- nexa - server-nexa.polito.it

How Fair Is Zoom Justice?
by don Luca Peyron June 23, 2020

June 23, 2020

Interessante inchiesta USA Buona lettura dl https://themarkup.org/coronavirus/2020/06/09/how-fair-is-zoom-justice _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1

Mappa avanzamento lavori piano Banda Ultra Larga
by Antonio Vetro' June 23, 2020

June 23, 2020

Mappa interattiva e grafici di sintesi: https://bandaultralarga.italia.it/ av

3 2

Il primo videogame a essere adottato come "libro di testo" scolastico
by don Luca Peyron June 23, 2020

June 23, 2020

This War of Mine entra nelle scuole polacche come libro di testo consigliato. La prima volta per un videogioco Buona lettura dl https://www.wired.it/gadget/videogiochi/2020/06/23/il-primo-videogame-a-ess… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

On Contact Tracing and Hardware Tokens « bunnie's blog
by Alberto Cammozzo June 23, 2020

June 23, 2020

<https://www.bunniestudios.com/blog/?p=5820> On Contact Tracing and Hardware Tokens Early in the COVID-19 pandemic, I was tapped by the European Commission to develop a privacy-protecting contact tracing token, which you can read more about at the Simmel project home page. And very recently, Singapore has announced the deployment of a TraceTogether token. As part of their launch, I was invited to participate in a review of their solution. The urgency of COVID-19 and the essential challenges of building supply chains means we are now in the position of bolting wheels on a plane as it rolls down the runway. As with many issues involving privacy and technology, this is a complicated and nuanced situation that cannot be easily digested into a series of tweets. Thus, over the coming weeks I hope to offer you my insights in the form of short essays, which I will post here. Since I was only able to spend an hour with the TraceTogether token so far, I’ll spend most of this essay setting up the background I’ll be using to evaluate the token. Contact Tracing The basic idea behind contact tracing is simple: if you get sick, identify your close contacts, and test them to see if they are also sick. If you do this fast enough, you can contain COVID-19, and most of society continues to function as normal. However, from an implementation standpoint, there are some subtleties that I struggled to wrap my head around. Dr. Vivian Balakrishnan, the Minister-in-charge of the Smart Nation Initiative, briefly stated at our meeting on Friday that the Apple/Google Exposure Notification system did not reveal the “graph”. In order to help myself understand the epidemiological significance of extracting the contact graph, I drew some diagrams to illustrate contact tracing scenarios. Let’s start by looking at a very simple contact tracing scenario. In the diagram above, two individuals are shown, Person 1 and Person 2. We start Day 1 with Person 1 already infectious yet only mildly symptomatic. Person 1 comes in contact with Person 2 around mid-day. Person 2 then incubates the virus for a day, and becomes infectious late on Day 2. Person 2 may not have any symptoms at this time. At some future date, Person 2 infects two more people. In this simple example, it is easy to see that if we can isolate Person 2 early enough, we could prevent at least two future exposures to the virus. Now let’s take a look at a more complicated COVID-19 spread scenario with no contact tracing. Let’s continue to assume Person 1 is a carrier with mild to no symptoms but is infectious: a so-called “super spreader”. The above graphic depicts the timelines of 8 people over a span of five days with no contact tracing. Person 1 is ultimately responsible for the infection of several people over a period of a few days. Observe that the incubation periods are not identical for every individual; it will take a different amount of time for every person to incubate the virus and become infectious. Furthermore, the onset of symptoms is not strongly correlated with infectiousness. Now let’s add contact tracing to this graph. The graphic above illustrates the same scenario as before, but with the “platonic ideal” of contact tracing and isolation. In this case, Person 4 shows symptoms, seeks testing, and is confirmed positive early on Day 4; their contacts are isolated, and dozens of colleagues and friends are spared from future infection. Significantly, digging through the graph of contacts also allows one to discover a shared contact of Person 4 and Person 2, thus revealing that Person 1 is the originating asymptomatic carrier. There is a subtle distinction between “contact tracing” and “contact notification”. Apple/Google’s “Exposure Notification” system only perform notifications to the immediate contacts of an infected person. The significance of this subtlety is hinted by the fact that the protocol was originally named a “Privacy Preserving Contact Tracing Protocol”, but renamed to the more accurate description of “Exposure Notification” in late April. To better understand the