June 2020 - nexa - server-nexa.polito.it

An algorithm was taken to court – and it lost (which is great news for the welfare state) - The Correspondent

by Alberto Cammozzo

<https://thecorrespondent.com/276/an-algorithm-was-taken-to-court-and-it-los…> An algorithm was taken to court in the Netherlands last week. The System Risk Indication (SyRI) has been legal since 2014 and is intended to detect any social security fraud – benefits, taxes, you name it. SyRI combines all kinds of data sources and dumps them into an algorithm. Then suspects roll out who are scrutinised because they’re supposedly more likely to commit fraud. The police and the public prosecutor can also access SyRI’s analyses. In response, a coalition consisting of a large labour union, organisations, and even writers took the state to court. And last Wednesday, this diverse group was vindicated. The judge ruled that SyRI is against the law and violates the European Convention on Human Rights, which stipulates that every citizen has the right to protection of their private life. The ruling has damaged SyRI’s credibility, but it’s also important in the fight against a much bigger development: the digitisation of the welfare state. Because a system like SyRI is not unique. The digital welfare state is advancing all around the world. A digital dystopia "[T]here is a grave risk of stumbling zombie-like into a digital welfare dystopia." These words aren’t from a sensational column or an alarmist conspiracy blog; they’re from a United Nations (UN) report from October 2019. (Not exactly a place where you’d expect to find zombies.) Philip Alston, the UN Special Rapporteur on extreme poverty and human rights who wrote the report, is deeply concerned. His report mentions Universal Credit, the UK social security payment that was designed to simplify the British benefits system. The system, which was the first major government service in the UK to be "digital by default", means people have to apply for their benefits online, prove online that they have applied for jobs, and provide required documents online. But even in a wealthy country like the UK in 2019, some 12 million adults, 22% of the population, do not have the "essential digital skills" needed for day-to-day life. Another 19% can’t perform a "fundamental" task like opening an app. And about four million adults are offline because of fears that the internet is an insecure environment – mostly those who are poorer and older. It’s become much more difficult for them to access the welfare state. Alston also mentions Australia, where the government implemented far-reaching automation to calculate who had received too many benefits or other allowances. The government used to flag 20,000 wrongful payments per year, but when the "Robodebt" programme was launched, this rose to as many as 20,000 per week. People quickly received hefty fines. And the onus was not on the government to prove wrongdoing – instead, it was people themselves who had to prove that the accusation was wrongful. A judge ruled that the method behind the calculation was wrong. Terry Carney from the University of Sydney said that could mean as many as 300,000 alleged debts should be repaid with interest, amounting to as much as A$660m. Alston’s report gives more examples, from India to Canada, to South Africa and Sweden. Again and again, he shows that the digitisation of the welfare state leaves poor people out in the cold. Not only that – it’s violating their human rights. [...]

June 17, 2020

EDPS Opinion on Data -European Strategy

by Oreste Pollicino

https://edps.europa.eu/sites/edp/files/publication/20-06-16_opinion_data_st… [La tua firma può scrivere un futuro. Aiuta gli studenti meritevoli a costruire il proprio. Dai il tuo 5x1000 alla Bocconi C.F. 80024610158] Please note that the above message is addressed only to individuals filing Italian income tax returns. 5x1000 is a percentage of Italian personal income tax that taxpayers can allocate to Universities, scientific research and non profit organizations.

June 17, 2020

Zoom Not Offering End-to-End Encryption to Free Users to Help Law Enforcement | SecurityWeek.Com

