February 2020 - nexa - server-nexa.polito.it

Walmart fulfillment services

by Luigi Scorca

Walmart is setting up a fulfillment service (in the US), just like Amazon: the vertical integration of e-commerce and delivery services is moving on.. Luigi https://seekingalpha-com.cdn.ampproject.org/c/s/seekingalpha.com/amp/news/3…

Feb. 26, 2020

Predire attacchi cardiaci con sensore adesivo e AI

by Federico Bo

https://thenextweb.com/neural/2020/02/26/new-ai-powered-sensor-can-predict-… Insieme ad altre notizie che ho letto, come l'analisi con AI degli ECG che sembra garantire buona affidabilità, testimonia di un campo di studi e applicazioni molto vivace. Del resto scoprire pattern specifici - in questo caso nell'attività cardiaca - è la ragione di vita degli algoritmi machine learning... Federico -- Ing. Federico Bo /federicobo.eu <https://www.federicobo.eu/>/

Feb. 26, 2020

Your body is a passport – POLITICO

by Alberto Cammozzo

<https://www.politico.eu/article/future-passports-biometric-risk-profiles-th…> [...] Ultimately, the replacement of physical passports with digital forms of identification presents a challenge to the concept of “citizenship.” The goal in Western societies like the EU and the U.S. is to have all travel biometrically determined. What’s never discussed is that this has the potential to change the criteria by which travelers are permitted to enter and leave a country. Those travelers whom governments identify as posing lesser risks will be waived through. For example, Peter Graham, a former director at IBM, working on border security, immigration and identity management, envisions a future in which “the foreign business traveler who comes to Europe regularly would have a Biometric Residence Permit and when using it would go through the same light touch process as a European citizen.” Global business leaders are falling over themselves to propose such streamlined forms of travel. In other words, business travelers would become de facto citizens. That’s great for them, but what about those on the other end of the automated risk spectrum? If you're a Muslim American traveler, entering the U.S. at an international airport is a very different experience. China is the most advanced algorithmic surveillance state on earth | Greg Baker/AFP via Getty Images The advance of data-driven uses of identification is likely irreversible. In democratic societies, rights protections may limit abuse. But how long can these hold? Security technologies tend to creep. How to control them is perhaps the most important question of our age. In China, the epicenter of “algorithmic surveillance,” the meaning of citizenship has already changed. A newly piloted “citizenship score” system seeks to make risk profiles a daily part of life. Those considered loyal to the regime are rewarded with social “goods,” such as high-speed internet or expedited visas to travel. Those who post political statements online without express permission or contradict the government risk having those goods taken away, or worse, see their civil liberties, already tenuous, further constrained. >From outside China, it’s easy to dismiss this as dystopian. It couldn’t happen in a democracy, right? But the truth is that it’s already happening. There’s no difference in the underlying logic between China’s citizenship scores and Western risk ratings. [...]

Feb. 26, 2020

Data Protection, Immigration,Enforcement and Fundamental Rights:,What the EU’s Regulations on,Interoperability Mean for People,with Irregular Status

