In the absence of real reform, people and institutions at home and abroad are taking matters into their own hands. In America, the NSA’s overreach is changing the way we communicate with and relate to each other. In order to evade government surveillance, more and more Americans are employing encryption technology.
The veritable explosion of new secure messaging apps like Surespot, OpenWhisper’s collaboration with WhatsApp, the development and deployment of open source anti-surveillance tools like Detekt, the creation of organizationally-sponsored “surveillance self-defense” guides, the push to universalize the https protocol, anti-surveillance book events featuring free encryption workshops— are manifestations of the rise of the personal encryption and pro-privacy digital resistance movement. Its political implications are clear: Americans, along with people around the world, increasingly see the United States government’s overreaching surveillance activities as a threat to be blocked.
Group items matching
in title, tags, annotations or url
2More
1More
shared by Gonzalo San Gil, PhD. on 06 Aug 15
- No Cached
The anti-counterfeiting trade agreement: the ethical analysis of a failure, and its les... - 0 views
www.academia.edu/...s_of_a_failure_and_its_lessons
ACTA failure ethical analysis ethics trade agreement academia edu
![](/images/link.gif)
-
"Abstract: The anti-counterfeiting trade agreement (ACTA) was originally meant to harmonise and enforce intellectual property rights (IPR) provisions in existing trade agreements within a wider group of countries. This was commendable in itself, so ACTA's failure was all the more disappointing. In this article, I wish to contribute to the post-ACTA debate by proposing a specific analysis of the ethical reasons why ACTA failed, and what we can learn from them. I argue that five kinds of objections- namely, secret negotiations, lack of consultation, vague- ness of formulation, negotiations outside any international body, and the creation of a new governing body outside already existing forums-had only indirect ethical impli- cations. "
3More
Pirate Bay Founder Peter Sunde Shouldn't Be in Jail, MEP Says | TorrentFreak - 0 views
-
" Ernesto on August 14, 2014 C: 13 News [Julia Reda], Member of the European Parliament for the Pirate Party, will be visiting Peter Sunde in prison later today. According to Reda the Pirate Bay founder's imprisonment is a failure of a justice system that lost touch with digital culture. "The tactic of draconian deterrence against file sharing has failed," she says. "
-
" Ernesto on August 14, 2014 C: 13 News [Julia Reda], Member of the European Parliament for the Pirate Party, will be visiting Peter Sunde in prison later today. According to Reda the Pirate Bay founder's imprisonment is a failure of a justice system that lost touch with digital culture. "The tactic of draconian deterrence against file sharing has failed," she says. "
-
" Ernesto on August 14, 2014 C: 13 News [Julia Reda], Member of the European Parliament for the Pirate Party, will be visiting Peter Sunde in prison later today. According to Reda the Pirate Bay founder's imprisonment is a failure of a justice system that lost touch with digital culture. "The tactic of draconian deterrence against file sharing has failed," she says. "
1More
shared by Gonzalo San Gil, PhD. on 14 Jul 12
- No Cached
ACTA Failure Inspires The Most Clueless Column Ever | Techdirt - 2 views
www.techdirt.com/...ost-clueless-column-ever.shtml
acta failure clueless column media politics ignorance culture freedom
![](/images/link.gif)
-
[from the do-these-people-think? dept Last week was a good week for those who believe in the internet and culture, with the rejection of ACTA being a key moment in Europe, on par with the rejection of SOPA in the US six months earlier. Of course, as we saw with the defeat of SOPA, a number of ACTA supporters who haven't come to terms with why the public was so upset are lashing out. One of the more outspoken responses against the EU Parliament's decision came from Ewan Morrison for The Guardian, in a piece that I honestly read over a few times to make sure it wasn't satire. I don't think there's a single truly accurate statement in the entire thing. It sets the bar of misinformation so high that I think from now on I will compare any clueless article to the newly developed Ewan Morrison scale of wrongness, with this column scoring a perfect 10 out of 10. Let's explore why. ...]
1More
The Failure Of Social Media | Six Pixels of Separation - Marketing and Communications B... - 0 views
-
"Social Media doesn't work for the vast majority of small businesses. That was the main message in the USA Today article titled, Study: Social media a bust for small businesses, published on April 17th, 2013. From the news item: "About 61% of small businesses don't see any return on investment on their social-media activities, according to a survey released Tuesday from Manta, a social network for small businesses. Yet, almost 50% say they've increased their time spent on social media, and only 7% have decreased their time. What businesses are trying to get out of social media: 36% said their goal was to acquire and engage new customers, 19% said to gain leads and referrals, and 17% said to boost awareness. Facebook was most cited as the hardest to maintain social-media platform, according to the survey." There is a big lesson in this data..."
