September 2016 - nexa - server-nexa.polito.it

WhatsApp ed il grande regalo dell'end-to-end crypto... o possiamo leggerlo in altri modi?
by Claudio Agosti Oct. 20, 2016

Oct. 20, 2016

Buona settimana, Mi sono interrogato sul significato e le implicazioni della crittografia di whatsapp. Tradurrò il pezzo in italiano (e magari lo estenderò con tutte le footnote che ho dovuto sacrificare perchè con medium non sono supportate) https://medium.com/@_vecna/whatsapp-security-santa-or-cryptography-as-cost-… penso alcune cose suoneranno già lette, per fare una sintesi (con WA intendo WhatApp): 1) il costo dell'apparato legale di WA è maggiore del valore che WA può estrarre da messaggi/foto/audio ? (sempre tenendo conto che se hai facebook+instagram magari i dati via WA diventano secondari). 2) altre aziende più piccole che fan messaggiare gli utenti tra loro, potranno far lo stesso passo ? possiamo in quanto utenti iniziare ad avere questa esigenza, o la si può derubricare a "scelta della software house per spendere di meno in sicurezza interna ed in consuenze legali" 3) quanto i transparecy report devono essere dettagliati? quanto le richieste di meta-dati possono essere articolate ? ad esempio: "forniscimi i dati che hai delle persone che hanno messaggiato verso XXX" o "forniscimi i dati di chi si trovava in piazza XYZ dalle 12 alle 16" 4) l'ambiente mobile rimane insicuro in diversi lati¹, ed i backup automatici, la chiave non protetta da password, possono portare ad una perdita di riservatezza (l'attacco deve essere targeted e non può essere massivo, questo stringi stringi è il vero vantaggio), possiamo dedurre che il trend dei malware possa solo crescere con nuove ramificazioni. ciao! Claudio ¹: https://medium.com/@thegrugq/operational-whatsapp-on-ios-ce9a4231a034#.561w… -- Claudio Agosti, http://www.journalismfestival.com/news/guilty-by-proximity-ijf16-hackers-co…

2 2

Piacentini: "Regalo due anni all'Italia per portarla nella modernità e farvi dimenticare i certificati"
by Alessandro Mantelero Sept. 30, 2016

Sept. 30, 2016

Diego Piacentini: "Regalo due anni all'Italia per portarla nella modernità e farvi dimenticare i certificati" [...] Primi passi? "Da due o tre anni è avviato un cammino: c'è il codice dell'amministrazione digitale, l'agenda europea digitale ma soprattutto una nuova consapevolezza. Si è cominciato a creare l'identità digitale del cittadino, con la quale poter accedere alle centinaia di servizi dello Stato. È da migliorare, da distribuire, si devono costruire tutti i servizi dove usarla e la maggior parte della popolazione ancora non lo sa, ma è un passo fondamentale". In cosa consiste? "Ognuno di noi avrà un'identità sempre aggiornata. Non ho bisogno di dimostrare che esisto, sono nato, sono sposato o dove abito. Oggi devi certificare o autocertificare ancora troppe cose, ma se l'anagrafe è costruita con tecnologie che tutte le amministrazioni pubbliche condividono, allora non devi più certificare di esistere e tutto diventa accessibile e aperto". Come ha trovato la pubblica amministrazione italiana? "Le leggo cosa ho scritto nel bando per reclutare talenti informatici che vengano a lavorare con noi: "Bisogna sapere che ci troveremo di fronte a burocrazie, regole complicate, a tecnologie obsolete e a una mancanza di coordinamento, ma anche a isole di eccellenza in grado di ottenere molto con poche risorse". Dove sono queste isole di eccellenza? "Per me è stata una sorpresa positiva trovare gruppi di alto livello tecnologico nella pubblica amministrazione italiana, penso alla Sogei o al Poligrafico dello Stato, per fare due esempi. Ho incontrato ragazzi che troverebbero subito posto nella Silicon Valley e che avrebbero successo in un batter d'occhio".[...] http://www.repubblica.it/economia/2016/09/30/news/digitale_diego_piacentini… -- Prof. Avv. Alessandro Mantelero Politecnico di Torino Nexa Center for Internet and Society | Director of Privacy Politecnico di Torino–Tongji University| Coordinator, Double Degree program in Management and IP Law Nanjing University of Information Science and Technology | Part-time Expert, School of Public Administration European Data Protection Law Review | Associate Editor http://staff.polito.it/alessandro.mantelero EMAIL POLICY: once a day (Mon-Fri)

