- nexa - server-nexa.polito.it

Affidabilità delle traduzioni automatiche
by Diego Giorio March 19, 2024

March 19, 2024

Questa è decisamente carina. E non ditemi che sono out of topic, perché riguarda l'affidabilità dei sistemi di traduzione automatica. Il paese in questione è naturalmente la cittadina di BRA, opportunamente tradotta in italiano... Saluti a tutti D.

2 1

MEMENTO | Convegno "Tra condivisione e controllo: intelligenza artificiale generativa e licenze aperte nel diritto d'autore" | 20 marzo 2024, ore 17.00
by Nexa - Media March 19, 2024

March 19, 2024

Gentilissime, gentilissimi, Vi ricordiamo che mercoledì 20 marzo, dalle ore 17.00 alle ore 19.00, si terrà il convegno organizzato dal Centro Nexa in collaborazione con l'Ordine degli Avvocati di Torino, dal titolo: "Tra condivisione e controllo: intelligenza artificiale generativa e licenze aperte nel diritto d'autore". Parteciperà all'incontro l'Avv. Deborah De Angelis (Nexa Fellow), in dialogo con il Prof. Maurizio Borghi (co-direttore del Centro Nexa) e l'Avv. Marco Ciurcina (Nexa Fellow). L'evento si terrà IN PRESENZA presso l'Aula Croce della Curia Maxima (Via Corte d'Appello 16, Torino) E ONLINE al seguente indirizzo: https://pyx-is.zoom.us/meeting/register/tZEqcOqgrTMtGdYyL0ziaS92NFo9pzKN3cw2 Per maggiori dettagli è possibile consultare la pagina web dell'incontro: https://nexa.polito.it/tra-condivisione-e-controllo Cordiali saluti, -- Valeria Bergantino Communication Officer Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino web: https://nexa.polito.it/ mail: valeria.bergantino(a)polito.it<mailto:valeria.bergantino@polito.it> tel: 3473443585

1 0

Joe Biden has just dealt a big defeat to big tech | Joseph Stiglitz | The Guardian
by Alberto Cammozzo March 19, 2024

