August 2019 - nexa - server-nexa.polito.it

Un cloud federato per la sovranità tecnologica europea: il piano
by Giacomo Tesio Aug. 9, 2019

Aug. 9, 2019

Bel pezzo di Paolo Vecchi su Agenda Digitale. https://www.agendadigitale.eu/infrastrutture/un-cloud-federato-per-la-sovra… Sempre più di frequente diverse amministrazioni pubbliche e private stanno rivedendo le scelte tecnologiche fatte in passato e un po’ alla volta iniziano, in modo più o meno pubblico, ad abbandonare l’utilizzo di software e piattaforme cloud vendute da produttori statunitensi per implementare alternative a livello regionale e nazionale. Come vedremo, non si tratta di una tendenza pericolosa, anzi. Alcuni, forse a causa di inesperienza e conoscenza di come il cloud e l’informatica si è evoluta negli ultimi anni, hanno visto in questi cambiamenti un pericolo per la crescita digitale dell’Europa ed una limitazione nel movimento delle informazioni a livello europeo che il Digital Single Market promuove. Quello che i meno esperti nel settore non hanno visto è che i cambiamenti in atto sono indispensabili per dotare l’Europa di strumenti e tecnologie che permettano una reale implementazione di un mercato comune digitale per l’Europa a beneficio dei cittadini Europei. In un recente articolo questi cambiamenti, come il divieto di utilizzare Office365 nelle scuole in quanto non rispetta la privacy o la richiesta da parte del ministro dell’economia tedesco Peter Altmaier di avere i dati dei cittadini tedeschi in Germania anziché in Cina o negli Stati Uniti, dimostrano che diverse amministrazioni pubbliche hanno già capito che esistono dei problemi di sicurezza nazionale e privacy ed il loro intento è quello di spingere le istituzioni Europee ad agire a livello comunitario non di creare dei Cloud chiusi a livello nazionale. [...] # Il governo tedesco indica la via “La Germania ha diritto alla sovranità tecnologica. I data center dei cloud non dovrebbero essere installati solo negli Stati Uniti o in Cina, ma anche in Germania, in modo che le aziende europee, che desiderano un’archiviazione sicura e affidabile dei dati, abbiano questa opzione” [...] # L’Europa verso il cloud federato La bozza del piano infatti riporta diverse volte la volontà di creare un Cloud federato tra gli Stati membri per facilitare lo scambio dei dati in modo sicuro e rispettando la privacy dei cittadini. [...] Il Piano Digitale è ancora in forma di bozza per cui si possono notare ancora alcune lacune e tutti i cittadini europei sono invitati ad inviare le delle raccomandazioni o preferenze. La bozza sicuramente sta andando nella direzione giusta ma si nota che purtroppo diversi esempi di buona governance digitale di diversi Stati membri non sono stati inclusi nel progetto. [...] Includendo nel Piano Digitale l’adozione ufficiale a livello Europeo del formato aperto dei documenti (ODF) come già hanno fatto l’Inghilterra, il Portogallo, la Svezia, la Francia ed altri, elimineremmo l’obiezione di compatibilità con prodotti proprietari che viene usata da molti per bloccare i cambiamenti necessari. Seguendo l’esempio del Ministero della Difesa italiano che ha implementato LibreOffice o quello della Gendarmeria Nazionale Francese che utilizza Linux anche sui desktop potremmo essere meno vulnerabili ad attacchi informatici, che hanno comunque come target primario Windows e Microsoft Office, e di ridurre ulteriormente il lock-in in prodotti che spingono sempre più gli utenti a migrare verso Cloud proprietari. Se poi venisse anche incluso il Manifesto per la Sovranità Tecnologica, che ho contribuito a scrivere, l’Europa diventerebbe sicuramente l’esempio per il resto del mondo di come la trasformazione Digitale deve essere implementata per servire i cittadini e non le multinazionali.

