- nexa - server-nexa.polito.it

Military intelligence buys location data instead of getting warrants
by Giovanni Biscuolo Jan. 25, 2021

Jan. 25, 2021

Buongiorno, nulla di nuovo sotto la coltre, solo che di tanto in tanto qualcuno scopre un interessante tassello del puzzle del Panopticon. Pare, si dice, che la Defence Intellicence Agency (del governo USA specializzata in intelligence militare) sostenga di non aver affatto bisogno di un mandato per ottenere i metadati aggregati dagli smartphones DEGLI STATUNITENSI: basta comperarli sul mercato. Altre (relativamente) recenti inchieste hanno evidenziato che la stessa indentica pratica è utilizzata da altre agenzie governative USA civili. Se lo fanno con gli statunitensi vi lascio solo immaginare cosa non fanno con il resto del mondo, dove praticamente tutte le agenzie - in primis la NSA - hanno sostanzialmente carta bianca avendo esplicito mandato di tutelare gli interessi USA qualsiasi cosa questo voglia dire, ma proprio QUALSIASI. Siccome SAPPIAMO che la raccolta a strascico di tonnellate di questi dati avviene per la maggior parte attraverso l'intera Internet e non solo al sottoinsieme dei device smartphone e SOPRATTUTTO non solo per i "soli" dati di geolocalizzazione, ci possiamo fare (ANCORA?) un'idea di che tipo di "commercio" stiamo parlando. Infine, siccome sappiamo bene come funziona il "mercato" (traffico?) dei dati attraverso il combinato disposto dei monopoli de facto e dei "data cartels" [1] allora capite bene che quello di cui stiamo parlando è un sistema dal quale difficilmente usciremo se non cambiamo drasticamente paradigma nella (ri)valutazione SCIENTIFICA degli strumenti TECNICI utilizzati nelle telecomunicazioni. A meno che si vogliano trascorrere i prossimi vent'anni a discutere ancora di come regolamentare il funzionamento di un Panopticon, che Panopticon rimarrà comunque lo si giri. https://web.archive.org/web/20210122173031/https://www.nytimes.com/2021/01/… (c'è un pertugino nel paywall, toh!) --8<---------------cut here---------------start------------->8--- A military arm of the intelligence community buys commercially available databases containing location data from smartphone apps and searches it for Americans’ past movements without a warrant, according to an unclassified memo obtained by The New York Times. --8<---------------cut here---------------end--------------->8--- https://arstechnica.com/tech-policy/2021/01/military-intelligence-buys-loca… --8<---------------cut here---------------start------------->8--- [...] The Supreme Court held in its 2018 Carpenter v. United States ruling that the government needs an actual search warrant to collect an individual's cell-site location data. "When the Government tracks the location of a cell phone it achieves near perfect surveillance [...] " The reality of the market, however, has created a big fat loophole: There are countless entities on the private market that scoop up, collate, and resell all kinds of personal data from basically everyone in the country. So instead of doing their own searches, law enforcement agencies are just buying the data they want. Last summer, for example, media reports found that Customs and Border Patrol buys license plate scanner data to track individuals' movements. Later reports also revealed that CBP and Immigration and Customs Enforcement buy cell phone location data—information the agencies would otherwise be required to get a search warrant to obtain. The Department of Homeland Security inspector general in December opened an investigation to determine if these tactics "adhered to policies related to cell-phone surveillance devices." The Secret Service, IRS, and other agencies have also purchased mobile location data, according to media reports. The DIA explains in the memo that it simply does not think the Carpenter ruling applies to it. "DIA does not construe the Carpenter decision to require a judicial warrant endorsing purchase or use of commercially-available data for intelligence purposes," the agency wrote. "DIA's acquisition, use, and storage of commercial geolocation data is governed" not by these civilian law enforcement rules but by the DoD's own "Attorney General-approved data handling requirements." --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] https://server-nexa.polito.it/pipermail/nexa/2021-January/019760.html -- Giovanni Biscuolo