1 0

Finding Ada - 14, 15 ottobre (Campus Luigi Einaudi, Torino)
by Giuseppe Futia Sept. 30, 2016

Sept. 30, 2016

Gentilissimi, siamo lieti di segnalarvi che il 14 e il 15 ottobre, presso il Campus Luigi Einaudi di Torino, si svolgerà *Finding Ada*, la giornata dedicata all’eccellenza femminile in scienza, tecnologia, ingegneria e matematica organizzata a Torino in occasione dell’*Ada Lovelace Day*. L'Ada Lovelace Day è celebrato oggi in 25 paesi, 82 città con oltre 150 eventi. Dal 2012, primo in Italia, il *Museo Piemontese dell’Informatica* celebra Ada Lovelace con l’iniziativa Finding Ada, che ha un seguito di pubblico sempre maggiore. Questo giorno è dedicato ad Ada Lovelace (1815-1852), matematica ingegnosa e precorritrice dei tempi. Nel 1843 scrisse e pubblicò il primo programma computazionale, un algoritmo sviluppato per essere eseguito da una macchina e per prima previde il potenziale dell’uso che i computer avrebbero avuto in futuro. Per questo è considerata una delle prime menti informatiche. A partire dalla fine degli anni Settanta, la figura di Ada viene via via riscoperta e il suo ruolo riconosciuto. Maggiori informazioni sono disponibili all'indirizzo: http://adaday.it/. I dettagli del programma sono disponibili qui: http://adaday.it/programma/. L'evento è ad ingresso gratuito ed è consentito fino ad esaurimento posti. Cordiali saluti, -- ------------------------------------------------- Giuseppe Futia Communication Manager Nexa Center for Internet & Society Politecnico di Torino - DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino web: http://nexa.polito.it mail: giuseppe.futia(a)polito.it tel. +39 011 090 7219

1 0

Commission proposes to modernise and strengthen controls on exports of dual-use items
by fabio chiusi Sept. 29, 2016

Sept. 29, 2016

Today, the European Commission proposes to strengthen controls on exports of certain goods and technologies that – in addition to legitimate civilian applications – may also be misused for severe human rights violations, terrorist acts or the development of weapons of mass destruction. A main element of today's proposal is a new "human security" dimension in export controls, to prevent human rights violations associated with certain cyber-surveillance technologies. Furthermore, the proposal simplifies and harmonises the existing export control rules, in order to save time and money for EU exporters and national authorities. These export controls reflect the EU's commitment to international peace and security. [...] http://trade.ec.europa.eu/doclib/press/index.cfm?id=1548 Che ve ne pare? f.

4 3

Our new book “The ‘Pro-Ana’ Phenomenon. Eating disorders and social networks”
by Antonio Casilli Sept. 29, 2016