by Alberto Cammozzo

*Full report:* *<https://www.statewatch.org/analyses/Data-Protection-Immigration-Enforcement…> * * * *Executive summary of the report* This paper examines the EU's justice and home affairs databases and information systems, the changes that have been introduced by recent legislation seeking to make those systems 'interoperable' and the potential implications of those changes for fundamental rights, in particular in relation to undocumented migrants. Notwithstanding concerns over the necessity and proportionality of the interoperability initiative as a whole, the new rules lack the necessary safeguards to protect people from the arbitrary, unjustified or excessive exercise of state power. With key details left to national government decisions, closely monitoring the implementation of these rules will be crucial to uphold the rights of undocumented migrants and other parts of the population. *Massive data processing to facilitate increased identity checks* One key aim of the interoperability initiative is to facilitate an increase in police identity checks of non-EU nationals, whether documented or undocumented. To this end, a huge new database - the Common Identity Repository (CIR) (see Fig. 2), with a capacity of up to 300 million records containing biographic and biometric data - is being constructed, making use of data in a number of existing and forthcoming EU databases. This paper focuses on four main issues arising from the legislation governing how national authorities should use the CIR for carrying out identity checks: * while the legislation contains anti-discrimination safeguards, they are extremely weak; * there is no evidence to suggest that non-EU nationals are more likely than EU nationals to be engaged in activities threatening public security or public policy, calling into question the proportionality of allowing access to the CIR for the broad purpose of "ensuring a high level of security", as it suggests that non-EU nationals a priori constitute a security threat; * the legislation does not precisely circumscribe the specific offences or legal thresholds that could justify access to the database; and * depending on the way Member States implement EU rules on data protection in the criminal justice and law enforcement sector, the CIR could be used to undermine 'firewalls' between public services and immigration enforcement. *Repurposing data from underlying IT systems* The way the CIR is being constructed also runs counter to a key data protection principle. The data it will contain (at least one biometric identifier and basic biographic details, in essence equivalent to that available in the chip of a biometric passport) is to be extracted from a number of existing and forthcoming systems (EES, ETIAS, Eurodac, SIS, VIS and ECRIS-TCN, see Figure 1). As well as being used to facilitate identity checks and assist in criminal investigations via the CIR, this data will be subject to large-scale, automated cross-checking to try to detect the use of multiple identities by non-EU nationals, through the introduction of a system called the Multiple Identity Detector (MID). These underlying databases were set up for specific purposes, such as the issuance of short-stay Schengen visas (the VIS) or the registration of crossings of the external Schengen borders (the EES). The use of data for new purposes that were never foreseen in the original legislation - as will be done with the CIR and the MID - undermines the principle of purpose limitation: personal data must be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes". While the relevant legislation has been amended to graft new purposes onto the existing systems, the necessity and proportionality of doing so is highly questionable. *Existing systems reformed for an expanded role in detection and expulsion* Recent and ongoing changes to the legislation governing the EU's databases do not only seek to ensure that the information they hold can be used in the CIR and the MID. Three long-standing databases - the Schengen Information System, Eurodac and the Visa Information System - have recently been or are being reformed. A key aim of the changes is to expand their role in the detection and expulsion of those with no right to remain in the Schengen area. The changes to Eurodac (for which negotiations are ongoing) will have a particular impact on undocumented migrants. The Eurodac proposal seeks to transform what is currently an asylum database into one for "wider immigration purposes" by introducing the five-year storage of personal data from third-country nationals or stateless persons found irregularly staying in a Member State. The aim is to help identify those who should be subject to expulsion orders and provide "precious elements of evidence for re-documentation and readmission purposes." Currently, data on this category of persons may be checked against the central Eurodac database (which holds the fingerprints of asylum-seekers and individuals apprehended in connection with irregular border-crossings) but it is not stored. If the changes are approved as proposed, their data would be stored in Eurodac and also added to the CIR, where it would be used to facilitate identity checks aimed at detecting undocumented migrants. Even without these changes, however, the absence of an individual from the CIR may lead to suspicion on the part of the authorities regarding their immigration status. *A fundamental shift in data processing to support immigration and law enforcement* The interoperability initiative will introduce fundamental changes to the structure and operation of the EU's justice and home affairs databases and the processing and use of the personal data they contain. In relation to the 'identity data' of non-EU nationals, the interoperability rules introduce a "single, overarching EU information system" - something that just a decade ago the European Commission argued would "constitute a gross and illegitimate restriction of individuals' right to privacy and data protection." At the same time, the databases underlying the new 'interoperable' systems are being altered to try to more effectively and efficiently locate and expel those who are irregularly present in the Schengen area, through the processing of more personal data, gathered from a greater number of people, for a broader set of purposes. The potential effects for non-EU nationals, including undocumented migrants, are likely to be significant. Migrants' rights and privacy advocates should pay close attention to the changes being introduced at EU level, the framing of forthcoming national legislation concerning identity checks, the development and implementation of the systems themselves and emerging plans that seek to expand the new 'interoperable' systems to include EU nationals.

