- nexa - server-nexa.polito.it

Law, code and systems – Public Strategist
by Alberto Cammozzo Aug. 27, 2020

Aug. 27, 2020

<https://www.publicstrategist.com/2017/11/law-code-and-systems/> Should law which results in the creation of new public administrative systems receive different parliamentary scrutiny from law which doesn’t? That’s the question raised in a recent blog post by Gordon Guthrie which caught my eye for a number of reasons, not least a typically thought provoking recent conversation with John Sheridan. As so often, apparently simple questions quickly get complicated when you dig into them a bit, and the first complication is to work out what question this special scrutiny is intended to answer. As a first approximation, there are three very different dimensions to this: How law is translated into code How law is translated into systems What role legislative scrutiny has in improving the way in which the first two are done. Law and code On the surface, law doesn’t look much like code. Despite heroic efforts by parliamentary counsel in recent years, it mostly looks like arcane wordplay. Looking just a little below the surface, though, patterns start to emerge which look intriguingly like code. Data elements are defined. Conditions are identified and tested for. The test leads execution down distinctive paths. A single text is unlikely to be self-contained but will refer to and draw on other legislative elements – calling functions if you will. But there is a deeper level still where the analogy breaks down again. The compiler or interpreter is not immediately deterministic – it can take years and many levels of the judicial system to work out the correct output from given inputs. Particularly, but not only, in a common law system, many functions are called by interpretation without it ever being explicit that they are being called at all. The idea that law can be some kind of pseudo code is attractive but insubstantial.1 That’s not to say that there is no connection at all. As one example, Richard Pope suggested a few years ago that there might be scope for using software testing techniques to provide some insight into whether regulations are being applied. More generally, there are many contexts where rules defined in law need to become rules applied in practice, and rules defined in code will almost always be a vital intermediate step. Law and systems Law may be a necessary component of an administrative system, but it is never a sufficient one. Data needs to be collected, cases need to be managed, help needs to be offered, processes and roles need to be understood, edge cases need to be identified, transitional arrangements need to be put in place – and the list goes on. In the implementation of a legal change, the capturing of the legal element itself is likely to be one of the smaller and more straightforward aspects of what needs to be done. That doesn’t mean that the project within which such a change is embedded will be small or straightforward – and government is littered with examples of projects which are anything but. It does though suggest that the extent of legislative change may not be the best indicator and certainly isn’t the only indicator of the level of risk in developing or redeveloping a system. Legislative scrutiny Law is the responsibility of legislators. They are both the primary decision makers about what the law should be and the primary means by which the executive is held to account for its implementation and application.2 Legislative debate is normally strongly focused on the merits of ideas and policies; there is rarely much attention given to the practical questions of implementation, partly because that is rarely specified within the legislation, partly because there is limited scope for preliminary work to have been considered during its passage,3 and partly because that doesn’t tend to be what legislators focus on. The result is that, as things currently work, legislative approval almost necessarily precedes any point at which it is possible to assess the likelihood of successful delivery. It’s certainly possible to see a model in which legislatures took a more active and more structured role in monitoring whether what was being developed had the characteristics of success, but however that were to work, it wouldn’t be a fundamentally legislative role. So perhaps the question is less whether legislatures should do more of this, and more whether there is a shortfall in the external challenge and oversight of programme management, and if so whether that shortfall is best addressed by legislators.4 Back to code I remain strongly of the view that thinking about law as code (or perhaps better, law as system) prompts interesting ideas and insights. At a more mundane level, it can prompt attention to language being used not just not in line with its natural meaning, but in flat contradiction to it. But that’s not because law is code; it’s because the parallels are strong enough and the differences clear enough that the cross-fertilisation of ideas is useful. The greater engagement of legislators with that debate might have some very interesting consequences.