by Alberto Cammozzo

<https://www.securityweek.com/zoom-not-offering-end-end-encryption-free-user…> Zoom’s chief executive revealed on Tuesday that free users will not be offered end-to-end encryption as the company wants to assist the FBI and local law enforcement in their investigations. Zoom’s popularity has increased significantly since the start of the COVID-19 pandemic due to many people being forced to work and study from home. This popularity has also attracted the attention of privacy and security experts, who have identified some serious issues in the video conferencing service, as well as the attention of bad actors who have started abusing the platform. Zoom has promised to take action and it has already started implementing measures that would help it address security and privacy concerns. One of these measures is related to end-to-end encryption. Zoom does encrypt communications between clients and its servers, but it currently does not offer true end-to-end encryption, which would prevent even the company itself from gaining access to the content of customers’ communications.Zoom end-to-end encryption Last month, the company published a detailed draft of the cryptographic design it plans on using for its upcoming end-to-end encryption feature, which it said would be offered to paying customers and schools. During a conference call following the release of financial results for the first quarter of fiscal year 2021, Zoom CEO Eric Yuan told investors that they do not want to offer this kind of protection to free users, which are more likely to abuse the platform, as the company wants to work with the FBI and local law enforcement if people use Zoom for “bad purposes.” In a long thread on Twitter, Alex Stamos, who was hired by Zoom as an outside advisor on cybersecurity, shared some details on the company’s plans for end-to-end encryption, which he says “are complicated by the product requirements for an enterprise conferencing product and some legitimate safety issues.” Stamos, who in the past worked as CSO at Yahoo and Facebook, said Zoom does not proactively monitor meeting content and it does not plan on doing so in the future. He says the vast majority of abuse comes from people who use Zoom for free and the company plans on taking measures that would “create friction and reduce harm.” Stamos pointed out that if end-to-end encryption is enabled, Zoom’s Trust and Safety team will not be able to enter a meeting they believe to be abusive — this is now possible without end-to-end encryption — and there will be no backdoor to facilitate such access. Stamos also noted that some meeting features are also incompatible with end-to-end encryption. This is why end-to-end encryption will be opt-in “for the foreseeable future.” “So we have to design the system to securely allow hosts to opt-into an E2E meeting and to carefully communicate the current security guarantees to hosts and attendees,” Stamos said. Zoom’s revenue for the first quarter was $328 million and the company expects to generate up to $1.8 billion this fiscal year, with an estimated profit of up to $380 million.

June 17, 2020

Google Faces Privacy Lawsuit Over Tracking Users in Incognito Mode | Threatpost

by Alberto Cammozzo

<https://threatpost.com/google-faces-privacy-lawsuit-over-tracking-users-in-…> A $5 billion class-action lawsuit filed in a California federal court alleges that Google’s Chrome incognito mode collects browser data without people’s knowledge or consent. Google faces a $5 billion class-action lawsuit over claims that it has been collecting people’s browsing information without their knowledge even when using the incognito browsing mode that’s meant to keep their online activities private. The lawsuit, filed in the federal court in San Jose, California, alleges that Google compiles user data through Google Analytics, Google Ad Manager and other applications and website plug-ins, including smartphone apps, regardless of whether users click on Google-supported ads, according to a report in Reuters. Google uses this data to learn about private browsing habits of Chrome users, ranging from seemingly innocuous data that can be used for ad-targeting—such as information about hobbies, interests and favorite foods—to the “most intimate and potentially embarrassing things” that people may search for online, according to the complaint. Google “cannot continue to engage in the covert and unauthorized data collection from virtually every American with a computer or phone,” the complaint said, according to the report. The technology problem at the root of the report is a feature called incognito mode in the Chrome browser, which ironically is one that is supposed to protect people when surfing the internet. Chrome users can turn on incognito mode to protect their browsing history, sessions and cookies from websites that want to use this information for marketing or ad-targeting purposes. Google Chrome incognito modeHowever, the feature has long had a problem in that even when using their mode, people’s activity has still been detectable by websites “for years” due to a FileSystem API implementation, Google Chrome developer Paul Irish tweeted last year. Though Google said it implemented the FileSystem API in a different way in Chrome 76, released last year, the problem persists even in the latest version of Chrome 83, which was released last month, according to a report filed Thursday in ZDNet. It is still possible to detect incognito mode in Chrome–as well as other Chromium-based browsers, such as Edge, Opera, Vivaldi, and Brave, which share the core of Chrome’s codebase, according to the report, which said Google still has not set a timeframe to fix the issue. Developers even have taken the Chrome codebase scripts to expand the ability of websites to block incognito mode users from browsing, expanding it to other browsers that don’t use the same code base, including Firefox and Safari, the report said. Ironically, the problem that’s put Google in legal hot water is nearly the same as the one the company accused browser rival Apple of having earlier this year in its Safari browser. In January, Google researchers said they identified a number of security flaws in Safari’s private-browsing feature—called Intelligent Tracking Protection–that allow people’s browsing behavior to be tracked by third parties. Apple responded by saying it had already fixed the flaws in an update to Webkit technology in Safari. Search-engine rival Duck Duck Go used news of the class-action suit as an opportunity to laud its own technology, which it offers as an alternative to Google search as a way to allow people to search and use the web privately. Incognito mode isn't private. It never was. DuckDuckGo is private. Will always be. https://t.co/bz5VmjurQW — DuckDuckGo (@DuckDuckGo) June 3, 2020 “Incognito mode isn’t private. It never was.” the company said on Twitter. “DuckDuckGo is private. Will always be.” Longtime Google critic, author, psychologist and researcher for the American Institute for Behavioral Research and Technology Dr. Robert Epstein also took to Twitter to reiterate his longstanding public opinion over Google’s privacy violations. “#Google #Surveillance & Advertising just got sued for $5 BILLION for lying about its bogus ‘incognito’ mode on its Chrome browser,” he tweeted. “As I’ve always said, you’re STILL being tracked when you’re in that mode.” The current case against the technology giant is Brown et al v Google LLC et al, U.S. District Court, Northern District of California, No. 20-03664. The New York-based law firm Boies Schiller & Flexner is representing the plaintiffs in the class-action suit, Chasom Brown, Maria Nguyen and William Byatt.