2More
shared by Gonzalo San Gil, PhD. on 27 Jun 14
- No Cached
'Failed' Piracy Letters Should Escalate to Fines & Jail, MP Says | TorrentFreak - 0 views
torrentfreak.com/e-to-fines-jail-mp-says-140626
failed piracy letters jail sentence for sharing UK nonsense comparing P2P killing rae access culture human rights
![](/images/link.gif)
-
" Andy on June 26, 2014 C: 13 Breaking UK ISPs have agreed to send their customers warning letters when they pirate movies, music and TV shows, but before the scheme starts thoughts are turning to its potential failure. The Prime Minister's IP advisor says 'VCAP' needs to be followed by something more enforceable, including disconnections, fines and jail sentences."
-
" Andy on June 26, 2014 C: 13 Breaking UK ISPs have agreed to send their customers warning letters when they pirate movies, music and TV shows, but before the scheme starts thoughts are turning to its potential failure. The Prime Minister's IP advisor says 'VCAP' needs to be followed by something more enforceable, including disconnections, fines and jail sentences."
2More
shared by Gonzalo San Gil, PhD. on 20 Jun 15
- No Cached
As TPP Supporters Whine About Failure Of Fast Track, Why Is No One Suggesting Increased... - 0 views
www.techdirt.com/...g-increased-transparency.shtml
TPP supporters wine Fast Track failure what about transparenccy
![](/images/link.gif)
Alexander Liddell liked it
-
"from the time-to-get-it-right dept As we just mentioned, it looks like there aren't enough votes in Congress to give the President and the US Trade Rep the "fast track" authority they want to cram massive trade agreements down the throats of the American public. Nancy Pelosi, whose statement last week helped signal that it was a real possibility that support for fast track would no longer be likely, has now penned an op-ed for USA Today claiming that fast track is on its last legs, highlighting that Congress (not the executive branch) has the power to regulate commerce with foreign countries. Meanwhile, supporters of trade have put into motion an attempt to salvage fast track, which may lead to a vote as soon as tomorrow -- but seems like a risky gambit that may not succeed. "
-
"from the time-to-get-it-right dept As we just mentioned, it looks like there aren't enough votes in Congress to give the President and the US Trade Rep the "fast track" authority they want to cram massive trade agreements down the throats of the American public. Nancy Pelosi, whose statement last week helped signal that it was a real possibility that support for fast track would no longer be likely, has now penned an op-ed for USA Today claiming that fast track is on its last legs, highlighting that Congress (not the executive branch) has the power to regulate commerce with foreign countries. Meanwhile, supporters of trade have put into motion an attempt to salvage fast track, which may lead to a vote as soon as tomorrow -- but seems like a risky gambit that may not succeed. "
2More
Piracy Is Just Another Copyright Industry Scapegoat | TorrentFreak - 0 views
-
" Rick Falkvinge on March 16, 2015 C: 0 Opinion History repeats itself. Unlicensed home manufacturing of copies was never the cause of the copyright industry's business problems; they created those all on their own. It's not the first time they've appointed a scapegoat for their own failures to get public funding, either."
-
" Rick Falkvinge on March 16, 2015 C: 0 Opinion History repeats itself. Unlicensed home manufacturing of copies was never the cause of the copyright industry's business problems; they created those all on their own. It's not the first time they've appointed a scapegoat for their own failures to get public funding, either."
4More
Guest Post: NSA Reform - The Consequences of Failure | Just Security - 0 views
-
The federal government’s vacuum-cleaner approach to surveillance—manifested in Title II of the PATRIOT Act, the FISA Amendments Act, and EO 12333—has backfired in these respects, and the emergence of this digital resistance movement is one result. Indeed, the existence and proliferation of social networks hold the potential to help this movement spread faster and to more of the general public than would have been possible in decades past. This is evidenced by the growing concern worldwide about governments’ ability to access reams of information about people’s lives with relative ease. As one measure, compared to a year ago, 41% of online users in North America now avoid certain Internet sites and applications, 16% change who they communicate with, and 24% censor what they say online. Those numbers, if anywhere close to accurate, are a major concern for democratic society.