1 0

Quanto costa affidare a Microsoft le email della scuola italiana - Wired
by Antonio Vetro' Aug. 27, 2020

Aug. 27, 2020

https://www.wired.it/internet/web/2020/08/27/microsoft-email-scuola-costi/ av

2 1

Wired.it: Quanto costa affidare a Microsoft le email della scuola italiana
by don Luca Peyron Aug. 27, 2020

Aug. 27, 2020

Buona lettura, Dl Wired.it: Quanto costa affidare a Microsoft le email della scuola italiana. https://www.wired.it/internet/web/2020/08/27/microsoft-email-scuola-costi/

1 0

How to destroy Surveillance Capitalism
by Giacomo Tesio Aug. 26, 2020

Aug. 26, 2020

The most surprising thing about the rebirth of flat Earthers in the 21st century is just how widespread the evidence against them is. You can understand how, centuries ago, people who’d never gained a high-enough vantage point from which to see the Earth’s curvature might come to the commonsense belief that the flat-seeming Earth was, indeed, flat. But today, when elementary schools routinely dangle GoPro cameras from balloons and loft them high enough to photograph the Earth’s curve — to say nothing of the unexceptional sight of the curved Earth from an airplane window — it takes a heroic effort to maintain the belief that the world is flat. Likewise for white nationalism and eugenics: In an age where you can become a computational genomics datapoint by swabbing your cheek and mailing it to a gene-sequencing company along with a modest sum of money, “race science” has never been easier to refute. We are living through a golden age of both readily available facts and denial of those facts. Terrible ideas that have lingered on the fringes for decades or even centuries have gone mainstream seemingly overnight. When an obscure idea gains currency, there are only two things that can explain its ascendance: Either the person expressing that idea has gotten a lot better at stating their case, or the proposition has become harder to deny in the face of mounting evidence. In other words, if we want people to take climate change seriously, we can get a bunch of Greta Thunbergs to make eloquent, passionate arguments from podiums, winning our hearts and minds, or we can wait for flood, fire, broiling sun, and pandemics to make the case for us. In practice, we’ll probably have to do some of both: The more we’re boiling and burning and drowning and wasting away, the easier it will be for the Greta Thunbergs of the world to convince us. The arguments for ridiculous beliefs in odious conspiracies like anti-vaccination, climate denial, a flat Earth, and eugenics are no better than they were a generation ago. Indeed, they’re worse because they are being pitched to people who have at least a background awareness of the refuting facts. [...] Surveillance capitalism assumes that because advertisers buy a lot of what Big Tech is selling, Big Tech must be selling something real. But Big Tech’s massive sales could just as easily be the result of a popular delusion or something even more pernicious: monopolistic control over our communications and commerce. [...] To understand why you shouldn’t worry about mind-control rays — but why you should worry about surveillance and Big Tech — we must start by unpacking what we mean by “persuasion.” Google, Facebook, and other surveillance capitalists promise their customers (the advertisers) that if they use machine-learning tools trained on unimaginably large data sets of nonconsensually harvested personal information, they will be able to uncover ways to bypass the rational faculties of the public and direct their behavior, creating a stream of purchases, votes, and other desired outcomes. The impact of dominance far exceeds the impact of manipulation and should be central to our analysis and any remedies we seek. [...] Rather than finding ways to bypass our rational faculties, surveillance capitalists like Mark Zuckerberg mostly do one or more of three things: 1. Segmenting [...] 2. Deception [...] 3. Domination [...] 4. Bypassing our rational faculties This is the good stuff: using machine learning, “dark patterns,” engagement hacking, and other techniques to get us to do things that run counter to our better judgment. This is mind control. Some of these techniques have proven devastatingly effective (if only in the short term). The use of countdown timers on a purchase completion page can create a sense of urgency that causes you to ignore the nagging internal voice suggesting that you should shop around or sleep on your decision. The use of people from your social graph in ads can provide “social proof” that a purchase is worth making. Even the auction system pioneered by eBay is calculated to play on our cognitive blind spots, letting us feel like we “own” something because we bid on it, thus encouraging us to bid again when we are outbid to ensure that “our” things