March 19, 2024

<https://www.theguardian.com/business/2024/mar/18/joe-biden-has-just-dealt-a…> Joe Biden has just dealt a big defeat to big tech | Joseph Stiglitz Joseph Stiglitz Last year, Joe Biden’s administration infuriated lobbyists representing big tech firms and others that profit from our personal data by denouncing a proposal that would have gutted domestic data privacy, online civil rights and liberties, and competition safeguards. Now, the US president’s new executive order on Americans’ data security reveals that the lobbyists had good reason to worry. After decades of data brokers and tech platforms exploiting Americans’ personal data without any oversight or restrictions, the Biden administration has announced that it will ban the transfer of certain kinds of data to China and other countries of concern. It is a small, but important, step towards protecting Americans’ sensitive personal information, in addition to government-related data. Moreover, the order is likely a precursor to additional policy responses. Americans are rightly worried about what is happening online, and their concerns extend well beyond privacy violations to a host of other digital harms, such as mis- and disinformation, social media-induced teenage anxiety, and racial incitement. The firms that make money from our data (including personal medical, financial, and geolocation information) have spent years trying to equate “free flows of data” with free speech. They will try to frame any Biden administration public interest protection as an effort to shut down access to news websites, cripple the internet, and empower authoritarians. That is nonsense. Tech companies know that if there is an open, democratic debate, consumers’ concerns about digital safeguards will easily trump concerns about their profit margins. Industry lobbyists thus have been busy trying to short-circuit the democratic process. One of their methods is to press for obscure trade provisions aimed at circumscribing what the US and other countries can do to protect personal data. It might seem obvious that a US president should protect Americans’ privacy and national security, both of which could be jeopardised depending on how and where the vast amounts of data that we all generate are processed and stored. Yet, amazingly, former President Donald Trump’s administration sought to prohibit the US from placing any restrictions on “the crossborder transfer of information, including personal information” to any country if such transfers were related to the business of any investor or service provider operating in the US or other countries signing the agreement. The Trump administration’s proposal to include this rule in the World Trade Organization did provide for one exception, which ostensibly would allow some regulation “necessary to achieve a legitimate public policy objective”, but it was designed not to work in practice. While big tech lobbyists cite the exception to rebut criticism of the broader proposal, the provision’s language comes straight from a WTO “General Exception” that has failed in 46 of 48 attempted uses. The ban on crossborder data regulation was just one of four proposals that big tech lobbyists convinced Trump officials to slip into the revised North American Free Trade Agreement and to propose at WTO-related talks. Written in arcane jargon and buried among hundreds of pages of trade-pact language, these provisions were misleadingly branded as “digital trade” rules. By prohibiting governments from adopting certain policies, the proposal’s industry-written terms threatened bipartisan efforts in the US Congress to counter big tech’s abuses of consumers, workers, and smaller businesses. They also undercut the US regulatory agencies responsible for protecting our privacy and civil rights, and for enforcing antitrust policy. In fact, had the Trump-era rules banning government restrictions on data flows gone into effect at the WTO, they would have barred the Biden administration’s own new data-security policy. Few people realised the Trump-era proposal even existed – except, of course, for the lobbyists who had been quietly commandeering trade talks. While no previous US trade pacts had included provisions pre-empting executive and congressional authority over data regulation, digital platforms suddenly would have been granted special secrecy rights. The kinds of algorithmic assessments and AI pre-screenings that Congress and executive-branch agencies deem critical to protecting the public interest would have been banned. After Trump’s loss in the 2020 election, industry lobbyists still hoped to make these anomalous rules a new norm. Their plan was to get the same provisions added to a Biden administration agreement called the Indo-Pacific Economic Framework. But instead of going with the lobbyists, Biden administration officials worked with Congress to determine that the Trump-era proposals were not compatible with congressional and administration goals for digital privacy, competition, and regulation. Now, we can understand why tech lobbyists were so incensed by the Biden administration’s decision to withdraw support for the Trump-era proposal. They recognised that by casting aside big tech’s favoured “digital trade” handcuffs, the Biden administration was reasserting its authority to regulate the large platforms and data brokers that Americans across the political spectrum think have too much power. Trade agreements have gotten a bad name precisely because of this kind of behaviour by corporate lobbyists. The US needs a robust debate about how best to regulate big tech, and over how to maintain competition while preventing the digital harms that are stoking political polarisation and undermining democracy. Obviously, the debate should not be tethered by constraints imposed surreptitiously by big tech through trade agreements. US trade representative Katherine Tai is exactly right when she says that it would be “policy malpractice” to lock in trade rules limiting action on these matters before the US government has established its own domestic approach. Whatever one’s position on the regulation of big tech – whether one believes that its anti-competitive practices and social harms should be restricted or not – anyone who believes in democracy should applaud the Biden administration for its refusal to put the cart before the horse. The US, like other countries, should decide its digital policy democratically. If that happens, I suspect the outcome will be a far cry from what big tech and its lobbyists were pushing for. Joseph E Stiglitz is a Nobel laureate in economics, university professor at Columbia University and a former chief economist of the World Bank. Ⓒ Project Syndicate

1 0

112° Nexa Lunch Seminar | 27 marzo 2024, ore 13.00
by Nexa - Media March 18, 2024

March 18, 2024

Gentilissime, gentilissimi, Vi invitiamo a partecipare al 112° Nexa Lunch Seminar che si terrà mercoledì 27 marzo, dalle ore 13.00 alle ore 14.00, con un incontro dal titolo: "'Pay or ok': you cannot be serious". Ospite dell'incontro: Marco Giraudo (Università degli Studi di Torino). L'incontro si terrà IN PRESENZA e ONLINE. SEDE FISICA dell'incontro: Campus Luigi Einaudi, Lungo Dora Siena, 100 Edificio D4, II piano, Aula H1 (MAPS<https://www.google.com/maps/place/Campus+Luigi+Einaudi/@45.0734963,7.699408…>) STANZA VIRTUALE dell'incontro: https://didattica.polito.it/VClass/NexaEvent Di seguito maggiori dettagli: https://nexa.polito.it/lunch-112 Cordiali saluti, -- Valeria Bergantino Communication Officer Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino web: https://nexa.polito.it/ mail: valeria.bergantino(a)polito.it<mailto:valeria.bergantino@polito.it> tel: 3473443585

1 0

Leading adviser quits over Instagram’s failure to remove self-harm content | Instagram | The Guardian
by Alberto Cammozzo March 17, 2024