1 0

Memento | 84° Nexa Lunch Seminar | 27 Gennaio 2021
by Nexa Media Jan. 25, 2021

Jan. 25, 2021

Gentilissimi, vi ricordiamo che *mercoledì 27 gennaio, dalle ore 13.00 alle ore 14.00*, si svolgerà l'84° Nexa Lunch Seminar, con un incontro dal titolo: **"eXplainable AI for Everyone. Interpretare l'intelligenza artificiale attraverso le tecnologie semantiche"*.* Ospite: /*Giuseppe Futia*//(Centro Nexa su Internet & Società)/. L'incontro si svolgerà in *modalità telematica*, utilizzando il software open source di conference call *Jitsi Meet*. Per chi vorrà partecipare live al seminario sarà possibile accedere alla conference call attraverso il seguente link: https://meet.nexacenter.org/LunchSeminar <https://meet.nexacenter.org/LunchSeminar> Maggiori informazioni sull'incontro sono disponibili alla pagina: https://nexa.polito.it/lunch-84 <https://nexa.polito.it/lunch-84> Cordiali saluti,   -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino _web:_ https://nexa.polito.it/ <https://nexa.polito.it/> _mail:_anita.botta@polito.it <mailto:anita.botta@polito.it> tel: 011 090 7219

1 0

We may Soon have City-Spanning 900 HMz Mesh Networks
by Alberto Cammozzo Jan. 25, 2021

Jan. 25, 2021

<https://cheapskatesguide.org/articles/900mhz-mesh.html/> We may soon have city-spanning public mesh networks that can be used to send text messages and emails and lightly surf the Internet. They may even be useful for voice communication. My guess is that this may happen within the next two to five years, thanks to Amazon's decision <https://techcrunch.com/2019/09/25/amazon-sidewalk-is-a-new-long-range-wirel…> to put 900 MHz radios in some of its devices. The dream of having large standalone and Internet-connected public mesh networks has been alive for years. User-run, wifi-based mesh networks already exist in some areas where Internet service providers are not willing to provide internet service. Unfortunately, it turns out that stringing together a large number of wifi devices that have a range of only about 300 feet under ideal conditions does not work very well, even when high-gain antennas are used. So far, wifi has been the only economically viable option for public mesh networks, because wifi already exists. This means two things: 1) consumers can legally use wifi frequencies for short-range communication without any kind of license, and 2) consumers already have wifi devices in their homes. The problem is that a catch-22 exists for new mesh network technologies. We are very unlikely to have city-spanning mesh networks until we have inexpensive longer-range radio hardware, and we will probably not have inexpensive longer-range radio hardware until enough of us are already using it to make others want to join a mesh network. One good example is the goTenna. The company incorporated in 2013. A few years later, goTennas were in use all over the United States, and users appeared to be well on their way to creating city-wide mesh networks. Lately, however, the number of goTennas in operation <https://imeshyou.gotennamesh.com/> seems to have declined. Aside from the cost ($189 for two units) and the limited usefulness of the goTenna, it seems that not enough users were attracted to the networks to fill the coverage holes that would have had to be filled to make them really useful. What seems to be required as the basis of a mesh network in areas that already have Internet service is a longer-range wireless device that is already widely used for something else. Once the hardware exists in sufficient quantities to fill the potential coverage holes, the last hurdle is for programmers to write good mesh-networking software to string the hardware together. In other words, we can end the mesh networking catch-22 simply by giving consumers another reason to put longer-range, license-free wireless devices in their homes. Enter, Amazon's Sidewalk mesh network. This is a mesh network that Amazon is beginning to create using its Ring products and Amazon Echos. These devices were already selling well and providing services completely unrelated to mesh networking. So, Amazon decided to add a new feature. It began shipping these devices with low-power, built-in 900 MHz radios using the LoRa protocol <https://en.wikipedia.org/wiki/LoRa> for extending the range. Amazon was not initially using the 900 MHz radios as a selling point, because no Sidewalk mesh network existed. Apparently, this has been going on secretly for quite a while, because second generation Amazon Echos (which came out in October 2016) are compatible with Sidewalk. Not until recently has Amazon begun putting the 900 MHz radios to use. Amazon recently tested its Sidewalk network in Los Angeles <https://www.techradar.com/news/what-is-amazon-sidewalk-and-how-will-it-impa…>. Even though LoRa has a range of over 10 Km in rural areas, Amazon says its devices have a typical range of between 500 meters and a mile in urban areas, which is sixteen times the range of wifi. Of course, based on the past behavior of just about every other company that has ever brought a new product to market, we can expect that Amazon will do everything in its power to lock every non-Amazon-sanctioned device out of its network. IBM initially tried to prevent competing manufacturers from making products compatible with the IBM PC. Apple still does this in a number of ways with its products. So, the fact that Amazon will likely try to hog its network for itself and milk it for every penny it is worth should come as no surprise. One must also assume that Amazon will do its best to encrypt its network traffic and make its devices as hard to hack as possible. Despite Amazon's best efforts to keep its network for itself, it will likely fail. Even if it succeeds, history has shown time and time again that once an innovative product hits the market, copycat products immediately appear. So, one way or another, we may soon have cheap, open source, 900 MHz devices that are capable of being coordinated into city-spanning public mesh networks. Amazon says its Sidewalk network has a maximum transmission bandwidth of 80 Kb/s <https://www.slashgear.com/what-is-amazon-sidewalk-shared-iot-neighborhood-n…>. That is faster than the fastest dial-up modems we had in the 1990's, so it is more than adequate for sending text messages and text-only email and surfing the Internet with a text-only browser like Lynx. Networks like Gopher and Gemini are even better targets. The text of this webpage can be downloaded using an 80 Kb/s connection in less than a fifth of a second. Sidewalk should also be fast enough for voice communication under good conditions. This means in two to five years we may be able to surf the internet or talk on our 900 MHz phones while walking down the sidewalk in nearly any city whose occupants own Amazon or other competing devices. We may also be able to do this very cheaply. Individuals who do not currently use the Internet enough to justify paying an ISP for a home Internet connection may be willing to pay a small monthly charge to use the new mesh networks. Once a new technology catches on, we eventually overcome the inevitable problems and find ways of making it better and faster. A 900 MHz network is likely to suffer from massive congestion soon after it first catches on, but just as we dealt with this with wifi, we can also deal with it with 900 MHz networks. All we need is enough of an incentive. Let's hope we are intelligent enough to sufficiently value the inexpensive, robust solution to the last mile problem that 900 MHz mesh networks should provide. Soon, the mobile phones for which we are now paying $40 US per month or more may work for practically no cost. Won't it be interesting to watch our widely-hated wireless telecommunication companies struggle to stay in business? If you have found this article worthwhile, please share it on your favorite social media. You will find sharing links at the top of the page.

