March 2024 - nexa - server-nexa.polito.it

Re: [nexa] SOCIAL MEDIA, AUTHORITARIANISM, AND THE WORLD AS IT IS - MEREDITH WHITTAKER

by Antonio

> From the McCarthy era, to the post-9/11 patriotic frenzy, to the recent wave of bans targeting pro-Palestinian student organizations, there’s a well-worn template that should give us pause before handing any given executive branch the power to force the divestiture of platforms so-designated, as this bill would. Modello "logoro"? Io direi modello efficace per tutte le stagioni. La gente non ha memoria, provate a dire in giro "maccartismo" e vedete quanti vi rispondono. Le espressioni antonomastiche e gli slogan semplici e diretti hanno fatto la "fortuna" dei presidenti. Dall'"Evil empire" di Reagan, al "rogue state" di Clinton, all'"axis of evil" di Bush ... C'è sempre un "evil" o, nei periodi "pacifici", un "rogue" state dall'altra parte. Con Iran e Corea del Nord come presenza fissa e Russia quasi sempre (tranne nel periodo yeltsiniano e fino al 2014). La sinofobia è recente, è trumpiana (a parte quella di fine ottocento [1] culminata con il Chinese Exclusion Act del 1882). > The Right has a point. In that they understand social media platforms as critical infrastructure capable of shaping and distorting our shared information ecosystem, and they recognize that controlling how this ecosystem is "distorted" is a better use of their time — in pursuit of power and influence — than trying to create a magic formula that can "democratize" or "balance" the influence these platforms exert. La formula "magica" per i social, per questi social, non esiste. Prima si abbandonano, meglio è (per la democrazia). A. [1] https://immigrants.harpweek.com/chineseamericans/4ItemsByIndex/AntiChineseT…