stay ours. Games are extraordinarily good at this. “Free to play” games manipulate us through many techniques, such as presenting players with a series of smoothly escalating challenges that create a sense of mastery and accomplishment but which sharply transition into a set of challenges that are impossible to overcome without paid upgrades. Add some social proof to the mix — a stream of notifications about how well your friends are faring — and before you know it, you’re buying virtual power-ups to get to the next level. [...] From the surveillance capitalist’s point of view, our adaptive capacity is like a harmful bacterium that deprives it of its food source — our attention — and novel techniques for snagging that attention are like new antibiotics that can be used to breach our defenses and destroy our self-determination. [...] Not everyone, of course. Some people never adapt to stimulus, just as some people never stop hearing the hum of the refrigerator. This is why most people who are exposed to slot machines play them for a while and then move on while a small and tragic minority liquidate their kids’ college funds, buy adult diapers, and position themselves in front of a machine until they collapse. [...] Zuboff puts enormous and undue weight on the persuasive power of surveillance-based influence techniques. Most of these don’t work very well, and the ones that do won’t work for very long. The makers of these influence tools are confident they will someday refine them into systems of total control, but they are hardly unbiased observers, and the risks from their dreams coming true are very speculative. By contrast, Zuboff is rather sanguine about 40 years of lax antitrust practice that has allowed a handful of companies to dominate the internet, ushering in an information age with, as one person on Twitter noted, five giant websites each filled with screenshots of the other four. [...] If our concern is that markets cease to function when consumers can no longer make choices, then copyright locks should concern us at least as much as influence campaigns. An influence campaign might nudge you to buy a certain brand of phone; but the copyright locks on that phone absolutely determine where you get it serviced, which apps can run on it, and when you have to throw it away rather than fixing it. [...] firms continue to over-collect and over-retain our data for three reasons: 1. They are locked in the aforementioned limbic arms race with our capacity to shore up our attentional defense systems to resist their new persuasion techniques. [...] 2. They believe the surveillance capitalism story. [...] 3. The penalties for leaking data are negligible. [...] Technology exceptionalism is a sin, whether it’s practiced by technology’s blind proponents or by its critics. Both of these camps are prone to explaining away monopolistic concentration by citing some special characteristic of the tech industry, like network effects or first-mover advantage. The only real difference between these two groups is that the tech apologists say monopoly is inevitable so we should just let tech get away with its abuses while competition regulators in the U.S. and the EU say monopoly is inevitable so we should punish tech for its abuses but not try to break up the monopolies. [...] the problem with monopolies is monopolism — the concentration of power into too few hands, which erodes our right to self-determination. If there is a monopoly, the law wants it gone, period. Sure, get rid of monopolies that create “consumer harm” in the form of higher prices, but also, get rid of other monopolies, too. Continua (a lungo) su https://onezero.medium.com/how-to-destroy-surveillance-capitalism-8135e6744… (anche su https://archive.is/fJTvQ ) Si tratta sostanzialmente di una interessante serie di obiezioni alla prospettiva della Professoressa Zuboff sul capitalismo di sorveglianza che lo riconduce ad un problema economico: la tendenza del capitalismo globale a generare enormi monopoli planetari che erodono le libertà dei consumatori per concentrare sempre più potere in poche mani. Tale potere da un lato impedisce ogni forma di regolamentazione, dall'altro innalza enormi barriere di ingresso per limitare la concorrenza. Per quanto condivisibile, credo sia una visione parziale (e forse ingenua) della questione: come altri prima di lui, Doctorow non considera gli enormi vantaggi politici, economici e militari che questi monopoli planetari forniscono agli U.S.A. Giacomo

1 0

Police Want Your Smart Speaker—Here's Why | WIRED
by J.C. DE MARTIN Aug. 26, 2020

Aug. 26, 2020

https://www.wired.com/story/star-witness-your-smart-speaker/ (Sent from my wireless device; please excuse brevity and typos (if any))

3 3

Using Google's location tracking can put innocents in jail.
by Giacomo Tesio Aug. 26, 2020

