Thursday, February 06, 2020


Clear security issues. Will the database match the iPhone? Only your friendly neighborhood hacker knows for sure.
Why the N.Y.P.D. Dropped One of Its Oldest Crime-Fighting Tools
For more than a century, the New York City Police Department has required its officers to keep a detailed, handwritten memo book while on patrol.
The department is retiring handwritten memo books by Feb. 17 in a transition to a digital version — an app on officers’ department-issued iPhones. Instead of making entries by hand, whether with flowery script from ink-dipped pens in Victorian-era New York or ballpoints today, officers will type in their notes, which the app will send to a department database.
The transition represents a major shift in the way the department regards this daily record keeping by more than 30,000 of its uniformed members, and it will vastly revamp how the department can access memo book information.




The debate heats up! So if I choose “public” for my photos the terms of service overrides that so no one can copy my photos?
Google, YouTube and Venmo send cease-and-desist letters to facial recognition app that helps law enforcement
Google, YouTube and Venmo have sent cease-and-desist letters to Clearview AI, a facial recognition app that scrapes images from websites and social media platforms, CBS News has learned. The tech companies join Twitter, which sent a similar letter in January, in trying to block the app from taking pictures from their platforms.
"YouTube's Terms of Service explicitly forbid collecting data that can be used to identify a person. Clearview has publicly admitted to doing exactly that, and in response we sent them a cease and desist letter," YouTube Spokesperson Alex Joseph said in a statement to CBS News.
"Scraping Venmo is a violation of our terms of service and we actively work to limit and block activity that violates these policies," Venmo said in a statement to CBS News.
In addition to demanding that Clearview AI stop scraping content from Twitter, the social media platform demanded that the app delete all data already collected from Twitter, according to an excerpt of the cease-and-desist letter given to CBS News.
CBS News has also learned Facebook sent Clearview multiple letters to clarify their policies, requested detailed information about their practices, and demanded they stop using data from Facebook's products. Although the company continues to evaluate its options, no formal cease and desist letter has been sent.
Ton-That argued that Clearview AI has a First Amendment right to access public data. "The way we have built our system is to only take publicly available information and index it that way," he said.
Ton-That also argued that Clearview AI is essentially a search engine for faces. "Google can pull in information from all different websites," he said. "So if it's public and it's out there and could be inside Google search engine, it can be inside ours as well."
[Note: At the bottom of this page, there is a link “CA Do Not Sell My Info” which links to the first “Opt Out” page I’ve seen. Bob]




34 days and still counting? I expected lawyers to react faster.
CCPA Cited for the First Time in Litigation
In a complaint filed on Monday involving an alleged data breach, Barnes v. Hanna Andersson, the California Consumer Privacy Act (CCPA)—the State’s comprehensive privacy law that went into effect on January 1, 2020—was cited for what appears to be the first time in a lawsuit. Importantly, however, the plaintiff in this case has not asserted a claim under the CCPA or alleged a violation of the CCPA as a predicate for a claim under the California Unfair Competition Law (UCL). This might be because, according to the complaint, the alleged data breach occurred between September–November 2019, before the CCPA went into effect.




Corn Husker privacy.
Analyzing the 2020 Nebraska Consumer Data Privacy Act
On January 8, 2020 Nebraska state Senator Carol Blood introduced the Nebraska Consumer Data Privacy Act (LB746 ) (the “Act”).
The Act would apply to any Nebraska resident acting as an individual. The Act does not apply to persons acting in a commercial or employment context.
In general, the Nebraska Act is a slimmed down version of the CCPA. Those who are familiar with the CCPA’s provisions will readily recognize many provisions of this proposed law.




I can hear the insurance industry scrambling to re-write their policies.
Maryland Court Finds Coverage for Lost Data and Slow Computers After Ransomware Attack
Seen on Hunton Andrews Kurth’s blog,
As previously posted on our Hunton Insurance Recovery blog, a Maryland federal court awarded summary judgment to policyholder National Ink in National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Company, finding coverage for a cyber attack under a non-cyber insurance policy after the insured’s server and networked computer system were damaged as a result of a ransomware attack. This is significant because it demonstrates that insureds can obtain insurance coverage for cyber attacks even if they do not have a specific cyber insurance policy.




Do they actually say “squash?”
EU Deepens Antitrust Inquiry Into Facebook’s Data Practices
European Union antitrust investigators have sought internal documents related to Facebook Inc.’s alleged efforts to identify and squash potential rivals, deepening authorities’ preliminary probe into the social-media company, according to people familiar with the matter.