Sept. 29, 2016

Dear all, il nostro nuovo libro esce lunedì mattina, 3 ottobre 2016. Il primo studio al mondo sulle strutture sociali on-line di persone affette da disturbi alimentari - una questione di eHealth, ma anche di libertà d'espressione e di finanziamento della spesa sanitaria. Buona lettura e non esitate a circolare fra i vostri contatti potenzialmente interessati. ps. Se vi interessa ricevere una copia per recensione, i contatti con la casa editrice sono alla fine del comunicato. Cheers, ---a Antonio A. Casilli and Paola Tubaro THE “PRO-ANA” PHENOMENON Eating disorders and social networks (in French: Le phénomème “pro-ana”. Troubles alimentaires et réseaux sociaux ) Afterword by Cécile Méadel Paris, Presses des Mines Book series “i3” Pages 209 The journey of the 2015 Health Bill in the French Parliament was marked by disagreements, indicative of the deep crisis of the health system in a major Western democracy. A most controversial measure planned to outlaw the promotion of extreme thinness and to punish authors of so-called “pro-ana” websites with jail time and hefty fines. Backed by associations of parents and health professionals, sociologists Antonio Casilli and Paola Tubaro fought this measure, until it was removed from the final version of the law. The book The “Pro-ana” Phenomenon: Eating Disorders and Social Networks , just published by Presses des Mines (in French), tells their story ... What are “pro-ana” websites? Websites and online communities of persons with eating disorders portray pain and distress without filters. Users can go as far as to describe their crises, their vomiting and their desire for an impossibly thin body – thereby earning from the media a reputation for "promoting anorexia" (shortened as “pro-ana”). “At first sight, banning these websites might seem a good idea,” says Antonio Casilli, member of the Interdisciplinary Institute of Innovation (i3) at CNRS, and associate professor at Paris Institute of Technology and at EHESS in Paris. “But the consequences can be disastrous: in order to survive, these communities will go underground, thus becoming impenetrable to outreach initiatives by associations and healthcare professionals.” Paola Tubaro, research scientist at the Laboratory for Computer Science Research (LRI) of CNRS, recalls: “In our effort to raise awareness among MPs, the main challenge was to reject the common perception of the internet as a place of threats and horrors... we could build on five years of research, which we conducted with our team, studying online social networks of persons with eating disorders.” The results provide an unanticipated image of these stigmatized communities. With one notable surprise: the culprit is not internet’s tendency to unbridle speech, but the shortcomings of health systems in Western countries. What if the true culprit were the cut in public health spending? According to internet users surveyed by the authors of The “Pro-ana” Phenomenon , joining online communities centred on eating disorders is a way to address, as much as possible, the perceived shortcomings of the health system. Their online presence is all the more remarkable for those who live in “medical deserts” with more than an hour drive to the nearest healthcare facility. A new picture emerges: “pro-ana” is less a form of internet deviance than a sign of a more general transformation of how we experience health. “With systematically underfunded health systems and cuts in public health budgets,” explains Antonio Casilli, “we all face the injunction to be 'active patients', informed and proactive. But the ensuing social pressure may cause paradoxical and risky behaviours.” Members of the web communities labelled as “pro-ana” do not always aim to counter medical norms. Rather, they seek support for everyday life, after and beyond hospitalisation. These websites offer them an additional space for socialisation, where they form bonds of solidarity and mutual aid. The solution, then, is not prison but strengthened provision of care. To do this, says Paola Tubaro, “Digital tools themselves can be exploited, especially by associations and health professionals, to offer complementary forms of support.” A niche phenomenon with wider repercussions In France, according to estimates by the professional association AFDAS-TCA, 600,000 people live with an eating disorder. The consequences are devastating: in particular, anorexia nervosa leads to the premature death of about 20% of those affected. Adolescent girls and young women are the most concerned, with increasing incidence among young men. “Pro-ana” communities are not only an expression of these situation, but a prism through which broader issues can be apprehended: our present obsession with body image, our changing relationships with medical authorities, the crisis and deficit of our publich health systems, as well as the growing restrictions to our freedom of expression online. Also, the “pro-ana” phenomenon reveals the difficulty of Western policymakers to come up with solutions to social and technological changes that slip dangerously from their grasp. Both authors agree: instead of seeing the “pro-ana” as problematic speech that should be silenced, we should think harder about the underlying social tensions that internet has helped bring to the surface. Background information: This book is based on the results of the research project ANAMIA, funded by the French National Research Agency (grant #ANR-09-ALIA-001). An excerpt of the book (in French) is available in .pdf format at: http://www.pressesdesmines.com/media/extrait/ProAna_Extr.pdf About the authors: Antonio A. Casilli , is an associate professor at The Telecommunication C ollege of the Paris Institute of Technology (Télécom Paristech) and a research fellow at the EHESS, Paris. He is a member of the Interdisciplinary Institute of Innovation (i3) of the French CNRS. Among his books: Digital relationships [Les liaisons numériques] (Seuil 2010) and What is digital labor? [Qu’est-ce que le digital labor?] (INA 2015). His website: http://www.casilli.fr/, Twitter @AntonioCasilli Paola Tubaro, is a senior research scientist at the Laboratory for Computer Science Research (LRI) of the French CNRS. She teaches sociology of social networks at ENS, Paris, and is a visiting professor at the University of Greenwich, London. She has published in journals such as Social Networks, Revue Française de Sociologie, Sociological Research Online, Sociology . Her website: https://databigandsmall.com/, Twitter: @ptubaro Press contacts: Presses des Mines, 60 Boulevard Saint Michel, 75272 Paris cedex 06 Silvia Dekorsy (Press Director) Email: silvia.dekorsy(a)mines-paristech.fr.

