Would you like to test drive your neighbor’s Tesla?

https://arstechnica.com/information-technology/2022/06/hackers-out-to-steal-a-tesla-can-create-their-very-own-personal-key/

Gone in 130 seconds: New Tesla hack gives thieves their own personal key

Last year, Tesla issued an update that made its vehicles easier to start after being unlocked with their NFC key cards. Now, a researcher has shown how the feature can be exploited to steal cars.

… Martin Herfurt, a security researcher in Austria, quickly noticed something odd about the new feature: Not only did it allow the car to automatically start within 130 seconds of being unlocked with the NFC card, but it also put the car in a state to accept entirely new keys—with no authentication required and zero indication given by the in-car display.

Only a hint. Does this suggest that AI juries are in our future?

https://legal-mag.com/2022/06/10/can-ai-tools-tell-us-what-juries-are-thinking/

Can AI Tools Tell Us What Juries Are Thinking?

Are jury consultants among the job categories at risk of replacement by AI? An increasing number of companies would say “yes, absolutely.”

A host of new AI tools, originally developed to analyze advertising campaigns, enhance customer service, or surveil possible suspects, has encountered an inevitable extension of use into the legal field.

If you declare our actions acts of war, we might declare your actions acts of war. It isn’t war, until we say it’s war.

https://www.theregister.com/2022/06/10/russia_china_usa_ukraine_cyberdefense/

Russia, China, warn US its cyber support of Ukraine has consequences

Russia and China have each warned the United States that the offensive cyber-ops it ran to support Ukraine were acts of aggression that invite reprisal.

The US has acknowledged it assisted Ukraine to shore up its cyber defences, conducted information operations, and took offensive actions during Russia's illegal invasion.

While many nations occasionally mention they possess offensive cyber-weapons and won't be afraid to use them, admissions they've been used are rare. US Cyber Command chief General Paul Nakasone's public remarks to that effect were therefore unusual.

Not an encouraging trend.

https://www.cpomagazine.com/cyber-security/twice-as-many-healthcare-organizations-paid-extortion-after-ransomware-attacks-but-only-2-recovered-all-data/

Twice as Many Healthcare Organizations Paid Extortion After Ransomware Attacks, but Only 2% Recovered All Data

A study by Sophos found that ransomware attacks against healthcare organizations almost doubled in 2021.

The State of Ransomware in Healthcare 2022 report found that nearly two-thirds (66%) of healthcare organizations were hit by ransomware in 2021 compared to just over a third (34%) in 2020.

Subsequently, the number of organizations paying ransom also almost doubled from 34% in 2020 to 61% in 2021, a 94% increase.

However, of all organizations that paid the ransom, only 2% recovered all data in 2021, compared to 8% in 2020. The change marked a 75% decrease in complete data recovery.

The new warriors. Taking a selfie with troops in the background? Photos of dead Russian soldiers that will be facially identified so their families can be sent emails? Videos of atrocities?

https://www.schneier.com/blog/archives/2022/06/smartphones-and-civilians-in-wartime.html

Smartphones and Civilians in Wartime

Interesting article about civilians using smartphones to assist their militaries in wartime, and how that blurs the important legal distinction between combatants and non-combatants:

The principle of distinction between the two roles is a critical cornerstone of international humanitarian law — the law of armed conflict, codified by decades of customs and laws such as the Geneva Conventions. Those considered civilians and civilian targets are not to be attacked by military forces; as they are not combatants, they should be spared. At the same time, they also should not act as combatants — if they do, they may lose this status.

The conundrum, then, is how to classify a civilian who, with the use of their smartphone, potentially becomes an active participant in a military sensor system. (To be clear, solely having the app installed is not sufficient to lose the protected status. What matters is actual usage.) The Additional Protocol I to Geneva Conventions states that civilians enjoy protection from the “dangers arising from military operations unless and for such time as they take a direct part in hostilities.” Legally, if civilians engage in military activity, such as taking part in hostilities by using weapons, they forfeit their protected status, “for such time as they take a direct part in hostilities” that “affect[s] the military operations,” according to the International Committee of the Red Cross, the traditional impartial custodian of International Humanitarian Law. This is the case even if the people in question are not formally members of the armed forces. By losing the status of a civilian, one may become a legitimate military objective, carrying the risk of being directly attacked by military forces.