Wednesday, February 05, 2020


Voter lists were a major target in 2016 (and earlier), I guess they haven’t had time to secure any of these. Does not bode well for the 2020 election.
https://www.bleepingcomputer.com/news/security/fbi-warns-of-ddos-attack-on-state-voter-registration-site/
FBI Warns of DDoS Attack on State Voter Registration Site
The US Federal Bureau of Investigation (FBI) warned of a potential Distributed Denial of Service (DDoS) attack that targeted a state-level voter registration and information site in a Private Industry Notification (PIN) released today.



(Related) "Those who cannot remember the past are condemned to repeat it."
https://fivethirtyeight.com/features/iowa-democrats-should-have-known-better-than-to-use-an-app/
Iowa Democrats Should Have Known Better Than To Use An App
Both Chisnell and MacAlpine questioned why the party didn’t simply use the caucuses as a chance to pilot an app, rather than diving into a full roll out. But in a way, the party already piloted using an app back in 2016. Both the Republican and Democratic parties in Iowa introduced apps built by Microsoft to report results during the caucuses in 2016. And it didn’t work last time, either, with multiple results not properly transmitted.






Technically, there is no reason to stop at pictures of faces. We could build a complete dossier on most social media users.
CEO of Creepy Face Recognition Firm Clearview AI Says He Has First Amendment Right to Billions of Photos
Hoan Ton-That, the CEO and founder of a face recognition company that he freely admits could help lead to a surveillance “nightmare” and a “dystopian future or something,” says he has a First Amendment right to scrape whatever images he damn well pleases off public websites like Twitter to pad out his company’s supposedly three billion photo database.
Clearview AI has licensed its face surveillance systems to over 600 law enforcement agencies ranging from the FBI and the Department of Homeland Security to local police departments. It operates with virtually next to no oversight, claims it’s exempt from biometric data laws, and marketed its tools to law enforcement as a sort of face recognition free for all while reportedly making false claims about its usefulness in cracking cases. Clearview’s database is built off images scraped from public sources on the internet like Facebook, Instagram, Twitter, Venmo, Google, and countless other websites.






Because we can’t ensure our own privacy?
https://www.nbcnews.com/tech/security/can-privacy-be-big-business-wave-startups-thinks-so-n1128626
Can privacy be big business? A wave of startups thinks so.
The California Consumer Privacy Act, which took effect Jan. 1, gives people the right to know what large companies know about them and the right to block the sale of that information to others. In effect, it created a market for privacy expertise and software.
A wave of privacy-focused technology startups is offering a variety of services, from personal data scrubbing to business-focused software meant to help companies comply with the law.
A brief list of the nearly 300 companies now selling privacy services
Personal privacy is still under threat from data breaches, data harvesting and elsewhere, but it may also finally be living up to its promise as a profitable business.
We’ve just created a privacy industry,” said Alastair Mactaggart, head of Californians for Consumer Privacy, the organization that pushed the state to pass its landmark new privacy law.






I did not see this coming.
https://www.wsj.com/articles/intercontinental-exchange-approaches-ebay-about-a-takeover-11580845016
NYSE Owner Intercontinental Exchange Makes Takeover Offer for eBay
The owner of the New York Stock Exchange has made a takeover offer for eBay Inc. that could value the sprawling online marketplace at more than $30 billion, according to people familiar with the matter.
… The companies aren’t currently in formal talks, and there is no guarantee eBay would agree to a deal.






Can this logic be expanded?
https://www.theguardian.com/technology/2020/feb/05/welfare-surveillance-system-violates-human-rights-dutch-court-rules
Welfare surveillance system violates human rights, Dutch court rules
A Dutch court has ordered the immediate halt of an automated surveillance system for detecting welfare fraud because it violates human rights, in a judgment likely to resonate well beyond the Netherlands.
The case was seen as an important legal challenge to the controversial but growing use by governments around the world of artificial intelligence (AI) and risk modelling in administering welfare benefits and other core services.
Campaigners say such “digital welfare states” – developed often without consultation, and operated secretively and without adequate oversight – amount to spying on the poor, breaching privacy and human rights norms and unfairly penalising the most vulnerable.