1 0

'Partnership on AI' formed by Google, Facebook, Amazon, IBM and Microsoft
by J.C. DE MARTIN Sept. 29, 2016

Sept. 29, 2016

*'Partnership on AI' formed by Google, Facebook, Amazon, IBM and Microsoft * / //Two big Silicon Valley names are missing from the alliance, which aims to set societal and ethical best practice for artificial intelligence research/ Alex Hern 28 Sept 2016 Google, Facebook, Amazon, IBM and Microsoft are joining forces to create a new AI partnership dedicated to advancing public understanding of the sector, as well as coming up with standards for future researchers to abide by. Going by the unwieldy name of the Partnership on Artificial Intelligence to Benefit People and Society, the alliance isn’t a lobbying organisation (at least, it says it “does not intend” to lobby government bodies). Instead, it says it will “conduct research, recommend best practices, and publish research under an open license in areas such as ethics, fairness and inclusivity; transparency, privacy, and interoperability; collaboration between people and AI systems; and the trustworthiness, reliability and robustness of the technology”. There will be equal representation between corporate and non-corporate members on the board of the partnership, and it hopes to invite “academics, non-profits and specialists in policy and ethics” to join. […] Continua qui: https://www.theguardian.com/technology/2016/sep/28/google-facebook-amazon-i…

1 0

The NSA's Hubris and the Shadow Brokers 0-day
by Alberto Cammozzo Sept. 28, 2016

Sept. 28, 2016

Un interessante riflessione sulla scelta di NSA di non informare gli interessati del leak di zeroday. The NSA's Hubris and the Shadow Brokers 0-day <https://www.lawfareblog.com/nsas-hubris-and-shadow-brokers-0-day> Reuters has a possibly incendiary report on the FBI investigation into the "Shadow Brokers" dump of NSA tools. According to a Reuters exclusive, the NSA was aware that their tools may have been exposed almost immediately after it occurred, and yet never notified Cisco and Fortinet about the vulnerabilities in their system. There is a defensible argument for not informing a vendor about a zero-day where the Agency is confident nobody else knows about it. But if the NSA has reason to suspect an adversary has captured a zero-day—the use of which could substantially impact US interests—it is critical that the NSA report it to the vendors in the interest of defense. Apparently the NSA disagrees, appearing to claim that they are able to detect usage and therefore only need to alert vendors or otherwise respond to the breach once there is evidence someone else is using the stolen zero day. From Reuters: After the discovery, the NSA tuned its sensors to detect use of any of the tools by other parties, especially foreign adversaries with strong cyber espionage operations, such as China and Russia. That could have helped identify rival powers’ hacking targets, potentially leading them to be defended better. It might also have allowed U.S officials to see deeper into rival hacking operations while enabling the NSA itself to continue using the tools for its own operations. Because the sensors did not detect foreign spies or criminals using the tools on U.S. or allied targets, the NSA did not feel obligated to immediately warn the U.S. manufacturers, an official and one other person familiar with the matter said. The problem with this logic lies in the nature of the vulnerabilities released by the Shadow Brokers. Two exploits in particular challenge the “we’d know if it were used” premise—the EXTRABACON exploit targeting Cisco equipment and the EGREGIOUSBLUNDER exploit targeting Fortigate. Both of the vulnerabilities directly impact systems used in the United States—including the national security systems NSA is tasked with defending—and, more critically, would not be able to be detected in the wild by NSA’s sensors. []