A missing datum. I can predict revenue and the costs of a given violation of GDPR, but the size of the potential fine was unknown… Until now!

https://www.insideprivacy.com/eu-data-protection/calculating-gdpr-fines-edpb-publishes-proposals-for-a-harmonized-methodology/

Calculating GDPR fines: EDPB publishes proposals for a harmonized methodology

The most significant change that GDPR made to EU data privacy law was to enhance enforcement and create a framework for increased fines for non-compliance. Four years after the GDPR started to apply, and as enforcement action picks up across the EU, the EDPB has finally issued draft guidelines on the calculation of administrative fines under the GDPR (the “Guidelines”). The EDPB aims to create a single methodology for calculating fines issued under the GDPR (for both cross-border and non-cross border cases), and thus should replace existing national frameworks, that diverge from the Guidelines. The Guidelines will sit alongside existing guidelines that focus on the circumstances in which to impose a fine.

Is there a clear line between making my system attractive and making it addictive?

https://www.bloomberg.com/news/articles/2022-06-08/meta-hit-with-8-suits-claiming-algorithms-hook-youth-ruin-lives#xj4y7vzkg

Meta Hit With 8 Suits Claiming Its Algorithms Hook Youth and Ruin Their Lives

• Users claim defective design, failure to warn of health issues

• Company says it has improved supervision tools for parents

Meta Platforms Inc. is now a leader in another social media trend – lawsuits claiming the company built algorithms in its platforms that lure young people into destructive addiction.

To blog or not to blog. Being much smaller than Facebook, I can say (or not say) anything I want. Laws differ due to the size of the offender.

https://www.bespacific.com/a-supreme-court-speech-showdown-is-coming-and-nobody-knows-what-to-expect/

A Supreme Court speech showdown is coming, and nobody knows what to expect

The Verge: US Supreme Court is poised to consider a question with seismic consequences for online speech. Over the past year, laws in Texas and Florida have set up a legal battle over whether the First Amendment protects social networks’ right to curate user-generated content or whether these sites should be treated more like phone companies, required to host nearly any speech their users post. The courts’ split reflects a deepening shift in how to interpret a basic constitutional right, filtered through a political culture war and backlash against large web platforms. For years, sites like Facebook and YouTube have broadly assumed that moderation decisions are protected by the First Amendment. But, last month, the Fifth Circuit Court of Appeals made a surprise ruling over Texas’ HB 20, a law that bans large apps and websites from moderating content based on “viewpoint.” The court ruled against NetChoice and the Computer & Communications Industry Association (CCIA) and let the law go into effect, sending the groups scrambling to file an emergency Supreme Court petition. That petition was granted — temporarily blocking the law but also offering a preview of a seemingly inevitable Supreme Court battle…. The central issue is whether the government can regulate how social networks sort and remove legal content. Opponents argue that curating posts and setting community standards involves private companies exercising a constitutional right to speak (or not speak, in the case of content bans). Supporters compare the sites to shopping malls or telephone networks, whose First Amendment rights are limited. But both sides so far are leaning on old cases involving non-digital spaces and tech, and the Texas law in particular repurposes legal terms outside of even relatively recent judicial context. It designates social networks as utility-like common carriers, a label that federal rules explicitly avoid applying to internet service providers — let alone websites. And it also bans “viewpoint discrimination,” a term the Supreme Court has used to describe unlawful government restrictions on speech but that Texas lawmakers have treated as synonymous with private companies moderating conservative content…”

Would you be negligent if you failed to use facial recognition in appropriate circumstances? Blocking my face for PimEyes users does nothing to block all the other facial recognition vendors.

https://www.cpomagazine.com/data-privacy/pimeyes-face-search-engine-alarmingly-thorough-and-accurate-able-to-pick-faces-out-of-crowds/

PimEyes Face Search Engine Alarmingly Thorough and Accurate, Able To Pick Faces Out of Crowds

A new report by the New York Times takes the subscription-based face search engine PimEyes for a test run, and comes back with worrying results for personal privacy. A test conducted on a number of the paper’s reporters unearthed a surprisingly accurate collection of results including decades-old pictures, pictures in which the subject’s face was obscured, and even pictures in which they were in the midst of a blurry crowd.