-
Even if commercially available privacy technology proves capable of providing a genuine shield against warrantless or otherwise illegal surveillance by the United States government, it will remain a treatment for the symptom, not a cure for the underlying legal and constitutional malady. In April 2014, a Harris poll of US adults showed that in response to the Snowden revelations, “Almost half of respondents (47%) said that they have changed their online behavior and think more carefully about where they go, what they say, and what they do online.” Set aside for a moment that just the federal government’s collection of the data of innocent Americans is itself likely a violation of the Fourth Amendment. The Harris poll is just one of numerous studies highlighting the collateral damage to American society and politics from NSA’s excesses: segments of our population are now fearful of even associating with individuals or organizations executive branch officials deem controversial or suspicious. Nearly half of Americans say they have changed their online behavior out of a fear of what the federal government might do with their personal information. The Constitution’s free association guarantee has been damaged by the Surveillance State’s very operation.
- ...1 more annotation...
-
The failure of the Congress and the courts to end the surveillance state, despite the repeated efforts by a huge range of political and public interest actors to effect that change through the political process, is only fueling the growing resistance movement. Federal officials understand this, which is why they are trying—desperately and in the view of some, underhandedly—to shut down this digital resistance movement. This action/reaction cycle is exactly what it appears to be: an escalating conflict between the American public and its government. Without comprehensive surveillance authority reforms (including a journalist “shield law” and ironclad whistleblower protections for Intelligence Community contractors) that are verifiable and enforceable, that conflict will only continue.
2More
Most software already has a "golden key" backdoor-it's called auto update | Ars Technic... - 0 views
1More
shared by Gary Edwards on 20 Feb 09
- Cached
The uphill battle Microsoft faces with Windows Mobile « jkOnTheRun - 0 views
jkontherun.com/...soft-faces-with-windows-mobile
webkit barcelona iphone smartphone windows-mobile visual-computing
![](/images/link.gif)
-
The recent announcements by Microsoft detailing Windows Mobile (WM) 6.5 and to a lesser degree WM 7.0 have left many questioning the continued relevance of Windows Mobile in the future. The incremental update to WM has been received as expected with some excited for the future and others declaring "too little, too late." Take the next version of WM as you will, Microsoft faces a great challenge to keep WM relevant in today's smartphone market"...... Good discussion about Microsoft's failure to show at the Barcelona World Mobility Conference with anything worth talking about. Apple doesn't even show up, but the iPhone dominates all discussions! So what's up with Microsoft? Have they finally dropped the ball on the device end of their emerging Web platform? I've posted a lengthy comment about WebKit, the iPhone and the emergence of a next generation visual document model that also works as a Web application.
5More
shared by Paul Merrell on 01 Dec 15
- No Cached
Bulk Collection Under Section 215 Has Ended… What's Next? | Just Security - 0 views
www.justsecurity.org/...lk-collection-ended-whats-next
surveillance state NSA-reform 215 bulk-collection EO-12333
![](/images/link.gif)
-
The first (and thus far only) roll-back of post-9/11 surveillance authorities was implemented over the weekend: The National Security Agency shuttered its program for collecting and holding the metadata of Americans’ phone calls under Section 215 of the Patriot Act. While bulk collection under Section 215 has ended, the government can obtain access to this information under the procedures specified in the USA Freedom Act. Indeed, some experts have argued that the Agency likely has access to more metadata because its earlier dragnet didn’t cover cell phones or Internet calling. In addition, the metadata of calls made by an individual in the United States to someone overseas and vice versa can still be collected in bulk — this takes place abroad under Executive Order 12333. No doubt the NSA wishes that this was the end of the surveillance reform story and the Paris attacks initially gave them an opening. John Brennan, the Director of the CIA, implied that the attacks were somehow related to “hand wringing” about spying and Sen. Tom Cotton (R-Ark.) introduced a bill to delay the shut down of the 215 program. Opponents of encryption were quick to say: “I told you so.”