March 29, 2024

SOCIAL MEDIA, AUTHORITARIANISM, AND THE WORLD AS IT IS - MEREDITH WHITTAKER

by Daniela Tafani

SOCIAL MEDIA, AUTHORITARIANISM, AND THE WORLD AS IT IS MEREDITH WHITTAKER Earlier this month, the United States House of Representatives passed the Protecting Americans from Foreign Adversary Controlled Applications Act, a bill that would force TikTok’s parent company to sell the platform to U.S. citizens or be banished from the U.S. market. The same fate could await any other platform the President designates as a “foreign adversary-controlled application.” A loud mix of celebration and outcry greeted the bill’s movement, splitting both right and left and placing common allies across from each other. While its path in the Senate remains uncertain, the issues the bill raises and the political fissures it has exposed must be critically engaged. In this I am not a neutral observer. I stake a position in the “outcry” camp. I see no evidence that this bill will offer meaningful privacy protection from China, the United States, or anyone else, or liberate people from the mental buffeting of engagement-driven algorithms. What the bill would do is ensure that TikTok joins almost all other widely-used social media platforms on earth under U.S. control, enriching U.S., not Chinese, interests and further entrenching U.S. social network dominance. U.S.-owned social media platforms include the top four most widely used services in the world, with TikTok lagging far behind YouTube, Instagram, Facebook, and WhatsApp. Nineteen of the twenty most widely used social media platforms in the world are based in either the United States or China — making all other countries consumers, not developers, of these services. In light of the existing concentration of military and financial power in the United States, handing the country even more “control” over all relevant social media platforms is not something we should reflexively embrace — especially when there is no evidence that U.S. control will make them meaningfully better in any way. In this brief essay, I outline why I am particularly concerned with the implications of U.S. control in our present political moment, a view that is rooted in concerns for free speech and expression. Those who raise such concerns often do so in bad faith, and because of this, liberals and some on the left tend to dismiss these worries out of hand. In ceding speech and expression to the right, they misunderstand the problem that the current tech industry and its business model present, and thus proffer the wrong solutions, with this TikTok bill being just the most recent example. FORGING POLITICAL WEAPONS By giving the President — any President — the power to designate which platforms are “foreign adversary controlled,” this bill provides the executive with a powerful new tool to coerce tech companies and exert control over the information ecosystem that platforms shape. While the “foreign adversaries” designation is narrow, and only applies to China, Iran, North Korea, and Russia for now, the long history of dubious fact patterns and malformed evidence that has sufficed to establish links between targeted organizations or individuals and malign actors should chill any optimism suggested by this limitation. Consider, for instance, the case of the Holy Land Foundation. The Holy Land Foundation was, in the 1990s, the largest Muslim charity in the United States, and supported aid organizations in Palestine — many of which were also supported by the U.S. government. In the wake of 9/11, HLF was targeted by the Bush administration’s DOJ. Even though no direct or knowing link to terrorist activity was ever alleged, let alone concretely established, HLF was still designated a terrorist organization. Its assets were seized, and its leaders ultimately convicted of material support for Hamas “on the notion that the social programs they financed help win the ‘hearts and minds’ of Palestinian people for Hamas.” This was in a climate, not unlike our own, marked by strong Islamophobia. Historically, such designations have proven flexible and highly conducive to political weaponization. From the McCarthy era, to the post-9/11 patriotic frenzy, to the recent wave of bans targeting pro-Palestinian student organizations, there’s a well-worn template that should give us pause before handing any given executive branch the power to force the divestiture of platforms so-designated, as this bill would. Indeed, the very idea that TikTok presents a threat to national security shows how such designations are often driven by ulterior motives — in this case, at least in part, hostility to support for Palestine. Many proponents of the ban harnessed the sinophobic narrative that TikTok was akin to “Chinese Opium,” enacting mind control to “brainwash” kids against Israel. Josh Hawley, for instance, alleged that the platform was a “purveyor of virulent antisemtic lies.” To be clear, there is no evidence for this claim, even as there is evidence that U.S.-based social media platforms suppressed pro-Palestinian speech, something we examine below. Importantly, the power to designate platforms as “foreign adversary controlled” doesn’t have to be used to exert disciplinary force. By simply existing, it provides a stick that can be wielded to jostle platforms into compliance, whether foreign or domestic. We already see this pattern in action, when politicians saber rattle in the direction of Section 230, in many cases less with serious intention than as a threat meant to provoke tech company compliance ‘or else.’ THE WORLD AS IT IS In voicing opposition to this bill, my views depart from incisive people with whom I generally agree, including many engaged in legal scholarship and policy advocacy. This may have something to do with my current role as Signal’s President, which requires that I scan a wide horizon for threats to privacy and free expression from government and industry, take these threats seriously, and prepare for them even if I lack definitive proof that they will materialize. In this endeavor I need to respect the libidinal pull of culture and culture-makers as powerful shapers of politics and legislation, and remember that ultimately power makes law, law doesn’t make power. And whatever I do, I have to work the rules as written alongside the world as it is: marked by self-interest, power asymmetries, and political corruption — all against the backdrop of an accelerating climate crisis and rising authoritarianism. This is a different mode of attention than most policy and legal work. As professions — not necessarily as individuals who engage in such work — these fields share an unspoken but foundational presumption of a functional, liberal state whose machinery of checks, balances, and independent agencies will produce, in the end, a more or less just outcome. A focus on the details of a particular case, or bill, or enforcement action tends to assume an orderly world lies beyond, into which such work will be situated and can produce incremental improvement. The problem is that in our current moment, these implicit assumptions look increasingly like a counterfactual diorama, a pretty archetype that bears less and less resemblance to the real world. And it’s here, in these lovely-if-specious counterfactuals, that I see many of the arguments in favor of this bill residing: from those that easily adopt the pronoun “we” when referring to the U.S. state, to those arguing that something — anything — applied to discipline platforms is a step in the right direction — a direction that a coherent body, we are to assume, is steadily striding toward. When we examine the big picture, such assurances fray. We see an illiberal tide with a deeply censorious agenda driven by a well-resourced and organized network working to take power. Across the US, state legislators are acquiescing to what PEN America has called “the work of a growing number of advocacy organizations that have made demanding censorship of certain books and ideas in schools part of their mission.” These bans seek to suppress, in particular, literature that engages race, racism and LGBTQ themes, and they’re part of a fierce and growing anti-DEI and anti-LGBTQ backlash aimed particularly at trans people. This movement is behind a surge in anti-gay legislation, like Florida’s 2022 “Don’t Say Gay” law, which proscribes discussions of gender identity and sexual orientation in public schools. Meanwhile, pregnant people in states that leapt to restrict access to reproductive care after Dobbs now rightly fear being unable to access any medical care, due to hospitals’ worries of liability were medical staff to harm a fetus in the process of caring for a person. And Jessica Burgess is serving two years in prison. Facebook messages, handed to law enforcement by Meta, comprised key evidence used to convict her and her daughter of accessing and managing reproductive care in Nebraska, after their home state had criminalized it. The Trump campaign and its backers have done little to hide their aspiration to bring these state-level restrictions on speech and freedom to the national level. In contrast to the lead up to 2016, during which it often felt like even Trump did not expect to prevail, his former staffers and allies are busy planning for victory. (Victory that I consider likely, particularly as Biden’s position on Gaza over the past six months has alienated the same young, progressive, Black and brown voters who would be required to push him to victory in November.) Consider, for instance, Project 2025, a coalition led by the Heritage Foundation and shaped by former Trump personnel that is focused on assembling an army of 20,000 potential administration staffers “to begin dismantling the administrative state from Day 1” and to centralize power under the executive branch such that it could unilaterally enact policies, including a federal abortion ban. This dovetails with the Trump campaign’s own stated plans, which focus on casting off as many checks on presidential authority as possible and bringing “independent agencies — like the Federal Communications Commission, which