PimEyes claims neutrality and that it is merely a “tool provider,” but the company’s business model raises questions. It offers “premium subscriptions” that run from $90 to $300 per month in price, which allow for requests that particular photos be excluded from the search results made available to all of the platform’s other users.

When is ‘no consent’ acceptable?

https://fpf.org/blog/new-report-on-limits-of-consent-in-south-koreas-data-protection-law/

NEW REPORT ON LIMITS OF “CONSENT” IN SOUTH KOREA’S DATA PROTECTION LAW

Today, the Future of Privacy Forum (FPF) and Asian Business Law Institute (ABLI) – as part of their ongoing joint research project: “From Consent-Centric Data Protection Frameworks to Responsible Data Practices and Privacy Accountability in Asia Pacific” – are publishing a second report in their series of detailed jurisdiction reports on the status of “consent” and alternatives to consent as lawful bases for processing personal data in Asia Pacific (APAC) – this time focusing on South Korea.

This report provides a detailed overview of relevant laws and regulations in South Korea, including:

• notice and consent requirements for processing personal data;

• the status of alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and

• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

The first report focused on the People’s Republic of China and explained how the country’s data protection framework has evolved over the past few years from a consent-centric model to one which provides various alternatives to consent in a GDPR-type model.

The findings of this report and others in the series will inform a forthcoming comparative review paper which will make detailed recommendations for legal convergence in APAC.

Coming soon to a state near me?

https://www.pogowasright.org/poland-establishes-terrifying-pregnancy-register-after-banning-almost-all-abortions/

Poland Establishes ‘Terrifying’ Pregnancy Register After Banning Almost All Abortions

Julia Conley reports:

A new government database tracking people’s pregnancies in Poland is sparking fears that medical data will be used to prosecute women who obtain abortion care in other countries or by getting abortion pills through the mail, and potentially to target women who have miscarriages.

Health Minister Adam Niedzielski approved an ordinance last Friday expanding the kind of information that can be stored in a central database on patients, including allergies, blood type, and pregnancy status.

Tracking pregnancies in the country is necessary, Niedzielski claimed, so doctors know if a woman shouldn’t receive certain medications or x-rays.

But in a country that banned abortion care in almost all cases in 2020—with exceptions theoretically in the case of health risks to the pregnant woman or of a pregnancy that results from rape or incest—Parliament member Kamila Gasiuk-Pihowicz said Tuesday that the register would be used to “persecute and control Polish women.”

Read more at CommonDreams.

(Related) Another surveillance of ‘something we don’t like?’

https://www.pogowasright.org/met-police-profiling-children-on-a-large-scale-documents-show/

Met police profiling children ‘on a large scale’, documents show

Wil Crisp and Vikram Dodd report:

Metropolitan police documents say the force has been collecting “children’s personal data” from social media sites as part of a project to carry out “profiling on a large scale”.

The Met says the scheme, known as Project Alpha, helps fight serious violence, with the intelligence gathered identifying offenders and securing the removal of videos glorifying stabbings and shootings from platforms such as YouTube.

The unit, comprising more than 30 staff and launched in 2019 with Home Office funding, scours social media sites looking at drill music videos and other content.

Read more at The Guardian.

(Related) What could you learn from my DNA? Targeted viruses?

https://www.pogowasright.org/uk-genetic-paparazzi-are-right-around-the-corner-and-courts-arent-ready-to-confront-the-legal-quagmire-of-dna-theft/

UK: Genetic paparazzi are right around the corner, and courts aren’t ready to confront the legal quagmire of DNA theft

Liza Vertinsky and Yaniv Heled write:

Every so often stories of genetic theft, or extreme precautions taken to avoid it, make headline news. So it was with a picture of French President Emmanuel Macron and Russian President Vladimir Putin sitting at opposite ends of a very long table after Macron declined to take a Russian PCR COVID-19 test. Many speculated that Macron refused due to security concerns that the Russians would take and use his DNA for nefarious purposes. German Chancellor Olaf Scholz similarly refused to take a Russian PCR COVID-19 test.