March 17, 2024

<https://www.theguardian.com/technology/2024/mar/16/instagram-meta-lotte-rub…> Leading adviser quits over Instagram’s failure to remove self-harm content A leading psychologist who advises Meta on suicide prevention and self-harm has quit her role, accusing the tech giant of “turning a blind eye” to harmful content on Instagram, repeatedly ignoring expert advice and prioritising profit over lives. Lotte Rubæk, who has been on Meta’s global expert group for more than three years, told the Observer that the tech giant’s ongoing failure to remove images of self-harm from its platforms is “triggering” vulnerable young women and girls to further harm themselves and contributing to rising suicide figures. Such is her disillusionment with the company and its apparent lack of desire to change, the Danish psychologist has resigned from the group, claiming Meta does not care about its users’ wellbeing and safety. In reality, she said, the company is using harmful content to keep vulnerable young people hooked to their screens in the interest of company profit. In her resignation letter, she wrote: “I can no longer be part of Meta’s SSI expert panel, as I no longer believe that our voice has a real positive impact on the safety of children and young people on your platforms.” In an interview with the Observer, Rubæk said: “On the surface it seems like they care, they have these expert groups and so on, but behind the scenes there’s another agenda that is a higher priority for them.” That agenda, she said, was “how to keep their users’ interaction and earn their money by keeping them in this tight grip on the screen, collecting data from them, selling the data and so on.” A Meta spokesperson said: “Suicide and self-harm are complex issues and we take them incredibly seriously. We’ve consulted with safety experts, including those in our suicide and self-harm advisory group, for many years and their feedback has helped us continue to make significant progress in this space. “Most recently we announced we’ll hide content that discusses suicide and self-harm from teens, even if shared by someone they follow, one of many updates we’ve made after thoughtful discussion with our advisers.” Rubæk’s warning comes as new research by Ofcom published last week found that violent online content is “unavoidable” for children in the UK, many of whom are first exposed when still in primary school. Among the main apps mentioned by those interviewed was Instagram. Rubæk, who leads the self-injury team in child and adolescent psychiatry in the Capital Region of Denmark, was first approached about joining the select group of experts – which has 24 publicly listed members – in December 2020. The invite came after she publicly criticised Meta, then known as Facebook, over an Instagram network linked to suicides of young women in Norway and Denmark following a documentary by Danish broadcaster DR. She agreed to join in the hope of helping to change the platform to make it safer for young people. After a couple of years of having her suggestions ignored – the original network she was critical of still exists – she came to the conclusion that the panel was just for show. Now she believes the invitation could have been an attempt to silence her. “Maybe they wanted me to be a part of them so I wouldn’t be so critical of them in the future.” In emails seen by the Observer Rubæk raised the difficulties users faced in trying to report potentially triggering images with Meta in October 2021. In correspondence with Martin Ruby, Meta’s head of public policy in the Nordics, she said she had tried to report an image of an emaciated female but received a message from Instagram saying they did not have enough moderators to look at the image, which stayed on the platform. In response, Ruby said in November 2021: “Our people are looking at it, but it is not that simple.” In the same email, he mentioned the secret Instagram network that Rubæk had originally criticised, saying that Meta was “taking a closer look”. But despite its well-documented links to suicides, Rubæk says the network remains up and running today. Rubæk’s patients tell her they have tried to report self-harm images on Instagram but they often remain. One client said that after reporting one image, it vanished, but she later saw it via a friend’s account, suggesting it had only been moved from her view. Meta “does a lot of tricks” to get around removing content, said Rubæk. “The AI is so clever, finding even the smallest nipple in a photo.” But when it comes to graphic pictures of self-harm that are proven to inspire others to harm themselves, she added, it appears to be a different story.

1 0

Fwd: [mpiwg-announce] AI and Digital seminar series
by J.C. DE MARTIN March 16, 2024

March 16, 2024

> > *From: *Etienne Benson <ebenson(a)mpiwg-berlin.mpg.de> > *Subject: **[mpiwg-announce] Fwd: AI and Digital seminar series* > *Date: *March 15, 2024 at 5:11:43 PM GMT+1 > *To: *Mpiwg Announce <mpiwg-announce(a)mpiwg-berlin.mpg.de> > >> AI and the Digital - Final Poster PNG copy.jpeg

1 0

The Software Heritage Archive wants to deadname me forever: part 1
by Giacomo Tesio March 15, 2024