Aug. 26, 2020

Geofencing requests - despite violating privacy rights - are being issued more frequently in the US every year. [...] The most recent example is Zachary McCoy, who was the prime suspect in a case of burglary due to a bike ride. Data from his fitness app showed that he had passed a burglarized home in his neighborhood three times during the timeframe of the burglary. As police had no clue who might have been the burglar, they sent a geofencing warrant to Google. [...] Being scared, his parents dipped into their savings to pay thousands of dollars to a lawyer to make sure their son would not go to prison for a crime that he never committed. The case against Zachary was eventually closed, but it shows that even when being innocent, you can still be in the wrong place at the wrong time - and in some cases you can even get jailed for being at the wrong place as another example from Arizona shows. # Being jailed because of Google data In 2018 an innocent man was jailed for six days in Avondale, Arizona, because his Google data showed that he had been at the scene of a shooting where one person was murdered. To make things worse his car had been spotted on surveillance cameras in the area as well. Later it turned out that the suspect's stepfather had used his car and had a device with him, on which the suspect's Google credentials where logged in. By now, the innocent suspect has filed a lawsuit against the authorities because while prosecutors never pursued charges against him, he lost his job, his car and his reputation due to the investigation, during which the police also released his full name in a press release. He was also unable to find a new job because a quick Google search showed that he had been investigated for murder so he did not pass background checks. # Tracking and geofencing The two cases show one thing very clearly: Al data that is accessible, is being used - whether you like it or not, even whether Google likes it or not. Google has to comply with warrants as any other company in the world. The problem is that today much more data about us exists than we can even imagine. The authorities are quickly learning how to get hold of this data, and despite the fact that general geofencing warrants are violating privacy rights, these are widely issued by judges in the US. # Fishing expeditions by the police Google said in a court filing last year that the requests from state and federal law enforcement authorities were increasing rapidly: by more than 1,500 percent from 2017 to 2018, and by 500 percent from 2018 to 2019. "This fishing expedition infringes on the privacy rights of so many possible people who had the misfortune of being in an area where a crime is alleged to be committed," said Jerome Greco, staff attorney at the Legal Aid Society to Forbes. "We should not allow for such broad access to the data of so many on the mere speculation that a suspect may have used a cellphone near the location of the crime." Police officers described the data they obtained from Google as "incredible". People would not realize to what extent they are being tracked - not by the government, but by private companies such as Google. Continua su https://tutanota.com/blog/posts/google-tracking-suspect/ Giacomo

1 0

US Border Patrol Says They Can Create Central Repository Of Traveler Emails, Keep Them For 75 Years
by Giovanni Biscuolo Aug. 25, 2020