While these concerns may seem relatively new, pop star celebrity Madonna has been raising alarm bells about the potential for nonconsensual, surreptitious collection and testing of DNA for over a decade. She has hired cleaning crews to sterilize her dressing rooms after concerts and requires her own new toilet seats at each stop of her tours.

At first, Madonna was ridiculed for having DNA paranoia. But as more advanced, faster and cheaper genetic technologies have reached the consumer realm, these concerns seem not only reasonable, but justified.

Read more at Inforrm

From sanctions to oblivion?

https://www.engadget.com/ibm-pulls-out-of-russia-terminates-workforce-213043951.html

IBM begins laying off its entire Russian workforce

The company suspended operations back in March but kept employees on the payroll.

… US sanctions on Russian banks have made it harder for the company to pay its employees in the country, Reuters reported last month.

(Related)

https://www.bloomberg.com/news/articles/2022-06-08/microsoft-slashes-russia-operations-after-war-clouds-outlook

Microsoft Slashes Russia Operations After War Clouds Outlook

… In March, the company suspended new sales of products and services in Russia but continued to support existing customers and maintain offices there.

My AI is following this case closely. Asks if there should be a jury of AI peers?

https://news.bloomberglaw.com/ip-law/federal-circuit-panel-balks-at-accepting-ai-as-inventor

Federal Circuit Panel Balks at Accepting AI as Inventor

A Federal Circuit panel homed in on the question of how to define “inventor” and “individual” in a test case for artificial intelligence inventorship, drawing skepticism from at least two judges.

The term “individual” as used in the Patent Act should be interpreted broadly, extending to artificial intelligence machines such as DABUS, which computer scientist Stephen Thaler listed as the inventor on two patent applications, Ryan Abbott, a partner at Brown, Neri, Smith & Khan LLP, argued to the US Court of Appeals for the Federal Circuit on Monday. Chief Judge Kimberly A. Moore and Circuit Judge Richard G. Taranto centered their questions on how to plainly define “individual,” hesitating at the notion of zero human involvement in the creation of AI-generated inventions.

Taranto noted that in some cases it would be “odd” to list an AI as an inventor. Artificial intelligence refers to a capability, he said, citing dictionary definitions.

… Stark noted that the Supreme Court’s 2012 decision in Mohamed v. Palestinian Auth. found that individual means natural person, “unless of course there’s some contrary indication,” he said.

Abbott said he wasn’t aware of any case that has interpreted the term more recently. Reading individual to mean natural person, though, wouldn’t be consistent with Congress’s intent in passing the Patent Act, Abbott argued.

“Congress passed the Patent Act to encourage innovation, not to inhibit it,” Abbott said. “Here, ‘individual’ needs a broader meaning as an inventor.”

… Moore and Taranto questioned Barghaan on whether the person who creates the code that programs the computer to then create a genetic sequence, a vaccine, or another invention would be the inventor. Taranto said the panel is not going to resolve the questions of whether a programmer is an inventor in those cases, but asked about what issues arise under those circumstances.

Barghaan argreed that Thaler didn’t have any involvement in the concept creation of the inventions DABUS produced, which is why those inventions aren’t patentable, he said. Listing the programmer as an inventor also “opens a Pandora’s Box” of issues, Barghaan said.

… The case is Thaler v. Vidal, Fed. Cir., 21-2347.

You need to think about this before allowing some amateur hacker to challenge the pros. On the other hand, this could be a new market for my Ethical Hackers.

https://www.cpomagazine.com/cyber-security/defensive-cyber-attacks-declared-legal-by-uk-ag-path-cleared-to-hack-back-when-critical-infrastructure-services-attacked/

Defensive Cyber Attacks Declared Legal by UK AG, Path Cleared to “Hack Back” When Critical Infrastructure & Services Attacked

The Attorney General of the United Kingdom has declared the country can make use of defensive cyber attacks when “key services” (such as critical infrastructure and banks) are struck by foreign threat actors.

The country is taking a formal position on extending international law to the digital realm, something that nations have typically been hesitant to do as espionage attempts are regularly traded back and forth between them. AG Suella Braverman paired the move with an argument before leading policy institute Chatham House that the international principle of non-intervention in the affairs of other sovereign countries should now extend to cyber attacks and countermeasures in a “proportionate” way.