makes and enforces rules for television and internet companies, and the Federal Trade Commission, which enforces various antitrust and other consumer protection rules against businesses — under direct presidential control.” THE RIGHT HAS A POINT The Right has a point. In that they understand social media platforms as critical infrastructure capable of shaping and distorting our shared information ecosystem, and they recognize that controlling how this ecosystem is “distorted” is a better use of their time — in pursuit of power and influence — than trying to create a magic formula that can “democratize” or “balance” the influence these platforms exert. This keen understanding, and a media strategy built around it, is evident in Twitch streams and YouTube channels that synchronize with X bots and local TV news, frequently demonstrating impeccable message discipline across an internally resonant ecosystem. To maintain and grow this ecosystem — and to develop muscles of platform discipline and control — those invested in this project direct significant attention to Meta, Amazon, Google, and other dominant platforms companies. They take to their streams and feeds to decry as censorship any move by these actors that might curtail their content and reach, while legislators and pundits echo and amplify these claims. And they threaten, sue, and work to discredit independent researchers who document and decry this behavior. When we read headlines announcing that the former Treasury Secretary under Trump, Steven Mnuchin, is assembling a group of investors eager to buy TikTok and place it under U.S. jurisdiction in response to the bill’s movement, we need to understand this as a preview of how “U.S. control” would operate in practice, and place it within the broader context of this canny right-wing media strategy. I worry that liberals and some on the left routinely downplay the threat to speech that these platforms and the prospect of government control over them present. This is in part because there are few staunch defenders of free speech among their ranks these days. It’s not hard to see why this is. The bad faith invocation of free speech has been used by some heinous characters to defend online harassment, doxxing, and surveillance-based micro-targeting. Moreover, the past two decades have witnessed the gauche instrumentation of the First Amendment to argue for corporations’ rights to do whatever the fuck they want, including the tech industry’s brandishing the constitution to defend their metastatic business model. It’s true, there is a lot of disingenuous nonsense when it comes to free speech discourse. But this doesn’t mean we should confuse these essential rights with the actors who speciously invoke them — something we often see in the liberal tendency to deny that centralized platform control of speech is a significant problem. The real problem, much liberal policy implies, is too little control of speech — too little monitoring, surveillance, and age-gating; too little trust, and too little safety; too many criminals hiding in shadows with not enough national security oversight; and too little U.S. ownership and “control.” The all-too-commonly proffered solution to the harms that flow from platform surveillance practices and business models is to ensure that they are wisely governed by upstanding people applying appropriate norms and standards. The fight, in other words, is aimed at expanding power over these platforms to governments and sometimes NGOs. With the counterfactual vision of an ordered and just state standing in for any critical thinking about who will actually exercise such power, and how. Let alone who is likely to be harmed — from sex workers, to dissidents, to queer teens trying to access LGBTQ resources in a future where these are criminalized. To be clear, I am not saying that norms and standards are bad. No publicly accessible message board or social media platform, from the biggest to the smallest, can survive without standards around content and behavior and some way to enforce these standards. From Usenet groups to Signal’s community forum to Facebook: without standards, spam will make your network unusable, bots will drown out and sow confusion, “that one guy” will clutter up every conversation with a long off-topic screed, and coordinated harassment and trolling will work to repress the speech of its targets. No, the actual problem isn’t tech qua tech. It’s the fact that we live in a world of nation-states and massive multinational corporate actors that flex power akin to states. And in this world, information control and asymmetry are key tools for the expansion and exercise of such power. So of course centralized media platforms — from Western Union in the 19th century, to Instagram and TikTok now — will always comprise a strategically significant lever desired by those who wish to maintain and expand their authority. As a result, governance of these platforms and their norms and standards will always be hotly contested and viciously politicized as states and corporations vie for influence, popular legitimacy, and power. Bolting more surveillance, monitoring, and oversight onto these formations only creates more places to exert such control. This reality isn’t hard to see. The Chinese government acknowledges it openly and acts accordingly by enforcing censorious and protectionist policies that dictate these standards and tightly restrict platform scope and ownership. It’s also at work in the United States, in different and more subtle ways: from the Obama campaign’s then-celebrated voter targeting efforts during the 2008 and 2012 election contests, which were heralded as tech-savvy; to the credible evidence of election-related disinformation in 2016 and 2020 — both of which were enabled via the affordances of these surveillance advertising platforms; to TikTok removing content discussing the dire situation of the Muslim Uyghur minority; to X censoring posts critical of Modi at the Indian government’s request; to this moment, when U.S.-homed media platforms — from Instagram to YouTube to Facebook — have moved in seeming lockstep to deprioritize pro-Palestinian speech, a position that echoes (and is almost certainly informed by) the mainstream political establishment in the US and other Western states. And it’s not that TikTok is a bastion of anti-censorship. There’s evidence that it has also dampened the reach of some pro-Palestine content. But what’s important here is that the perception of TikTok’s divergence from this pro-Israel norm played a meaningful part in actuating the bill’s movement in the house. The problem here is the platforms themselves. There is something deeply wrong with the whole form. With their self-reinforcing business models, their reliance on surveillance, and their role in undermining an independent media ecosystem and replacing it with their monolithic feeds. And with the fact that there are only a handful of them, clustered mainly in the United States, representing staggeringly lopsided and concentrated power in the hands of a few companies whose positions generally mirror the common sense of the U.S. state and whose actions always prioritize profit and growth, whatever else they may do. SO, WHAT? The world would be better if these platforms were dismantled and their revenues shared with the people, professions, and communities whose livelihoods and public spaces they’ve worked to foreclose, and if a more localized variation on digital spaces for deliberation, discussion, and discovery could be constructed in their wake. But we’re not even close to this. Standing in this moment, with platforms that exercise outsized control over our information ecosystem going nowhere, we need to weigh our choices and define what we’re actually fighting for. The right is fighting to take control of these platforms, while liberals and some on the left are fighting to expand vectors of platform control, without thinking hard enough about who will wield this power and who is likely to get hurt. We can’t treat these factors as “outside the scope of this paper.” We need to map and sit with the implications of this conjuncture — a complex endeavor I barely begin here. My hope in offering this analysis is to open up a larger conversation among those invested in dismantling the dangerous centralized power of the tech industry, and to do the work of mapping and thinking together. For now, I believe that taking all of this seriously means rejecting any move that would further concentrate global surveillance and propaganda power within the borders (and often hands) of a single government — the United States. It is always dangerous to treat nation-states like home teams, without acknowledging that these forms are always, in every case, containers whose function is to hold and codify power over subjects, and that those wielding power from within these structures can do so benevolently, or with unspeakable brutality. When it comes to the implications of this analysis for the TikTok bill, I think it is vastly preferable to exploit and expand the cracks and corner rooms where dissent is still possible instead of leaning on a state to codify and enforce rules that — only in some counterfactual — would be applied to make platforms more private, democratic, or friendly to dissent. This is where we need to recognize that the agonism of big-power geopolitical platform rivalry could produce some collateral good, creating opportunities for dissent in the spaces shaped by competing interests. Or, to oversimplify for the sake of explanation, one platform may suppress pro-Palestinian speech, and another may suppress documentation of Uyghur genocide, but together they could provide access to both. In my view, this is vastly preferable to shuttling the entire world’s information ecosystem and digital surveillance hubs under the sole jurisdiction of the United States — a country that is far closer to the precipice of authoritarianism than many of my legal and policy colleagues acknowledge in their daily work. https://lpeproject.org/blog/social-media-authoritarianism-and-the-world-as-…

