July 2020 - nexa - server-nexa.polito.it

The great coronavirus-tracing apps mystery

by Giacomo Tesio

Germany's Corona-Warn-App was rolled out nationwide in June. A few days ago, the Robert Koch Institute provided an update on its progress, celebrating the fact that it had now been installed by around 16 million people. "A successful start that speaks for great interest and acceptance among the population," a statement from the app's developer said. Bear in mind, however, that there are 83 million Germans, and it is thought more than half of the population need to have an app before it is truly effective. "The app works" added the institute's president Prof Lothar Wieler. He went on to say that about 500 app users had tested positive for the virus and "had the opportunity to warn others via the app". But he then said: "We cannot say exactly how many people were warned, because of the decentralised approach of the app." In other words, we do not know whether the software is performing its key function. To know how well your app is performing, it is also vital to understand whether it is producing a lot of false positives or false negatives - in bald terms, whether the software is failing to alert people who have been in close contact with an infected user, and sending warnings to those who haven't. That's important to know, because studies have indicated that Bluetooth is an unreliable way to determine the distance between two people in some common situations. The Robert Koch Institute (RKI) told us it too didn't know because, once again, the log history it would need to tap into "remains with the users, encrypted on their smartphones". We wondered as a workaround whether Germany's manual contact tracers might provide RKI with a record of people who had come to their attention after being alerted by the app. No, came the answer. Local municipalities run manual contact tracing and do not share this information. RKI added that it hoped scientific tests would eventually assess the app's impact in the "medium to long term", but had yet to work out how this would be achieved. Switzerland faces the same issue. Continua con una disanima dei non-successi nei diversi stati su https://www.bbc.com/news/technology-53485569 Io non posso che ammirare l'acume dietro Google ed Apple. Sono riusciti a deployare su milioni di cellulari un framework che non solo non può funzionare, ma la cui inefficacia non può essere dimostrata per ragioni tecniche ed etiche: quanti contagi dovremmo causare in laboratorio ed in quanti scenari diversi per verificare che le previsioni di rischio sono completamente campate in aria? E, capolavoro nel capolavoro, se la gente lo attiva e qualcosa va storto, la colpa sarà dei governi, mentre se nessuno lo attiva, la colpa sarà della popolazione ignorante e malfidata. Giacomo

July 22, 2020

Major Security Flaws Found in South Korea Quarantine App

by Giacomo Tesio

In April, South Korea began requiring all visitors and residents arriving from abroad to isolate themselves for two weeks. To monitor compliance, they had to install an app whose name in Korean means Self-Quarantine Safety Protection. As of last month, more than 162,000 people had downloaded the app, which tracks users’ locations to ensure they remain in designated quarantine areas. Violators might be required to wear tracking wristbands or pay steep fines. In May, Mr. Rechtenstein returned to his home in Seoul from a trip abroad. While self-isolating at home, he became curious about the government’s seemingly simple app and what extra features it might have. That prompted Mr. Rechtenstein to peek under the hood of the code, which is how he discovered several major security flaws. He found that the software’s developers were assigning users ID numbers that were easily guessable. After guessing a person’s credentials, a hacker could have retrieved the information provided upon registration, including name, date of birth, sex, nationality, address, phone number, real-time location and medical symptoms. Mr. Rechtenstein also found that the developers were using an insecure method to scramble, or encrypt, the app’s communications with the server where data was stored. Instead of HTTPS, the security standard used by apps like Gmail and Twitter, the app used an encryption key written directly into its code. Doing so meant hackers could easily find the key and decode the data if they had tried. It also meant the key did not change depending on the message being sent or on the user sending it. The key was also far from random: It was “1234567890123456.” [...] Over time, the government also asked Mr. Jung’s team to add surveillance functions to the app, which officials said increased their workload and prevented them from spending time hunting for security flaws. [...] “We were simply overwhelmed with work,” said Koo Chang-kyu, a South Korean official. Continua su https://www.nytimes.com/2020/07/21/technology/korea-coronavirus-app-securit… (best viewed without JavaScript ;-) Giacomo