Forewarned etc.

https://www.makeuseof.com/what-is-smishing-scam/

What Is a Smishing Scam? How Can You Spot One?

… The term "smishing" is a merger of "SMS" (Short Message Service) and "phishing"—fittingly so, as smishing scams involve conducting phishing via SMS. Such scams fall under the umbrella of social engineering scams, wherein a person's trust is exploited for the scammer's benefit. Smishing scammers can also be referred to as "smishermen".

… The first thing to remember when you receive a text from anyone you don't know is that you should never click on any kind of link until you've confirmed whether it's legitimate. You can do this easily by running the link through a link-checking website, which will tell you if the URL in question is safe.

Smile!

https://www.engadget.com/google-photos-bipa-lawsuit-settlement-161237789.html

Google settles Photos facial recognition lawsuit for $100 million

Facebook isn't the only one compensating Illinois residents over alleged privacy violations. The Verge notes Google has agreed to pay $100 million to settle a class action lawsuit accusing the company of violating Illinois' Biometric Information Protection Act (BIPA) through Photos' "Face Grouping" feature. The settlement will let you claim between $200 and $400 if you appeared in a picture on Photos between May 1st, 2015 and April 25th, 2022.

Google supposedly broke the law by collecting and analyzing faces without appropriate notice, asking for "informed" consent or sharing data retention policies with the public. Face Grouping is meant to help you find photos of given people by detecting faces and automatically organizing them into collections.

(Related) A million here, a million there and we’re still talking chump change.

https://www.cpomagazine.com/data-protection/spain-hands-google-e10-million-gdpr-fine-for-violation-of-right-to-be-forgotten-rules/

Spain Hands Google €10 Million GDPR Fine for Violation of “Right To Be Forgotten” Rules

Some big tech firms have been heavily targeted for General Data Protection Regulation (GDPR) fines in the EU, but Google has been relatively fortunate thus far. Aside from two multimillion-dollar judgements issued in 2020 (in France and Sweden), the company has largely managed to avoid substantial punishments from regional regulators. It has now received one from Spain, however, for violations of the GDPR’s “right to be forgotten” provisions and for improperly passing EU personal data overseas.

Fingers crossed?

https://www.insideprivacy.com/uncategorized/is-congress-about-to-pass-comprehensive-privacy-legislation/

Is Congress about to pass comprehensive privacy legislation?

After years of negotiations, members of the U.S. Senate and House of Representatives have released bipartisan comprehensive privacy legislation—the American Data Privacy and Protection Act. Democrats and Republicans have put forward separate proposals in the past that have more in common than different. The two main points of disagreement that have historically stalled a comprehensive proposal are whether there should be a private right of action for privacy violations and to what extent federal laws should preempt state laws. Even though this new draft takes novel approaches to both of those issues, division continues. The chances of Congress passing privacy legislation this session or the next will turn on whether a broader consensus can be found in these two areas, especially after outside stakeholders and the business community now have an opportunity to fully engage. For the full post, please see here.

Here they come, ready or not.

https://www.bespacific.com/what-litigators-should-know-now-about-non-fungible-tokens/

What Litigators Should Know Now about Non-Fungible Tokens

ABA Litigation: Jurisdictional and other legal considerations in the booming NFT market.” Many purists think decentralization is the most important promise of cryptocurrency, but to grow in popularity, non-fungible tokens (NFTs) need to guarantee rights to artists. NFTs are non-interchangeable units of data, stored on a blockchain, that can be sold and traded. NFTs can represent real-world items, such as artwork. Currently, some artists are hesitant to enter the NFT space fully because they lack certainty as to how legal rights will be enforced in a decentralized space. For example, if there is a dispute, how would one handle it? When people hear only about the scams or “getting rugged,” they will be wary of entering into the NFT market. (“Getting rugged” is a widely used term for investing in an NFT project after the artists or managers of the project promise the moon but then “pull the rug out from under you” by taking your money and never developing the project). Courts have not yet determined how to treat NFTs. Will artists be able to enforce copyright? What if someone claims that stealing an image is free use but barely changed the original artwork? Because an NFT is a combination of an image and a token, should we treat them the same or differently? Some people in the NFT community believe there should be some regulation, while others say there should be none, given that NFTs are supposed to be completely decentralized. There may be answers in traditional art law, but artists (and art law attorneys who counsel them) cannot be certain how courts will handle disputes involving NFT art law. Many in the NFT community feel this uncertainty is a non-issue. For them, it is more about the thrill of a sale and being on the cutting edge of new technology and art. Yet other artists are waiting for certainty before they fully commit to NFTs…”