March 28, 2024

"Privacy Shield" arriverà a mangiare il panettone?!?

by 380°

Buongiorno, ne dubito seriamente. Il motivo è semplicissimo: CDN e VPN _non_ se ne andranno, quindi non resta che spegnere "Privacy Shield". Notizia di ieri è che il codice sorgente e la documentazione del sistema "Piracy Shield" italiano è stato trafugato su GitHub da parte dell'utente fuckpiracyshield [1]: https://torrentfreak.com/piracy-shield-source-code-internal-documentation-l… «Piracy Shield Source Code & Internal Documentation Leak Online» --8<---------------cut here---------------start------------->8--- The source code of Italian anti-piracy platform Piracy Shield appears to have been leaked online. Nine repositories claim to contain everything from the front end, data models, storage and filesystem, through to the platform's API and internal documentation. Presented with a manifesto of sorts, the unknown leaker claims that Piracy Shield "isn't just a failed attempt to combat online piracy," it's a "dangerous gateway" to censorship "disguised as a solution to piracy." [...] In what could develop into the biggest crisis yet for the Piracy Shield system and those who operate it, nine repositories of source code, internal documentation, and other related data, claiming to be the various components of the Piracy Shield system, appear to have leaked online. --8<---------------cut here---------------end--------------->8--- Dal punto di vista "pratico" è improbabile che la trafugazione possa avere serie conseguenze /tecniche/ sul sistema "Privacy Shield", serve "solo" a sottolineare che non è da paese civile nascondere dietro presunte esigenze di segretezza (sicurezza nazionale?!?) le informazioni, compresi i dati, la documentazione e gli IP bloccati, relative a quel sistema. Sì perchè non è normale che per sapere quali siano gli IP bloccati occorra un sito che "trafughi" (tra otto virgolette) anche quelle informazioni: https://piracyshield.iperv.it/ --8<---------------cut here---------------start------------->8--- The biggest problem is that IP addresses make up the bulk of the blocking while also producing the most errors. These errors can be devastating for innocent parties that unwittingly end up as collateral damage. Yet with no open reporting, holding perpetrators to account – if only to improve the system – could prove all but impossible. Any argument in favor of secrecy necessarily fails, since IPTV providers know before anyone else that their IP addresses are being blocked. That means those privy to the details of IP address blocking include AGCOM, rightsholders, ISPs, and pirate IPTV providers. The only people kept in the dark are those who become collateral damage through no fault of their own. --8<---------------cut here---------------end--------------->8--- (via https://torrentfreak.com/piracy-shield-iptv-blocks-reportedly-hit-zenlayer-…) La trafugazione arriva in un clima già decisamente problematico per il "Piracy Shield", verso il quale sono stati espressi diversi i dubbi in merito efficacia nel bloccare *in generale* il traffico /illegale/ su internet, tipo: https://techhq.com/2024/02/does-italys-piracy-shield-work/ «Italy’s Piracy Shield proves the internet works - Legislating the internet proves…tricky. Whodathunkit?» 29 February 2024 --8<---------------cut here---------------start------------->8--- Political parties are fond of making big promises, especially when in opposition, and few such claims are more specious than the promise to ‘clean up the internet’ to protect its citizenry from the scourges of pornography, piracy, and terrorism. Political statements on the matter usually contain the word ‘children’ in the context of child abuse or protecting minors from the evils that lurk just a couple of mouse clicks away. While their aims are entirely laudable, they ignore or are unaware of the fact that the internet is not a place that can easily be policed either at national boundaries or by filtering content in an effective manner. The digital domain was never designed in a way that would allow total oversight, and attempts to impose the type of stricture required after the fact will always be hugely imperfect. Circumvention of stricture is in the digital DNA of the internet. [...] Sports fans at the weekend just gone soon discovered firsthand how complex a specifically-targeted act of traffic blocking can be. An IP address belonging to CDN Cloudflare found itself on the wrong side of Italy’s Piracy Shield, which prevented innocent traffic from reaching the ODW Prison Volunteers Association and Elimobile, a telecomms company, among others. [...] But because large CDNs aggregate data from multiple sources, the nefarious actions of just one of those sources can cause all of its clients to be tarred with the same brush. Bad actors are as wont to use CDNs as lawful parties, and traffic delivery assignment algorithms can’t differentiate between them. Additionally, it’s easy to mistake genuine traffic for bad traffic. In short, at a low level, things are very, very complicated, in ways not easily explained to those who draft laws. The Italian experience should be a salutary lesson for lawmakers the world over. Even with a tightly constrained remit, the fallout from attempts to control the digital arena is unpredictable. As a rule of thumb, preventing dubious data movements is borderline impossible to achieve with any accuracy. The public has to be made aware of this fact, so that when the next clarion call goes out for legislation to ‘protect the children,’ the populace recognizes there may be secondary motives – or utter ignorance – at play. Both possibilities are equally alarming, and it’s naive to believe that people in government are any smarter than most. --8<---------------cut here---------------end--------------->8--- Mentre parallelamente le misure imposte attraverso il sistema "Privacy Shield" hanno già creato seri problemi al traffico legittimo: 1. CDN Zenlayer https://torrentfreak.com/piracy-shield-iptv-blocks-reportedly-hit-zenlayer-… «Piracy Shield IPTV Blocks Reportedly Hit Zenlayer CDN’s Innocent Customers» February 15, 2024 by Andy Maxwell --8<---------------cut here---------------start------------->8--- If initial reports coming out of Italy today are proven true, Italy's Piracy Shield system designed to block live sports piracy, is currently blocking Zenlayer CDN IP addresses and the innocent services reliant upon them. A claim that cloud services provider Cloud4C has been rendered inaccessible appears to be credible. --8<---------------cut here---------------end--------------->8--- 2. CDN Cloudflare https://torrentfreak.com/agcom-admits-piracy-shield-blunder-cloudflare-urge… «AGCOM Admits ‘Piracy Shield’ Blunder, Cloudflare Urges Users to Complain» March 21, 2024 by Andy Maxwell --8<---------------cut here---------------start------------->8--- It may have taken almost a month but Italian telecoms regulator AGCOM has finally admitted that Cloudflare was wrongfully blocked by its fledgling anti-piracy system, Piracy Shield. There was no apology for the journalists accused of reporting 'fake news', or an apology for Cloudflare after disrupting its business. --8<---------------cut here---------------end--------------->8--- https://torrentfreak.com/piracy-shield-cloudflare-disaster-blocks-countless… «Piracy Shield Cloudflare Disaster Blocks Countless Sites, Fires Up Opposition» February 26, 2024 by Andy Maxwell --8<---------------cut here---------------start------------->8--- Experts warned that a radical site-blocking program without proper checks and balances would end badly in Italy. On Saturday, at least one Cloudflare IP address was added to the Piracy Shield anti-piracy system. According to an expert, that ended up blocking a large number of websites, including a charity, a telecoms company, and several schools. It's the outcome many people predicted but one that could've been easily avoided. --8<---------------cut here---------------end--------------->8--- 3. CDN Akamai https://torrentfreak.com/live-piracy-shield-data-exposed-by-new-platform-re… «Live ‘Piracy Shield’ Data Exposed By New Platform Reveals Akamai IP Blocking» --8<---------------cut here---------------start------------->8--- Following at least two major blocking blunders at Italy's Piracy Shield system that were initially denied, it was hoped that authorities would take the opportunity to be more transparent. While that has failed to emerge, live data from the Piracy Shield platform is now being made available via an unofficial third-party service. That has revealed yet more blocking blunders, this time involving Akamai IPs. --8<---------------cut here---------------end--------------->8--- Oltre ad aver provocato la reazione di AirVPN, un provider italiano di connessioni VPN: https://airvpn.org/forums/topic/57256-termination-of-service-in-italy/ https://walledculture.org/italys-new-piracy-shield-has-just-gone-into-opera… «Italy’s new Piracy Shield has just gone into operation and is already harming human rights there» Posted on 14 February --8<---------------cut here---------------start------------->8--- This is Italy’s new Internet blocking system, which assumes people are guilty until innocent, and gives the copyright industry a disproportionate power to control what is available online, no court orders required. [...] Companies can compile block lists without any constraint or even oversight. If the blocks are unjustified, there are no statutory damages, which will obviously encourage overblocking. And proving they are unjustified is a slow and complex process, and only takes place after the block has been effected. [...] copyright is evidently regarded by the authorities as more important than fundamental human rights such as privacy and security. --8<---------------cut here---------------end--------------->8--- Saluti, 380° [1] https://github.com/fuckpiracyshield -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