July 21, 2020

Sulla didattica a distanza

by don Luca Peyron

"Altro che web, abbiamo perso un anno". Il prof filosofo: scuola vittima della pandemia" parla il presidente di Alma Laurea Buona lettura dl https://www.quotidiano.net/politica/altro-che-web-abbiamo-perso-un-anno-il-… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

July 21, 2020

Microsoft accused of sharing data of Office 365 business subscribers with Facebook and its app devs

by Giacomo Tesio

Microsoft is being sued for allegedly sharing its Office 365 customers' business data with Facebook app developers, partners, and subcontractors in violation of its data privacy promises. The lawsuit was filed in US District Court in San Francisco, on behalf of plaintiffs Frank Russo, Koonan Litigation Consulting, and Sumner Davenport & Associates, all Office 365 customers. The complaint says that – while Microsoft has repeatedly promised its business customers that it would only use their data to provide purchased services, that it would share their data with subcontractors only on a need-to-know basis, and that it will never share their data with third-parties – those claims are false. "In fact, contrary to its representations, Microsoft has regularly shared – and continues to share – its business customers' data with Facebook and other third parties," the complaint says. "The data is shared even when neither the customers nor their contacts are Facebook users." [...] In particular, the plaintiffs claim that Microsoft automatically shares customers' business contacts with Facebook, without consent, whether or not the customers or their contacts are Facebook users. "Even if a customer discovers and disables this Facebook-sharing 'feature' after activating Office 365 or Exchange Online services, the damage has already been done," [...] "At that point, the business customer’s contacts have been shared with Facebook. As Microsoft explains in an obscure technical instruction, '[o]nce contacts are transferred to Facebook, they cannot be deleted from Facebook's systems except by Facebook.'" Continua su https://www.theregister.com/2020/07/20/microsoft_office_data_facebook/ Giacomo

July 21, 2020

Report: CIA received more offensive hacking powers in 2018

by Giacomo Tesio

US President Donald Trump gave broad powers to the Central Intelligence Agency (CIA) in 2018 to carry out offensive cyber operations across the globe. In an exclusive today, Yahoo News reported that the agency used its newly acquired powers to orchestrate "at least a dozen operations" across the world. [..] NSC oversight previously kept US intelligence agencies like the CIA in check when it came to orchestrating and approving cyber operations on foreign ground, making sure agencies like the NSA and CIA went through a due process that would sometime take years from the planning to the execution phase. However, Yahoo News sources said that some intelligence officials were ecstatic at Trump's decision, calling it "a needed reform" in order to make the CIA more agile and speed up response times to foreign attacks. The locations of these foreign CIA cyber operations are currently classified, along with operational details, but former US officials who have seen the presidential finding said the document listed Russia, China, Iran, and North Korea as targets, but also left the door open for the CIA to carry out operations in other countries at its discretion. https://www.zdnet.com/article/report-cia-received-more-offensive-hacking-po…

July 20, 2020

Report: "Digital Trade Rules"