June 17, 2020

Coronavirus: Alarm over 'invasive' Kuwait and Bahrain contact-tracing apps - BBC News

by Alberto Cammozzo

<https://www.bbc.com/news/world-middle-east-53052395> Kuwait and Bahrain have rolled out some of the most invasive Covid-19 contact-tracing apps in the world, putting the privacy and security of their users at risk, Amnesty International says. The rights group found the apps were carrying out live or near-live tracking of users' locations by uploading GPS co-ordinates to a central server. It urged the Gulf states to stop using them in their current forms. Norway has halted the roll-out of its app because of similar concerns. The country's data protection authority said the app represented a disproportionate intrusion into users' privacy given the low rate of infection there. Researchers at Amnesty's Security Lab carried out a technical analysis of 11 apps in Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia and the United Arab Emirates. Bahrain's "BeAware Bahrain" and Kuwait's "Shlonik" stood out, along with Norway's "Smittestopp", as being among the most alarming mass surveillance tools, according a report published on Tuesday. Most contact-tracing apps rely solely on Bluetooth signals, but Bahrain and Kuwait's capture location data through GPS and upload this to a central database, tracking the movements of users in real time. The researchers say Bahraini and Kuwaiti authorities would easily be able to link this sensitive personal information to an individual, as users are required to register with a national ID number. Other countries' contact tracing apps assure users' anonymity. Accessing such data could help authorities tackle Covid-19, but Claudio Guarnieri, head of Amnesty's Security Lab, said the apps were "running roughshod over people's privacy, with highly invasive surveillance tools which go far beyond what is justified". Image caption Authorities in Kuwait have reported 36,400 cases of Covid-19 and 298 deaths Mr Guarnieri added: "They are essentially broadcasting the locations of users to a government database in real time - this is unlikely to be necessary and proportionate in the context of a public health response. Technology can play a useful role in contact tracing to contain Covid-19, but privacy must not be another casualty as governments rush to roll out apps." Mohammed al-Maskati, a Bahraini activist who is the Middle East digital protection co-ordinator for the human rights group Front Line Defenders, said there was also a concern the information collected by the apps might be shared with third parties. Bahrain's app was linked to a television show called "Are You At Home?", which offered prizes to users who stayed at home during Ramadan.