March 27, 2024

"Privacy Shield" arriverà a mangiare il panettone?!?

by 380°

Buongiorno, ne dubito seriamente. Il motivo è semplicissimo: CDN e VPN _non_ se ne andranno, quindi non resta che spegnere "Privacy Shield". Notizia di ieri è che il codice sorgente e la documentazione del sistema "Piracy Shield" italiano è stato trafugato su GitHub da parte dell'utente fuckpiracyshield [1]: https://torrentfreak.com/piracy-shield-source-code-internal-documentation-l… «Piracy Shield Source Code & Internal Documentation Leak Online» --8<---------------cut here---------------start------------->8--- The source code of Italian anti-piracy platform Piracy Shield appears to have been leaked online. Nine repositories claim to contain everything from the front end, data models, storage and filesystem, through to the platform's API and internal documentation. Presented with a manifesto of sorts, the unknown leaker claims that Piracy Shield "isn't just a failed attempt to combat online piracy," it's a "dangerous gateway" to censorship "disguised as a solution to piracy." [...] In what could develop into the biggest crisis yet for the Piracy Shield system and those who operate it, nine repositories of source code, internal documentation, and other related data, claiming to be the various components of the Piracy Shield system, appear to have leaked online. --8<---------------cut here---------------end--------------->8--- Dal punto di vista "pratico" è improbabile che la trafugazione possa avere serie conseguenze sul sistema "Privacy Shield" a parte sottolineare che non è da paese civile nascondere dietro presunte esigenze di segretezza (sicurezza nazionale?!?) le informazioni, compresi i dati, quindi gli IP bloccati, relative a quel sistema. Sì perchè non è normale che per sapere quali siano gli IP bloccati occorra un sito che "trafughi" anche quelle informazioni: https://piracyshield.iperv.it/ --8<---------------cut here---------------start------------->8--- The biggest problem is that IP addresses make up the bulk of the blocking while also producing the most errors. These errors can be devastating for innocent parties that unwittingly end up as collateral damage. Yet with no open reporting, holding perpetrators to account – if only to improve the system – could prove all but impossible. Any argument in favor of secrecy necessarily fails, since IPTV providers know before anyone else that their IP addresses are being blocked. That means those privy to the details of IP address blocking include AGCOM, rightsholders, ISPs, and pirate IPTV providers. The only people kept in the dark are those who become collateral damage through no fault of their own. --8<---------------cut here---------------end--------------->8--- (via https://torrentfreak.com/piracy-shield-iptv-blocks-reportedly-hit-zenlayer-…) La trafugazione arriva in un clima già decisamente problematico per il "Piracy Shield", verso il quale sono stati espressi diversi i dubbi in merito efficacia nel bloccare *in generale* il traffico /illegale/ su internet, tipo: https://techhq.com/2024/02/does-italys-piracy-shield-work/ «Italy’s Piracy Shield proves the internet works - Legislating the internet proves…tricky. Whodathunkit?» 29 February 2024 --8<---------------cut here---------------start------------->8--- Political parties are fond of making big promises, especially when in opposition, and few such claims are more specious than the promise to ‘clean up the internet’ to protect its citizenry from the scourges of pornography, piracy, and terrorism. Political statements on the matter usually contain the word ‘children’ in the context of child abuse or protecting minors from the evils that lurk just a couple of mouse clicks away. While their aims are entirely laudable, they ignore or are unaware of the fact that the internet is not a place that can easily be policed either at national boundaries or by filtering content in an effective manner. The digital domain was never designed in a way that would allow total oversight, and attempts to impose the type of stricture required after the fact will always be hugely imperfect. Circumvention of stricture is in the digital DNA of the internet. [...] Sports fans at the weekend just gone soon discovered firsthand how complex a specifically-targeted act of traffic blocking can be. An IP address belonging to CDN Cloudflare found itself on the wrong side of Italy’s Piracy Shield, which prevented innocent traffic from reaching the ODW Prison Volunteers Association and Elimobile, a telecomms company, among others. [...] But because large CDNs aggregate data from multiple sources, the nefarious actions of just one of those sources can cause all of its clients to be tarred with the same brush. Bad actors are as wont to use CDNs as lawful parties, and traffic delivery assignment algorithms can’t differentiate between them. Additionally, it’s easy to mistake genuine traffic for bad traffic. In short, at a low level, things are very, very complicated, in ways not easily explained to those who draft laws. The Italian experience should be a salutary lesson for lawmakers the world over. Even with a tightly constrained remit, the fallout from attempts to control the digital arena is unpredictable. As a rule of thumb, preventing dubious data movements is borderline impossible to achieve with any accuracy. The public has to be made aware of this fact, so that when the next clarion call goes out for legislation to ‘protect the children,’ the populace recognizes there may be secondary motives – or utter ignorance – at play. Both possibilities are equally alarming, and it’s naive to believe that people in government are any smarter than most. --8<---------------cut here---------------end--------------->8--- Mentre parallelamente le misure imposte attraverso il sistema "Privacy Shield" hanno già creato seri problemi al traffico legittimo: 1. CDN Zenlayer https://torrentfreak.com/piracy-shield-iptv-blocks-reportedly-hit-zenlayer-… «Piracy Shield IPTV Blocks Reportedly Hit Zenlayer CDN’s Innocent Customers» February 15, 2024 by Andy Maxwell --8<---------------cut here---------------start------------->8--- If initial reports coming out of Italy today are proven true, Italy's Piracy Shield system designed to block live sports piracy, is currently blocking Zenlayer CDN IP addresses and the innocent services reliant upon them. A claim that cloud services provider Cloud4C has been rendered inaccessible appears to be credible. --8<---------------cut here---------------end--------------->8--- 2. CDN Cloudflare https://torrentfreak.com/agcom-admits-piracy-shield-blunder-cloudflare-urge… «AGCOM Admits ‘Piracy Shield’ Blunder, Cloudflare Urges Users to Complain» March 21, 2024 by Andy Maxwell --8<---------------cut here---------------start------------->8--- It may have taken almost a month but Italian telecoms regulator AGCOM has finally admitted that Cloudflare was wrongfully blocked by its fledgling anti-piracy system, Piracy Shield. There was no apology for the journalists accused of reporting 'fake news', or an apology for Cloudflare after disrupting its business. --8<---------------cut here---------------end--------------->8--- https://torrentfreak.com/piracy-shield-cloudflare-disaster-blocks-countless… «Piracy Shield Cloudflare Disaster Blocks Countless Sites, Fires Up Opposition» February 26, 2024 by Andy Maxwell --8<---------------cut here---------------start------------->8--- Experts warned that a radical site-blocking program without proper checks and balances would end badly in Italy. On Saturday, at least one Cloudflare IP address was added to the Piracy Shield anti-piracy system. According to an expert, that ended up blocking a large number of websites, including a charity, a telecoms company, and several schools. It's the outcome many people predicted but one that could've been easily avoided. --8<---------------cut here---------------end--------------->8--- 3. CDN Akamai https://torrentfreak.com/live-piracy-shield-data-exposed-by-new-platform-re… «Live ‘Piracy Shield’ Data Exposed By New Platform Reveals Akamai IP Blocking» Following at least two major blocking blunders at Italy's Piracy Shield system that were initially denied, it was hoped that authorities would take the opportunity to be more transparent. While that has failed to emerge, live data from the Piracy Shield platform is now being made available via an unofficial third-party service. That has revealed yet more blocking blunders, this time involving Akamai IPs. [1] https://github.com/fuckpiracyshield -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