Feb. 26, 2020

Ethics of Technology Needs More Political Philosophy

by Antonio Vetro'

Interessante commento uscito nel numero di gennaio di Communications of the ACM: https://cacm.acm.org/magazines/2020/1/241714-ethics-of-technology-needs-mor… L'autore prende come riferimento il noto "trolley problem" e suggerisce che esso dovrebbe essere trattato non (solo) con la filosofia morale, ma (anche) con la filosofia politica, perché essa ha migliori strumenti per trattare le questioni del pluralismo, dell’azione umana e della legittimità delle decisioni. Riporto un breve estratto dal finale che ho trovato particolarmente concreto e personalmente abbastanza condivisibile: “To respect reasonable pluralism, our responses to ethical challenges of technology should find common ground between the fundamentally different values that people hold and consider processes of incorporating and resolving value conflicts. To respect individual agency, we should hesitate to replace human judgment and decision making. And if we make decisions that affect others, we should keep their interests in mind and try to decide for them as they would for themselves. To respect legitimacy, corporations should democratize decisions that affect basic goods such as individuals' liberty, safety, or opportunity. Options to democratize corporate decisions can involve government regulation, stakeholder participation, or deliberative input from the public, among others.” Un caro saluto, antonio

Feb. 26, 2020

EU Antitrust Chief Defends Countries’ Digital Tax Measures

by J.C. DE MARTIN

*EU Antitrust Chief Defends Countries’ Digital Tax Measures *Feb. 26, 2020, 8:00 AM / - Efforts needed in absence of unified solution, Vestager says// // - Supports OECD efforts to forge a global plan/ EU antitrust and tech chief Margrethe Vestager defended European nations’ plans to impose their own digital services taxes on large tech firms. France, Italy, Austria, and the Czech Republic, frustrated by failure to reach consensus on an EU-wide digital services tax, are pushing ahead with their own measures. “I strongly applaud that member states are picking it up where we failed as a community together to do something,” Vestager said in an interview with Bloomberg Tax on Tuesday. “I think it is very important in order to be able to answer the many businesses who pay their taxes, that you’re willing to do something to make sure that your competitors, they pay as well,” she added. [...] continua qui: https://news.bloombergtax.com/daily-tax-report-international/eu-antitrust-c…