June 17, 2020

Conviction in the Philippines Reveals Facebook’s Dangers - The New York Times

by Alberto Cammozzo

<https://www.nytimes.com/2020/06/16/technology/facebook-philippines.html> Mark Zuckerberg likes to say that Facebook does more good than harm in the world. But Facebook’s effect on the world is multifaceted and complicated, and the good can’t simply make us forget the bad. Without Facebook or a digital hangout like it, we might never have seen the bystander video of George Floyd pinned under the knee of a Minneapolis police officer, undermining the official account of Floyd’s death. Facebook gives everyone — even a 17-year-old — a printing press. Yes, that is often very good. But on the flip side I think about the Philippines, where Facebook has been weaponized by powerful people to vilify and harass their enemies, and where the social network has contributed to a poisoned atmosphere in which even basic facts are in doubt. It is in poorer countries without strong democratic institutions where the good but also the harm of Facebook has been magnified. Facebook has acknowledged that is has been slow to act in some countries and has more work to do to stop harmful abuses of its hangouts. But Zuckerberg’s mathematical equation — the good outweighs the bad — is too simplistic. Every time I think something positive about Facebook, I also hold in my mind the profound damage the company has done — and that too should be an indelible part of Zuckerberg’s legacy. I am grappling with this again now because on Monday a court in Manila convicted a prominent journalist in the Philippines, Maria Ressa, and a former colleague of cyber libel. Thanks for reading The Times. Subscribe to The Times Ressa and her defenders have said the legal case was an effort to silence news publications like Rappler, which she co-founded, that have been critical of President Rodrigo Duterte and his war on drugs that has left thousands of people dead and disappeared. Davey Alba, my New York Times colleague, wrote a must-read article two years ago about the ways that Duterte and his allies employed Facebook to build a large base of supporters, smear opponents like Ressa and spread hoaxes. Davey explained to me that Facebook gave Duterte the means to disseminate his message quickly and broadly. And the company’s computer-rigged system that is programmed to circulate the most engaging (and often divisive) material lined up perfectly with the fear, outrage and anger that fueled Duterte’s political campaign and then his presidency. There were violent world leaders before Facebook, but as in other countries, the social network and an authoritarian were a match. Ressa used Facebook to build an audience for her fledgling news organization. But she and other Rappler staff were also targeted on Facebook, and the news outlet devoted its time and resources to combat false information there. As an official Facebook partner, Rappler was tasked by Facebook to protect the Philippines from the worst of Facebook. Alone, the Philippines shows the worst side of Facebook. But this is not an isolated case. In Myanmar, Sri Lanka and beyond, there’s a repeated pattern of Facebook’s system rewarding the most outrageous or fear-mongering messages with more distribution, to grave consequence. And Facebook fails to address warnings about the abuses happening under its nose. Yes, we want and need to bear witness to police brutality videos. But we shouldn’t accept a genocide in Myanmar or the targeting of a journalist in the Philippines in exchange for it. [...]

June 16, 2020

Re: [nexa] Città intelligenti, Cittadini sorvegliati.

by Roberto Resoli

Il 16/06/20 12:06, Giacomo Tesio ha scritto: > Grazie mille Roberto. > > Anche il link alla traduzione risultava troncato. > > Immagino che fosse guesto: > https://www.resolutions.it/nextcloud/index.php/s/rRDqkfQ7okNe3Ab > > > Giacomo Si, grazie Giacomo. rob

June 16, 2020

Re: [nexa] Città intelligenti, Cittadini sorvegliati.

by Giacomo Tesio

Grazie mille Roberto. Anche il link alla traduzione risultava troncato. Immagino che fosse guesto: https://www.resolutions.it/nextcloud/index.php/s/rRDqkfQ7okNe3Ab Giacomo