March 15, 2024

When I first contacted them, politely, they didn't even respond to me. What happened instead was that their content policy changed from a standard EU content policy to one that is very defensive about their ability to archive personal data forever with no exceptions. [...] The reason they can't just change references to your deadname, like any decent person would, is vaguely because of "integrity" (the common refrain of transphobic cowards), but more specifically because they made a fucking immutable blockchain out of it. [...] You can guess what happened next: I fucking exploded at them on Twitter. This got a faster reaction than anything else I'd seen in the process. The rant against changing names in the content policy disappeared again. One of the developers went to my DMs to tell me condescendingly that I'd understood it wrong. It wasn't a blockchain, he explained, it's just a Merkle tree, like Git, because we copied your Git repository. I screenshotted their documentation that said "blockchain". [...] He said, but we have to do that, what if someone wanted to cite your code in a paper? You can't just change a citation. I pointed out that you can just change a citation if it's wrong, and that I've gotten citations that deadname me changed. I pointed out that people cite my code under my correct name through Zenodo, not through whatever cryptographic bullshit SWH was dreaming up. He said, well anyway, I don't see why this is our problem. You can't even change your name in your own repository! Imagine if people could just change history ha ha I pointed him at my Git repository that I had already mutated using git-filter-repo. He stopped replying. Continua su https://cohost.org/arborelia/post/4968198-the-software-heritag Questa storia presenta molti aspetti politicamente interessanti. Anzitutto evidenzia come l'ignoranza tecnica causi alienazione cibernetica dove meno ce la si aspetta: modificare un repository git è facilissimo, SH avrebbe potuto riclonarlo in pochi minuti da github già aggiornato e con qualche giorno di lavoro avrebbe anche potuto introdurre dei redirect dalle url con i vecchi hash a quelle con i nuovi. MA, non sapendolo, hanno tirato su questo ridicolo muro di gomma, trattando una persona che esercita i propri diritti come un problema di conformità alla macchina: in sintesi credendo che la macchina non si possa adattare ai diritti di una persona, si chiede a quella persona di rinunciare ai propri diritti. Non è la prima e non sarà l'ultima volta, ma questa volta al posto della mistica "AI" troviamo semplici repository GIT. E poi interessantissimo come tale ignoranza/alienazione venga scambiata per transfobia dall'autrice che definisce "transphobic" "white cis" i dirigenti della Software Heritage. Un'accusa ovviamente infondata, ma che non può non richiamare alla memoria un'accusa altrettanto strumentale sottoscritta da alcuni di quei dirigenti contro un'altra vittima [1]. In quell'occasione però, misogynist, ableist e transphobic era una singola persona, definita come "forza pericolosa" e indicata con nome e cognome. In secondo luogo porta alla luce come, anche nella civilissima Francia, i DPO dimentichino spesso lo scopo del proprio ruolo: garantire la protezione dei dati personali, non degli interessi dei propri clienti. Fortunatamente in questo caso, la caparbietà del richiedente potrebbe far coincidere la negligenza del DPO (che avrebbe dovuto dar seguito alla richiesta di esercizio dei diritti, non riscrivere la privacy policy sperando di esentare la Software Heritage) con un meritatissimo danno di immagine al proprio cliente. In terzo luogo, è interessantissimo come l'esercizio dei diritti sia dovuto passare da Twitter. È interessante non solo perché rende evidente come chi ha partecipato o scatenato gogne come quella subita anni fa da Stallman, le teme molto di più di quanto non tema un Garante serio come quello francese. E d'altro canto, si tratta di un timore infondato: Twitter non ha alcuna ragione di catalizzare uno shitstorm contro una organizzazione finanziata, fra gli altri da Google, Microsoft, Intel e molti altre aziende con interessi strategici affini [2]. Stallman invece può davvero sembrare "una forza pericolosa nel software libero" per quegli interessi. [3] Infine sarà interessante vedere come andrà a finire (sembra che l'autrice si stia preparando a dare battaglia sul piano legale). Personalmente scommetto che finirà tutto a tarallucci e vino: un bel blog di scuse con tanto di ringraziamento nei confronti dell'autrice e di auto-assoluzione, la sostituzione del nome, una vittoria giustamente sbandierata dalla stessa autrice (e probabilmente strumentalizzata da qualche movimento). Alla fine, questa volta, il diritto verrà esercitato con successo. Speriamo ne nasca un precedente utile per tutti! Giacomo [1] https://rms-open-letter.github.io/ [2] https://www.softwareheritage.org/support/sponsors/ [3] che lo sia ancora, in realtà, non saprei dirlo...