March 27, 2024

House passes bill to prevent the sale of personal data to foreign adversaries

by Daniela Tafani

The bill bans data brokers from selling Americans’ personal information to countries like China, Russia, North Korea, and Iran. A week after the House of Representatives passed a bill that seeks to force TikTok to separate from its Chinese parent company, it passed a second bill that aims to protect Americans’ data from foreign adversaries. The Protecting Americans’ Data from Foreign Adversaries Act, or HR 7520, would prohibit data brokers from selling Americans’ personally identifiable information to foreign adversaries, including countries like China, Russia, North Korea, and Iran. Data brokers can face penalties from the Federal Trade Commission if they’re found to have sold sensitive information like location or health data to these countries. The bill sailed through the House, with all 414 lawmakers who voted opting to pass it. The bill, led by House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) and Ranking Member Frank Pallone (D-NJ), was unanimously voted out of committee alongside the TikTok bill that similarly passed the House with broad support. Lawmakers hope the combination of legislation will protect US internet users and safeguard US national security. McMorris Rodgers and Pallone said in a joint statement Wednesday that the legislation “builds on our efforts in the House last week to pass H.R. 7521 — with overwhelming and bipartisan support — and serves as an important complement to more comprehensive national data privacy legislation, which we remain committed to working together on.” Unlike the TikTok bill, this one does not name individual companies. But it imposes a broad limit on data brokers’ ability to “sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available sensitive data of a United States individual” to foreign adversaries or organizations they control. It also gives the Federal Trade Commission authority to enforce the legislation. The sensitive data covered by the bill includes biometric and genetic information, Social Security numbers, health diagnoses or treatments, and precise geolocation data. If it passes the Senate and is signed by the president, the bill would provide a significant uptick in data privacy for Americans — but that said, the bar for that is relatively low. Discussions about a broader privacy law have withered in recent years, but the Energy and Commerce leaders say they’re holding out hope that the overwhelming support for the data broker bill can get Congress moving on more ambitious privacy legislation. “We’re encouraged by today’s strong vote, which should help build momentum to get this important bipartisan legislation, as well as more comprehensive privacy legislation, signed into law this Congress,” McMorris Rodgers and Pallone said in their joint statement. https://www.theverge.com/2024/3/20/24106991/house-data-broker-foreign-adver…

March 27, 2024

E' online il programma di Biennale Tecnologia 2024 (Torino, 17-21 aprile)

by J.C. DE MARTIN

Questa mattina è stato presentato il programma della quarta edizione di Biennale Tecnologia, la manifestazione su tecnologia e società organizzata dal Politecnico, che si terrà a Torino dal 17 al 21 aprile 2024. Il programma è online sul sito www.biennaletecnologia.it <https://www.biennaletecnologia.it>. Di incontri che hanno a che fare in qualche modo con le tecnologie digitali ce sono moltissimi, per cui non provo neanche a elencarli... lasciate solo che evidenzi la presenza del grande Cory Doctorow, che terrà la lectio conclusiva di Biennale domenica 21 aprile alle ore 18:30. Ingresso libero e gratuito, fino a esaurimento posti. Ciao, juan carlos

