- nexa - server-nexa.polito.it

EDPS: Outcome of own-initiative investigation into EU institutions’ use of Microsoft products and services
by Giovanni Biscuolo July 6, 2020

July 6, 2020

Buongionro, il Re è nudo: sull'insostenibile inconsistenza del GDPR (aka "Se nemmeno le istrituzioni europee sono in grado di esercitare il controllo sui propri dati significa che nel digitale siamo messi male, ma proprio male, male, al limite dell'irrecuperabile".): https://edps.europa.eu/sites/edp/files/publication/20-07-02_edps_euis_micro… --8<---------------cut here---------------start------------->8--- [...] The EDPS made the following key findings in its investigation into the EU institutions’ use of Microsoft products and services. First, the licensing agreement between Microsoft and the EU institutions allowed Microsoft to define and change the parameters of its processing activities carried out on behalf of EU institutions and contractual data protection obligations. The discretion that Microsoft had, amounted to a broad right for Microsoft to act as a controller. Given the EU institutions’ role as public service institutions, the EDPS did not consider this appropriate. The EDPS recommended to EU institutions that they act to retain controllership. Second, EU institutions needed to put in place a comprehensive and compliant controller-processor agreement and documented instructions of the EU institutions to the processors. Their lack of control over which sub-processors Microsoft used and lack of meaningful audit rights also presented significant issues. The EDPS made recommendations on how to improve the controller-processor agreement and put robust audit checks in place. Third, EU institutions faced a number of linked issues concerning data location, international transfers and the risk of unlawful disclosure of data. They were unable to control the location of a large portion of the data processed by Microsoft. Nor did they properly control what was transferred out of the EU/EEA and how. There was also a lack of proper safeguards to protect data that left the EU/EEA. EU institutions also had few guarantees at their disposal to defend their privileges and immunities and ensure that Microsoft would only disclose personal data insofar as permitted by EU law. The EDPS made recommendations to assist EU institutions in addressing these issues. Fourth, the EDPS considered the technical measures that the Commission had put in place to stem the flow of personal data generated by Microsoft products and services and sent to Microsoft. The EDPS recommended that all EU institutions perform tests using a revised and comprehensive approach, share among them the knowledge and technical solutions they developed to prevent unauthorised data flows to Microsoft and inform each other of any data protection issues they identify with the products or services. Fifth, the EU institutions had insufficient clarity as to the nature, scope and purposes of the processing and the risks to data subjects to be able to meet their transparency obligations towards data subjects. The EDPS recommended that EU institutions seek the clarity and assurances allowing them to keep data subjects properly informed. [...] --8<---------------cut here---------------end--------------->8--- ...e questo è solo l'inizio, il rapporto va letto tutto, anche a piccole dosi. Saluti, Giovanni. P.S.: lascia una strana sensazione di SMARRIMENTO anche a voi il fatto che analisi di contratti come questo vengano svolte DOPO più di due anni dalla loro stipula, quasi come se le istituzioni europee non avessero sufficienti risorse legali per farlo PRIMA?!? P.P.S.: il solo fatto che siano le istituzioni europee a dover contrattare per ottenere qualche emendamento ai contratti standard di una di queste aziende e non IL CONTRARIO la dice lunga sul livello di potere che certe aziende sono riuscite a ottenere, ben oltre quello delle nazioni, anche coalizzate assieme nella EU. -- Giovanni Biscuolo

1 1

AI Authorship? Considering the role of humans in copyright protection of outputs produced by artificial intelligence
by Enrico Nardelli July 6, 2020

July 6, 2020

... This column reviews the reasons why copyright professionals find this <<AI Authorship>> such a bedeviling issue. AI software may be the author-in-fact of such outputs, but is it an author-in-law who can own a copyright? Which, if any, human is entitled to claim copyrights in such outputs? ... https://cacm.acm.org/magazines/2020/7/245693-ai-authorship/fulltext -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

