January 2020 - nexa - server-nexa.polito.it

Israeli spyware firm fails to get hacking case dismissed | World news | The Guardian
by Alberto Cammozzo Jan. 16, 2020

Jan. 16, 2020

<https://www.theguardian.com/world/2020/jan/16/israeli-spyware-firm-nso-hack…> An Israeli judge has rejected an attempt by the spyware firm NSO Group to dismiss a case brought against it by a prominent Saudi activist who alleged that the company’s cyberweapons were used to hack his phone. The decision could add pressure on the company, which faces multiple accusations that it sold surveillance technology, named Pegasus, to authoritarian regimes and other governments that have allegedly used it to target political activists and journalists. A Tel Aviv court ruled that the case brought by Omar Abdulaziz, a dissident based in Canada, could go ahead. In his lawsuit, he has argued that Saudi spies used Pegasus to read his conversations with Jamal Khashoggi, a Washington Post columnist later murdered in the Saudi Arabian consulate in Istanbul. The Guardian understands that Abdulaziz and Khashoggi exchanged hundreds of messages in the months before he died. NSO had attempted to get the case thrown out of court by arguing that it lacked “good faith” and was abusing Israel’s judicial system, according to a copy of the ruling on 22 December. However, the judge, Guy Hyman, found no grounds for dismissal. Separately, while he agreed that the trial related to sensitive security issues, he did not accept that meant it should be held in secret. “The scope [of the case] is very broad, especially in matters of the roots of constitutional values and fundamental rights,” he said. “The ruling, therefore, in my view, must be public.” NSO should also pay Abdulaziz’s legal costs of 23,000 shekels (about £5,100), he added. Alaa Mahajna, the lawyer representing Abdulaziz in Israel, welcomed the ruling and said the decision would push the trial forward. “It will force NSO to provide a defence and not just hide behind procedural delay tactics,” he said. “To my knowledge, this is the most advanced stage any private lawsuit against spyware developers has ever reached.” In his lawsuit, Abdulaziz has claimed 600,000 shekels in damages. He argued that the intercepted communications between him and Khashoggi – including discussions about how to push for democratic change in Saudi Arabia – were critical elements in the decision to kill Khashoggi. “While the deceased Khashoggi’s political activities were not new, and officials from the Saudi government knew of them a long time ago, the tightening collaboration between the plaintiff and the deceased in developing joint projects was the main reason for the decision to kill him,” the lawsuit claimed. An NSO spokesperson said the company would appeal against the decision. “The latest judgement was part of an interim proceeding which did not address the merit of [Abdulaziz’s] allegations; we remain confident that, once considered, the court will reject them,” he said. The spokesperson would not comment on specifics of the case but said Khashoggi was never targeted by one of the firm’s products. NSO faces a separate case in the US, brought against it in October by WhatsApp, which accuses the company of a series of sophisticated cyber-attacks that breached its messaging platform. [...]

1 0

Aiutare OONI a capire implicazioni cambio licenza database MaxMind
by Simone Basso Jan. 16, 2020

Jan. 16, 2020

Cari tutti, Stiamo avendo difficoltà a capire le implicazioni del cambio di licenza del database MaxMind di geolocalizzazione che usiamo per OONI. Ci stavamo chiedendo se per caso c'è qualcuno in lista che ci può aiutare. Molto brevemente il problema è che la licenza del database non è più CC BY SA dal 1 Gennaio, e non riusciamo a capire esattamente cosa sia lecito e cosa non sia lecito fare con la nuova licenza, che estende/modifica le CC [1, 2]. La ragione principale per cui MaxMind ha cambiato la licenza è l'entrata in vigore di una nuova legge ispirata al GDPR, il California Consumer Privacy Act. Se capisco bene, questa nuova legge contiene una specie di "diritto all'oblio", che quindi ha complicato non poco gli obblighi cui MaxMind deve sottostare. Aggiungo maggiori dettagli in seguito, ma forse questo è un momento per far presente che la prossima settimana siamo a Torino sia io sia Arturo Filastò per il 75o lunch seminar di Nexa [4], quindi questa potrebbe benissimo essere una conversazione che possiamo avere di persona prima/dopo il lunch seminar, se viene troppo complicato/lungo discutere di questo argomento via email. Grazie, -sbs --- maggiori dettagli --- Quello che facevamo fino al 31 Dicembre era questo: (1) scaricare liberamente il database dal sito di MaxMind; (2) pubblicarlo su GitHub e salvare lo sha256 del file; (2) configurare le nostre app per scaricarlo e verificare lo sha256; (4) usarlo nelle app per vedere se dove si trova OONI, ossia in quale paese e in quale rete, cosi' da rendere inutile raccogliere l'indirizzo IP. Il nostro desiderio principale ovviamente sarebbe poter non cambiare nulla, perche' il workflow che avevamo era sufficientemente robusto per noi. Quello che vogliamo (e non riusciamo a) capire [5] e': 1. possiamo continuare a ripubblicare il database su GitHub? Altrimenti, quali sono i nostri obblighi per continuare a poter implementare questa soluzione? 2. se non possiamo fare questo, possiamo liberamente includere una copia del database nelle app? Altrimenti, quali sono adesso i nostri obblighi per implementare questa soluzione? 3. se non possiamo fare questo, possiamo creare un servizio web liberamente accessibile cui possiamo fare collegare le nostre app per ottenere la geolocazione? 4. che cosa è che possiamo fare con questa libreria esattamente alla luce della nuova licenza? Quale è lo spirito della licenza e che casi di uso dovrebbero essere permessi secondo voi? --- note --- [1] https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-us… [2] https://www.maxmind.com/en/geolite2/eula [3] https://geoip.ubuntu.com/lookup [4] https://nexa.polito.it/lunch-75 [5] abbiamo ovviamente le nostre risposte ad alcune di queste domande, ma non essendo giuristi non siamo per nulla sicuri di aver capito bene :-).