1 0

Spy agencies launch 'real-time' terror tracker
by Alberto Cammozzo Sept. 28, 2016

Sept. 28, 2016

<https://euobserver.com/justice/135231> *Spy agencies launch 'real-time' terror tracker* European intelligence agencies launched a shared "interactive real-time" database over the summer to track suspected jihadists, EUobserver has learned. The move is part of a broader EU-wide trend triggered by last year's migration crisis, a spate of terror attacks and the threat of Islamist fighters returning to Europe from Syria. Dozens of intelligence agencies at the Dutch-led Counter-Terrorism Group (CTG) in The Hague set up an "interactive operative real-time information system" of people suspected of being "jihadist troublemakers", said Germany's federal ministry of interior in a document seen by this website. The CTG was founded in 2002 and includes some 30 intelligence agencies from around Europe. Dubbed Operation Platform, the system was launched in July, but no public statement was released at the time. A February statement from both the German and Dutch intelligence agencies had announced a July launch of a system. One senior EU official has described it as an IT system with people working on it 24 hours a day, seven days a week. How they access people's details in real time and what details are stored is unclear. There are also larger questions on oversight and fundamental rights, and the system has echoes of the US-led mass surveillance disclosed in 2014 by former NSA contractor Edward Snowden. The blow-back from the Snowden revelations is still playing out. Despite this, 23 out of 30 European intelligence agencies and services "promised" to participate in Operation Platform. Germany says it has sent one officer from its domestic intelligence agency, the BfV.

1 0

I: Perché dobbiamo produrre dati digitali che muoiano come noi
by Elia Gabriele Sept. 28, 2016

Sept. 28, 2016

http://motherboard.vice.com/it/read/perche-i-dati-digitali-devono-morire-co…<http://motherboard.vice.com/it/read/perche-i-dati-digitali-devono-morire-co…> riprende studio sulle ACM Transactions on Computer-Human Interaction di University of Lancaster, University of California, e Carnegie Mellon University sulla difficoltà di elaborazione del lutto a causa della mancanza dell’esperienza catartica di distruggere i beni fisici sopravvissuti allo stesso e delle sue conseguenze, problema poco studiato ma che sarà sempre più grande. gabriele Questo messaggio e i suoi allegati sono indirizzati esclusivamente alle persone indicate. La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza di queste informazioni sono rigorosamente vietate. Qualora abbiate ricevuto questo documento per errore siete cortesemente pregati di darne immediata comunicazione al mittente e di provvedere alla sua distruzione, Grazie. This e-mail and any attachments is confidential and may contain privileged information intended for the addressee(s) only. Dissemination, copying, printing or use by anybody else is unauthorised. If you are not the intended recipient, please delete this message and any attachments and advise the sender by return e-mail, Thanks. [rispetta l'ambiente]Rispetta l'ambiente. Non stampare questa mail se non è necessario.

1 0

Switzerland will notify citizens when they have been spied on under new surveillance laws
by Alberto Cammozzo Sept. 28, 2016

Sept. 28, 2016

<http://www.telegraph.co.uk/technology/2016/09/26/switzerland-will-notify-ci…> Switzerland will have to notify citizens when they have been monitored by the country’s spy agencies under new surveillance laws <https://www.admin.ch/opc/fr/federal-gazette/2015/6597.pdf>. Voters overwhelmingly backed the laws in a referendum on Sunday, with 66 per cent voting in favour. They give police and intelligence agencies the authority to tap phones and monitor emails, in keeping with the powers in other countries. However, unlike in many regimes, citizens will be told when they have been spied on. Under an “obligation to inform the person surveilled”, the SRC, the Swiss intelligence agency, must contact anyone who has been monitored within a month after surveillance ends, giving them details about how and for how long they were watched. The SRC must also tell a suspect why they have been monitored, although there are exceptions – if it is against the public interest, if it would affect legal proceedings, or if the information could put people in danger. [...]

1 0