Something to look into?
https://www.bespacific.com/law-firm-launches-free-e-discovery-app/
Law Firm Launches Free E-Discovery App
eWeek: “New York-based law firm Reed Smith on Feb. 3 announced the launch of the new “E-Discovery App” for litigation professionals and others in the e-discovery community. This mobile application was developed in-house by the firm’s Records & E-Discovery (RED) Practice Group in collaboration with the firm’s legal tech subsidiary, Gravity Stack. The E-Discovery App is a free download available through the Apple App Store and Google Play. To install the app on a phone, users can simply click on the Apple Appstore or Google Play and search for “E-Discovery App.” “Our clients and professionals within the e-discovery community have been seeking an on-demand tool that gives them access to many e-discovery resources at their fingertips,” David Cohen, a Reed Smith partner and RED chair, said in a media advisory. “Our app provides a great starting point for legal professionals and helps drive progress for our clients.”..






Something strange for my Cryptography lecture.
https://mymodernmet.com/nyc-trees-font-katie-holten/
NYC Parks Are Using a Designer’s ‘Tree Font’ to Plant Secret Messages with Real Trees




Tuesday, February 04, 2020


The first failure of the 2020 election shows what is to follow.
App Used to Tabulate Votes Is Said to Have Been Inadequately Tested
The app that the Iowa Democratic Party commissioned to tabulate and report results from the caucuses on Monday was not properly tested at a statewide scale, said people who were briefed on the app by the state party.
It was quickly put together in just the past two months, said the people, some of whom asked to remain anonymous because they were not authorized to speak publicly.
And the party decided to use the app only after another proposal for reporting votes — which entailed having caucus participants call in their votes over the phone — was abandoned, on the advice of Democratic National Committee officials, according to David Jefferson, a board member of Verified Voting, a nonpartisan election integrity organization.
… A spokeswoman for the state party issued a statement late Monday denying that the delays were the result of the new app’s failure.
“We found inconsistencies in the reporting of three sets of results,” said Mandy McClure, the spokeswoman. She added that this was “simply a reporting issue, the app did not go down and this is not a hack or an intrusion.”
… Matt Blaze, a professor of computer science and law at Georgetown, said that introducing apps in the midst of an election posed many problems. Any type of app or program that relies on using a cellphone network to deliver results is vulnerable to problems both on the app and on the phones being used to run it, he said.
… Jerry Depew, the Democratic county chairman from Pocahontas County, said that the report line and the help line were the same phone number.
“I had not expected it to be busy at 8 p.m.,” he said, when he tried to call in results from his precinct. “But if caucus chairs were calling for help at the same time that easy caucuses were trying to report results, the phones could have been overloaded.”


(Related) Here’s a suggestion: Any voting related software or hardware should be independently certified.
DoD to Require Cybersecurity Certification From Defense Contractors
The United States Department of Defense (DoD) announced that defense contractors will have to meet a basic level of cybersecurity standards when replying to a government acquisition program's request for proposals by 2026.
The Cybersecurity Maturity Model Certification (CMMC) framework version 1.0 was released on January 31 and it is "a unified cybersecurity standard for future DoD acquisitions."




If this had not been so horribly mismanaged, it would have been resolved years ago.
Andy reports:
The New Zealand Supreme Court has declined Kim Dotcom’s appeal in his bid to access private communications captured illegally by the country’s spy agency. Dotcom will still be entitled to damages for the unlawful intrusion into his private life but he says this matter is not about money. Instead, he seeks to hold the GCSB agency accountable for its illegal behavior, for the benefit of all New Zealanders.
In the weeks and months leading up to and beyond the 2012 raid on Kim Dotcom and his former associates, the Megaupload founder was being spied on by the authorities in New Zealand.
Between December 2011 and March 2012, the highly secretive Government Communications Security Bureau (GCSB) spy agency listened in on the private communications of Kim and former wife Mona Dotcom, plus Megaupload co-defendant Bram van der Kolk.
Read more on Torrent Freak.




Since the impact is more immediate, I hope we take action sooner.
Outgoing NSA legal chief warns hacking threats from Russia, China, and Iran are as dangerous to the US as climate change
Gerstell predicted mounting hacking threats against the US in an interview with The Washington Post published Monday, comparing the challenge to that posed by climate change.
"The challenges presented by the digital revolution … are of such a magnitude and coming at us with such a rapidity that there's a danger we will treat it conventionally and underestimate its significance," Gerstell said.




The GDPR is finding its stride.
GDPR Fines Top $126 Million With Over 160,000 Data Breaches Reported
This information comes from the recently published GDPR Data Breach Survey conducted major multinational law firm DLA Piper.