1 0

Fwd: TECH-WORK
by Vincenzo Cortese Jan. 15, 2020

Jan. 15, 2020

---------- Forwarded message --------- Da: Agata Lo Tauro <agatalotauro(a)gmail.com> Date: Mer 15 Gen 2020, 13:34 Subject: TECH-WORK Caro Vincenzo,Mi posti il messaggio su NEXA perfavore? Basta che fai inoltra To: Vincenzo Cortese <vinc.cortese(a)gmail.com> *We are glad to inform you that we are implementing the New TECH-WORK Network* *TECH-WORK* * Implementing “Tech-Work and Open Data” for Everyone* *Planning a Sustainable, Healthy, Secure and Innovative Future:* *Novel Technologies and Open Data* *Implementing a novel multidisciplinary network for Innovative Humanitarian Researches and Applications* *https://www.facebook.com/agata.lotauro.52/posts/172268484132304* <https://www.facebook.com/agata.lotauro.52/posts/172268484132304> *We also update information in the following links* *https://www.linkedin.com/feed/update/urn:li:activity:6613145235822268417/* <https://www.linkedin.com/feed/update/urn:li:activity:6613145235822268417/> *TECH-WORK LinkedIn Group **https://www.linkedin.com/groups/10513587/* <https://www.linkedin.com/groups/10513587/> *TECH-WORK Family - links* *https://www.linkedin.com/feed/update/urn:li:ugcPost:6623146280820576256/* <https://www.linkedin.com/feed/update/urn:li:ugcPost:6623146280820576256/> *https://www.facebook.com/assem.mousa/posts/10219871721171036* <https://www.facebook.com/assem.mousa/posts/10219871721171036> *Please follow us!* *Fell free, anyway!*

1 0

Bando graduate colloquium European network on digital labour (deadline 20 gennaio 2020)
by Antonio Casilli Jan. 15, 2020

Jan. 15, 2020

Dear all, “Unboxing AI”, il nostro prossimo convegno ENDL (European Network on Digital Labour), in collaborazione con Fondazione Giangiacomo Feltrinelli e Nexa Center for Internet & Society, si svolgerà a Milano il 27-28 marzo 2020. Presto sveleremo il programma e i nomi dei relatori. Nel frattempo, se siete student* master o phd (o se ne conoscete di potenzialmente interessat*) ecco il bando per presentare le vostre ricerche nella sezione “graduate colloquium”👉👉👉 http://endl.network/endl-3-graduate-colloquium-on-digital-labour/ Deadline: 20 gennaio 2020. -- Antonio A. Casilli Professor, Telecom Paris, Institut Polytechnique de Paris Member, Interdisciplinary Institute for Innovation (i3 UMR 9217 CNRS) Associate Member, LACI-IIAC (EHESS) Faculty Fellow, Nexa Center for Internet & Society *We respect your right to disconnect. This email send time is due to my own workflow efficiency. You are in no obligation to take action or reply to it outside your office hours.*

1 0

Surprising results after activists test facial recognition technology on Denver City Council
by J.C. DE MARTIN Jan. 15, 2020

Jan. 15, 2020

https://www.thedenverchannel.com/news/local-news/surprising-results-after-a… (Sent from my wireless device; please excuse brevity and typos (if any))

3 2

Instagram says it's removing posts supporting Soleimani to comply with US sanctions - CNN
by J.C. DE MARTIN Jan. 15, 2020

Jan. 15, 2020

https://www.cnn.com/2020/01/10/tech/instagram-iran-soleimani-posts/index.ht… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

An open letter to Google
by Giacomo Tesio Jan. 14, 2020

Jan. 14, 2020

Credo non sia passata in lista: https://privacyinternational.org/advocacy/3320/open-letter-google Giacomo ____ Dear Mr. Pichai, We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it. And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent. These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store. These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions. We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world. The changes we believe are needed most urgently are as follows: - Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled. - Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions. - Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account. Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way. We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone. We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

3 4

NYTimes: Prime Leverage: How Amazon Wields Power in the Technology World
by J.C. DE MARTIN Jan. 14, 2020

Jan. 14, 2020

Prime Leverage: How Amazon Wields Power in the Technology World https://www.nytimes.com/2019/12/15/technology/amazon-aws-cloud-competition.… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Consultazione: 2025 Strategia per l’innovazione tecnologica e la digitalizzazione del Paese
by J.C. DE MARTIN Jan. 13, 2020

Jan. 13, 2020

Consultazione aperta fino al 30 aprile: https://partecipa.gov.it/processes/innovazione-tecnologica jc (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Microsoft: Developer's Mind Control (Evangelism is War, ~2000)
by Giacomo Tesio Jan. 13, 2020

Jan. 13, 2020

http://techrights.org/wp-content/uploads/2008/08/comes-3096.pdf A distanza di anni mi è ricapitato davanti questo leak di Microsoft risalente al 2000. E' una lettura molto interessante. A pagina 118 abbiamo una slide sul controllo mentale degli sviluppatori: > # Mind Control > > - To control mental output you have to control mental input. > - Take control of the channels by which developers receive information, > - then they can only think about the things you tell them. > - Thus, you control mindshare! Insomma, Google ha perfezionato il metodo... ma non l'ha inventato. Giacomo

1 0