by J.C. DE MARTIN

*Digital Trade Rules* / //Jul 8th, 2020// // //Deborah James/ A disastrous new constitution for the global economy written by and for Big Tech The largest corporations in the history of the world – Amazon, Facebook, Google, Apple, and Microsoft – are seeking to use ‘trade’ rules to rig the rules of the global (digital) economy to enable them to collect more data, exercise more control over our lives and their workers, and amass ever more profit. More than 80 members of the World Trade Organization (WTO) are currently negotiating a new agreement on digital trade based on these proposals. This paper seeks to explain how these corporations operate in order to achieve their goals; what the potential impacts of the rules would be on workers, citizens, communities, developing countries, public services, safety and security, and democracy itself; what the alternatives are; and what we can do to stop this mass corporate takeover. This paper was written towards the end of 2019. Today, in 2020, the world seems a different place, as we collectively experience the coronavirus crisis and new awareness about issues of racism and policy brutality. The crises have brought about new, and highlighted existing, urgent problems – often exacerbated by Big Tech’s iron grip on our economic and social lives. *Emerging challenges in 2020* The WTO itself is in serious crisis. The 12th WTO Ministerial Conference was due to be held in June 2020, but has been postponed – possibly for another year. WTO Director-General Roberto Azevêdo has said he will step down on 31 August 2020, a year before the completion of his term of office. The United States is still blocking the appointment of new Appellate Body Members to the WTO, which means the judicial function is not operational. At the same time, many countries have had to take measures to deal with the coronavirus that are inconsistent with their WTO obligations. This is leading to a re-thinking of whether the WTO model – which left many countries short on domestic productive capacity and locked in rules that put foreign corporate rights over the domestic public health emergency – are really fit for purpose. Thus, there is a need for countries to have greater flexibility to depart from existing trade rules. This could well lead to a fundamental re-think of the WTO and its model of extreme liberalisation – an urgent and welcome outcome. Online commerce is booming, but many technology start-ups and thousands of small businesses have been hit hard by the coronavirus economic shutdowns. On the contrary, Facebook, Google, and Amazon have seen their market shares and profits explode during the crisis. At the same time, there is growing concern about the control that Big Tech exerts over so many aspects of public life, especially through anti-competitive behaviour. Members of the US Congress and several federal agencies have joined European Union leaders in growing calls to break up vertically integrated roll-up corporations like Amazon, Google and Facebook. A key provision of US tech policy which shields platforms from liability is coming under political scrutiny in the United States. As science deniers circulated inaccurate information about COVID-19 on social media, some tech corporations began to take steps to remove or flag erroneous content from their platforms. The Trump administration claimed a political bias, and Republicans are looking into rescinding the platforms’ immunity. At the same time, Democrats are concerned about some of the platforms’ policies of not taking down false or misleading political advertising that could jeopardise our elections. There is growing recognition on the part of many countries that digital corporations should pay their fair share of taxes. The EU is proposing this as a fiscal support measure in the wake of the crisis, but the Trump administration has just abandoned the efforts towards a multilateral solution at the Organisation for Economic Cooperation and Development (OECD). Dependence on essential workers during the coronavirus crisis has also led to a greater understanding of the need for hazard pay and social protections, especially in sectors with sectoral bargaining agreements. But so-called ‘gig’ workers, such as Uber drivers, GrubHub deliverers, and Instacart shoppers, still do not enjoy basic labour rights as workers, not ‘contractors’. In the United States, pressure campaigns have successfully targeted the use of facial recognition software powered by artificial intelligence (AI), since studies have demonstrated the racist impacts of such software: AI gives false positives for blacks more often than for whites. At the same time, WTO members have undertaken multiple rounds of negotiations with a view to drafting a new ‘plurilateral’ agreement on digital trade. They have negotiated draft texts in secret on 13 different provisions on data collection, liability, market access rights, non-discrimination, source code disclosure, taxes, cybersecurity and more – as described in this paper. During these times of crisis, uncertainty, and rapid transformation, we need our governments to be able to respond more proactively to emerging problems. We need public interest concerns about economic rights, racial justice and fairness, and human, civil and political rights to be the focus of conversations about rewriting the rules governing data and technology. To accomplish this, however, we need to ensure that corporations are unable to acquire new WTO ‘trade’ disciplines designed by Big Tech to consolidate their power over our economy and to limit democratic oversight in the public interest. *Read the full text: https://www.rosalux.eu/kontext/controllers/document.php/528.5/c/01b5be.pdf*

