November 2020 - nexa - server-nexa.polito.it

Moscow’s facial recognition system can be hijacked for just $200, report shows - The Verge

by Alberto Cammozzo

<https://www.theverge.com/2020/11/11/21561018/moscows-facial-recognition-sys…> A digital rights activist in Moscow was able to purchase access to the city’s extensive facial recognition system for just 16,000 rubles (approximately $200), as reported by the Thomson Reuters Foundation <https://news.trust.org/item/20201109090922-3k4a5/>. After seeing ads for the service on Telegram, Anna Kuznetsova transferred the money along with a picture of herself to a seller. Two days later, she received an extensive report of her movements over the previous month, apparently pulled directly from the police system. Spanning more than 100,000 cameras across the city, Moscow’s facial recognition system is meant to be restricted to law enforcement. It’s unclear how the seller was able to secure access, whether through bribery or a digital intrusion. Two officers were placed under investigation in the wake of the incident, but Kuznetsova has filed a lawsuit aimed at pausing the program until clearer procedures are set. As Kuznetsova sees it, the system poses a clear danger to the public as long as it’s available. “Any crazy guy can stalk you using this; criminals can check when and where you go and steal from your apartment or hurt you,” she told /Reuters/. “Anything can happen.” Moscow police rolled out facial recognition in January <https://www.theverge.com/2020/1/30/21115119/moscow-live-facial-recognition-…>, and while their system is one of the more extensive city-level efforts, it’s far from the only one. In July, Rite Aid was revealed to have used facial recognition across a network of hundreds of stores <https://www.theverge.com/2020/7/28/21345185/rite-aid-facial-recognition-sur…> for more than eight years, intended as a deterrent against theft and violent crime. A number of US cities have banned facial recognition by public agencies in response to those concerns, including San Francisco, Boston, and (most recently) Portland, Maine <https://www.theverge.com/2020/11/4/21536892/portland-maine-facial-recogniti…>.

Nov. 13, 2020

Re: [nexa] tecnologia aperta: Andrea Crisanti un hacker?

by Alberto Cammozzo

On 12/11/2020 10:03, Roberto Resoli wrote: [...] > Più che giusto. Crisanti non è nè infallibile nè un guru, ovviamente. > Sulla protezione dei dati personali ha posizioni sinceramente > retrograde, e anche la proposta: "4-Incoraggiare l’adesione al sistema > di tracciamento App immuni assicurando a tutti coloro che scaricano > l’applicazione priorità di accesso ai tamponi;" credo sia assolutamente > immorale (e chi non ha un telefono?) e non fattibile prima di tutto dal > punto di vista giuridico. A questo proposito: l'informativa privacy che accompagnava l'analisi sierologica *e genetica* di UniPD/Crisanti sulla popolazione di Vo' (che prevedeva la raccolta di DNA su adulti e minori) riportava: "I dati e i campioni possono essere trasferiti, privi dei dati identificativi, ad un Paese appartenente o non appartenente all'Unione Europea o a un'organizzazione internazionale, [segue elenco provvisorio]. La informiamo che in alcuni Paese il livello di protezione dei dati potrebbe non essere ritenuto adeguato a quanto richiesto dalla Commissione Europea"

Nov. 13, 2020

HOW COVID-19-RELATED CRIME INFECTED EUROPE DURING 2020

by don Luca Peyron

Il report di Europol molto interessante, molti crimini legati agli interessi di questa lista. Buona lettura dl https://www.europol.europa.eu/publications-documents/how-covid-19-related-c… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Nov. 12, 2020

italiche buone nuove

by don Luca Peyron

La società automatizzata: la diffusione degli ADM in Italia Buona lettura dl https://privacy-network.it/la-societa-automatizzata-la-diffusione-degli-adm… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Nov. 12, 2020

RFC: Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

by Giacomo Tesio

Sono certo che molti Nexiani potranno fornire un contributo. The European Data Protection Board welcomes comments on the Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. Such comments should be sent by 30th November 2020 at the latest using the provided form. Please note that, by submitting your comments, you acknowledge that your comments might be published on the EDPB website. https://edpb.europa.eu/our-work-tools/public-consultations-art-704/2020/rec… Giacomo