4 15

AI models with systemic risk
by Antonio March 15, 2024

March 15, 2024

Articolo 52 dell'AI Act [1]. Classification of general-purpose AI models as general-purpose AI models with systemic risk ... 2. A general-purpose AI model shall be presumed to have high impact capabilities pursuant to paragraph 1, point (a), when the cumulative amount of computation used for its training measured in FLOPs is greater than 10^25 Dato che quel 10^25 è il discrimine tra AI a rischio sistemico e AI non a rischio sistemico, bisogna essere chiari. Cosa intendeva il legislatore per FLOPs ? Plurale di FLOP, ovvero, QUANTITA' di operazioni in virgola mobile, oppure FLOP al secondo, ovvero, operazioni in virgola mobile AL SECONDO ? In entrambi i casi è sbagliato. Nel primo, è un errore "morfologico", il plurale di FLOP è FLOPS, non FLOPs. Nel secondo, ovvero nel caso il significato fosse di FLOP/s, in questo caso è un errore "matematico" di stima, perché 10^25 è milioni di volte superiore alla "potenza" dei vari GPT4, Gemini, ecc. FLOPs vs FLOPS When dealing about computing effort and computing speed (hardware performance), terminology is usually confusing. The term ‘compute’ is usually ambiguous, sometimes applied for a number of operations or the number of operations per second. However, it is important to clarify what kind of operations and the acronyms for them. In this regard, we will use the acronym FLOPS to measure hardware performance, by referring to the number of floating point operations per second, as standardised in the industry, while FLOPs will be applied to the amount of computation for a given task (e.g., a prediction or inference pass), by referring to the number of operations, counting a multiply-add operation pair as two operations. For instance, we found out that the acronym FLOP may be misleading. By FLOP, we mean one floating point operation, a measure of the amount of compute (computing effort) and by FLOPS, we mean floating point operations per second, i.e., FLOPS = FLOP/s. However, many papers, especially CV papers, use the terms FLOPs and FLOPS to refer to the number of operations, but we will be just use FLOPs as the plural of FLOP, never as FLOPS. Then there is the question of what a FLOP is. When dealing with DNN, this is usually associated with the number of multiply-add operations, even there are other type of operations involved when executing a DNN. This is done this way because it is usually a good estimation [Hollemans, 2018, Clark et al., 2020]. More specifically, we will count one fused multiply-add operation as 2 FLOPs (note the lowercase ‘s’). Hardware manufacturers count them in this manner [NVIDIA, 2015], because in fact there are two mathematical operations. However, CV research papers count a multiply-add operation as only one operation. In this case, we will multiply the number of operations reported by 2. In sum, the acronym FLOPS will be applied to measure hardware performance, by referring to the number of floating point operations per second, as standardised in the industry, while FLOPs will be applied to the amount of computation for a given task (e.g., a prediction or inference pass), by referring to the number of operations, counting a multiply-add operation pair as two operations." [2] A. [1] https://www.europarl.europa.eu/doceo/document/TA-9-2024-0138_EN.pdf [2] https://arxiv.org/pdf/2109.05472.pdf

1 0

How Facebook Messenger and Meta Pay are used to buy child sexual abuse material | Technology | The Guardian
by Alberto Cammozzo March 15, 2024