limitations of exposure notification, let’s consider the same scenario as above, but instead of tracing out the entire graph, we only notify the immediate contacts of the first person to show definite symptoms – that is, Person 4. With exposure notification, carriers with mild to no symptoms such as Person 1 would get misleading notifications that they were in contact with a person who tested positive for COVID-19, when in fact, it was actually the case that Person 1 gave COVID-19 to Person 4. In this case, Person 1 – who feels fine but is actually infectious – will continue about their daily life, except for the curiosity that everyone around them seems to be testing positive for COVID-19. As a result, some continued infections are unavoidable. Furthermore, Person 2 is a hidden node from Person 4, as Person 2 is not within Person 4’s set of immediate notification contacts. In a nutshell, Exposure Notification alone cannot determine causality of an infection. A full contact “graph”, on the other hand, can discover carriers with mild to no symptoms. Furthermore, it has been well-established that a significant fraction of COVID-19 infections show mild or no symptoms for extended periods of time – these are not “rare” events. These individuals are infectious but are well enough to walk briskly through crowded metro stations and eat at hawker stalls. Thus, in the “local context” of Singapore, asymptomatic carriers can seed dozens of clusters in a matter of days if not hours, unlike less dense countries like the US, where infectious individuals may come in contact with only a handful of people on any given day. The inability to quickly identify and isolate mildly symptomatic super-spreaders motivates the development of the local TraceTogether solution, which unlocks the potential for “full graph” contact tracing. On Privacy and Contact Tracing Of course, the privacy implications of full-graph contact tracing are profound. Also profound are the potential health risks and loss of life absent full-graph contact tracing. There’s also a proven solution for containing COVID-19 that involves no sacrifice of privacy: an extended Circuit-Breaker style lockdown. Of course, this comes at the price of the economy. Of the three elements of privacy, health, or economy, it seems we can only pick two. There is a separate and important debate about which two we should prioritize, but that is beyond the context of this essay. For the purpose of this discussion, let’s assume contact tracing will be implemented. In this case, it is incumbent upon technologists like us to try and come up with a compromise that can mitigate the privacy impact while facilitating public policy. Back in early April, Sean ‘xobs’ Cross and I were contacted by the European Commission’s NGI program via NLnet to propose a privacy-protecting contact tracing hardware token. The resulting proposal is called “Simmel”. While not perfect, the salient privacy features of Simmel include: Strong isolation of user data. By disallowing sensor fusion with the smartphone, there is zero risk of GPS or other geolocation data being leaked. It is also much harder to do metadata-based attacks against user privacy. Citizens are firmly in control. Users are the physical keeper of their contact data; no third-party servers are involved, until they volunteer their data to an authority by surrendering the physical token. This means in an extreme case, a user has the option of physically destroying their token to erase their history. Citizens can temporarily opt-out. By simply twisting the cap of the token, users can power the token down at any time, thus creating a gap in their trace data (note: this feature is not present on the first prototypes). Randomized broadcast data. This is a protocol-level feature which we recommend to defeat the ability for third parties (perhaps an advertising agency or a hostile government) from piggy backing on the protocol to aggregate user locations for commercial or strategic benefit. Why a Hardware Token? But why a hardware token? Isn’t an app just better in so many ways? At our session on Friday, the TraceTogether token team stated that Singapore needs hardware tokens to better serve two groups: the underprivileged, and iPhone users. The underprivileged can’t afford to buy a smartphone; and iPhone users can only run Apple-approved protocols, such as their Exposure Notification service (which does not enable full contact tracing). In other words, iPhone users, like the underprivileged, also don’t own a smartphone; rather, they’ve bought a phone that can only be used for Apple-sanctioned activities. Our Simmel proposal makes it clear that I’m a fan of a hardware token, but for reasons of privacy. It turns out that apps, and smartphones in general, are bad for user privacy. If you genuinely care about privacy, you would leave your smartphone at home. The table below helps to illustrate the point. A red X indicates a known plausible infraction of privacy for a given device scenario. [...]