Nov. 12, 2020

Zoom lied to users about end-to-end encryption for years, FTC says

by Giacomo Tesio

"[S]ince at least 2016, Zoom misled users by touting that it offered 'end-to-end, 256-bit encryption' to secure users' communications, when in fact it provided a lower level of security," the FTC said today in the announcement of its complaint against Zoom and the tentative settlement. Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised." The FTC complaint says that Zoom claimed it offers end-to-end encryption in its June 2016 and July 2017 HIPAA compliance guides, which were intended for health-care industry users of the video conferencing service. Zoom also claimed it offered end-to-end encryption in a January 2019 white paper, in an April 2017 blog post, and in direct responses to inquiries from customers and potential customers, the complaint said. "In fact, Zoom did not provide end-to-end encryption for any Zoom Meeting that was conducted outside of Zoom's 'Connecter' product (which are hosted on a customer's own servers), because Zoom's servers—including some located in China—maintain the cryptographic keys that would allow Zoom to access the content of its customers' Zoom Meetings," the FTC complaint said. [...] The settlement is supported by the FTC's Republican majority, but Democrats on the commission objected because the agreement doesn't provide compensation to users. "Today, the Federal Trade Commission has voted to propose a settlement with Zoom that follows an unfortunate FTC formula," FTC Democratic Commissioner Rohit Chopra said. "The settlement provides no help for affected users. It does nothing for small businesses that relied on Zoom's data protection claims. And it does not require Zoom to pay a dime. The Commission must change course." [...] "The ZoomOpener Web server allowed Zoom to automatically launch and join a user to a meeting by bypassing an Apple Safari browser safeguard that protected users from a common type of malware," the FTC said. "Without the ZoomOpener Web server, the Safari browser would have provided users with a warning box, prior to launching the Zoom app, that asked users if they wanted to launch the app." The software "increased users' risk of remote video surveillance by strangers" and "remained on users' computers even after they deleted the Zoom app, and would automatically reinstall the Zoom app—without any user action—in certain circumstances," Continua su: https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-users-about-end-to… Giacomo

Nov. 12, 2020

Re: [nexa] Call for clear rejection plans to break secure online encryption by EU governments.

by Giovanni Biscuolo

Buongiorno Giacomo Tesio <giacomo(a)tesio.it> writes: [...] > https://european-pirateparty.eu/pirates-call-for-clear-rejection-plans-to-b… per chi fosse interessato, con Giacomo ci siamo praticamente incrociati nel segnalare la questione; qui [1] ulteriori dettagli: https://server-nexa.polito.it/pipermail/nexa/2020-November/019283.html [...] Saluti, Giovanni -- Giovanni Biscuolo

Nov. 12, 2020

bozza risoluzione consiglio EU: security despite encryption?