Feb. 26, 2020

We found 6 critical PayPal vulnerabilities – and PayPal punished us for it

by Giacomo Tesio

When our analysts discovered six vulnerabilities in PayPal – ranging from dangerous exploits that can allow anyone to bypass their two-factor authentication (2FA), to being able to send malicious code through their SmartChat system – we were met with non-stop delays, unresponsive staff, and lack of appreciation. Below, we go over each vulnerability in detail and why we believe they’re so dangerous. When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. This happened even when the issue was eventually patched, although we received no bounty, credit, or even a thanks. Instead, we got our Reputation scores (which start out at 100) negatively impacted, leaving us worse off than if we’d reported nothing at all. [...] # PayPal’s reputation for dishonesty PayPal has been on the receiving end of criticism for not honoring its own bug bounty program. Most ethical hackers will remember the 2013 case of Robert Kugler, the 17-year old German student who was shafted out of a huge bounty after he discovered a critical bug on PayPal’s site. Kugler notified PayPal of the vulnerability on May 19, but apparently PayPal told him that because he was under 18, he was ineligible for the Bug Bounty Program. But according to PayPal, the bug had already been discovered by someone else, but they also admitted that the young hacker was just too young. Another researcher earlier discovered that attempting to communicate serious vulnerabilities in PayPal’s software led to long delays. At the end, and frustrated, the researcher promises to never waste his time with PayPal again. There’s also the case of another teenager, Joshua Rogers, also 17 at the time, who said that he was able to easily bypass PayPal’s 2FA. He went on to state, however, that PayPal didn’t respond after multiple attempts at communicating the issue with them. PayPal acknowledged and downplayed the vulnerability, later patching it, without offering any thanks to Rogers. # The big problem with HackerOne HackerOne is often hailed as a godsend for ethical hackers, allowing companies to get novel ways to patch up their tools, and allowing hackers to get paid for finding those vulnerabilities. It’s certainly the most popular, especially since big names like PayPal work exclusively with the platform. There have been issues with HackerOne’s response, including the huge scandal involving Valve, when a researcher was banned from HackerOne after trying to report a Steam zero-day. However, its Triage system, which is often seen as an innovation, actually has a serious problem. The way that HackerOne’s triage system works is simple: instead of bothering the vendor (HackerOne’s customer) with each reported vulnerability, they’ve set up a system where HackerOne Security Analysts will quickly check and categorize each reported issue and escalate or close the issues as needed. This is similar to the triage system in hospitals. These Security Analysts are able to identify the problem, try to replicate it, and communicate with the vendor to work on a fix. However, there’s one big flaw here: these Security Analysts are also active Bug Bounty Hackers. Essentially, these Security Analysts get first dibs on reported vulnerabilities. They have full discretion on the type of severity of the issue, and they have the power to escalate, delay or close the issue. That presents a huge opportunity for them, if they act in bad faith. Other criticisms have pointed out that Security Analysts can first delay the reported vulnerability, report it themselves on a different bug bounty platform, collect the bounty (without disclosing it of course), and then closing the reported issue as Not Applicable, or perhaps Duplicate. As such, the system is ripe for abuse, especially since Security Analysts on HackerOne use generic usernames, meaning that there’s no real way of knowing what they are doing on other bug bounty platforms. ______ Sono sempre a disagio di fronte alla locuzione "hacker etico". L'hacking è sempre una azione etica: un'etica basata sulla curiosità, volta alla ricerca di conoscenza. Il fatto che si qualifichi come "etica" la collaborazione con i responsabili di una falla di sicurezza nel ritardare la diffusione dell'informazione è in parte sintomo ed in parte causa del pessimo livello di sicurezza nell'informatica. Se ogni falla di sicurezza venisse subito anonimamente diffusa sui mass media, dopo un paio di fallimenti aziendali, avremmo software molto più sicuro. Windows sarebbe il sistema operativo più sicuro del pianeta. (o Microsoft non esisterebbe più...) Invece, abbiamo HackerOne. Giacomo

Feb. 26, 2020

Musicians Algorithmically Generate Every Possible Melody, Release Them to Public Domain

by Stefano Quintarelli

Musicians Algorithmically Generate Every Possible Melody, Release Them to Public Domain Damien Riehl and Noah Rubin generated and saved every possible melody to a hard drive, then turned it back around to the commons. https://www.vice.com/en_us/article/wxepzw/musicians-algorithmically-generat… -- reserve your meeting with me at https://cal.quintarelli.it

Feb. 26, 2020

Moshe Vardi: Advancing Computing as a Science and Profession–But to What End?

by Diego Latella

Nice note of Moshe Vardi in the Communications of the ACM (March 2020): "Advancing Computing as a Science and Profession–But to What End?” https://cacm.acm.org/magazines/2020/3/243014-advancing-computing-as-a-scien… <https://cacm.acm.org/magazines/2020/3/243014-advancing-computing-as-a-scien…> Diego Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat

Feb. 26, 2020

How Much is Privacy Worth Around the World and Across Platforms?

by don Luca Peyron

In this paper, we measure individuals’ valuation of online privacy across a wide range of countriesand data types. The online information we consider includes personal information onfinances, biometrics, location, networks, communications, and web browsing. The countries we analyze include the United States, Mexico, Brazil, Colombia, Argentina, and Germany. We conduct these measures using carefully designed, internationally distributed, discrete choice surveys. These surveys allow us to measure tradeoffs across these aspectsof online privacy, and importantly,allow us to make relative comparisons of these tradeoffs across many countries. dl https://techpolicyinstitute.org/wp-content/uploads/2020/02/Prince_Wallsten_… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Feb. 26, 2020