1 0

30mila caselle email della scuola italiana passano a Microsoft
by Marco Ciurcina July 6, 2020

July 6, 2020

"Il ministero dell'Istruzione ha completato il processo a fine giugno per adottare la suite Office 365 come piattaforma di lavoro. Ma non rivela il costo del trasloco" continua qui https://www.wired.it/internet/web/2020/07/06/microsoft-scuola/ Sul tema, credo sia anche rilevante lo studio sull'uso dei servizi e prodotti Microsoft nell'ambito delle istituzioni europee dell'European Data Protection Supervisor https://edps.europa.eu/data-protection/our-work/publications/papers/outcome… m.c.

2 2

Reminder | 131° Mercoledì di Nexa | 8 Luglio 2020
by Nexa Media July 6, 2020

July 6, 2020

Gentilissimi, vi ricordiamo che *mercoledì 8 luglio, dalle ore 18.00 alle ore 20.00*, si svolgerà il 131° Mercoledì di Nexa, con un incontro dal titolo: *Per una strategia di condivisione etica dei Big Data: dalle Coop alle Co-App*. Ospite: /Giovanni Rinaldi //(Legacoop)//./ L'incontro si svolgerà in *modalità telematica*, utilizzando il software open source di conference call *Jitsi Meet*. Per chi vorrà partecipare live al seminario sarà possibile accedere alla conference call attraverso il seguente link: https://meet.nexacenter.org/MercolediNexa Maggiori informazioni sull'incontro sono disponibili alla pagina: https://nexa.polito.it/mercoledi-131 Cordiali saluti,   -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino _web:_ https://nexa.polito.it/ _mail:_anita.botta@polito.it <mailto:anita.botta@polito.it> tel: 011 090 7219

1 0

The Guardian view on Facebook and democracy: real and present danger | Editorial | Opinion | The Guardian
by Alberto Cammozzo July 6, 2020

July 6, 2020

<https://www.theguardian.com/commentisfree/2020/jul/05/the-guardian-view-on-…> In every political debate since Facebook began to dominate democracy, the company has placed itself on the wrong side of history. The social media firm cannot be reformed from within because its business model profits from hosting bomb-throwing circuses of hate, humbug and hogwash. The platform harvests users’ personal data to algorithmically recommend content but can’t seem to help steering people towards vilifying one another while keeping their attention. It is not good for society, but it is good for Facebook. That apparently is fine for the company’s founder, Mark Zuckerberg, who is worth $85bn. Consider the latest ugly episode in the firm’s life. After some of the world’s biggest brands boycotted Facebook over its refusal to ban racist and violent content, the company reached for the usual bromide of reassurance that the matter was being taken seriously. Internally it was a very different story. The boycotters, Mr Zuckerberg said, would be back and his company was “not going to change our policies … because of a threat to a small percent of our revenue”. In America there is a view that capitalism fixes things. In Britain, government usually acts. The Lords select committee on democracy and digital technologies last week was correct to say it was a mistake to allow social media firms to grow unimpeded by regulation. This, the peers said, had “become acutely obvious in the current Covid-19 pandemic where online misinformation poses not only a real and present danger to our democracy but also to our lives”. Facebook cannot be allowed to remain beyond the restraints applied to the rest of society. This message has been received by the UK’s competition authority, which has proposed forcing Facebook to give consumers a choice over whether to accept targeted advertising and even suggested breaking it up. The Lords select committee was right to praise the UK government for putting forward an online harms framework, requiring social media platforms to protect users and sanctioning those that fail to do so by, for example, taking too long to remove offensive material. However, ministers have been tardy in bringing forward legislation and there’s no sign the platforms’ duty of care will shield voters from misinformation campaigns. Such a move would be in necessary conflict with Facebook’s “neutrality”. The firm’s hands-off approach means it won’t drain its swamp of racism, misogyny and conspiracy. In a speech last October, Mr Zuckerberg had controversially signalled that Facebook’s interests aligned with Donald Trump’s. The Facebook founder said it’s not right to censor politicians. Mr Trump has been notably softer on Facebook than its rivals. This bargain is unravelling. Faced with a growing backlash over Mr Trump’s inflammatory rhetoric, the social network removed a Trump ad that used a Nazi-era symbol. Facebook will also start allowing US users to opt out of seeing political ads. Yet in Britain Facebook is used to spread false political advertising. It does so knowing that the network’s algorithms spit out, in the words of its own research, “more and more divisive content in an effort to gain user attention and increase time on the platform”. There is an easy solution. The UK bans all political advertising from being broadcast on television or radio. Unless firms like Facebook change radically, it may be time to extend this prohibition to social media.