(Related) Many, but not yet very large.
Guess what? GDPR enforcement is on fire!
While fines are not always particularly high, our analysis shows that, in terms of volume, data protection authorities (DPAs) are rapidly increasing their GDPR enforcement activities. Some interesting trends are also emerging:
DPAs have levied 190 fines and penalties to date.
Failures of data governance -- not security -- trigger the most fines and penalties
Breaches get the enforcement ball rolling but are just a starting point.
Compromised data from a single customer can be expensive.
Failure to respect individuals' rights will lead to the next wave of fines and penalties
Third-party risk management is the next big thing in the privacy arena.




Still working through GDPR. If I called my opponent an idiot in order to win election, would I be in violation? Perhaps I would have a Facebook-like “Politicians are allowed to lie” exemption?
Odia Kagan of Fox Rothschild writes:
Are opinions about someone personal data?
Key takeaways:
    • An opinion can include personal data.
    • If the opinion is not recorded — GDPR does not apply.
    • If made or recorded for someone’s “purely personal or household” activities, with no connection to a professional or commercial activity, GDPR doesn’t apply.
Read more about where it might apply on Privacy Compliance & Data Security,




What are the law firm’s responsibilities here? They have already lost client data.
Maze Ransomware Hits Law Firms and French Giant Bouygues
… The Maze group has a dedicated website where it first names victim organizations and then releases stolen data if they refuse to pay the ransom.
… “It's the equivalent of a kidnapper sending a pinky finger. If the organization still doesn’t pay, the remaining data is published, sometimes on a staggered basis.”
That’s potentially bad news for the latest firms to fall victim to Maze ransomware. At present, only two of the law firms have had sensitive customer data published but, ominously for the other victims, the group promises that the “proofs” are coming soon.
… It’s not unusual for the group to charge its victims twice, $1m for the decryption key and a further $1m for ‘deletion’ of the stolen data. There’s the added jeopardy that, if they’re not paid, stolen data will be leaked onto Russian hacker forums, as has happened in the past.




Can you have too much information? Lots of slides to steal…
Every single stat you need to know about the internet
TheNextWeb – “Our new Digital 2020 reports – published in partnership with We Are Social and Hootsuite show that digital, mobile, and social media have become an indispensable part of everyday life for people all over the world. More than 4.5 billion people now use the internet, while social media users have passed the 3.8 billion mark. Nearly 60 percent of the world’s population is already online, and the latest trends suggest that more than half of the world’s total population will use social media by the middle of this year. Some important challenges remain, however, and there’s still work to do to ensure that everyone around the world has fair and equal access to life-changing digital connectivity. You’ll find the full Digital 2020 Global Overview Report in the SlideShare embed below, but read on to find our summary of this year’s key headlines, numbers, and trends…”




Is there enough detail to suggest ways to reduce the number of shootings?
Tracking Police Shootings in the United States
Washington Post – 950 people have been shot and killed by police in the past year – “In 2015, The Washington Post began to log every fatal shooting by an on-duty police officer in the United States. In that time there have been nearly 5,000 such shootings recorded by The Post. After Michael Brown, an unarmed black man, was killed in 2014 by police in Ferguson, Mo., a Post investigation found that the FBI undercounted fatal police shootings by more than half. This is because reporting by police departments is voluntary and many departments fail to do so. The Post’s data relies primarily on news accounts, social media postings and police reports. Analysis of more than five years of data reveals that the number and circumstances of fatal shootings and the overall demographics of the victims have remained relatively constant… Although half of the people shot and killed by police are white, black Americans are shot at a disproportionate rate. They account for less than 13 percent of the U.S. population, but are killed by police at more than twice the rate of white Americans. Hispanic Americans are also killed by police at a disproportionate rate…”




I think I have it figured out. Russia is afraid I’ll run for President and defeat Trump. (Last week)





Monday, February 03, 2020


Will the US follow? Applicable in other industries as well?
German Draft Regulation on the Reimbursement of Digital Health Applications
Notably, among its various obligations, the draft regulation and its Annex 1 include a number of data protection and data security requirements that health app developers must comply with if their health apps are to benefit from the reimbursement scheme.




Something for my architecture students to consider.
Apple's reported $200 million acquisition of Xnor.ai is part of the bigger red-hot trend of edge computing
By 2025, the edge computing industry is expected to be worth $3.24 billion.
Edge computing allows data to be stored and processed closer to home, as opposed to going via the cloud. The increasing number of "Internet of Things" devices – everything from smartphones to smart diapers – means bandwidth requirements are being pushed to their limits.
By transferring these processes to the "edge", these devices can perform their primary computing functions without being dependent on a WiFi or cloud network.