March 15, 2024

<https://www.theguardian.com/global-development/2024/mar/14/facebook-messeng…> How Facebook Messenger and Meta Pay are used to buy child sexual abuse material When police in Pennsylvania arrested 29-year-old Jennifer Louise Whelan in November 2022, they charged her with dozens of counts of serious crimes, including sex trafficking and indecent assault of three young children. One month earlier, police said they had discovered Whelan was using three children as young as six, all in her care, to produce child sex abuse material. She was allegedly selling and sending videos and photos to a customer over Facebook Messenger. She pleaded not guilty. The alleged buyer, Brandon Warren, was indicted by a grand jury in February 2022 and charged with nine counts of distribution of material depicting minors engaged in sexually explicit conduct. Warren also pleaded not guilty. Court documents seen by the Guardian quote Facebook messages between the two in which Warren allegedly describes to Whelan how he wants her to make these videos. “I’ll throw in a little extra if you tell him it makes mommy feel good and get a good length video,” he tells Whelan, according to the criminal complaint document used for her arrest. Whelan received payment for the footage over Meta Pay, Meta’s payment system, according to the criminal complaint against him. “Another 250 right? Heehee,” she allegedly wrote to Warren after sending him a video of her abusing a young girl. Meta Pay, known as Facebook Pay before rebranding in 2022, is a peer-to-peer payment service enabling users to transfer money over the company’s social networks. Users upload their credit cards, debit cards or PayPal account information to Facebook Messenger or Instagram to send and receive money. A spokesperson for Meta confirmed that the company has seen and reported payments via Meta Pay on Facebook Messenger that are suspected of being linked to child sexual exploitation. “Child sexual exploitation is a horrific crime. We support law enforcement in its efforts to prosecute these criminals and invest in the best tools and expert teams to detect and respond to suspicious activity. Meta reports all apparent child sexual exploitation to NCMEC [the National Center of Missing and Exploited Children], including cases involving payment transactions,” the spokesperson said. Through reviewing documents and interviewing former Meta content moderators, a Guardian investigation has found that payments for child sexual abuse content taking place on Meta Pay are probably going undetected, and unreported, by the company. Court documents show Whelan and Warren’s actions were not spotted or flagged by Meta. Instead, Kik Messenger, another social platform, reported Warren had uploaded videos suspected to be child sexual abuse material (CSAM) to share with other users. This triggered a police investigation in West Virginia, where Warren lives. His electronics were seized, and police then discovered the eight videos and five images that he had allegedly bought from Whelan over Facebook Messenger. “We responded to valid legal process,” said a Meta spokesperson, in response to the Guardian’s findings that the company did not detect these crimes. Additionally, two former Meta content moderators, employed between 2019 and 2022, told the Guardian that they saw suspicious transactions taking place via Meta Pay that they believed to be related to child sex trafficking, yet they were unable to communicate with Meta Pay compliance teams to flag these payments. “It felt like [Meta Pay] was an easy-to-use payment method since these people were communicating on Messenger. The amounts sent could be hundreds of dollars at a time,” says one former moderator, who spoke under the condition of anonymity because they had to sign a non-disclosure agreement as a condition for employment. The moderator, employed for four years until mid-2022 by Accenture, a Meta contractor, reviewed interactions between adults and children over Facebook Messenger for inappropriate content. Payments for sex or CSAM are typically just a few hundred dollars or less in cases reviewed by the Guardian. According to the former Meta compliance analyst, transactions of such small amounts are unlikely to be flagged for review by Meta’s systems. This means that payments connected to illicit activities are probably taking place undetected, financial crimes experts said. A Meta spokesperson said that the company uses a combination of automated and human review to detect suspicious financial activity in payment transactions in Messenger. “The size of the payment is just one signal our teams use to identify potentially suspicious activity, and our compliance analysts are trained to assess a variety of signals,” said the Meta spokesperson. “If our teams had reason to suspect suspicious activity, especially activity involving a child and even if the payments are small, it would be investigated and reported appropriately.” The spokesperson also said that the company had “a strong ‘see something, say something’ culture”. For situations where American men were targeting underage girls abroad to groom, payments could be for things like getting a phone and school supplies, the moderator said. “Most of what we saw were older men from America, targeting girls in Asian countries and often travelling there,” the moderator added. “When it comes to child exploitation and CSAM, it’s really all about small amounts,” said Silvija Krupena, director of the financial intelligence unit at RedCompass Labs, a London-based financial consultancy. “It’s a global crime and criminals, with different types of offenders. In low-income countries like the Philippines, $20 is big money. The production usually happens in those countries. These are small amounts that can fall through the cracks when it comes to traditional money-laundering controls.” Meta has a team of about 15,000 moderators and compliance analysts who are tasked with monitoring its platforms for harmful and illegal content. Possible criminal behavior is supposed to be escalated by Meta and reported to law enforcement. Anti-money laundering regulations also require money service businesses to train their compliance staff to have access to enough information to be able to detect when illegal financing occurs. Yet contractors monitoring Meta Pay transaction activity do not receive specific training for detecting and reporting money flows that could