1 0

Disuguaglianze digitali (numero speciale della rivista universitaria First Monday)
by Antonio Casilli July 6, 2020

July 6, 2020

Per ben cominciare la settimana, vi segnalo questo numero "di riferimento" della rivista First Monday al quale ho contribuito assieme a un collettivo di colleghi nord- e sud-americani, europei e africani. Il numéro, in open access, è stato valorosamente capitanato da Laura Robinson. Al sommario: * [ https://firstmonday.org/ojs/index.php/fm/article/view/10840 | Global perspectives on digital inequalities and solutions to them ] Laura Robinson, Jeremy Schulz, Noah McClain, Timothy Hale, Heloisa Pait, Massimo Ragnedda, Joseph D. Straubhaar, Aneka Khilnani, Natalia Tolentino * [ https://firstmonday.org/ojs/index.php/fm/article/view/10842 | Digital inequalities 2.0: Legacy inequalities in the information age ] Laura Robinson, Jeremy Schulz, Grant Blank, Massimo Ragnedda, Hiroshi Ono, Bernie Hogan, Gustavo S. Mesch, Shelia R. Cotten, Susan B. Kretchmer, Timothy M. Hale, Tomasz Drabowicz, Pu Yan, Barry Wellman, Molly-Gloria Harper, Anabel Quan-Haase, Hopeton S. Dunn, Antonio A. Casilli, Paola Tubaro, Rod Carvath, Wenhong Chen, Julie B. Wiest, Matías Dodel, Michael J. Stern, Christopher Ball, Kuo-Ting Huang, Aneka Khilnani * [ https://firstmonday.org/ojs/index.php/fm/article/view/10844 | Digital inequalities 3.0: Emergent inequalities in the information age ] Laura Robinson, Jeremy Schulz, Hopeton S. Dunn, Antonio A. Casilli, Paola Tubaro, Rod Carvath, Wenhong Chen, Julie B. Wiest, Matías Dodel, Michael J. Stern, Christopher Ball, Kuo-Ting Huang, Grant Blank, Massimo Ragnedda, Hiroshi Ono, Bernie Hogan, Gustavo S. Mesch, Shelia R. Cotten, Susan B. Kretchmer, Timothy M. Hale, Tomasz Drabowicz, Pu Yan, Barry Wellman, Molly-Gloria Harper, Anabel Quan-Haase, Aneka Khilnani * [ https://firstmonday.org/ojs/index.php/fm/article/view/10847 | Who are the limited users of digital systems and media? An examination of U.K. evidence ] Simeon J. Yates, Elinor Carmi, Eleanor Lockley, Alicja Pawluczuk, Tom French, Stephanie Vincent * [ https://firstmonday.org/ojs/index.php/fm/article/view/10830 | Determinants of cyber-safety behaviors in a developing economy The role of socioeconomic inequalities, digital skills and perception of cyber-threats ] Matías Dodel, Daniela Kaiser, Gustavo Mesch * [ https://firstmonday.org/ojs/index.php/fm/article/view/10854 | Digital skills and political participation in northeast Anatolia, Turkey ] Duygu Özsoy, Eyyup Akbulut, Sait Sinan Atılgan, Glenn Muschert * [ https://firstmonday.org/ojs/index.php/fm/article/view/10855 | Digital capital and online activities: An empirical analysis of the second level of digital divide ] Maria Laura Ruiu, Massimo Ragnedda * [ https://firstmonday.org/ojs/index.php/fm/article/view/10839 | Building online skills in off-line realities The SolarSPELL Initiative (Solar Powered Educational Learning Library) ] Laura Hosman, Coreen Walsh, Martín Pérez Comisso, Jared Sidman * [ https://firstmonday.org/ojs/index.php/fm/article/view/10860 | Digital inequalities: Homework gap and techno-capital in Austin, Texas ] Melissa Santillana, Joe Sraubhaar, Alexis Schrubbe, Jaewon Choi, Sharon Strover * [ https://firstmonday.org/ojs/index.php/fm/article/view/10865 | ICT policies in Latin America: Long-term inequalities and the role of globalized policy-making ] Eduardo Villanueva-Mansilla * [ https://firstmonday.org/ojs/index.php/fm/article/view/10866 | Connecting research to policy: Understanding macro and micro policy-makers and their processes ] Lloyd Levine * [ https://firstmonday.org/ojs/index.php/fm/article/view/10845 | Digital inequalities in time of pandemic: COVID-19 exposure risk profiles and new forms of vulnerability ] Laura Robinson, Jeremy Schulz, Aneka Khilnani, Hiroshi Ono, Shelia R. Cotten, Noah McClain, Lloyd Levine, Wenhong Chen, Gejun Huang, Antonio A. Casilli, Paola Tubaro, Matías Dodel, Anabel Quan-Haase, Maria Laura Ruiu, Massimo Ragnedda, Deb Aikat, Natalia Tolentino -- Antonio A. Casilli Professor, Telecom Paris, Institut Polytechnique de Paris Member, Interdisciplinary Institute for Innovation (i3 UMR 9217 CNRS) Associate Member, LACI-IIAC (EHESS) Faculty Fellow, Nexa Center for Internet & Society *We respect your right to disconnect. This email send time is due to my own workflow efficiency. You are in no obligation to take action or reply to it outside your office hours.*