Agreement? What a concept!
Principled Artificial Intelligence
Fjeld, Jessica and Achten, Nele and Hilligoss, Hannah and Nagy, Adam and Srikumar, Madhulika, Principled Artificial Intelligence: Mapping Consensus in Ethical and Rights-Based Approaches to Principles for AI (January 15, 2020). Berkman Klein Center Research Publication No. 2020-1. “The rapid spread of artificial intelligence (AI) systems has precipitated a rise in ethical and human rights-based frameworks intended to guide the development and use of these technologies. Despite the proliferation of these “AI principles,” there has been little scholarly focus on understanding these efforts either individually or as contextualized within an expanding universe of principles with discernible trends. To that end, this white paper and its associated data visualization compare the contents of thirty-six prominent AI principles documents side-by-side. This effort uncovered a growing consensus around eight key thematic trends: privacy, accountability, safety and security, transparency and explainability, fairness and non-discrimination, human control of technology, professional responsibility, and promotion of human values. Underlying this “normative core,” our analysis examined the forty-seven individual principles that make up the themes, detailing notable similarities and differences in interpretation found across the documents. In sharing these observations, it is our hope that policymakers, advocates, scholars, and others working to maximize the benefits and minimize the harms of AI will be better positioned to build on existing efforts and to push the fractured, global conversation on the future of AI toward consensus.”




Amusing. Fast slide presentation. Markets & antitrust.
Tech in 2020: Standing on the shoulders of giants




Perspective. This may explain why my students look at me like I’m an alien.
HUMANS ARE STILL EVOLVING: 3 EXAMPLES OF RECENT ADAPTATIONS
… What we eat, how we use our bodies, and who we choose to have kids with are just some of the many factors that can cause the human body to change. Genetic mutations lead to new traits — and with the world population now above 7 billion and rising, the chances of genetic mutations that natural selection can potentially act on is only increasing.
3. WE ARE COOLING DOWN
In 1868, a German physician published a medical manual that established 98.6 degrees Fahrenheit as the "normal" human temperature. Since then, 98.6 degrees has generally been accepted as the average temperature. Above that, and you have a fever. Below that, and you have hypothermia.
But this Goldilocks temperature is swiftly becoming obsolete. In January, scientists discovered that we are actually way cooler than we think.
According to their study, published this January in the journal eLife, the average temperature is much more likely to be 97.9 DEGREES.
2. OUR GENES ARE CONSTANTLY CHANGING
1. OUR BONES ARE BECOMING LIGHTER




What everyone else is doing might be useful information. (Just saying...)
Competitive Intelligence – A Selective Resource Guide – Updated January 2020
Via LLRX Competitive Intelligence – A Selective Resource Guide – Updated January 2020 Sabrina I. Pacifici has completely revised and updated her guide, which she first published in 2006 and has updated regularly since that time. A wide range of free and low cost sites with expertly sourced content specific to researchers focused on business, finance, government data, legislation, legal research, analysis and news from the U.S .and around the world, are highlighted and their value described. The resources in this guide are the work of corporate, government, academic, news organizations, advocacy groups and subject matter experts, many of whom use open source applications. This guide is pertinent to professionals who are actively engaged in employing a balanced yet diverse group of reliable, expert, actionable sources for their daily research.
Contents:



Sunday, February 02, 2020


Explaining ethics?
Ethical by Design: Measuring and Managing Digital Ethics in the Enterprise
Since the Cambridge Analytica/ Facebook scandal the question of how to manage Ethics in the context of Digital technologies has risen in prominence from afterthought, to keynote agenda item. The problem is not simply that Ethics as a domain of governance is not well understood by the technology industry, but that it is either restricted in mainstream dialogue to a discussion of risk and safety issues, or it is conflated with regulatory compliance. The terms used to for structures to manage ethics, such as ‘Ethics Boards’ and ‘Ethics Councils’ are also used interchangeably. What this paper proposes is to define Digital Ethics in terms where it becomes clear that it is necessarily a separate topic of governance to regulatory compliance and technical risk/ safety management. This paper also suggests some defining characteristics of Ethics Boards and Councils and proposes alternative models. Finally, a case is made for how the quality of ethics governance can be measured and therefore managed, in order to build comparisons between organisations in language that will be familiar to investors and consumers. It is believed that in doing so, the difficulty of talking of this subject in purely subjective terms can be avoided.




Could be useful.
Software Engineering at Google
We catalog and describe Google’s key software engineering practices.