by Giovanni Biscuolo

Buongiorno nexiane, scusate, sono prolisso oltre la mia media in questo messaggio, ma vorrei essere esaustivo. Insomma che intenzioni ha il consiglio europeo (e la commissione? e il parlamento?) in merito all'encryption E2E?!? Sono paranoie di qualcuno o si stanno preparando a smontare l'encryption E2E delle "piattaforme"? ... e del software in generale? Renderanno illegali i software di comunicazione decentralizzata con encryption E2E tipo Jami https://jami.net/ Delta.Chat https://delta.chat/it/ e simili? Perché ho letto tutto e seguo "da sempre" la cosa... e non capisco, anzi da quello che capisco mi preoccupo. Vogliono evitare che l'encryption E2E venga usata dai criminali senza che una autorità competente sia in grado di intercettare il contenuto: e quale sarebbe quindi il "balance" tra diritto alla riservatezza e lotta al crimine? Leggendo la bozza del consiglio, sostanzialmente il "balance" sarebbe quello di armonizzare il "legal framework" EU al fine di consentire alle autorità competenti di svolgere i propri compiti operativi (intercettazione) in modo efficace, OVVIAMENTE il tutto in modo legale, ça va sanse dire! Quindi?!? Le autorità competenti avranno accesso alle informazioni in chiaro perché c'è una backdoor nel software (e col software libero come la mettiamo?!?) o una "superchiave" in grado di decifrare tutto? Pare che le fonti ufficiali spergiurino non non pensare minimamente a un divieto della E2EE e nemmeno a una compromissione "stile backdoor"... ma allora cosa? Una "superchiave" iniettata ovunque? Un modesto suggerimento: che ne direste di smetterla di essere ossessionati dalla E2E encryption e di organizzarsi per *infiltrarsi* nelle organizzazioni criminali usando i loro stessi mezzi digitali, stando comodamente seduti alle scrivanie dei centri operativi delle autorità competenti? Ecco a cosa mi riferisco: In questo articolo del 9 Novembre scorso; https://stemcelllove.com/2020/11/eu-resolution-draft-seeks-to-bypass-encryp… «EU Resolution Draft Seeks to Bypass Encryption» viene fatto riferimento a un articolo https://fm4.orf.at/stories/3008930/ (in tedesco) dell'emittente radiofonica austriaca radioFM24, parte di ORF (radiotelevisione nazionale austriaca); ecco un estratto del succo del dicscorso che *farebbe* l'articolo di ORF: --8<---------------cut here---------------start------------->8--- An Austrian news outlet reported that the Council of the European Union has nearly completed a resolution, “made ready within five days,” that would require applications such as WhatsApp and Signal to have a “master key” for monitoring end-to-end (E2E)-encrypted chats and messages. ORF.at claims to have received an internal document dated November, addressed from the German Presidency to the delegations of the member states in the Council. The alleged revised version of the Draft Council Resolution on Encryption argues that, while encryption is “a necessary means of protecting fundamental rights and the digital security of governments, industry and society,” which should be “promoted and developed,” the European Union also must “ensure the ability of competent authorities in the area of security and criminal justice […] to exercise their lawful powers, both online and offline.” That said, an increasing number of communication channels, instant messaging apps, and other online platforms implementing E2E encryption has brought “great opportunities” and “considerable challenges” – namely “the potential for exploitation for criminal purposes,” stands in the draft. Therefore, law enforcement has to increasingly depend on access to individual electronic devices during their investigations of terrorism, organized crime, child sexual abuse, etc. However, sometimes doing this is “extremely challenging or practically impossible despite the fact that the access to such data would be lawful,” argues the draft. “Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality,” it adds, inviting governments, industry, research and academia to work together on creating a balance. “There is a clear need to review the effects arising from different regulatory frameworks in order to develop further a consistent regulatory framework across the EU that would allow competent authorities to carry out their operational tasks effectively.” The document makes no mention of either a master key or a ban. ORF.at stated that the topic will be discussed between the French President Emmanuel Macron and the Austrian Chancellor Sebastian Kurz in a video conference at the beginning of the week, claiming that the resolution “has already been voted on in the Council,” and “has already been agreed to such an extent that it can be passed in the video conference of the interior and justice ministers at the beginning of December without further discussion.” What we know from the document is that, if there are no further objections or comments, this resolution will be adopted in the Standing Committee on Operational Cooperation on Internal Security (COSI) on November 19, and submitted to the Committee of the Permanent Representatives of the Governments of the Member States to the European Union (COREPER) six days later, “followed by adoption by the Council via written procedure.” ORF.at, however, argued that the decision will be made in a virtual meeting at the beginning of December, after which the Council will draw up a draft regulation and put it through the usual procedure by the European Parliament, though it might be possible “to implement the planned regulation in its core even without the involvement of the Parliament,” as has already happened in connection with surveillance, claimed the article. --8<---------------cut here---------------end--------------->8--- Il documento trafugato è stato pubblicato qui: https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st12143-re01en20_7… (vietnam2?!?!? interessante sottocartella :-O ) Ecco il testo, trasportato dal PDF: --8<---------------cut here---------------start------------->8--- Brussels, 6 November 2020 (OR. en) 12143/1/20 REV 1 NOTE From: Presidency To: Delegations Subject: Draft Council Resolution on Encryption - Security through encryption and security despite encryption Delegations will find in attachment the revised version [1] of the Draft Council Resolution on Encryption. It reflects the comments received from the Member States before and during the informal VTC meeting of JHA Counsellors (Encryption) on 3 November 2020. Unless delegations send in further substantive comments, accompanied by concrete wording suggestions, by 12 November 2020 noon, to [OMISSIS, ndr], the Presidency intends to present this revised text for endorsement to COSI (VTC) on 19 November 2020, in view of further submission to COREPER (I-item) on 25 November 2020, followed by adoption by the Council via written procedure. Please be advised that the form of the document has been adjusted to a "Council resolution", so that the text could be processed for adoption via a written procedure by the Council in case it takes place in a VTC format. [1] Changes compared to the previous version are marked in *bold* and /strikethrough/ 1. Preamble: Security through encryption and security despite encryption The European Union fully supports the development, implementation and use of strong encryption. Encryption is a necessary means of protecting fundamental rights and the digital security of governments, industry and society. At the same time, the European Union needs to ensure the ability of *competent authorities in the area of security and criminal justice, e.g.