March 25, 2024

locandina spettacolo su Chelsea Manning/Wikileaks - Torino 11 Aprile

by Norberto Patrignani

Carissim*, segnalo questo spettacolo su Chelsea Manning/Wikileaks a Torino 11 Aprile, allego locandina ciao! Norberto

March 25, 2024

When it comes to privacy, it’s all or nothing

by Daniela Tafani

Taurus leak: When it comes to privacy, it’s all or nothing The German Taurus leak shows one thing very clearly: encrypted and secure communication does not work for the few. Instead, it must become the standard for everyone. 23.03.2024 um 07:20 Uhr - Gastbeitrag, Meredith Whittaker An alarming breach of state secrecy recently rocked German newswires. On March 1, Margarita Simonjan, head of Russian TV network RT, published confidential communications between German military officials, turning strategically sensitive deliberations into public news and further polarizing an already fierce debate centered on Europe’s support for Ukraine–or lack thereof. How did this happen? The alleged culprit was the German military’s reliance on insecure communications systems. According to official sources, one of the officials involved in the conversation joined using not sufficiently secure software or an insecure line. Software that enables encryption as an option, not as the default, will always undermine privacy eventually. Because it takes only one person forgetting to “turn on” encryption to ruin it for everyone – and just like that, to enable a breach. This incident underscores something important: private communications only work if everyone participates. If one person or endpoint is compromised, the whole network goes with it. Which means that digital privacy and security must be embedded at the core of our digital infrastructure. As we saw with the German military, relegating privacy to the status of optional „add ons“ or institutional infrastructure for a privileged few means that they will, at some point, fail. And when they do, they will fail everyone. Encryption is a collective endeavor For decades, the human right to communicate privately has been a fractious proposition, with security services and law enforcement agencies frequently voicing opposition to the idea of digital privacy as the default for everyone. This oppositional position was cemented in the 1990s, as the internet moved from a hypothetical to the infrastructure of daily life. And the arguments made against privacy then are familiar today, namely that widespread encryption and the privacy it enables would facilitate criminal activities. Of course, the same entities arguing against privacy for us were not so keen on exposing their own communications and operations. At the same time that they argued for backdoors and weak privacy for the masses, they worked to ensure that their own communications remained protected by encryption. Ultimately, their stance amounted to: „privacy for me, not for thee“. And as we see, this stance results in “no privacy for any of us” in practice. This truth lies at the heart of the recent German military breach. Often overlooked in discussions surrounding digital privacy and security is the fact that end-to-end-encryption is a collective endeavor and should be the default. The integrity of encrypted communication is only as strong as its weakest link. A single participant using an insecure connection can compromise the privacy of the entire network, making the widespread adoption of end-to-end-encrypted communications one of the few strategies that can mitigate against such risks. Encryption should not be optional This incident illuminates the inherent fallacy of perceiving encryption as an optional feature or relying solely on closed, intra-organizational tools for secure communication. The reality of our interconnected world necessitates constant communication with individuals within and outside any single organization’s bubble – be it for sharing critical intelligence, coordinating with allies, or the mundane yet essential exchanges of daily life. Further, the networks and people a given person or organization is required to communicate with changes frequently, as the exigencies and focus of their work and the world they’re situated in shifts. What does not shift is the need for these communications to remain secure and private. Ironically, it was Stewart Baker, former head of the US National Security Agency, who articulated this dilemma in the 1990s, albeit from a perspective that opposed mass privacy. He highlighted the fact that if encryption wasn’t default, it would not be widely used. And this would thus leave even those endeavoring to apply encryption in bespoke or selective contexts (criminals, in his selective example) exposed to surveillance. Because, somewhere, somehow, they would slip up. Or, they would need to contact their father, or friends, or accountant on an unencrypted line. Thus, their “conspiracy”, in his words, would be discoverable by security services, due to the fact that only default encryption ‘for everyone’ is capable of truly protecting privacy for anyone. While he was arguing against the principle of privacy for everyone, Baker’s analogy unwittingly underscores the crux of the problem we currently face: without ubiquitous end-to-end encryption by default, every organization, be it a governmental body or otherwise, is left permanently exposed. Encryption goes beyond technology This also highlights the fact that to understand private communications, we cannot simply focus on technology. We must also appreciate the nature of how people communicate. Namely, that each one of us has many relationships with others around us; from our families, to our friends, to our colleagues. And that these boundaries are constantly shifting and blurred. Organizations partner with third parties routinely. Colleagues become friends. Family can be estranged. And it is frequently necessary to check in with a partner or friend about our location, our plans, and other intimate information. If only some of these conversations are private, the rest of them provide a surface area for interception and ultimately violation of privacy. Just as Baker noted. Each of us, always, communicates across a dynamic network that extends well beyond our workplace and profession. It is this fact that makes systems where end to end encryption is an option for some communications, but not the default for all, insufficient. The recent breach in German military communications serves as a compelling argument for the adoption of universally accessible, secure communication platforms. And this is why truly private messengers like Signal offer simple, unified messaging apps, capable of connecting with any other person using it. Communication platforms and tools are critical infrastructure These mass platforms and standards are not merely tools. They must be understood as critical infrastructure for the digital age, ensuring that privacy and security are not privileges but rights accessible to all. By making end-to-end encryption the default, and ensuring that this default is available to everyone not siloed within a given company or institution, we safeguard not just the communication between high-ranking officials but the human right to privacy of every individual. A right that to be honored for anyone, anywhere, must transcend organizational boundaries and national borders. To ensure privacy for anyone, we must champion systems that provide privacy to everyone. „Privacy for me but not for thee“ is an idea that, even in the 1990s, was understood to be fatally flawed. Those of us who believe in the human right to privacy must champion options that provide this right to the masses. Because if we don’t, everything from journalism, to dissent, to the sensitive communications of high ranking German military officials will be put at risk. https://netzpolitik.org/2024/taurus-leak-when-it-comes-to-privacy-its-all-o…