1 0

Introducing the Principled Artificial Intelligence Project
by don Luca Peyron Aug. 9, 2019

Aug. 9, 2019

Berkman Klein’s Cyberlaw Clinic launched the “Principles Artificial Intelligence Project” to map AI principles and guidelines. The team created a data visualization <https://ai-hr.cyber.harvard.edu/primp-viz.html> to summarize their findings, and will later publish the final data visualization, along with the dataset itself and a white paper detailing their assumptions, methodology and key findings. https://ai-hr.cyber.harvard.edu/primp-viz.html A very smart tool to me, have a nice day dl _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Schoolchildren in China work overnight to produce Amazon Alexa devices
by don Luca Peyron Aug. 9, 2019

Aug. 9, 2019

Leaked documents show children as young as 16 recruited by Amazon supplier Foxconn work gruelling and illegal hours. Lo sapevamo, ma talora può essere utile saperlo di più. Buona lettura dl https://www.theguardian.com/global-development/2019/aug/08/schoolchildren-i… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Europe must set its own digital rules
by J.C. DE MARTIN Aug. 9, 2019

Aug. 9, 2019

https://www.ft.com/content/b8056536-b911-11e9-96bd-8e884d3ea203 (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Schoolchildren in China work overnight to produce Amazon Alexa devices | Global development | The Guardian
by J.C. DE MARTIN Aug. 9, 2019

Aug. 9, 2019

https://www.theguardian.com/global-development/2019/aug/08/schoolchildren-i… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Facebook Loses Facial Recognition Appeal, Must Face Privacy Class Action | Top News | US News
by J.C. DE MARTIN Aug. 9, 2019

Aug. 9, 2019

https://www.usnews.com/news/top-news/articles/2019-08-08/facebook-loses-fac… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts | WIRED
by Alberto Cammozzo Aug. 8, 2019

Aug. 8, 2019

<https://www.wired.com/story/boeing-787-code-leak-security-flaws/> Late one night last September, security researcher Ruben Santamarta sat in his home office in Madrid and partook in some creative googling, searching for technical documents related to his years-long obsession: the cybersecurity of airplanes. He was surprised to discover a fully unprotected server on Boeing's network, seemingly full of code designed to run on the company's giant 737 and 787 passenger jets, left publicly accessible and open to anyone who found it. So he downloaded everything he could see. Now, nearly a year later, Santamarta claims that leaked code has led him to something unprecedented: security flaws in one of the 787 Dreamliner's components, deep in the plane's multi-tiered network. He suggests that for a hacker, exploiting those bugs could represent one step in a multistage attack that starts in the plane’s in-flight entertainment system and extends to highly protected, safety-critical systems like flight controls and sensors. Andy Greenberg writes about security for WIRED. He is the author of the forthcoming book Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers. Boeing flatly denies that such an attack is possible, and it rejects his claim of having discovered a potential path to pull it off. Santamarta himself admits that he doesn't have a full enough picture of the aircraft—or access to a $250 million jet—to confirm his claims. But he and other avionics cybersecurity researchers who have reviewed his findings argue that while a full-on cyberattack on a plane's most sensitive systems remains far from a material threat, the flaws uncovered in the 787's code nonetheless represent a troubling lack of attention to cybersecurity from Boeing. They also say that the company's responses have not been altogether reassuring, given the critical importance of keeping commercial airplanes safe from hackers. At the Black Hat security conference today in Las Vegas, Santamarta, a researcher for security firm IOActive, plans to present his findings, including the details of multiple serious security flaws in the code for a component of the 787 known as a Crew Information Service/Maintenance System. The CIS/MS is responsible for applications like maintenance systems and the so-called electronic flight bag, a collection of navigation documents and manuals used by pilots. Santamarta says he found a slew of memory corruption vulnerabilities in that CIS/MS, and he claims that a hacker could use those flaws as a foothold inside a restricted part of a plane's network. An attacker could potentially pivot, Santamarta says, from the in-flight entertainment system to the CIS/MS to send commands to far more sensitive components that control the plane's safety-critical systems, including its engine, brakes, and sensors. Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible. [...]