1 0

Papa Francesco e la comunicazione
by don Luca Peyron Jan. 25, 2021

Jan. 25, 2021

Nella comunicazione nulla può mai completamente sostituire il vedere di persona. *Alcune cose si possono imparare solo facendone esperienza. *Non si comunica, infatti, solo con le parole, ma con gli occhi, con il tono della voce, con i gesti. La forte attrattiva di Gesù su chi lo incontrava dipendeva dalla verità della sua predicazione, ma l’efficacia di ciò che diceva era inscindibile dal suo sguardo, dai suoi atteggiamenti e persino dai suoi silenzi. Buona lettura e buona settimana dl http://www.vatican.va/content/francesco/it/messages/communications/document… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Selinger: A Premature Eulogy for Privacy - Los Angeles Review of Books
by J.C. DE MARTIN Jan. 25, 2021

Jan. 25, 2021

https://lareviewofbooks.org/article/a-premature-eulogy-for-privacy/ (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

The Ethics of Facial Recognition Technology by Evan Selinger, Brenda Leong :: SSRN
by J.C. DE MARTIN Jan. 23, 2021

Jan. 23, 2021

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3762185 (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Da Washington all'Uganda...
by M. Fioretti Jan. 23, 2021

Jan. 23, 2021

o in qualsiasi altro paese, come si fanno propaganda e censura politica dipende da cosa e' successo prima negli USA: https://stop.zona-m.net/2021/01/i-have-seen-the-laptop-of-the-future/ -- Help me to continue my digital awareness blogging: https://stop.zona-m.net/christmas-2020-fundraising/

1 0

Doctorow, "Call center workers pay for the privilege"
by J.C. DE MARTIN Jan. 23, 2021