March 25, 2024

Re: [nexa] Un dipendente infedele o uno stato opaco?

by Antonio

> Spiegare tutto questo sarebbe stato impossibile nel pezzo, per cui ho > sintetizzato, forse sbagliando e me ne scuso. No, forse sbaglio io ... Saranno i troppi "elenchi" di alcuni politici, sarà la troppa confusione "scientifica" che c'è in giro, ma monta (almeno in me) una idiosincrasia verso le sintesi, le "reductio ad unum", ecc. Ben vengano i dettagli, le note a margine, i link di approfondimento, ecc. Grazie di avere usato questo spazio su Nexa per chiarire i miei (e forse altrui) dubbi. Antonio

March 25, 2024

Re: [nexa] Un dipendente infedele o uno stato opaco?

by Carlo Blengino

Ciao, hai solo in parte ragione, e in una prima versione del pezzo spiegavo che quella banca dati SOS è in realtà già il frutto della "approssimativa" elaborazione (algoritmica ed automatizzata per i soggetti più strutturati come gli istituti di credito e di moneta) di migliaia di altre banche dati "diffuse" facenti capo a tutti i soggetti sottoposti a obblighi antiriciclaggio (io teoricamente sono uno di quelli, ed è un delirio, essendo io un penalista e buona parte dei miei clienti potrebbero esser "sospetti" nelle loro transazioni per il solo fatto di esser miei clienti...ché mica difendiamo solo gli innocenti!). Banche dati che il Governo vorrebbe oggi accentrare ed elaborare con automatismi (di profilazione?) come disposto con il recente D.L. 145/2023 che ha introdotto nella normativa base sull'antiriciclaggio (231/2007) l'art. 34bis : il fine è centralizzare e automatizzare (sic!) la valutazione fumosa di "sospetto" (che genera poi la SOS) creando di fatto nuove e decisamente più ampie banche dati in capo agli "organismi di autoregolamentazione" (dizione piuttosto oscura che per i professionisti iscritti ad un albo sembrerebbero esser i consigli dell'ordine). Quelle banche dati a monte della banca dati SOS, oggi nella titolarità di ogni soggetto obbligato e che si vorrebbero (e saranno) centralizzare contengono "milioni di dati" relativi a milioni di transazioni (perfettamente lecite eh!) e di soggetti coinvolti; i criteri di raccolta poi si ampliano ogni anno, l'ultimo è nella finanziaria 2024 al comma 504 dell'art.1, per dire. La genesi delle banche dati "madri" della SOS centralizzate è interessante perchè l'idea di prevedere la trasmissione di tutti i dati (usualmente leciti!) in un CED che così potrà meglio calibrare la valutazione di "sospetto" per poi alimentare la SOS è l'esempio perfetto di una sorveglianza di massa. Ricordo che al di là del problema legato agli accessi del Law enforcement, in Italia i Servizi di Informazione per la Sicurezza Nazionale (DIS & C.) hanno accesso by default a praticamente tutte le banche dati di pubblico interesse. C'è anche un (blando) parere del Garante su questa scriteriata operazione di concentrazione delle banche dati "madri" della SOS, ma dopo il Decreto Capienze il Garante si limita a dare pareri...sic!. Spiegare tutto questo sarebbe stato impossibile nel pezzo, per cui ho sintetizzato, forse sbagliando e me ne scuso. Leggetelo così: il sistema dell'antiriciclaggio genera centinaia di banche dati *che potenzialmente contengono informazioni sulle transazioni di milioni di cittadini, alimentata da centinaia di enti, aziende private e professionisti *[non c'è nessuna gerarchia nell'elenco]*, e basata su criteri discutibili e incerti di mero sospetto, a cui accedono diverse agenzie statuali con diverse competenze e che si è rivelata fisiologicamente vulnerabile e fragili*. La situazione è in realtà imho, assai più inquietante. Carlo Il giorno lun 25 mar 2024 alle ore 09:20 Antonio <antonio(a)piumarossa.it> ha scritto: > > https://centroriformastato.it/un-dipendente-infedele-o-uno-stato-opaco/ > > D'accordo, in linea di massima, con l'articolo. Solo qualche precisazione: > "una banca dati enorme, che potenzialmente contiene informazioni sulle > transazioni di milioni di cittadini, alimentata da centinaia di enti, > aziende private e professionisti, e basata su criteri discutibili e incerti > di mero sospetto, a cui accedono diverse agenzie statuali con diverse > competenze e che si è rivelata fisiologicamente vulnerabile e fragile." > > La banca dati non è affatto enorme, il termine "enorme" è sicuramente > soggettivo ma visto che subito dopo si usa l'aggettivo numerale "milioni" > vorrei ridurlo, almeno, di un ordine di grandezza. > Il numero dei "record" presenti nella banca dati SOS è pubblico. Ogni anno > l'Unità di Informazione Finanziaria per l’Italia della Banca d'Italia, > ovvero l'ufficio che gestisce la banca dati, pubblica un rapporto. > Nell'ultimo [1], datato maggio 2023, i numeri sono questi (pag. 23): > 2018 98.030 > 2019 105.789 > 2020 113.187 > 2021 139.524 > 2022 155.426 > Anche la frase "alimentata da centinaia di enti, aziende private e > professionisti", seppur corretta, mette in ordine decrescente enti, aziende > private e professionisti, quando, invece, il 95% delle segnalazioni arriva > da banche e Poste, il 3,7% da professionisti e lo 0,1% dalla P.A. (pag. 12) > > A. > > [1] > https://uif.bancaditalia.it/pubblicazioni/rapporto-annuale/2023/Rapporto-UI… > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa > -- *Avv. Carlo Blengino* *Via Duchessa Jolanda n. 19,* *10138 Torino (TO) - Italy* *tel. +39 011 4474035* Penalistiassociati.it

March 25, 2024