March 2021 - nexa - server-nexa.polito.it

Europe’s Intelligence Services Aim to Avoid the EU’s Highest Court
by Giovanni Biscuolo March 11, 2021

March 11, 2021

Buongiorno, Schrems II ciao ciao!?! https://www.lawfareblog.com/how-europes-intelligence-services-aim-avoid-eus… --8<---------------cut here---------------start------------->8--- How Europe’s Intelligence Services Aim to Avoid the EU’s Highest Court—and What It Means for the United States By Theodore Christakis, Kenneth Propp Monday, March 8, 2021, 3:01 PM [...] In the fall of 2020, the court softened that bitter pill when, for the first time, it also imposed limits on EU member states’ intelligence services’ own data collection and retention activities. But now the member state governments have struck back against the Luxembourg-based court, quietly slipping into their version of the EU’s ePrivacy legislative reform proposal a provision that would put these contested national security activities beyond the court’s reach. The U.S. government is already [on record] as objecting to what it perceives as a laxer data protection standard being applied by European courts to their own national intelligence services. This latest move in Brussels has only accentuated the sense of a disparity in treatment. This post explores the ongoing struggle within the European Union to delimit the national security exception in its data protection law for the activities of member state intelligence services, and the corresponding impact this Brussels debate could have on the ongoing transatlantic negotiations to restore a secure basis for commercial data transfers from the European Union to the United States. [...] Conclusion The Council of the European Union’s action in the ePrivacy saga has revealed that many EU member states were so deeply uncomfortable with the evolution of CJEU jurisprudence on surveillance, that they decided to do something radical about it. They acted to interpose a broad national security exception in the ePrivacy regulation because they saw it as the only way to preserve freedom of action in the areas of data collection and retention for their intelligence agencies. France also recently has taken a unilateral [additional action] in order to escape the data retention case law of the CJEU: It asked the country’s highest administrative court—the Council of State—to ignore the CJEU ruling in the LQDN case. French government lawyers contend that the CJEU acted outside its scope (ultra vires) by usurping for the EU an important “sovereign” competence—national security and protection of public order—that member states had never transferred to it. In effect, the French government’s concern about the CJEU’s intrusion into its intelligence and law enforcement activities is so great that it has asked its highest court to choose between an EU member state’s duty to respect, as a matter of principle, the jurisprudence of the CJEU and its own interpretation of its core constitutional prerogatives. The United States, by contrast, can make no comparable Houdini-like escape from the Schrems II judgment. EU law provides no national security exemption that may be invoked on behalf of third-state intelligence services. The United States, as well as other third countries, will remain under the close scrutiny of the CJEU in Schrems-like cases addressing their “adequacy” and “essential equivalence.” Similarly, while national data protection authorities in Europe have no basis in EU law to sanction a company responding to an EU member state request for data on national security grounds, they will be able to heavily fine companies transferring data to the United States, on the basis that U.S. national security laws do not meet the Schrems II and the European Data Protection Board’s restrictive surveillance standards. There can be little doubt that the NSA’s counterparts in European capitals sympathize with its uncomfortable position. After all, these European agencies richly benefit from U.S. intelligence in combating terrorism and other national security threats, and would be loath to lose such a valuable source. One also can presume that Washington is encouraging EU member state governments to bring the same level of appreciation of surveillance interests to the international negotiations for a successor to the Privacy Shield that they brought to their own Brussels deliberations on the ePrivacy regulation. In both contexts, governments are weighing traditional national security surveillance prerogatives against an increasing and insistent “judicialization” of the fundamental right to data protection in all settings. The situation is in flux both within the European Union and in transatlantic relations. If there is an eventual balance that excludes from the scrutiny of the CJEU the data retention laws and practices of European national security services, but not those of their U.S. counterpart, it might well be unstable. Whether and how U.S. and European diplomats can deliver their governments from this unsustainable situation remains to be seen. [on record] <https://www.privacyshield.gov/servlet/servlet.FileDownload?file=015t0000000…> [additional action] <https://www.politico.eu/article/france-data-retention-bypass-eu-top-court/> --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni -- Giovanni Biscuolo