4 4

Most Government-Sponsored COVID-19 Contact Tracing Apps Are Insecure and Risk Exposing Users’ Privacy and Data
by Enrico Nardelli June 23, 2020

June 23, 2020

(mi pare non sia passato in lista) https://www.guardsquare.com/en/blog/report-proliferation-covid-19-contact-t… ... We assessed 17 Android mobile contact tracing apps from 17 different countries. All of these apps were built by government entities (though some have used third-party contractors, which we’ll cover later). ... Each of the categories analyzed below presents risk for mobile app security, including user location data and other information with privacy concerns attached. Without adequate protection, these apps could be tampered with or even copied and turned into “fake apps,” allowing malicious actors to trick citizens into downloading unapproved versions and giving away sensitive information. ... it’s clear that the vast majority of contact tracing apps built and deployed by governments are not sufficiently secured. They are easy for hackers to decompile, attack, and even create fake clones, and are likely to lead to security breaches if they have not already. -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

2 2

Parlamento europeo vieta la pubblicità personalizzata di Facebook e Google
by Giacomo Tesio June 23, 2020

June 23, 2020

Riporto da https://www.linkiesta.it/2020/06/facebook-google-pubblicita-personalizzata-… La notizia più importante di cui non avete mai sentito parlare anche perché non compare nelle ricerche sui social si è consumata il 18 giugno a Bruxelles, nelle aule del Parlamento europeo, quando 503 deputati su 701 hanno approvato la mozione proposta dal deputato olandese Paul Tang, del gruppo socialista e democratico, di vietare la pubblicità personalizzata su Internet su cui è incentrato il modello di business di Facebook e Google. I deputati italiani dei vari gruppi hanno votato a favore, tranne quelli della Lega. Si tratta di un emendamento al rapporto annuale sulla concorrenza, ma soprattutto è la prima presa di posizione ufficiale di un’assemblea democratica contro il modello di business dei giganti del web che sfrutta i dati personali degli utenti per fare ricavi e determina una posizione dominante che cancella la concorrenza, per non parlare dei problemi legati alla manipolazione dell’opinione pubblica e dei processi democratici. Su Twitter, Paul Tang festeggia questa SQL^W Legal injection: https://twitter.com/paultang/status/1273960659420680192 Giacomo

5 5

Webinar infuocato sul dopo virus nella diocesi di Salsiccia
by don Luca Peyron June 23, 2020

June 23, 2020

Per sorridere ma anche per aiutare chi non è del ramo a comprendere cosa si agita dalle nostre parti, e soprattutto come Buona leggera lettura dl https://www.vinonuovo.it/teologia/pensare-la-fede/webinar-infuocato-sul-dop… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Reminder | 79° Nexa Lunch Seminar | 24 Giugno 2020
by Nexa Media June 22, 2020

June 22, 2020

Gentilissimi, vi ricordiamo che *mercoledì 24 giugno, dalle ore 13.00 alle ore 14.00*, si svolgerà il 79° Nexa Lunch Seminar, con un incontro dal titolo: *Data-Driven Economy: approccio olistico nella regolamentazione ex ante ed ex post.* Ospite: /Emanuele Fazio//(Università degli Studi di Trento//)./ L'incontro si svolgerà in *modalità telematica*, utilizzando il software open source di conference call *Jitsi Meet*. Per chi vorrà partecipare live al seminario sarà possibile accedere alla conference call attraverso il seguente link: https://meet.nexacenter.org/LunchSeminar Maggiori informazioni sull'incontro sono disponibili alla pagina: https://nexa.polito.it/lunch-79 Cordiali saluti, -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino _web:_ https://nexa.polito.it/ _mail:_anita.botta@polito.it <mailto:anita.botta@polito.it> tel: 011 090 7219

1 0

Levine: "The Racist Origins of Silicon Valley"
by J.C. DE MARTIN June 22, 2020

June 22, 2020

Il titolo è acchiappaclick, ma il post merita una lettura. jc *The Racist Origins of Silicon Valley** * /A century ago, America loved eugenics and was obsessed with protecting its "superior" Anglo-American stock from the threat of immigration. Out of this nativist vortex, the first computer was born.// / Yasha Levine Jun 21 https://yasha.substack.com/p/the-racist-origins-of-silicon-valley

1 0

Journalist’s phone hacked by new ‘invisible’ technique: All he had to do was visit one website. Any website. | The Star
by Alberto Cammozzo June 22, 2020

June 22, 2020

<https://www.thestar.com/news/canada/2020/06/21/journalists-phone-hacked-by-…> The white iPhone with chipped paint that Moroccan journalist Omar Radi used to stay in contact with his sources also allowed his government to spy on him. They could read every email, text and website visited; listen to every phone call and watch every video conference; download calendar entries, monitor GPS coordinates, and even turn on the camera and microphone to see and hear where the phone was at any moment. Yet Radi was trained in encryption and cyber security. He hadn’t clicked on any suspicious links and didn’t have any missed calls on WhatsApp — both well-documented ways a cell phone can be hacked. Instead, a report published Monday by Amnesty International shows Radi was targeted by a new and frighteningly stealthy technique. All he had to do was visit one website. Any website. Forensic evidence gathered by Amnesty International on Radi’s phone shows that it was infected by “network injection,” a fully automated method where an attacker intercepts a cellular signal when it makes a request to visit a website. In milliseconds, the web browser is diverted to a malicious site and spyware code is downloaded that allows remote access to everything on the phone. The browser then redirects to the intended website and the user is none the wiser. [...] Link a reporter di Amnesty: <https://www.amnesty.org/en/latest/research/2020/06/moroccan-journalist-targ…>

2 1