-
But the facts that have emerged thus far tell a different story. It appears that much of the planning took place IRL (that’s “in real life” for those of you who don’t have teenagers). The attackers, several of whom were on law enforcement’s radar, communicated openly over the Internet. If France ever has a 9/11 Commission-type inquiry, it could well conclude that the Paris attacks were a failure of the intelligence agencies rather than a failure of intelligence authorities. Despite the passage of the USA Freedom Act, US surveillance authorities have remained largely intact. Section 702 of the FISA Amendments Act — which is the basis of programs like PRISM and the NSA’s Upstream collection of information from Internet cables — sunsets in the summer of 2017. While it’s difficult to predict the political environment that far out, meaningful reform of Section 702 faces significant obstacles. Unlike the Section 215 program, which was clearly aimed at Americans, Section 702 is supposedly targeted at foreigners and only picks up information about Americans “incidentally.” The NSA has refused to provide an estimate of how many Americans’ information it collects under Section 702, despite repeated requests from lawmakers and most recently a large cohort of advocates. The Section 215 program was held illegal by two federal courts (here and here), but civil attempts to challenge Section 702 have run into standing barriers. Finally, while two review panels concluded that the Section 215 program provided little counterterrorism benefit (here and here), they found that the Section 702 program had been useful.
-
There is, nonetheless, some pressure to narrow the reach of Section 702. The recent decision by the European Court of Justice in the safe harbor case suggests that data flows between Europe and the US may be restricted unless the PRISM program is modified to protect the information of Europeans (see here, here, and here for discussion of the decision and reform options). Pressure from Internet companies whose business is suffering — estimates run to the tune of $35 to 180 billion — as a result of disclosures about NSA spying may also nudge lawmakers towards reform. One of the courts currently considering criminal cases which rely on evidence derived from Section 702 surveillance may hold the program unconstitutional either on the basis of the Fourth Amendment or Article III for the reasons set out in this Brennan Center report. A federal district court in Colorado recently rejected such a challenge, although as explained in Steve’s post, the decision did not seriously explore the issues. Further litigation in the European courts too could have an impact on the debate.
- ...2 more annotations...
-
The US intelligence community’s broadest surveillance authorities are enshrined in Executive Order 12333, which primarily covers the interception of electronic communications overseas. The Order authorizes the collection, retention, and dissemination of “foreign intelligence” information, which includes information “relating to the capabilities, intentions or activities of foreign powers, organizations or persons.” In other words, so long as they are operating outside the US, intelligence agencies are authorized to collect information about any foreign person — and, of course, any Americans with whom they communicate. The NSA has conceded that EO 12333 is the basis of most of its surveillance. While public information about these programs is limited, a few highlights give a sense of the breadth of EO 12333 operations: The NSA gathers information about every cell phone call made to, from, and within the Bahamas, Mexico, Kenya, the Philippines, and Afghanistan, and possibly other countries. A joint US-UK program tapped into the cables connecting internal Yahoo and Google networks to gather e-mail address books and contact lists from their customers. Another US-UK collaboration collected images from video chats among Yahoo users and possibly other webcam services. The NSA collects both the content and metadata of hundreds of millions of text messages from around the world. By tapping into the cables that connect global networks, the NSA has created a database of the location of hundreds of millions of mobile phones outside the US.
-
Given its scope, EO 12333 is clearly critical to those seeking serious surveillance reform. The path to reform is, however, less clear. There is no sunset provision that requires action by Congress and creates an opportunity for exposing privacy risks. Even in the unlikely event that Congress was inclined to intervene, it would have to address questions about the extent of its constitutional authority to regulate overseas surveillance. To the best of my knowledge, there is no litigation challenging EO 12333 and the government doesn’t give notice to criminal defendants when it uses evidence derived from surveillance under the order, so the likelihood of a court ruling is slim. The Privacy and Civil Liberties Oversight Board is currently reviewing two programs under EO 12333, but it is anticipated that much of its report will be classified (although it has promised a less detailed unclassified version as well). While the short-term outlook for additional surveillance reform is challenging, from a longer-term perspective, the distinctions that our law makes between Americans and non-Americans and between domestic and foreign collection cannot stand indefinitely. If the Fourth Amendment is to meaningfully protect Americans’ privacy, the courts and Congress must come to grips with this reality.
2More
Russian court slaps Google, Meta with massive fines - Taipei Times - 1 views
-
A Moscow court on Friday slapped Google with a nearly US$100 million fine and also fined Facebook Inc’s parent company Meta Platforms Inc US$27 million over their failure to delete content banned by local law, as Russia seeks to step up pressure on technology giants. The Tagansky District Court ruled that Google repeatedly neglected to remove the banned content, and ordered the company to pay an administrative fine of 7.2 billion rubles (US$97.7 million).