Aug. 25, 2020

Buongiorno, l'ennesimo capitolo della querelle in merito alla "Border Search Exeption" sulla perquisizione e copia integrale del contenuto dei dispositivi elettronici (fino a 100 miglia dal confine, all'interno ovviamente). [1] ...meno male che c'è "il cloud"! :-D «US Border Patrol Says They Can Create Central Repository Of Traveler Emails, Keep Them For 75 Years» https://viewfromthewing.com/us-border-patrol-says-they-can-create-central-r… --8<---------------cut here---------------start------------->8--- The U.S. government has taken the opportunity during the global pandemic, when people aren’t traveling out of the country much, to roll out a new platform for storing information they believe they are entitled to take from people crossing the border. A new filing reveals how the U.S. Border Patrol will store data from traveler devices centrally, keeping it backed up and searchable for up to 75 years. On July 30 the Department of Homeland Security published a privacy impact assessment detailing the electronic data that they may choose to collect from people crossing the border – and what happens to that data. * Border Patrol claims the right to search laptops, thumb drives, cell phones, and other devices capable of storing electronic information” and when they call it a ‘border search the can do this not just when you’re “crossing the U.S. border” in either direction (i.e. when you’re leaving, not just when you’re entering the country) but even “at the extended border” which generally means within 100 miles of the border, which encompasses where two-thirds of the U.S. population lives. * They needed an updated privacy impact assessment because of a new “enterprise-wide solution to manage and analyze certain types of information and metadata USBP collects from electronic devices” – and they they actually keep on file. Border Patrol will “acquire a mirror copy of the data on the device” they take from a traveler and store it locally. Before uploading it to their network they check to make sure there’s no porn on it (so they search your devices to find porn first). Then once they’ve determined it’s “clean” they transfer the data first to an encrypted thumb drive and then to the Border Patrol-side system called PLX. Examples of what they plan to keep from travelers’ devices include e-mails; videos and pictures; texts and chat messages; financial accounts and transactions; location history; web browser bookmarks; tasks list; calendar; call logs; contracts. Information is stored for 75 years although if it’s not related to any crime it may be deleted after 20 years. The government emphasizes they’ve been collecting this information, what’s changed is simply that they’ll be storing it in a central system where everything “will now by accessible to a larger number of USBP agents with no nexus” to suspected illegal activity. They promise, though, to restrict access and train staff not to do anything they aren’t supposed to. And they don’t see risk to privacy because they’ve published a notice (that I’m now writing about) telling you how your privacy may be violated. Electronic device searches have been on the rise. Between October 2008 and June 2010 6500 devices were searched. In 2016 there were 10,000 device searches, and 30,200 in 2017. It’s not clear though that these searches are all actually legal. In November 2019 a federal judge in Boston ruled that forensic searches of cell phones require at least reasonable suspicion “that the devices contain contraband.” --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] https://en.wikipedia.org/wiki/Border_search_exception#Searching_of_electron… -- Giovanni Biscuolo

1 0

Uber and the lawlessness of 'sharing economy' corporates | Uber | The Guardian
by J.C. DE MARTIN Aug. 25, 2020

Aug. 25, 2020

Uber and the lawlessness of ‘sharing economy’ corporates Companies including Airbnb and Google compare themselves to civil rights heroes, while using their popularity among consumers to nullify federal law Frank Pasquale and Siva Vaidhyanathan Tue 28 Jul 2015 07.00 BST https://www.theguardian.com/technology/2015/jul/28/uber-lawlessness-sharing… (Sent from my wireless device; please excuse brevity and typos (if any))