Jan. 23, 2021

*Call center workers pay for the privilege* /Propublica breaks open the massive, secretive abuser Arise, fronted by Disney, Airbnb, Intuit, Comcast, Carnival and more. / /Cory Doctorow// / https://pluralistic.net/2020/10/02/chickenized-by-arise/#arise If you only learn one technical term from labor economics, make it "chickenization" – Christopher Leonard's term for the way that the Big Three poultry processors have structured the chicken-farming industry (I learned it from Zephyr Teachout). https://pluralistic.net/2020/07/29/break-em-up/#break-em-up Here's chickenization: you're a chicken farmer. There is only one company that can buy your birds, thanks to market concentration. They tell you how to design and maintain your coop. They sell you the chicks. They tell you which feed to use, how much and when. They tell you when the lights go on and when they go off. They tell you how which vet to use, and which medicines they can use. They bind you to secrecy through nondisclosure and strip you of the right to sue through arbitration. They experiment on you. Your barn is filled with sensors that they monitor, and they tell you to vary feed, lighting, medicine and other variables to see if your birds get bigger. They are the only buyer in your region, so they know how each farmer's birds are thriving. But if the "independent" farmers ever tried to compare notes, they'd be violating their nondisclosure agreements and could be sued. Farmers who complain to regulators are barred from the market. Once your birds are grown, you bring them to the processor, who exploits their information asymmetry to figure out how to pay you JUST ENOUGH to go back to things, but not enough to get ahead. Since chickenization, poultry farmers have faced a wave of suicides. Once you know about chickenization, you see it everywhere: crop farmers are chickenized by seed companies, and Uber drivers are chickenized by their apps. [...] continua qui: https://pluralistic.net/2020/10/02/chickenized-by-arise/#arise

1 0

Bugs in Signal, Facebook, Google chat apps let attackers spy on users (microphone and camera)
by Giacomo Tesio Jan. 22, 2021

Jan. 22, 2021

Vulnerabilities found in multiple video conferencing mobile applications allowed attackers to listen to users' surroundings without permission before the person on the other end picked up the calls. The logic bugs were found by Google Project Zero security researcher Natalie Silvanovich in the Signal, Google Duo, Facebook Messenger, JioChat, and Mocha messaging apps and are now all fixed. However, before being patched, they made it possible to force targeted devices to transmit audio to the attackers' devices without the need of gaining code execution. "I investigated the signalling state machines of seven video conferencing applications and found five vulnerabilities that could allow a caller device to force a callee device to transmit audio or video data," Silvanovich explained. "Theoretically, ensuring callee consent before audio or video transmission should be a fairly simple matter of waiting until the user accepts the call before adding any tracks to the peer connection. "However, when I looked at real applications they enabled transmission in many different ways. Most of these led to vulnerabilities that allowed calls to be connected without interaction from the callee." As Silvanovich revealed, a Signal bug patched in September 2019 made it possible to connect the audio call by sending the connect message from the caller devices to the callee one instead of the other way around, without user interaction. The Google Duo bug, a race condition that allowed callees to leak video packets from unanswered calls to the caller, was fixed in December 2020, while the Facebook Messenger flaw (previously covered by BleepingComputer here) which allowed audio calls to connect before the call was answered was addressed in November 2020. Two similar vulnerabilities were discovered in the JioChat and Mocha messengers in July 2020, bugs that allowed sending JioChat audio (fixed in July 2020) and to send Mocha audio and video (fixed in August 2020) after exploitation, without user consent. Silvanovich also looked for similar bugs in other video conferencing apps, including Telegram and Viber, but didn't find any such issues. "The majority of calling state machines I investigated had logic vulnerabilities that allowed audio or video content to be transmitted from the callee to the caller without the callee’s consent," Silvanovich added. "It is also concerning to note that I did not look at any group calling features of these applications, and all the vulnerabilities reported were found in peer-to-peer calls. This is an area for future work that could reveal additional problems." Two years ago, Silvanovich also found a critical vulnerability in the WhatsApp mobile messaging app that could have been activated simply by a user answering a call to crash or fully compromise the app. Tratto da https://www.bleepingcomputer.com/news/security/bugs-in-signal-facebook-goog… Giacomo

1 0

Google Classroom rimosso dal MIUR
by Giacomo Tesio Jan. 22, 2021

Jan. 22, 2021

Ciao, vi segnalo una notizia passata incredibilmente in sordina e che ho appreso oggi durante da Paolo Monella durante il convegno AIUCD e che non vedo l'ora di condividere con i Dirigenti scolastici delle mie figlie (ed il loro DPO): il Ministero dell'Istruzione ha rimosso Google Classroom dalle piattaforme consigliate per la didattica a distanza https://www.istruzione.it/coronavirus/didattica-a-distanza.html#piattaforme C'è ancora Office 365, ma è comunque un enorme passo avanti. Qualcuno sa quale sequenza di eventi ha prodotto questo risultato? Giacomo

4 7