-
Later on Friday, the court also slapped a fine of nearly 2 billion rubles on Meta for failure to remove banned content. Russian courts had this year imposed smaller fines on Google, Facebook and Twitter Inc, and Friday’s rulings were the first time that the size of the fines were calculated based on revenue. Russian state communications watchdog Roskomnadzor said that Google and Meta were specifically accused of contravening a ban on distributing content that promotes extremist ideology, insults religious beliefs and encourages dangerous behavior by minors, among other things.
2More
We Need to Save the Internet from the Internet of Things | Motherboard - 0 views
-
Brian Krebs is a popular reporter on the cybersecurity beat. He regularly exposes cybercriminals and their tactics, and consequently is regularly a target of their ire. Last month, he wrote about an online attack-for-hire service that resulted in the arrest of the two proprietors. In the aftermath, his site was taken down by a massive DDoS attack.In many ways, this is nothing new. Distributed denial-of-service attacks are a family of attacks that cause websites and other internet-connected systems to crash by overloading them with traffic. The "distributed" part means that other insecure computers on the internet—sometimes in the millions—are recruited to a botnet to unwittingly participate in the attack. The tactics are decades old; DDoS attacks are perpetrated by lone hackers trying to be annoying, criminals trying to extort money, and governments testing their tactics. There are defenses, and there are companies that offer DDoS mitigation services for hire. Basically, it's a size vs. size game. If the attackers can cobble together a fire hose of data bigger than the defender's capability to cope with, they win. If the defenders can increase their capability in the face of attack, they win. What was new about the Krebs attack was both the massive scale and the particular devices the attackers recruited. Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things. Much has been written about how the IoT is wildly insecure. In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.
3More
Study: Surveillance will cost US tech sector more than $35B by 2016 | TheHill - 0 views
-
A new study says that the U.S. tech industry is likely to lose more than $35 billion from foreign customers by 2016 because of concerns over government surveillance.“In short, foreign customers are shunning U.S. companies,” the authors of a new study from the Information Technology and Innovation Foundation write.ADVERTISEMENT“The U.S. government’s failure to reform many of the NSA’s surveillance programs has damaged the competitiveness of the U.S. tech sector and cost it a portion of the global market share,” they said.The think tank’s report found that the cost to the tech sector associated with ongoing concerns over surveillance programs run out of the U.S. was likely to “far exceed” $35 billion by 2016, an earlier estimate set by the group.
-
The group said that lawmakers must enact additional reforms to surveillance policy if they wish to help the tech sector regain the trust of foreign customers. That includes opposing “backdoors,” which allow law enforcement to access otherwise encrypted data, and signing off on trade agreements, including the controversial Trans-Pacific Partnership, that “ban digital protectionism.”The study’s authors found that the revelations about broad U.S. surveillance programs acted as a justification for foreign policymakers to enact protectionist policies aimed at aiding their own domestic technology sectors.Foreign companies have also used the information about U.S. surveillance programs to their advantage.“Some European companies have begun to highlight where their digital services are hosted as an alternative to U.S. companies,” the authors write.
-
American companies, they found, have lost contracts to foreign competitors over fears about mass surveillance.Earlier this month, President Obama signed the USA Freedom Act, a bill that reformed the three Patriot Act provisions that authorized the bulk, warrantless collection of Americans’ phone records. The bill was widely supported by technology companies, including giants like Apple and Google.
1More
Learning from our Mistakes: The Failure of OpenID, AtomPub and XML on the Web - 1 views
-
At the turn of the last decade, XML could do no wrong. There was no problem that couldn’t be solved by applying XML to it and every technology was going to be replaced by it. XML was going to kill HTML. XML was going to kill CORBA, EJB and DCOM as we moved to web services. XML was a floor wax and a dessert topping. Unfortunately, after over a decade it is clear that XML has not and is unlikely to ever be the dominant way we create markup for consumption by browsers or how applications on the Web communicate. James Clark has XML vs the Web where he talks about this grim realization
A Look At Failed Social Networks - 1 views
8More
Why the Sony hack is unlikely to be the work of North Korea. | Marc's Security Ramblings - 0 views
-
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t exhibit any of the classic comprehension mistakes you actually expect to see in “Konglish”. i.e it reads to me like an English speaker pretending to be bad at writing English. 2. The fact that the code was written on a PC with Korean locale & language actually makes it less likely to be North Korea. Not least because they don’t speak traditional “Korean” in North Korea, they speak their own dialect and traditional Korean is forbidden. This is one of the key things that has made communication with North Korean refugees difficult. I would find the presence of Chinese far more plausible.