1 1

How I helped fix Canadaʼs COVID Alert app
by Alberto Cammozzo Aug. 25, 2020

Aug. 25, 2020

<https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-alert-app> On July 31st, Canada's COVID Alert app was made available for general use, though it does not have support for actually reporting a diagnosis in most provinces, yet. In Quebec, we can run the tracing part of the app, and if diagnosis codes become available here, the app can retroactively report contact. It uses the tracing mechanism that Google and Apple created together, and in my opinion—at least for now—Canadians should be running this thing to help us all deal with COVID-19. I won't run it forever, but for now, it seems to me that the benefits outweigh the "government can track me" fear (it's not actually tracking you; it doesn't even know who you are), and it's enabled on my phone. But, before I decided to take this position and offer up my own movement data, I wanted to be sure the app is doing what it says it's doing—at least to the extent of my abilities to be duly diligent. (Note: it's not purely movement data that's shared—at least without more context—but it's actual physical interactions with other people whose phones are available within the radio range of Bluetooth LE.) Before installing the app on my real daily-carry phone, I decided to put it on an old phone I still have, and to do some analysis on the most basic level of communication: who is it contacting? In 2015, I gave a talk at ConFoo entitled "Inspect HTTP(S) with Your Own Man-in-the-Middle Non-Attacks", and this is exactly what I wanted to do here. The tooling has improved in the past 5 years, and firing up mitmproxy, even without ever having used it on this relatively new laptop, was a one-liner, thanks to Nix: nix-shell -p mitmproxy --run mitmproxy This gave me a terminal-based UI and proxy server that I pointed my old phone at (via the Wifi Network settings, under HTTP proxy, pointed to my laptop's local IP address). I needed to have mitmproxy create a Certificate Authority that it could use to generate and sign "trusted" certificates, and then have my phone trust that authority, by visiting http://mitm.it/ in mobile Safari, and doing the certificate acceptance dance (this is even more complicated on the latest versions of iOS). Worth noting also, is that certain endpoints such as the Apple App Store appear to use Certificate Pinning, so you'll want to do things like install the COVID Alert app from the App Store before turning on the proxy. Once I was all set up to intercept my own traffic, I visited some https:// URLs and saw the request flows in mitmproxy. I fired up the COVID Alert app again, and noticed something strange… something disturbing: shows that the app is accessing clients.google.com In addition to the expected traffic to canada.ca (I noticed it's using .alpha.canada.ca, but I suspect that's due to the often-reported unbearably-long bureaucratic hassle in getting a .canada.ca TLS certificate, but that's another story), my phone, when running COVID Alert, was contacting Google. HEAD https://clients4.google.com/generate_204 A little web searching helped me discover that this is a commonly-used endpoint that helps developers determine if the device is behind a "captive portal" (an interaction that requires log-in or payment, or at least acceptance of terms before granting wider access to the Web). I decided that this was probably unintended by the developers of COVID Alert, but it still bothered me that an app, designed for tracking interactions between people['s devices], that the government wants us to run is telling Google that I'm running it, and disclosing my IP address in doing so: shows that the User Agent header identifies the app as (Note that the app clearly identifies itself in the User-Agent header.) A bit more quick research turned up a statement by Canada's Privacy Commissioner: An Internet Protocol (IP) address can be considered personal information if it can be associated with an identifiable individual. For example, in one complaint finding, we determined that some of the IP addresses that an internet service provider (ISP) was collecting were personal information because the ISP had the ability to link the IP addresses to its customers through their subscriber IDs. It's not too difficult to imagine that Google probably has enough data on Canadians for this to be a real problem. I discovered that this app is maintained by the Canadian Digital Service, and that the source code is on GitHub, but that the code itself didn't directly contain any references to clients3.google.com. [...]

1 0

Who’s been editing the Ripple CEO’s Wikipedia page?
by Giacomo Tesio Aug. 24, 2020

Aug. 24, 2020

Ripple is a cutting-edge Silicon Valley tech start-up with ambitions to one day be “to payments as Amazon was to books”. [...] Spanish bank Santander, a Ripple investor and what the company calls “one of our largest and most important customers”, recently chose not to use Ripple’s XRP currency for its new international payment network. [...] ..it’s come to FT Alphaville’s attention recently that some Wikipedia users — two in particular — have been repeatedly editing Ripple CEO Brad Garlinghouse’s Wikipedia page to remove some less positive aspects of the entry. Specifically, these two users have been removing text under the “Controversies” section of the page, and one of them in fact removed the whole section entirely, before it was reinstated by a different Wikipedia editor. The Controversies section includes the fact that Garlinghouse had claimed multiple times that the published error rate for SWIFT messaging was at least six per cent (a claim that has been proven to be false in a great piece by Martin Walker published by the London School of Economics Business Review); the fact that he’d been personally named in a group of class actions against Ripple that claim the company has breached various securities laws; and the fact he’d admitted that, without sales of the XRP cryptocurrency, Ripple would be lossmaking [...] # Crypto propaganda wars So there’s been something of an “edit war” on the page, with multiple removals and reinstatements of text since May. [...] Continua su https://ftalphaville.ft.com/2020/08/20/1597909956000/Who-s-been-editing-the… o su https://technocodex.com/whos-been-editing-the-ripple-ceos-wikipedia-page/ La questione è interessante non tanto per le manomissioni di Wikipedia a fini propagandistici (piuttosto consueti nel mondo politico in prossimità delle elezioni) ma perché Ripple è spesso citato come esempio di blockchain "enterprise", addirittura uno strumento b2b per banche, un esempio "virtuoso" a riprova della serietà della fuffa blockchain. Giacomo

1 0