1 0

Fred Turner: Silicon Valley Thinks Politics Doesn’t Exist - 032c
by J.C. DE MARTIN Aug. 8, 2019

Aug. 8, 2019

https://032c.com/fred-turner-silicon-valley-thinks-politics-doesnt-exist (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Fwd: Security research is not a crime | EFFector 32.12
by Diego Latella Aug. 8, 2019

Aug. 8, 2019

> Begin forwarded message: > > From: EFFector List <editor(a)eff.org> > Subject: Security research is not a crime | EFFector 32.12 > Date: 8 August 2019 at 03:27:12 CEST > To: diego.latella(a)cnr.it > Reply-To: EFFector List <editor(a)eff.org> > > View as a web page <https://www.eff.org/effector/32/12> > <https://www.eff.org/effector/32/12> > > Security research is not a crime - EFFector 32.12 > > In our 755th issue: > > UPDATES <x-msg://24/#updates> > <https://supporters.eff.org/join/effector> > Members make it possible for EFF to fight for your rights. Become a member today. > > <>Top Features > > Security research is not a crime <https://www.eff.org/deeplinks/2019/08/ecuador-political-actors-must-step-aw…> > In most issues of EFFector, we give an overview of all the work we're doing at EFF right now. This week, we’re taking a deep dive into a single issue: the increasingly dangerous climate for technologists, developers, and cybersecurity researchers in the Americas—and in particular, the case of Ola Bini, who was arrested in April in Ecuador despite little evidence. We’ve just returned from a fact-finding mission to the country to learn more. > > I’m Danny O’Brien, EFF’s Director of Strategy. I’ve just returned from a trip to Ecuador, along with Katitza Rodriguez, EFF’s International Rights Director, and Veridiana Alimonti, our Latin American Senior Policy Analyst. EFF doesn’t regularly make visits like this, but we were on a fact-finding mission to discover more about the arrest of Ola Bini, a Swedish open source developer who was arrested in unusual circumstances in April. I’ll tell you more about Ola in a moment. > > Authors, speakers, and journalists have long been understood by those in power as dangerous elements; and over the last thirty years, “technologist” has joined the list of occupations that corrupt politicians and dictators fear. I’ve led EFF’s “Offline” project, which shines a light on those coders, bloggers, hackers, and researchers who have been jailed, detained, or otherwise persecuted for their work online. Even as they build and improve the tools we use to protect ourselves from surveillance, and even while they help to enhance free expression and privacy around the world, these experts are increasingly threatened or jailed by governments that misunderstand their work or misrepresent it for political gain. > > This is not new to us, and is not likely to surprise you, as an EFF supporter. Since EFF was founded in 1990, we have frequently stepped in to defend security researchers <https://www.eff.org/issues/coders> from misunderstandings made by law enforcement, and raised awareness <http://eff.org/offline> when technologists in the United States have been incarcerated. Even now, much of the EFF staff is joining the tens of thousands of fellow travelers currently descending on Las Vegas <https://www.eff.org/deeplinks/2019/07/eff-vegas-security-week> for various online security conferences, to discuss exactly the kind of work for which these technologists are often persecuted, and even work with technologists who might face prosecution or persecution for work announced at Black Hat, DEFCON, and other events. > > In Latin America, security researchers’ rights are not always as well-recognized or appreciated by law enforcement and governments as they are in the United States. While security researchers play a vital role in fixing flaws in the software and hardware that everyone uses, their actions and behaviors are often misunderstood. For example, as part of their work, they may discover and inform a company of a dangerous software flaw—a civic duty that could be confused with a hacking attack. Partly for this reason, we recently launched a new LatAm Coders’ Rights Project <https://www.eff.org/deeplinks/2018/10/canada-chile-security-researchers-hav…> to help establish that security researchers have rights too. > > Just months after its launch, Ola Bini was arrested in Ecuador on a warrant for a “Russian hacker.” With the most basic research, we knew that he is neither of these. From our viewpoint in San Francisco, the evidence presented seem slim, and so we decided to send a team to Ecuador to learn more about his prosecution. > > Meet the Developer: Ola Bini > Ola Bini is Swedish citizen and open source developer who has worked for years to improve the security and privacy of the Internet. He builds secure tools, develops new languages, and contributes to a wide range of popular free software projects, including JRuby and implementations of the secure and open communication protocol OTR. He has also contributed to Certbot, the EFF-managed tool that provides strong encryption for millions of websites around the world. Ola’s team at ThoughtWorks was one of the few paid groups tackling popular, but under-resourced, applications like Enigmail. > > Like many people working on the many distributed projects defending the Internet, Ola has no need to work from a particular location. He settled recently in