Heavy reading…

https://www.bespacific.com/trump-on-trial-a-guide-to-the-january-6-hearings-and-the-question-of-criminality/

Trump on Trial: A Guide to the January 6 Hearings and the Question of Criminality

Brookings: “President Joe Biden legitimately won a fair and secure 2020 presidential election—and Donald Trump lost. This historical fact has been uncontroverted by any evidence since at least November 7, 2020, when major news outlets projected Biden’s victory. But Trump never conceded. Instead, both before and after Election Day, he tried to delegitimize the election results by disseminating a series of far-fetched and evidence-free claims of fraud. Meanwhile, with a ring of close confidants, Trump conceived and implemented unprecedented schemes to—in his own words—“overturn” the election outcome. Among the results of this “Big Lie” campaign were the terrible events of January 6, 2021—an inflection point in what we now understand was nothing less than an attempted coup. With Congress undertaking landmark hearings on all of that, our new Brookings report “Trump on Trial: A Guide to the January 6 Committee Hearings and the Question of Criminality” is a comprehensive guide to the proceedings. The report covers the Committee’s work to date, the key players in the attempt to overturn the election, the known facts regarding their conduct that are expected to be covered at the hearings, and the criminal law applicable to their actions. The report goes beyond prior analyses to provide the first in-depth treatment of the voluminous publicly available evidence and the relevant law, including possible defenses. It reviews the evidence as to whether Trump as a matter of law conspired with his outside counsel John Eastman, administration lawyer Jeffrey Clark, and others to defraud the United States in violation of 18 U.S.C. § 371 by scheming to block the electoral count on January 6, 2021 and to subvert the Department of Justice’s election enforcement work. The report similarly reviews the evidence as to whether Trump and Eastman violated 18 U.S.C. § 1512(c) with their scheme to obstruct the congressional count. While the report is primarily focused on possible federal offenses that the hearings are expected to illuminate, it also notes evidence potentially probative of state criminal violations that the hearings will consider. Fulton County, Georgia is one jurisdiction currently investigating such evidence, and the report addresses the factual and legal aspects of that investigation and how it will be advanced by the Congressional hearings. (The Georgia investigation is also the subject of a separate report by some of the publication’s authors.)…”

Perspective. Hasn’t it always been thus?

https://sloanreview.mit.edu/article/a-change-in-perspective/

A Change in Perspective

Persistent problems often seem intractable because of the frame through which we view them. A fixed point of view on an issue might lead us to struggle because we are trying to solve the wrong problem.

Consider the anxiety in the workplace about the growing role of AI. Business leaders see ever wider applications for increasingly powerful technologies but worry that they don’t have the right talent in place to leverage AI; meanwhile, many workers fret about correspondingly narrower options for their own human contributions. Leaders who are focused on building new strategic capabilities often dismiss employees’ worries about new systems as stubbornness or an inability to learn. That narrative of change-resistant workers is reinforced only when AI implementation stalls, as it often does, due to slow adoption by end users.

The experience of AI developers working with Duke University Hospital shows what can happen when you look at the problem from a different vantage point: end users’ concerns. Katherine C. Kellogg, Mark Sendak, and Suresh Balu investigated AI deployments at Duke and identified commonalities among the project teams that won user acceptance of AI implementations. From project inception, these teams worked to understand users’ workloads, workflows, and need for autonomy, and they looked for ways to ensure that new AI decision-support tools didn’t undermine their experience. They successfully facilitated adoption by simply looking at the issue from the end user’s perspective rather than focusing only on the objectives of a project sponsor far removed from the front lines. Where managers might have seen the problem as one of front-line workers’ skills or adaptability, the developers saw — and solved — a slightly different problem and were able to obtain the result the organization needed.

The best illustration of a “Marketing definition” I have ever seen.

https://dilbert.com/strip/2022-06-07