1 0

Defund Facial Recognition Before It's Too Late - The Atlantic
by J.C. DE MARTIN July 5, 2020

July 5, 2020

Defund Facial Recognition I’m a second-generation Black activist, and I’m tired of being spied on by the police. MALKIA DEVICH-CYRIL 12:00 PM ET https://www.theatlantic.com/technology/archive/2020/07/defund-facial-recogn… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Michael Veale (DP3T) sul potere di chi controlla il digitale
by Roberto Resoli July 4, 2020

July 4, 2020

Sul potere delle aziende informatiche, ormai superiore a quello degli stati. "One key lesson requires distinguishing the problem of privacy from that of platform power. It is possible to be strongly in favour of a decentralised approach, as I am (as a co-developer of the open-source DP-3T system that Apple and Google adapted), while being seriously concerned about the centralised control of computing infrastructure these firms have amassed." https://amp.theguardian.com/commentisfree/2020/jul/01/apple-google-contact-… rob

3 2

Privacy is not the problem with the Apple-Google contact-tracing toolkit
by Giacomo Tesio July 4, 2020

July 4, 2020

New tools give tech giants the power to shape communities and change behaviour, all without any data leaving our phones https://www.theguardian.com/commentisfree/2020/jul/01/apple-google-contact-… In April, Apple and Google announced a partnership. They would take research into how to undertake Bluetooth-powered Covid-19 contact tracing in a privacy-preserving manner, with no central database, and make it available as a toolkit inside their operating systems for public health authority–sanctioned apps. Before they did this, all such apps had effectively been doomed to fail. At least on iPhones, they were crippled by the same baked-in Bluetooth restrictions that stop normal apps secretly tracking you. The firms’ contact-tracing toolkit has been both praised and condemned. Its “decentralised” approach, with no sensitive central database of who-saw-who, has been supported by hundreds of privacy, security and human rights scholars. The concerns are understandable. The history of passports – which were introduced as a seemingly temporary measure during the first world war, but were retained in response to fears about spreading the Spanish flu – shows that pandemics can significantly influence our social infrastructure. And so they should be designed to minimise future misuse. Through a software update, Apple and Google loosened privacy restrictions enough to allow public health authorities to run decentralised contact-tracing apps, but did not engineer new functionality to let apps send the unique Bluetooth identities of phones they encountered to a central server. Data had to remain secretly on phones: which was not a problem for decentralised systems, but left centralised apps – such as those favoured by France and the tech wing of NHS England, NHSX – continuing to struggle to use Bluetooth. Reasons for preferring centralised systems differed. NHSX wanted individuals to trigger self-isolation alerts based on self-reported symptoms, and said it needed centralised fraud analysis to weed out the inevitable hypochondriacs and trolls. The French minister for the digital sector, Cédric O, said that self-reporting was a no-no, and instead wanted to use centralisation to try to lower the risk of a particular snooping attack from a tech-savvy neighbour. (This is a risk that can never be fully removed from any Bluetooth contact-tracing system.) Tensions grew as it became clear that the firms did not intend to engineer a further global change to their operating systems to specifically accommodate these countries. In the French parliament, O stated that it was no coincidence that the UK and France were going against the grain, given that they were “the only two European states with their own nuclear deterrent”. However, it is worth noting that no country, nuclear-armed or not, even attempted to use the first tool of a sovereign nation against the firms — the ability to make binding laws. Instead, they continued the bizarre path, seen in recent