* law enforcement and judicial authorities, to exercise their lawful powers, both online and offline. According to the European Council conclusions of 1-2 October 2020 (EUCO 13/20), the EU will leverage its tools and regulatory powers to help shape global rules and standards. It was agreed that funds under the Recovery and Resilience Facility would be used to advance objectives such as enhancing the EUʼs ability to protect itself against cyber threats, to provide for a secure communication environment, especially through quantum encryption, and to ensure access to data for judicial and law enforcement purposes. 2. Current use/state of encryption In today’s world, encryption technology is increasingly used in all areas of public and private life. It is a means to protect governments, *critical infrastructures*, civil society, citizens and industry by ensuring the privacy, *confidentiality* and *data integrity* of communications and personal data: it is evident that all parties benefit from high-performance encryption technology. Encryption has been identified by EU data protection authorities as an important tool contributing for instance to the protection of personal data transferred outside the EU *but subject to the requirement of an essentially equivalent level of protection*, which according to the Court of Justice is a legal requirement for data transfers [2]. Not only are electronic devices and applications increasingly programmed to encrypt stored user data by default, but more and more communication channels are also secured by end-to-end (E2E) encryption. This is positively reflected in an increasing response by the communication and application industry, where the majority of instant messaging apps and other online platforms have also implemented end-to-end encryption. [2] Judgment of 16 July 2020 in Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd, Maximillian Schrems, ECLI:EU:C:2020:559: 3. Challenges for ensuring public *security* "Digital life’" and cyberspace not only present great opportunities, but also considerable challenges: the digitalisation of modern societies brings with it certain vulnerabilities and the potential for *exploitation for criminal purposes*. Thus criminals can include readily available, off-the-shelf encryption solutions designed for legitimate purposes in their modi operandi [3]. At the same time law enforcement is increasingly dependent on access to electronic evidence to effectively fight terrorism, organised crime, child sexual abuse (particularly its online aspects), as well as a variety of cyber-enabled crimes. *For competent authorities, access to electronic evidence is not only essential to conduct successful investigations and thereby* bring criminals to justice*, but also to protect victims and help ensure security*. However, there are instances where encryption renders analysis of the content of communications in the framework of access to electronic evidence extremely challenging *or practically impossible despite the fact that the access to such data would be lawful*. Independently of the technological environment of the day, it is therefore essential to preserve the powers of *competent* authorities *in the area of security and criminal justice* through lawful access to carry out their tasks, as prescribed and authorised by law. Such laws providing for the enforcement powers must always fully respect due process and other safeguards, as well as other freedoms and rights, in particular the right to respect for private life and communications and the right to the protection of personal data. [3] iOCTA 2020, p. 25 4. Creating a *better* balance The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and *in protection of fundamental rights and* should be promoted and developed. Protecting the privacy and security of communications through encryption and at the same time upholding the possibility for *competent* authorities *in the area of security and criminal justice* to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious *and/or organized* crimes *and terrorism*, including in the digital world, are extremely important. Any actions taken have to balance these interests carefully. 5. Joining forces with the tech industry Moving forward, the European Union strives to establish an active discussion with the technology industry, *while associating research and academia,* to ensure the continued implementation and use of strong encryption technology. *Competent* authorities must be able to access data in a lawful and targeted manner, in full respect of fundamental rights and the data protection regime, while upholding cybersecurity. Technical solutions for gaining access to encrypted data must comply with the principles of legality, *transparency*, necessity and proportionality. Since there is no single way of achieving the set goals, governments, industry, *research and academia* need to work together to *strategically* create this balance. 6. Legal framework There is a *clear* need *to review the effects arising from different regulatory frameworks in order to develop further* a *consistent* regulatory framework *across the EU* that *would allow competent authorities to carry out their operational tasks effectively. Potential technical solutions will have to enable authorities to use their investigative powers which are subject to proportionality, necessity and judicial oversight under their domestic legislation, while upholding* fundamental rights and *preserving* the advantages of encryption. Possible solutions /may need the support of service providers/ should be developed in a transparent manner *in cooperation with communication service providers. Such technical solutions could also require* improving the technical and *operational* skills and *expertise of competent* authorities to *effectively address* the challenges of digitalisation in their work on a global scale. /In line with the principle of proportionality, such measures should be prioritised./ /Developing technical tools aimed at supporting criminal proceedings, could also be considered. Such technical tools should be subject to the principles outlined in this declaration./ 7. Innovative investigative capabilities Finally, it is of paramount importance to /improve the coordination/ at EU level /aimed at/: 1) combining the efforts of all Member States and EU institutions and bodies; 2) defining and establishing innovative approaches /in view of new technologies/; 3) /analysing appropriate technical/ and /operational solutions; and/ 4) /providing tailored high quality training/. Technical /and operational/ solutions anchored /in a legal framework built/ on the principles of /legality/, necessity and proportionality should be developed in close consultation with service providers and the relevant authorities, although there should be no single prescribed technical solution to provide access to encrypted data. --8<---------------cut here---------------end--------------->8--- -- Giovanni Biscuolo