July 20, 2020

Hackers Convinced Twitter Employee to Help Them Hijack Accounts

by Giacomo Tesio

A Twitter insider was responsible for a wave of high profile account takeovers on Wednesday, according to leaked screenshots obtained by Motherboard and two sources who took over accounts. On Wednesday, a spike of high profile accounts including those of Joe Biden, Elon Musk, Bill Gates, Barack Obama, Uber, and Apple tweeted cryptocurrency scams in an apparent hack. "We used a rep that literally done all the work for us," one of the sources told Motherboard. The second source added they paid the Twitter insider. [...] The panel is a stark example of the issue of insider data access at tech companies. Whereas in other cases hackers have bribed workers to leverage tools over individual users, in this case the access has led to takeovers of some of the biggest accounts on the social media platform and tweeted bitcoin related scams in an effort to generate income. Continua, con frasi di circostanza da Twitter che però censura chi ne evidenzia i problemi sulla sua piattaforma, su https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-acco… D'altronde, già durante l'attacco sembrava piuttosto ovvio un insider. https://twitter.com/giacomotesio/status/1283519269741920257 Gli hacker, questa volta, hanno voluto farsi notare. E le altre? ;-) La copia dei dati non lascia traccia... Illudersi che la firma di un contratto possa proteggere veramente libertà e democrazia è piuttosto ingenuo. L'unico "privacy shield" efficace nel mondo reale è il controllo fisico e competente dell'hardware che detiene ed elabora i dati degli utenti. Giacomo

July 20, 2020

Re: [nexa] Competenze digitali dei cittadini

by Federico Leva (Nemo)

Apparentemente essere a un livello avanzato comprende: «Sono in grado di utilizzare gli strumenti digitali più appropriati al lavoro (ad es. Dropbox, Google Drive, wiki) per creare con i miei colleghi un depliant e un blog sull’evento.» Federico

July 20, 2020

Reminder | 80° Nexa Lunch Seminar | 22 Luglio 2020

by Nexa Media

Gentilissimi, vi ricordiamo che *mercoledì 22 luglio, dalle ore 13.00 alle ore 14.00*, si svolgerà l'80° Nexa Lunch Seminar, con un incontro dal titolo: **"Bambini e digital literacy, durante e oltre l'emergenza COVID-19"*.* Ospite: /Fabio Nascimbeni//(Fellow Centro Nexa)./ L'incontro si svolgerà in *modalità telematica*, utilizzando il software open source di conference call *Jitsi Meet*. Per chi vorrà partecipare live al seminario sarà possibile accedere alla conference call attraverso il seguente link: https://meet.nexacenter.org/LunchSeminar Maggiori informazioni sull'incontro sono disponibili alla pagina: https://nexa.polito.it/lunch-80 Cordiali saluti,   -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino _web:_ https://nexa.polito.it/ _mail:_anita.botta@polito.it <mailto:anita.botta@polito.it> tel: 011 090 7219

July 20, 2020

Re: [nexa] "Star Critic of Big Tech Has Side Gig Working for Amazon, Apple"

by Stefano Quintarelli

questo e' un grandissimo problema. persone e organizzazioni che hanno rapporti economici con aziende su cui esprimono pareri apparentemente neutrali. anche se i soldi non sono condizionati, il condizionamento (quantomeno psicologico) rimane. un amico contadino una volta mi disse "non potrei mai mangiare una mucca che ho guardato negli occhi"... ciao!, s. On 19/07/2020 08:38, J.C. DE MARTIN wrote: > *Star Critic of Big Tech Has Side Gig Working for Amazon, Apple** > * > By David McLaughlin > > July 17, 2020, 10:00 AM GMT+2 Updated on July 17, 2020, 7:06 PM GMT+2 > > Fiona Scott Morton is widely recognized as a top antitrust expert, known > for her warnings that American tech giants are stifling competition and > innovation. > > Yet Scott Morton, a Yale University economist and former Justice > Department official, is also advising two of the biggest names in tech > -- Amazon.com Inc. and Apple Inc. -- as they confront federal antitrust > investigations. > > She didn’t disclose those relationships in papers she recently > co-authored outlining how the U.S. could bring antitrust cases against > Alphabet Inc.’s Google and Facebook Inc. > > […] > > Continua qui: > https://www.bloomberg.com/news/articles/2020-07-17/amazon-apple-hire-one-of… > > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa > -- reserve your meeting with me at https://cal.quintarelli.it

July 19, 2020