1 0

CISPE Code of Conduct Certification vs GDPR
by Giovanni Biscuolo March 11, 2021

March 11, 2021

Buongiorno, non mi pare di aver trovato notizie del CISPE in lista. --8<---------------cut here---------------start------------->8--- CISPE (Cloud Infrastructure Services Providers in Europe) is a non-profit trade association for infrastructure as a service (IaaS) cloud providers in Europe. It was started to aid IaaS providers in explaining their business model to policymakers. [...] The association aims to advocate for an EU-wide cloud-first public procurement policy and engage for a European Digital Single Market including the promotion of high-level security and data protection rules/standards as well as avoiding vendor lock-in. In June 2020, the association became one the 22 founding members of GAIA-X --8<---------------cut here---------------end--------------->8--- CISPE promuove un registro pubblico https://cispe.cloud/publicregister/ di fornitori certificati (o autocertificati) con il loro... Codice di Condotta... olè! Guardando tra i fornitori **certificati** troviamo Amazon con diversi servizi AWS dagli USA... e Tencent Cloud Computing dalla Cina. Mumble mumble, ma davvero?!? Nella pagina del codice di condotta https://cispe.cloud/code-of-conduct/ dicono: --8<---------------cut here---------------start------------->8--- CISPE’s Code of Conduct for data protection anticipates the enforcement of the European Union’s General Data Protection Regulation (GDPR). On March 2017 the CISPE Code of Conduct was submitted for review and approval by the European Data Protection Board (EDPB). This review is currently underway by the EDPB. --8<---------------cut here---------------end--------------->8--- Il Code of Conduct è del Marzo 2017, non riesco a trovare se EDPB ne frattempo abbia commentato qualcosa. Trovo però che CISPE sollecita EDPB: --8<---------------cut here---------------start------------->8--- the adoption of a clear and simple approval procedure as well as greater clarity over the timeline necessary to obtain such approval. CISPE therefore asks the European Data Protection Board to facilitate efficient coordination between Data Protection Authorities so that Codes of Conduct will be approved under transparent and fixed timelines. --8<---------------cut here---------------end--------------->8--- (tratto da https://cispe.cloud/website_cispe/wp-content/uploads/2019/04/190402-CISPE-r…) Io già intravedo l'implementazione del GDPR attraverso certificazioni a fronte di Code of Conduct dove i fornitori se la cantano e se la suonano :-O Oppure il CISPE è un tentativo innocuo di annacquare il GDPR che non trova sponde nella commissione e nel EDPB? Saluti, Giovanni -- Giovanni Biscuolo

1 0

Going from bad to worse: from Internet voting to blockchain voting
by Giacomo Tesio March 11, 2021

March 11, 2021

Voters are understandably concerned about election security. News reports of possible election interference by foreign powers, of unauthorized voting, of voter disenfranchisement, and of technological failures call into question the integrity of elections worldwide. This article examines the suggestions that “voting over the Internet” or “voting on the blockchain” would increase election security, and finds such claims to be wanting and misleading. While current election systems are far from perfect, Internet- and blockchain-based voting would greatly increase the risk of undetectable, nation-scale election failures. Online voting may seem appealing: voting from a computer or smartphone may seem convenient and accessible. However, studies have been inconclusive, showing that online voting may have little to no effect on turnout in practice, and it may even increase disenfranchisement. More importantly, given the current state of computer security, any turnout increase derived from Internet- or blockchain-based voting would come at the cost of losing meaningful assurance that votes have been counted as they were cast, and not undetectably altered or discarded. This state of affairs will continue as long as standard tactics such as malware, zero day, and denial-of-service attacks continue to be effective. This article analyzes and systematizes prior research on the security risks of online and electronic voting, and shows that not only do these risks persist in blockchain-based voting systems, but blockchains may introduce ‘additional’ problems for voting systems. Finally, we suggest questions for critically assessing security risks of new voting system proposals. [...] # Critical questions This section provides a list of worthwhile questions that should be asked about any future online or blockchain-based election system proposal in order to better understand its security implications, before considering its adoption for high-stakes elections. Much of this list is inspired by previous examples of failures in Internet voting schemes [15, 20, 54, 56, 100], questions asked by experts involving past blockchain-based systems [7], as well as the survey of open problems E2E-V systems by Bernhard et al. [101]. This list is not intended to be comprehensive, as a short article like this cannot provide a complete guide to all of the issues that might be raised about “voting on the blockchain,” or electronic-only voting as a whole. First, the questions raised here relate to voting system security, rather than other important aspects of voting systems (e.g., usability, cost, accessibility, etc.). Second, security cannot be achieved simply by “passing a checklist” — even given good answers to all of the questions here, a system could still be insecure. However, a good set of questions illuminates gaps in reasoning, poor assumptions, and implementation problems. We believe that satisfactory answers to these questions are a worthwhile demand: a valuable starting point to evaluate voting system proposals, and a basic level of transparency to which the public is entitled. Continua, proponendo alcune OTTIME domande, su https://academic.oup.com/cybersecurity/article/7/1/tyaa025/6137886 Giacomo