years from politicians around the world, of treating these firms like sovereign nations, hoping that they recognised each other’s legitimacy and that their “officials” could come to some agreement. They did not, and the saga of the demise of NHSX’s centralised app in a mid-June U-turn is well-documented. NHSX piloted an app relying on fragile workarounds to avoid the privacy restrictions built into operating systems, despite warnings from many outside the project — myself included — that it was likely to encounter problems. In June, the government admitted that its workarounds left its system unacceptably poor at detecting either iPhones or Androids at all. What can we learn from NHSX’s encounter with these tech giants? One key lesson requires distinguishing the problem of privacy from that of platform power. It is possible to be strongly in favour of a decentralised approach, as I am (as a co-developer of the open-source DP-3T system that Apple and Google adapted), while being seriously concerned about the centralised control of computing infrastructure these firms have amassed. It’s commonly said that in the digital world, data is power. This simple view might apply to a company collecting data through an app or a website, such as a supermarket, but doesn’t faithfully capture the source of power of the firms controlling the hardware and software platforms these apps and websites run on. Using privacy technologies, such as “federated” or “edge” computing, Apple and Google can understand and intervene in the world, while truthfully saying they never saw anybody’s personal data. Data is just a means to an end, and new, cryptographic tools are emerging that let those firms’ same potentially problematic ends be reached without privacy-invasive means. These tools give those controlling and co-ordinating millions or even billions of computers the monopolistic power to analyse or shape communities or countries, or even to change individual behaviour, such as to privately target ads based on their most sensitive data — without any single individual’s data leaving their phone. It’s not just ad targeting: privacy technologies could spotlight the roads where a protest is planned, the areas or industries likely to harbour undocumented migrants, or the spots in an oppressive country most likely to be illegal LGBT clubs — not personal data, but data with serious consequences nonetheless. This approach is effectively what underpins the Apple-Google contact-tracing system. It’s great for individual privacy, but the kind of infrastructural power it enables should give us sleepless nights. Countries that expect to deal a mortal wound to tech giants by stopping them building data mountains are bulls charging at a red rag. In all the global crises, pandemics and social upheavals that may yet come, those in control of the computers, not those with the largest datasets, have the best visibility and the best – and perhaps the scariest — ability to change the world. Law should be puncturing and distributing this power, and giving it to individuals, communities and, with appropriate and improved human-rights protections, to governments. To do so, we need new digital rights. Data protection and privacy laws are easily dodged or circumvented by technical assurances of confidentiality: we need something more ambitious to escape the giants’ walled gardens. A “right to repair” would stop planned obsolescence in phones, or firms buying up competitors just to cut them off from the cloud they need to run. A “right to interoperate” would force systems from different providers, including online platforms, to talk to each other in real time, allowing people to leave a social network without leaving their friends. These interventions need strong accompanying oversight to maintain security and privacy, and stop unwanted side-effects or government abuse, such as the outlawing of end-to-end encryption to oppress dissidents and whistle-blowers. It all starts from realising that deflating digital power isn’t just about governing data: it’s the walls of the underlying systems we have to tear down