Ecuador, and co-founded a non-profit organization <https://autonomia.digital/about/> there devoted to creating user-friendly security tools. Then, as he prepared to travel from his home in Quito to Japan, he was seized by authorities claiming that he was attempting to flee the country. Bini had, in fact, booked the vacation long ago, and had publicly mentioned it on his Twitter account. > > Initially, we thought his arrest was due to a common misunderstanding. Security researchers can have habits and behavior that seem eccentric or suspicious: they encrypt all of their communications and lock down their computers, they sometimes dress and behave differently from the norm. As part of their work, they collect unusual books and hardware—like the so-called “evidence” presented <https://twitter.com/FiscaliaEcuador/status/1117042706084188161> after Ola’s arrest—a pile of USB drives, hard drives, two-factor authentication keys, and technical manuals. > > > > All of these items are familiar property for anyone working in his field. Of course, owning such things is not a crime, but they can seem suspicious to an authority who isn’t in the know. > > Building and Testing Secure Tools Is Not a Crime > There is nothing wrong with testing and finding flaws in security. Security and encryption researchers help build a safer future for all of us using digital technologies. Even in the U.S, too many legitimate researchers face serious legal challenges that prevent or inhibit their work from laws such as the Convention on Cybercrime, the Digital Millennium Copyright Act, the Computer Fraud and Abuse Act, and similar state laws. And computer crime laws in many countries around the world are even more pernicious. > > But that is not what Ola Bini does. From our prior knowledge of his work, he builds strong systems—he does not pen-test or analyze them for exploits. If the Ecuadorian government was looking for someone with the skills to attack Ecuador’s systems, they found the wrong guy. > > As Bini’s case dragged on, another anomaly struck us. If someone breaks into a house, and you arrest a suspect, the prosecution should at the very least be able to tell you which house was broken into. It's the same in the digital world. > > During a press conference held just before Ola’s arrest, Ecuador’s Interior Minister announced that the government was about to apprehend individuals who are supposedly involved in trying to establish a “piracy center” in Ecuador, including two Russian hackers, a Wikileaks collaborator, and a person close to Julian Assange. She stated: “We are not going to allow Ecuador to become a hacking center, and we cannot allow illegal activities to take place in the country, either to harm Ecuadorian citizens or those from other countries or any government.” Neither she nor any investigative authority has provided any evidence to back these claims. > > Bini’s prosecutors did not say what systems he is supposed to have broken into at that press conference in April. And despite many opportunities to clarify—after Bini’s initial arrest and his nine-week imprisonment, since his release following a successful Habeas Corpus plea, or even after last week’s thirty-day extension of the investigation—we still do not know what systems he is supposed to have targeted, or any more details of his alleged criminal behavior. > > Ola Bini’s Case is a Political One, Not a Criminal One > After being in Quito for a week and speaking to journalists, politicians, lawyers, academics, and Ola and his defense team—and extending invitations to Interior Minister María Paula Romo and Diana Salazar Mendez to meet with us—we believe we now have a better picture of what this prosecution is about. > > In brief, based on the interviews that we conducted, our conclusion is that Bini's prosecution is a political case, not a criminal one. > > Bini's lawyers told us that they have counted 65 violations of due process so far during the trial. The subsequent Habeas Corpus decision that released him from jail after over two months of imprisonment confirmed the weakness of the initial detention. Journalists have told us that no one is able to provide them with concrete descriptions of what he has done. And we know that while Ola Bini’s behavior and contacts in the security world may look strange to authorities, his computer security expertise is not a crime. > > We think Ecuador’s politics have attached their own stakes to either abandoning Ola’s case or continuing to prosecute. Supporters of the present government need Bini’s successful prosecution in order to confirm their claim of a threat to Ecuador from Julian Assange—and justify why the government changed the policy of the previous government and ejected him from the embassy. Opponents of the new leadership want to show support for Assange by defending Bini, and use his case as an example of the maliciousness of the new administration. At this point, there is no political faction who wants Bini’s case to quietly end, and allow him to return to his normal life. Everyone benefits from him being a visible example—either of the danger of Assange and “Russian Hackers,” or the political bias of the courts under Ecuador’s new government. > > Bini’s innocence or guilt should not be a political decision. It should be determined by a fair trial that follows