2 1

Federal Reserve interbank payment system suffers outage
by Giovanni Biscuolo March 11, 2021

March 11, 2021

Buongiorno, curioso che alcune notizie di "disservizi digitali" passino quasi inosservate mentre altre facciano molto rumore (a volte per nulla). https://www.datacenterdynamics.com/en/news/federal-reserve-interbank-paymen… --8<---------------cut here---------------start------------->8--- Federal Reserve interbank payment system suffers outage, disrupting crucial piece of US economy Delaying hundreds of billions of dollars in transactions February 25, 2021 By Sebastian Moss "Our technical teams have determined that the cause is a Federal Reserve operational error," the Fed said in a statement. "We acknowledge that payment deadlines are impacted and will communicate remediation efforts to our customers when available. Thank you for your patience while we work to resolve the issue.” The glitch is not thought to be due to a cyber attack. "Let's work together to ensure we have a faster, more reliable way to send payments," Senator Cynthia Lummis said [on Twitter]. Following the September 11 attacks, the Federal Reserve has taken a more active interest in maintaining the uptime of the financial system. In 2003, it created an undisclosed list of the biggest and most influential financial institutions, which it told to beef up their data center redundancy. The companies and organizations were told to ensure that primary and backup facilities were on different grid and water systems, and followed numerous other resiliency best practices. In 2019, with much of the financial sector moving to the cloud - and in particular, moving to one cloud vendor - [the Federal Reserve conducted a formal examination of an Amazon Web Services data center] in Virginia. The examination focused on Amazon’s resiliency and backup systems, and is thought to be the first of several visits to cloud facilities. A single outage, caused by software or hardware issues, can still cripple key parts of the US economy. In 2019, [a fire at a Wells Fargo data center] meant that customers could not access ATMs, or their online and mobile banking accounts. [on Twitter] <https://twitter.com/SenLummis/status/1364665835558760453> [the Federal Reserve conducted a formal examination of an Amazon Web Services data center] <https://www.datacenterdynamics.com/en/news/us-federal-reserve-conducted-for…> [a fire at a Wells Fargo data center] <https://www.datacenterdynamics.com/en/news/widespread-wells-fargo-outage-bl…> --8<---------------cut here---------------end--------------->8--- Anche su: https://arstechnica.com/tech-policy/2021/02/fed-outage-shuts-down-us-paymen… --8<---------------cut here---------------start------------->8--- The Fed urged banks to double-check that any transactions they submitted in recent hours had actually gone through. --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni -- Giovanni Biscuolo

1 0

infrastrutture e data center, prima o poi un disastro arriva?
by Giovanni Biscuolo March 11, 2021

March 11, 2021

Buongiorno, nelle mie ricerche a seguito della segnalazione di questa mattina dell'incendio al data center di Strasburgo di OVH sono "inciampato" in notizie di incidenti analoghi. Questi incidenti ci richiamano bruscamente a fare i conti con la **realtà fisica** "del cloud" (squali compresi, quelli che stanno davvero negli oceani); perché da qualche parte "il ferro", gli impianti (impianto elettrico, sistemi UPS, raffreddamento, regolazione accesso fisico, ecc.), la connessione e l'energia qualcuno li deve pur fornire, gestire e manutenere. Tanta roba. Se conoscete altri siti specializzato o altre storie analoghe le condividete per favore? 0. https://www.datacenterdynamics.com/en/news/?term=outages Basta farsi un giro per comprendere come il disastro OVH faccia impressione ma... sono in buona compagnia. Molte storie interessanti, tipo quella del roditore che ha interrotto la connessione Internet a 1000 utenti di West Auckland :-) 1. Varie storie di incendi: https://www.datacenterdynamics.com/en/tags/fire/ 2. Azure Cloud in Japan suffers after UPS failure, cooling outage (April 03, 2017) Data center gets hot and bothered, causing services to shut down https://www.datacenterdynamics.com/en/news/azure-cloud-in-japan-suffers-aft… 3. OVH to Disassemble Container Data Centers after Epic Outage in Europe (2017) https://www.datacenterknowledge.com/uptime/ovh-disassemble-container-data-c… 4. Data Center Disasters You'll Never See Coming, https://www.informationweek.com/cloud/7-data-center-disasters-youll-never-s… (attenzione l'articolo è suddiviso in 9 paginate... uff) Ogni storia è emblematica e coinvolge sia attori pubblici che privati, alcuni anche famosi. Molto curiosa la storia (la quinta) del generatore di emergenza al 18mo piano con la pompa del carburante situata **nel seminterrato** e quindi finita sott'acqua e di come sono riusciti a rimettere in pista il generatore di emergenza. Ma l'evento che ignoravo (ah beata ignoranza) è il Carrington Event [1] del 1859 che (oltre allo spettacolo delle aurore boreali a latitudini improbabili) arrestò (non ho capito per quanto) il sistema di comunicazioni via telegrafo --8<---------------cut here---------------start------------->8--- Earth would have been in the line of fire, Daniel Baker of the University of Colorado told NASA Science News in 2014. The flare's effects would have struck the earth's atmosphere, leading to heavy and unexpected voltage surges in electrical lines. You might consider such a hazard as being extremely remote, but in 1859 a solar flare's disturbance known as the Carrington Event hit the earth and produced such large voltages that the wiring of telegraph offices sparked out of control, setting some offices on fire. --8<---------------cut here---------------end--------------->8--- Dopo il covid-19 ci manca soltanto la tempesta solare perfetta... :-O Saluti, Giovanni -- Giovanni Biscuolo