be related to human trafficking, including the language, codewords and slang that traffickers typically use, a former Meta Pay payment compliance analyst contractor said. “If a human trafficker is using a codeword for selling girls, we didn’t get into that. We didn’t really get trained on those,” said the former compliance analyst. “You don’t even give it a second thought or even dig into that kind of stuff at all.” A Meta spokesperson disputed the payment compliance analyst’s claims. “Compliance analysts receive both initial and ongoing training on how to detect potentially suspicious activity – which includes signs of possible human trafficking and child sexual exploitation. Our program is regularly updated to reflect the latest guidance from financial crime regulators and safety experts,” the spokesperson said. Meta’s history with accusations of child exploitation Meta’s platforms have been linked to alleged child exploitation and the distribution of CSAM in the past. In December, the New Mexico attorney general’s office filed a lawsuit against the company, alleging Facebook and Instagram are “breeding grounds” for predators targeting children for human trafficking, grooming and solicitation. The suit followed an April 2023 Guardian investigation, which revealed how child traffickers were using Meta’s platforms to buy and sell children into sexual exploitation. As a money services business, Meta Pay is subject to the US anti-money laundering and “know your client” (KYC) banking regulations, which require businesses to report illicit financing to the US treasury department’s Financial Crimes Enforcement Network (FinCEN). If Meta fails to detect and report these payments, it could be in violation of US anti-money laundering laws, financial crimes experts have said. “Regulations apply to any company that participates in a payments business. But for social media because they can see users, they see their lives, their transactions, they can see abuse and see contact. It’s such a low-hanging fruit for them to detect this,” said Krupena. Other peer-to-peer payment apps have faced scrutiny for their practices in preventing illicit activity. In 2023, Senate Democrats requested detailed fraud detection and prevention methods from PayPal, Venmo and Cash App. Sex trafficking “ran rampant” on Cash App, according to a report last year by US investment research firm Hindenburg. Block, Cash App’s owner, disputed these claims, threatening legal action. Meta introduced end-to-end encryption to Facebook Messenger in late 2023, but even before this, payment compliance analyst contractors could not access the Messenger chat between the two users exchanging funds. The former Meta compliance analyst told the Guardian their team could only see transactions with notes and the relationship between the two users. “I don’t know how you do compliance in general without being able to see intentions around transacting,” said Frances Haugen, a former Facebook employee turned whistleblower, who released tens of thousands of damaging documents about its inner workings in 2021. “If the platforms actually wanted to keep these kids safe, they could.” Siloed work prevents flagging suspicious transactions, say ex-moderators Other former content moderators interviewed by the Guardian compared their jobs to call center or factory work. Their jobs entailed reviewing content flagged as suspicious by users and artificial intelligence software and making quick decisions on whether to ignore, remove or escalate the content to Meta through a software program. They say they could not communicate with the Meta Pay compliance analysts about suspicious transactions they witnessed. “We were not allowed to contact Facebook employees or other teams,” one former moderator said. “Our managers didn’t tell us why this was.” Gretchen Peters, who is the executive director of the Alliance to Counter Crime Online, has documented the sale of narcotics, including fentanyl, over Meta’s platforms. She also interviewed Meta moderators who were not permitted to communicate with other teams in the company. She said this siloing was a “major violation” of “know your customer” banking regulations. “We’ve heard from moderators at Meta they can see illegal conduct is occurring and that there are concurrent transactions through Meta Pay, but they have no way of communicating what they are seeing internally to moderators at Meta Pay,” said Peters. A Meta spokesperson said the company prohibits the sale or purchasing of narcotics on its platforms and removes that content when it finds it. “Meta complies with all applicable US anti-money laundering laws,” the spokesperson said. “It is also untrue to suggest that there is a lack of communication between teams. Content moderators are trained to escalate to a specific point of contact, who brings in the appropriate specialist team.” In December, Meta announced it had rolled out end-to-end encryption for messages sent on Facebook and via Messenger. Encryption hides the contents of messages from anyone but the sender and intended recipient by converting text and images into unreadable cyphers that are unscrambled on receipt. Yet this move could also affect the company’s ability to prevent illicit transactions on Meta Pay. Child safety experts, policymakers, parents and law enforcement criticized the move, arguing encryption obstructs efforts to rescue child sex trafficking victims and the prosecution of predators. “When Meta Pay is linked to Messenger or Instagram, the messages associated with payments could uncover illicit behaviors,” said Krupena. “Now that this context is removed, the implications are significant. It almost feels like encryption is inadvertently facilitating illicit activity. This opens many opportunities for criminals to hide in plain sight.” A Meta spokesperson said the decision to move to encryption was to “provide people with privacy”, and that the company encourages users to self-report private messages related to child exploitation to the company. “Moving to an encrypted messaging environment does not mean we will sacrifice safety, and we have developed over 30 safety tools, all of which work in encrypted messaging,” said the spokesperson. “We’ve now made our reporting tools easier to find, reduced the number of steps to report and started encouraging teens to report at relevant moments.” FinCEN declined to comment. PayPal did not respond to a request for comment.