due process. At this point, we are urging political actors of all sides to step away from this case, and to allow justice to be done <https://www.eff.org/deeplinks/2019/08/ecuador-political-actors-must-step-aw…>. By remaining involved, they risk damaging the reputation of Ecuador’s judicial system abroad, and violating the international human rights standards as defined within the Inter-American system for the protection of human rights. > > Protecting The Rights of Security Researchers > Ola Bini’s detainment is a flagship case of the targeting of technologists, and the dangers of overbroad cybercrime laws. > > Technologists, developers, security researchers, and hackers all have fundamental human rights. We must not allow politics to sway the judicial process towards scapegoating their work. We must stop politicians from demonizing benign uses of technology. And we must ensure that the laws protect the fundamental human rights of security researchers across the world. > > If you are a researcher wondering if your own research is in a legal gray area, or concerned that the vendor will threaten legal action, please reach out to info(a)eff.org <mailto:info@eff.org>or visit our Coders' Rights project <https://www.eff.org/issues/coders> for legal FAQs. All EFF legal consultations are pro bono (free), as part of our commitment to help the security researcher community. If you happen to be in Las Vegas this week, you can also stop by the EFF booths at BSides, Black Hat, or DEF CON to make an appointment with one of our attorneys, though we highly recommend contacting us as far in advance of your talk as possible. And as always, even if you don’t have a legal question, come say hi at the booth or watch one of our talks. <https://www.eff.org/deeplinks/2019/07/eff-vegas-security-week> > For now, Ola Bini is in legal limbo. The clock is running out for the prosecution to formally charge him, although it was just reset to 30 days when they linked a new individual, Ricardo Arguello, to the case. Over the years, we have often heard from those who have been released from detention that shining a spotlight on their case has led to better treatment in prison or a speedier release. We hope you’ll join us in advocating for Ola and other individuals like him <http://eff.org/offline> whose online work has led authorities to unjustly incarcerate them or take them offline. > > Digital rights are human rights. Together, we can work to protect those rights globally, and fight back against the injustice and fearmongering perpetrated worldwide against innocent technologists. > > <>EFF Updates > > No other updates at this time. <https://eff.org/effector/32/12> > ... > > Supported by Donors > > Our members make it possible for EFF to bring legal and technological expertise into crucial battles about online rights. Whether defending free speech online or challenging unconstitutional surveillance, your participation makes a difference. Every donation gives technology users who value freedom online a stronger voice and more formidable advocate. > > If you aren't already, please consider becoming an EFF member today. > > <https://supporters.eff.org/join/effector> > Administrivia > > Editor: Danny O'Brien, Director of Strategy editor(a)eff.org <mailto:editor@eff.org> > EFFector is a publication of the Electronic Frontier Foundation. eff.org <https://www.eff.org/> > Membership & donation queries: membership(a)eff.org <mailto:membership@eff.org> > General EFF, legal, policy, or online resources queries: info(a)eff.org <mailto:info@eff.org> > Reproduction of this publication in electronic media is encouraged. MiniLinks do not necessarily represent the views of EFF. > > Back issues of EFFector <https://www.eff.org/effector/> > <http://twitter.com/eff> <http://www.facebook.com/eff> <https://www.instagram.com/efforg/> > About EFF > The Electronic Frontier Foundation is the leading organization protecting civil liberties in the digital world. Founded in 1990, we defend free speech online, fight illegal surveillance, promote the rights of digital innovators, and work to ensure that the rights and freedoms we enjoy are enhanced, rather than eroded, as our use of technology grows. EFF is a member-supported organization. Find out more at https://eff.org. > > ACTIVISM | IMPACT LITIGATION | TECHNOLOGY > This newsletter is printed from 100% recycled electrons. > 815 Eddy Street, San Francisco, CA 94109 United States > EFF appreciates your support and respects your privacy <http://www.eff.org/policy>. > > Unsubscribe or change your email preferences <https://supporters.eff.org/update-your-preferences?cid1=1848942&cs=05b956d0…>, or opt out of all EFF email <https://supporters.eff.org/civicrm/mailing/optout?reset=1&jid=82835&qid=105…> > > 815 Eddy Street > San Francisco, CA 94109-7701 > United States > Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat

1 0

Four questions about online hate speech - David Kaye - Medium
by J.C. DE MARTIN Aug. 8, 2019

Aug. 8, 2019

Four questions about online hate speech David Kaye Aug 6 · 6 min read The New York Times devoted the front page of its business section this morning to this screaming headline and three articles that followed it: https://medium.com/@dkisaway/four-questions-about-online-hate-speech-ae3e0a… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0