June 16, 2020

Immuni: “Se le prove di efficacia non arrivano dall’alto, lanciamo una ricerca dal basso”

by Giacomo Tesio

Oggi lunedì 15 Giugno il servizio dell’app immuni viene attivato su tutto il territorio nazionale. Ciò accade dopo un periodo di rodaggio, forse troppo ambiziosamente denominato di sperimentazione, che si è svolto in 4 regioni ed è durato appena una settimana: abbastanza per comprendere i principali problemi di compatibilità con dispositivi vecchi o non aggiornati (si pensi al problema riguardo ai dispositivi Huawei e Honor e a tutti i modelli più vecchi di 5 anni) e per intercettare i principali problemi di usabilità e sicurezza su tutte le tipologie di utente (dal luser all’hacker); decisamente troppo poco per raccogliere, e soprattutto analizzare, dati dirimenti sulla efficacia dell’app. Ovviamente non pensiamo che questi dati (più avanti diremo quali possono servire) non siano raccolti dai gestori del servizio; ma riteniamo che non condividerli con ricercatori indipendenti limiti di molto il dibattito sull’utilità di uno strumento che richiede comunque un importante dispiego di forze da parte di strutture pubbliche. È inoltre probabile che la campagna di comunicazione e promozione dell’uso di questo strumento si farà ingente nei prossimi giorni, anche per quel fenomeno che Nardelli ha denominato “fatequalcosite” e che riguarda i tentativi più o meno fondati su evidenze scientifiche che sono messi in atto dai decisori politici per dimostrare che stanno facendo qualcosa per gestire adeguatamente l’emergenza. Ma proprio perché l’eco mediatico su questa app raggiungerà il suo culmine nei prossimi giorni, di seguito vogliamo cercare di capire quali sono gli elementi ancora poco chiari di questa strategia. [...] Questa configurazione, anche se “è stata adottata per ridurre al minimo i falsi positivi” pone un rischio di privacy che non è di livello tecnico –livello riguardo cui l’app immuni è effettivamente un ottimo prodotto come anche certificato da diverse fonti, ma sostanziale: infatti, per poter stimare il periodo di incubazione e quindi la durata dell’eventuale quarantena, l’app notifica all’utente a rischio anche il giorno in cui il potenziale contatto infettivo avrebbe avuto luogo; a seconda della intensità della loro vita sociale, questa semplice indicazione potrebbe permettere agli utenti di ricostruire chi sia stata la persona con cui si siano intrattenuti in un contatto ravvicinato così prolungato, alimentando così sospetti su un aspetto molto delicato (un tempo definito sensibile) relativo alla salute di colleghi e conoscenti. [...] anche quando parliamo con una persona per più di 15 minuti, la app potrebbe considerarci più lontani di quanto siamo effettivamente stati se la borsa, tasca o zaino in cui anche uno solo dei due avesse tenuto il proprio cellulare avesse attenuato il segnale in maniera importante, come se fossimo stati a decine di metri di distanza a campo libero. [...] Eppure, si potrebbe obiettare, male che vada immuni non serve, ma male non può fare. Non è esattamente così [...] Continua su https://www.key4biz.it/immuni-federico-cabitza-univ-milano-bicocca-se-le-pr… Giacomo

June 16, 2020

Re: [nexa] Amazon’s Ring has 29 new police agreements since the killing of George Floyd

