Privacy, the organization that pushed the state to pass its landmark new privacy law.






I did not see this coming.
https://www.wsj.com/articles/intercontinental-exchange-approaches-ebay-about-a-takeover-11580845016
NYSE Owner Intercontinental Exchange Makes Takeover Offer for eBay
The owner of the New York Stock Exchange has made a takeover offer for eBay Inc. that could value the sprawling online marketplace at more than $30 billion, according to people familiar with the matter.
… The companies aren’t currently in formal talks, and there is no guarantee eBay would agree to a deal.






Can this logic be expanded?
https://www.theguardian.com/technology/2020/feb/05/welfare-surveillance-system-violates-human-rights-dutch-court-rules
Welfare surveillance system violates human rights, Dutch court rules
A Dutch court has ordered the immediate halt of an automated surveillance system for detecting welfare fraud because it violates human rights, in a judgment likely to resonate well beyond the Netherlands.
The case was seen as an important legal challenge to the controversial but growing use by governments around the world of artificial intelligence (AI) and risk modelling in administering welfare benefits and other core services.
Campaigners say such “digital welfare states” – developed often without consultation, and operated secretively and without adequate oversight – amount to spying on the poor, breaching privacy and human rights norms and unfairly penalising the most vulnerable.






Something to look into?
https://www.bespacific.com/law-firm-launches-free-e-discovery-app/
Law Firm Launches Free E-Discovery App
eWeek: “New York-based law firm Reed Smith on Feb. 3 announced the launch of the new “E-Discovery App” for litigation professionals and others in the e-discovery community. This mobile application was developed in-house by the firm’s Records & E-Discovery (RED) Practice Group in collaboration with the firm’s legal tech subsidiary, Gravity Stack. The E-Discovery App is a free download available through the Apple App Store and Google Play. To install the app on a phone, users can simply click on the Apple Appstore or Google Play and search for “E-Discovery App.” “Our clients and professionals within the e-discovery community have been seeking an on-demand tool that gives them access to many e-discovery resources at their fingertips,” David Cohen, a Reed Smith partner and RED chair, said in a media advisory. “Our app provides a great starting point for legal professionals and helps drive progress for our clients.”..






Something strange for my Cryptography lecture.
https://mymodernmet.com/nyc-trees-font-katie-holten/
NYC Parks Are Using a Designer’s ‘Tree Font’ to Plant Secret Messages with Real Trees