2 1

SPID e Google Authenticator : Quando l'interoperabilità viene ostacolata di proposito
by Giacomo Tesio March 11, 2021

March 11, 2021

La maggior parte dei provider SPID supporta l’autenticazione a due fattori tramite un’app che genera codici OTP. Ogni provider ha la propria app, incompatibile con le app degli altri provider e con quelle “universali” [...] Peccato che, dietro le quinte, tutte le app usino lo stesso algoritmo e che l’incompatibilità sia puramente artificiale. In questo post analizzo le app per Android di alcuni provider SPID. Con del reverse engineering ottengo i parametri necessari per la generazione dei codici OTP, e li uso per configurare un generatore di codici universale Continua con un bell'esempio di reverse enginering accessibile a tutti, su https://blog.jacopo.io/it/post/spid-google-authenticator/ Due considerazioni personali a margine: - l'interoperabilità in questo caso potrebbe porre un oggettivo rischio di sicurezza per gli utenti, che potrebbero involontariamente diffondere un segreto non facile da modificare - MAI installare App come Google Autheticator che, oltre ad avere accesso a dati estremamente sensibili richiede, fra gli altri i permessi di "full network access", "view network connections" e "use accounts on the device". Cosa mai può andare storto? Giacomo

1 0

Avvenire: "L'allarme di Lassègue e Garapon. «Attenti, si va verso un regime digitale»"
by J.C. DE MARTIN March 10, 2021

March 10, 2021

*L'allarme di Lassègue e Garapon. «Attenti, si va verso un regime digitale» */Il filosofo e il magistrato francesi: «Stiamo galoppando verso democrazie governate dagli algoritmi e da scelte anzitutto economiciste. A pagare saranno i meno “alfabetizzati” nelle tecnologie»/ Simone Paliaga mercoledì 10 marzo 2021 https://www.avvenire.it/agora/pagine/attenti-si-va-verso-un-regime-digitale

2 2

"Tempi difficili" (13 marzo - 5 giugno)
by J.C. DE MARTIN March 10, 2021

March 10, 2021

Mi permetto di segnalare "Tempi difficili", un percorso interdisciplinare in 11 tappe offerto dal Politecnico di Torino per provare a orientarsi nella pandemia in corso: www.polito.it/tempidifficili Dal 13 maggio al 5 giugno tutti i sabati (tranne Pasqua e 1° maggio) alle ore 16, per circa un'ora. Nel corso della lezione dell'8 maggio cercherò di dare qualche elemento su tecnologie digitali e pandemia. jc

1 0

HAI: Artificial Intelligence Index Report 2021
by don Luca Peyron March 10, 2021

March 10, 2021

The 2021 AI Index report is one of the most comprehensive reports about artificial intelligence to date. This latest edition significantly expands the amount of data available in the report, which was drawn from a broader set of academic, private, and non-profit organizations for calibration. The report also shows the effect of COVID-19 on AI development from multiple perspectives, including how AI helps with COVID-related drug discovery and the effect of the pandemic on hiring and private investment. https://aiindex.stanford.edu/wp-content/uploads/2021/03/2021-AI-Index-Repor… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1

Allan McDonald, Who Refused To Approve Shuttle Challenger Launch, Dead At 83 : NPR
by J.C. DE MARTIN March 9, 2021

March 9, 2021

Scusate se non riguarda il digitale, ma credo sia una storia che sia utile continuare a tenere presente parlando, come si fa anche in questa sede, di responsabilità etica dei “tecnici”. jc https://www.npr.org/2021/03/07/974534021/remembering-allan-mcdonald-he-refu… (Sent from my wireless device; please excuse brevity and typos (if any))

3 3