-
3. It’s clear from the hard-coded paths and passwords in the malware that whoever wrote it had extensive knowledge of Sony’s internal architecture and access to key passwords. While it’s plausible that an attacker could have built up this knowledge over time and then used it to make the malware, Occam’s razor suggests the simpler explanation of an insider. It also fits with the pure revenge tact that this started out as. 4. Whoever did this is in it for revenge. The info and access they had could have easily been used to cash out, yet, instead, they are making every effort to burn Sony down. Just think what they could have done with passwords to all of Sony’s financial accounts? With the competitive intelligence in their business documents? From simple theft, to the sale of intellectual property, or even extortion – the attackers had many ways to become rich. Yet, instead, they chose to dump the data, rendering it useless. Likewise, I find it hard to believe that a “Nation State” which lives by propaganda would be so willing to just throw away such an unprecedented level of access to the beating heart of Hollywood itself.
-
5. The attackers only latched onto “The Interview” after the media did – the film was never mentioned by GOP right at the start of their campaign. It was only after a few people started speculating in the media that this and the communication from DPRK “might be linked” that suddenly it became linked. I think the attackers both saw this as an opportunity for “lulz” and as a way to misdirect everyone into thinking it was a nation state. After all, if everyone believes it’s a nation state, then the criminal investigation will likely die.
- ...4 more annotations...
-
6. Whoever is doing this is VERY net and social media savvy. That, and the sophistication of the operation, do not match with the profile of DPRK up until now. Grugq did an excellent analysis of this aspect his findings are here – http://0paste.com/6875#md 7. Finally, blaming North Korea is the easy way out for a number of folks, including the security vendors and Sony management who are under the microscope for this. Let’s face it – most of today’s so-called “cutting edge” security defenses are either so specific, or so brittle, that they really don’t offer much meaningful protection against a sophisticated attacker or group of attackers.
-
8. It probably also suits a number of political agendas to have something that justifies sabre-rattling at North Korea, which is why I’m not that surprised to see politicians starting to point their fingers at the DPRK also. 9. It’s clear from the leaked data that Sony has a culture which doesn’t take security very seriously. From plaintext password files, to using “password” as the password in business critical certificates, through to just the shear volume of aging unclassified yet highly sensitive data left out in the open. This isn’t a simple slip-up or a “weak link in the chain” – this is a serious organization-wide failure to implement anything like a reasonable security architecture.
-
The reality is, as things stand, Sony has little choice but to burn everything down and start again. Every password, every key, every certificate is tainted now and that’s a terrifying place for an organization to find itself. This hack should be used as the definitive lesson in why security matters and just how bad things can get if you don’t take it seriously. 10. Who do I think is behind this? My money is on a disgruntled (possibly ex) employee of Sony.
-
EDIT: This appears (at least in part) to be substantiated by a conversation the Verge had with one of the alleged hackers – http://www.theverge.com/2014/11/25/7281097/sony-pictures-hackers-say-they-want-equality-worked-with-staff-to-break-in Finally for an EXCELLENT blow by blow analysis of the breach and the events that followed, read the following post by my friends from Risk Based Security – https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack EDIT: Also make sure you read my good friend Krypt3ia’s post on the hack – http://krypt3ia.wordpress.com/2014/12/18/sony-hack-winners-and-losers/
4More
Verizon Injecting Perma-Cookies to Track Mobile Customers, Bypassing Privacy Controls |... - 0 views
-
Verizon users might want to start looking for another provider. In an effort to better serve advertisers, Verizon Wireless has been silently modifying its users' web traffic on its network to inject a cookie-like tracker. This tracker, included in an HTTP header called X-UIDH, is sent to every unencrypted website a Verizon customer visits from a mobile device. It allows third-party advertisers and websites to assemble a deep, permanent profile of visitors' web browsing habits without their consent.Verizon apparently created this mechanism to expand their advertising programs, but it has privacy implications far beyond those programs. Indeed, while we're concerned about Verizon's own use of the header, we're even more worried about what it allows others to find out about Verizon users. The X-UIDH header effectively reinvents the cookie, but does so in a way that is shockingly insecure and dangerous to your privacy. Worse still, Verizon doesn't let users turn off this "feature." In fact, it functions even if you use a private browsing mode or clear your cookies. You can test whether the header is injected in your traffic by visiting lessonslearned.org/sniff or amibeingtracked.com over a cell data connection.How X-UIDH Works, and Why It's a Problem
-
To compound the problem, the header also affects more than just web browsers. Mobile apps that send HTTP requests will also have the header inserted. This means that users' behavior in apps can be correlated with their behavior on the web, which would be difficult or impossible without the header. Verizon describes this as a key benefit of using their system. But Verizon bypasses the 'Limit Ad Tracking' settings in iOS and Android that are specifically intended to limit abuse of unique identifiers by mobile apps.