1 0

Identifying software (and software bill of materials).
by 380° March 14, 2024

March 14, 2024

Buonasera, segnalo un articolo un po' tecnico che illustra cosa significa identificare univocamente i "software artifact", specialmente quando in forma binaria, che è la forma particolarmente problematica del software... da sempre :-) «Identifying software» Ludovic Courtès, Maxim Cournoyer, Jan Nieuwenhuizen, Simon Tournier — March 4, 2024 https://guix.gnu.org/en/blog/2024/identifying-software/ --8<---------------cut here---------------start------------->8--- [...] 1 On Software Identification ════════════════════════════ The /Software Identification Ecosystem Option Analysis/ white paper released by CISA in October 2023 studies options towards the definition of /a software identification ecosystem that can be used across the complete, global software space for all key cybersecurity use cases/. Our experience lies in the design and development of [GNU Guix], a package manager, software deployment tool, and GNU/Linux distribution, which emphasizes three key elements: *reproducibility, provenance tracking, and auditability*. We explain in the following sections our approach and how it relates to the goal stated in the aforementioned white paper. Guix produces binary artifacts of varying complexity from source code: package binaries, application bundles (container images to be consumed by Docker and related tools), system installations, system bundles (container and virtual machine images). All these artifacts qualify as “software” and so does source code. Some of this “software” comes from well-identified upstream packages, sometimes with modifications added downstream by packagers (patches); binary artifacts themselves are the byproduct of a build process where the package manager uses /other/ binary artifacts it previously built (compilers, libraries, etc.) along with more source code (the package definition) to build them. How can one identify “software” in that sense? Software is dual: it exists in /source/ form and in /binary/, machine-executable form. The latter is the outcome of a complex computational process taking source code and intermediary binaries as input. Our thesis can be summarized as follows: *We consider that the requirements for source code identifiers differ from the requirements to identify binary artifacts.* Our view, embodied in GNU Guix, is that: 1. *Source code* can be identified in an unambiguous and distributed fashion through /inherent identifiers/ such as cryptographic hashes. 2. *Binary artifacts*, instead, need to be the byproduct of a /comprehensive and verifiable build process itself available as source code/. In the next sections, to clarify the context of this statement, we show how Guix identifies source code, how it defines the /source-to-binary/ path and ensures its verifiability, and how it provides provenance tracking. [GNU Guix] <https://guix.gnu.org> [...] As with Nix, build processes are identified by /derivations/, which are low-level, content-addressed build instructions; derivations may refer to other derivations and to source code. For instance, `/gnu/store/c9fqrmabz5nrm2arqqg4ha8jzmv0kc2f-gcc-11.3.0.drv' uniquely identifies the derivation to build a specific variant of version 11.3.0 of the GNU Compiler Collection (GCC). Changing the package definition—patches being applied, build flags, set of dependencies—, or similarly changing one of the packages it depends on, leads to a different derivation (more information can be found in [Eelco Dolstra's PhD thesis]). Derivations form a graph that *captures the entirety of the build processes leading to a binary artifact*. In contrast, mere package name/version pairs such as `gcc 11.3.0' fail to capture the breadth and depth elements that lead to a binary artifact. This is a shortcoming of systems such as the *Common Platform Enumeration* (CPE) standard: it fails to express whether a vulnerability that applies to `gcc 11.3.0' applies to it regardless of how it was built, patched, and configured, or whether certain conditions are required. [reproducible builds] <https://reproducible-builds.org> [Nix package manager] <https://nixos.org> [Eelco Dolstra's PhD thesis] <https://edolstra.github.io/pubs/phd-thesis.pdf> [...] 5 Provenance Tracking ═════════════════════ We define provenance tracking as the ability *to map a binary artifact back to its complete corresponding source*. Provenance tracking is necessary to allow the recipient of a binary artifact to access the corresponding source code and to verify the source/binary correspondence if they wish to do so. [...] In other words, because Guix itself defines how artifacts are built, *the revision of the Guix source coupled with the package name unambiguously identify the package's binary artifact*. As scientists, we build on this property to achieve reproducible research workflows, as explained in this [2022 article in /Nature Scientific Data/]; as engineers, we value this property to analyze the systems we are running and determine which known vulnerabilities and bugs apply. Again, a software bill of materials (SBOM) written as a mere list of package name/version pairs would fail to capture as much information. The *Artifact Dependency Graph (ADG) of [OmniBOR]*, while less ambiguous, falls short in two ways: it is too fine-grained for typical cybersecurity applications (at the level of individual source files), and it only captures the alleged source/binary correspondence of individual files but not the process to go from source to binary. [`guix pack'] <https://guix.gnu.org/manual/en/html_node/Invoking-guix-pack.html> [the `time-machine' command] <https://guix.gnu.org/manual/en/html_node/Invoking-guix-time_002dmachine.html> [2022 article in /Nature Scientific Data/] <https://doi.org/10.1038/s41597-022-01720-9> [OmniBOR] <https://omnibor.io/> [...] --8<---------------cut here---------------end--------------->8--- -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

1 0