1 0

Google's AMP, the Canonical Web, and the Importance of Web Standards
by Giovanni Biscuolo July 4, 2020

July 4, 2020

Buongiorno, un altro esempio di involontaria strategia «Embrace and extinguish» del web. ...un altro piccolo ma molto significativo esempio della «fenomenologia degli standard», che storicamente a tutto sono serviti tranne che contribuire a rendere il mercato accessibile e concorrenziale. https://www.eff.org/deeplinks/2020/07/googles-amp-canonical-web-and-importa… «Google's AMP, the Canonical Web, and the Importance of Web Standards» Alexis Hancock; Thu, 2 Jul 2020 --8<---------------cut here---------------start------------->8--- Have you ever clicked on a link after googling something, only to find that Google didn’t take you to the actual webpage but to some weird Google-fied version of it? Instead of the web address being the source of the article, it still says “google” in the address bar on your phone? That’s what’s known as Google Accelerated Mobile Pages (AMP), and now Google has announced that AMP has graduated from the OpenJS Foundation Incubation Program. [...] What Is AMP? This Google-backed, stripped down HTML framework was created with the promises of creating faster web pages for a better user experience. Cutting out slower loading content, like those developed with JavaScript. At a high level, AMP works by fast loading stripped down versions of full web pages for mobile viewing. [...] AMP pages began making an appearance by 2016. But right away, many observed that AMP encroached on the principles of the open web. The web was built on open standards, developed through consensus, that small and large actors alike can use. Which, in this case, entails keeping open web standards in the forefront and discouraging proprietary, closed standards. [...] The final URL, the one in view or the URL bar, of a cached AMP page would look something like this: https://www.google.com/amp/www.example.com/amp.doc.html This cache model does not follow the web origin concept and creates a new framework and structure to adhere to. The promise is better performances and experience for users. Yet, the approach is implementation first and web standards later. Since Google has become such an ingrained part of the modern web for so many, any technology they deploy would immediately have a large share of users and adopters. This is also paired with other arguments other product teams within Google have made to reshape the URL as we know it. This fundamentally changed the way the mobile web is served for many users. [...] If Google was simply a web performance company that would still be too much centralization of the web’s decisions. But they are not just a one-function company, they are a giant conglomerate that already controls the largest mobile OS, web browser, and search engine in the world. [...] Furthermore, the web standards process itself is far from perfect. Standards organizations are heavily dominated by members of corporate companies and the connections one may have to them offer immense social capital. Less-represented people don’t have the social capital to join or be a member. It’s a long way until a more equitable process occurs for these types of organizations; paired with the lack of diversity these kinds of groups tend to have, the costs of membership, and time commitments. These particular issues are not Google’s fault, but Google has an immense amount of power when it comes to joining these groups. When joining standards organizations, It’s not a matter of earning their way up, but deciding if they should loosen their reigns. [...] --8<---------------cut here---------------end--------------->8--- «The web standards process itself is far from perfect.» è una battuta spettacolare, perfetta per un titolo di Lercio. Saluti. Giovanni. -- Giovanni Biscuolo

2 2