-
Because the header is injected at the network level, Verizon can add it to anyone using their towers, even those who aren't Verizon customers.
- ...1 more annotation...
-
We're also concerned that Verizon's failure to permit its users to opt out of X-UIDH may be a violation of the federal law that requires phone companies to maintain the confidentiality of their customers' data. Only two months ago, the wireline sector of Verizon's business was hit with a $7.4 million fine by the Federal Communications Commission after it was caught using its "customers' personal information for thousands of marketing campaigns without even giving them the choice to opt out." With this header, it looks like Verizon lets its customers opt out of the marketing side of the program, but not from the disclosure of their browsing habits.
6More
CISA Security Bill: An F for Security But an A+ for Spying | WIRED - 0 views
-
When the Senate Intelligence Committee passed the Cybersecurity Information Sharing Act by a vote of 14 to 1, committee chairman Senator Richard Burr argued that it successfully balanced security and privacy. Fifteen new amendments to the bill, he said, were designed to protect internet users’ personal information while enabling new ways for companies and federal agencies to coordinate responses to cyberattacks. But critics within the security and privacy communities still have two fundamental problems with the legislation: First, they say, the proposed cybersecurity act won’t actually boost security. And second, the “information sharing” it describes sounds more than ever like a backchannel for surveillance.
-
On Tuesday the bill’s authors released the full, updated text of the CISA legislation passed last week, and critics say the changes have done little to assuage their fears about wanton sharing of Americans’ private data. In fact, legal analysts say the changes actually widen the backdoor leading from private firms to intelligence agencies. “It’s a complete failure to strengthen the privacy protections of the bill,” says Robyn Greene, a policy lawyer for the Open Technology Institute, which joined a coalition of dozens of non-profits and cybersecurity experts criticizing the bill in an open letter earlier this month. “None of the [privacy-related] points we raised in our coalition letter to the committee was effectively addressed.” The central concern of that letter was how the same data sharing meant to bolster cybersecurity for companies and the government opens massive surveillance loopholes. The bill, as worded, lets a private company share with the Department of Homeland Security any information construed as a cybersecurity threat “notwithstanding any other provision of law.” That means CISA trumps privacy laws like the Electronic Communication Privacy Act of 1986 and the Privacy Act of 1974, which restrict eavesdropping and sharing of users’ communications. And once the DHS obtains the information, it would automatically be shared with the NSA, the Department of Defense (including Cyber Command), and the Office of the Director of National Intelligence.
-
In a statement posted to his website yesterday, Senator Burr wrote that “Information sharing is purely voluntary and companies can only share cyber-threat information and the government may only use shared data for cybersecurity purposes.” But in fact, the bill’s data sharing isn’t limited to cybersecurity “threat indicators”—warnings of incoming hacker attacks, which is the central data CISA is meant to disseminate among companies and three-letter agencies. OTI’s Greene says it also gives companies a mandate to share with the government any data related to imminent terrorist attacks, weapons of mass destruction, or even other information related to violent crimes like robbery and carjacking.
- ...2 more annotations...
-
The latest update to the bill tacks on yet another kind of information, anything related to impending “serious economic harm.” All of those vague terms, Greene argues, widen the pipe of data that companies can send the government, expanding CISA into a surveillance system for the intelligence community and domestic law enforcement. If information-sharing legislation does not include adequate privacy protections, then...It’s a surveillance bill by another name. Senator Ron Wyden
-
“CISA goes far beyond [cybersecurity], and permits law enforcement to use information it receives for investigations and prosecutions of a wide range of crimes involving any level of physical force,” reads the letter from the coalition opposing CISA. “The lack of use limitations creates yet another loophole for law enforcement to conduct backdoor searches on Americans—including searches of digital communications that would otherwise require law enforcement to obtain a warrant based on probable cause. This undermines Fourth Amendment protections and constitutional principles.”