Nov. 12, 2020

Call for clear rejection plans to break secure online encryption by EU governments.

by Giacomo Tesio

On Monday the Austrian National Service Broadcaster (ORF) published a secret draft of a planned Council resolution seeking to undermine encryption. According to the resolution, messaging services such as Whatsapp are to allow governments to decrypt and intercept secure online communications. Pirates call on responsibility of representatives of the public services to uphold and protect the fundamental right to privacy as well as the security of our digital communications infrastructure. We also call on YOU, Internet users, to contact their governments in advance of tomorrow’s deadline (12:00) for input. https://european-pirateparty.eu/pirates-call-for-clear-rejection-plans-to-b… Per chi fosse interessato, qui la versione proposta dal Partito Pirata Europeo per i rappresentanti italiani, da inviare a rpue.rpue(a)esteri.it: https://publisher.pp-eu.eu/static/ViewerJS/#/tmp/assets/doc/Italian.pdf Giacomo In allegato una versione ODT per chi non si riconoscesse nel PP, ma condividesse la preoccupazione per le istanze emerse.

Nov. 12, 2020

Re: [nexa] Uomo e macchina: cosa cambia con la pandemia?

by J.C. DE MARTIN

due belle interviste a due ospiti di eccezione di Biennale Tecnologia, grazie per la segnalazione! jc On 12/11/2020 10:10, don Luca Peyron wrote: > Una psicologa e una storica a confronto sui rischi e sulle possibilità > aperte dai nuovi strumenti digitali, per la prima volta utilizzati in > massa. Il tema della prima Biennale Tecnologia > > Buona lettura > > dl > https://www.avvenire.it/agora/pagine/quelle-macchine-tra-noi > <https://www.avvenire.it/agora/pagine/quelle-macchine-tra-noi> > _________________________ > don Luca Peyron > Direttore Ufficio per la Pastorale Universitaria > Arcidiocesi di Torino > www.universitari.to.it <http://www.universitari.to.it> > via XX settembre 83, Torino > tel. 011 5156239 > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Nov. 12, 2020