by Roberto Resoli

Il 15/06/20 19:41, J.C. DE MARTIN ha scritto: > > Amazon’s Ring has 29 new police agreements since the killing of George > Floyd > > > That includes the Crystal Police Department, located several miles > away from the spot where Floyd was killed in Minneapolis. > «Ring di Amazon ha 29 nuovi accordi di polizia dall'uccisione di George Floyd di Emily Birnbaum Ring di Amazon ha annunciato 29 nuove collaborazioni con i dipartimenti di polizia dopo l'uccisione di George Floyd il 25 maggio, come dimostrano documenti pubblici, attirando le accuse di ipocrisia da attivisti che affermano che il lavoro di Amazon per conto delle forze dell'ordine è antitetico al suo dichiarato sostegno al movimento Black Lives Matter. Gli attivisti e i ricercatori hanno offerto un plauso silenzioso ad Amazon questa settimana, dopo che la compagnia ha annunciato che non venderà la sua controversa tecnologia di riconoscimento facciale ai dipartimenti di polizia per un anno, rispondendo alla crescente pressione sulle aziende tecnologiche per tagliare certi legami con le forze dell'ordine in mezzo a una valutazione a livello nazionale sulla brutalità della polizia e la disuguaglianza razziale. L'amministratore delegato di Amazon, Jeff Bezos, ha dichiarato di essere "felice di perdere" i clienti che non sostengono Black Lives Matter. Ma Amazon sta affrontando un nuovo scrutinio sul suo lavoro in rapida espansione con le forze di polizia tramite Ring, la società di sorveglianza e campanelli casalinghi di proprietà di Amazon, che ha lavorato per anni per farsi conoscere come amica delle forze dell'ordine. Gli attivisti dei diritti civili dicono che Ring, e il social network Neighbors che lo accompagna, permette di sorvegliare e di prendere di mira i neri in modo sproporzionato. Permette inoltre alla polizia di accedere a grandi quantità di filmati video, a patto che gli utenti di Ring diano loro il permesso. Secondo i dati pubblicati attraverso la mappa "active agency" di Ring, nelle ultime settimane Ring ha stretto collaborazioni con i dipartimenti di polizia e gli uffici dello sceriffo di almeno 20 stati - incluso il Crystal Police Department, situato a diverse miglia di distanza dal luogo in cui Floyd è stato ucciso a Minneapolis. La società ha anche annunciato un contratto con il Dipartimento di Polizia di Las Cruces nel New Mexico, dove un ufficiale di polizia è accusato di omicidio colposo involontario dopo aver immobilizzato bloccando il collo un uomo di nome Antonio Valenzuela durante un arresto di febbraio. I funzionari di Ring non hanno risposto immediatamente venerdì a una richiesta di commento. In una lettera al Congresso dello scorso anno, il principale lobbista di Amazon, Brian Huseman, ha detto che l'obiettivo di Ring è quello di aiutare le persone a "proteggere le loro case e le loro comunità". "Stiamo assistendo a un cambiamento radicale in ciò che è possibile fare quando si tratta di polizia e giustizia razziale", ha detto Maurice Weeks, co-direttore esecutivo dell'Action Center on Race and the Economy, che sostiene la giustizia razziale e la responsabilità di Wall Street. "Amazon, d'altra parte, sta solo facendo dei piccoli passi". Ring, che mantiene partnership con più di 1.300 dipartimenti di polizia, incoraggia i suoi utenti a condividere con i dipartimenti di polizia e con l'app dei vicini le riprese video "preoccupanti" catturate attraverso i loro campanelli. Ring ha spesso offerto gratuitamente i suoi sistemi di sorveglianza dei campanelli ai dipartimenti di polizia, incoraggiandoli a diffondere la tecnologia attraverso le loro comunità locali. Nelle segnalazioni è emerso che molti degli incidenti che gli utenti riferiscono come "sospetti" coinvolgono persone di colore, e su questo gli esperti di libertà civili hanno lanciato l'allarme. "Molti dei luoghi in cui Ring ha contratti ... sono aree di gentrificazione, luoghi in cui i bianchi stanno entrando, e poi non si sentono a loro agio perché c'è gente di colore", ha detto Brandon Forester, un organizzatore con l'organizzazione di difesa dei diritti digitali MediaJustice. Gruppi come MediaJustice e Athena, una coalizione anti-Amazon, dicono che la società dovrebbe tagliare i legami con le forze dell'ordine per sostenere il movimento Black Lives Matter con l'azione. Nel frattempo, la Electronic Frontier Foundation, un gruppo per la privacy, sta facendo circolare una petizione che chiede ad Amazon Ring di porre fine alle sue collaborazioni con la polizia, aumentando la possibilità che le telecamere del Ring possano essere usate per sorvegliare le proteste in tutto il paese. "Alla luce della recente dichiarazione di Amazon che condanna la violenza della polizia, vi chiediamo di seguire i vostri sentimenti e di porre fine alle preoccupanti e pericolose collaborazioni del Ring con le forze dell'ordine", si legge nella petizione. "Queste collaborazioni mettono i membri della comunità e il pubblico in generale a rischio di profilazione razziale, di eccesso di polizia e di potenziale violenza". Ring finora non ha fatto alcuna dichiarazione pubblica in risposta alle proteste della Black Lives Matter o alle crescenti critiche sulla sua tecnologia.» > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa >

June 16, 2020