- nexa - server-nexa.polito.it

GAO reports di un qualche interesse
by Diego Latella July 8, 2019

July 8, 2019

Nuclear Weapons: Additional Actions Could Help Improve Management of Activities Involving Explosive Materials GAO-19-449, June 17 Report: https://www.gao.gov/products/GAO-19-449 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/700/699767.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Critical Infrastructure Protection: Key Pipeline Security Documents Need to Reflect Current Operating Environment GAO-19-426, June 5 Report: https://www.gao.gov/products/GAO-19-426 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/700/699512.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Information Technology: Implementation of GAO Recommendations Would Strengthen Federal Agencies' Acquisitions, Operations, and Cybersecurity Efforts GAO-19-641T, June 26 Testimony: https://www.gao.gov/products/GAO-19-641T <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/710/700020.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Face Recognition Technology: DOJ and FBI Have Taken Some Actions in Response to GAO Recommendations to Ensure Privacy and Accuracy, But Additional Work Remains GAO-19-579T, June 4 Testimony: https://www.gao.gov/products/GAO-19-579T <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/700/699488.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat

1 0

121° Mercoledì di Nexa | 10 luglio 2019
by Nexa Media July 8, 2019

July 8, 2019

Nexa Center for Internet and Society Newsletter Se non visualizzi correttamente questo messaggio clicca qui <http://nexa.polito.it/mercoledi-121> NEXA 121° Mercoledì di Nexa Mercoledì 10 luglio 2019, ore 18.00 - 20.00 Politecnico di Torino http://nexa.polito.it/mercoledi-121 Condividere la conoscenza legale Speaker Marco Ciurcina (Avvocato e Fellow Centro Nexa) e Puria Nafisi Azizi (Dyne.org) This event will be webcast live: https://nexa.polito.it/nexa-hangout-on-air Negli ultimi anni si è diffusa la pratica di *lavorare sui documenti legali utilizzando strumenti di condivisione* (wiki, ecc.). Si sono diffusi anche dispositivi che permettono di elaborare documenti legali attraverso flussi di domande e risposte. Alcuni di questi, sono progetti in software libero (per es., Docassemble <https://github.com/jhpyle/docassemble> e KSweb <https://ks.studiolegale.it/>). In occasione del seminario verrà illustrato il funzionamento e le caratteristiche di KSweb, analizzando nello specifico: # l'uso di una base di conoscenza (flusso di domande e risposte e compilazione di un documento) # la generazione e condivisione di una base di conoscenza. BIOGRAFIE - e informazioni supplementari [mercoledì121] *Marco CIURCINA*, avvocato in Torino, opera nel campo del diritto commerciale e contrattuale, diritto dell'Information Technology, diritto d'autore, brevetti e marchi, in particolare con focus su software libero, contenuti e dati aperti. Docente in "Diritto ed etica della comunicazione" presso il Politecnico di Torino. Attivamente impegnato per la promozione del software libero e delle libertà digitali. *Puria Nafisi AZIZI *nasce a Milano nel 1982 da una famiglia di architetti e artisti. Da sempre ha una bivalenza tra design e tecnologia scoprendo solo poi che le due cose non sono disgiunte e anzi per ottenere buoni risultati bisogna altresí aggiungere amor proprio per il lavoro e per i risultati di impatto sociale. Hacktivista di Software Libero (netstudent, hiptia, assoli...). Attualmente lavora con una delle free software foundry piú grandi e politicamente esposte d'europa (Dyne.org <https://www.dyne.org/>) per il progetto europeo DECODE <https://decodeproject.eu/> dove fa l'esperto di tecnologia a alto impatto sociale su ledger distribuiti e Interaction Design per la crittografia. Da due anni a questa parte si cura anche della manutenzione dello strumento KSWEB <https://ks.studiolegale.it/> per la generazione, la diffusione e la permeazione della conoscienza strutturata. *Letture consigliate e link utili:* * https://slides.com/mac5/deck-6. * https://ks.studiolegale.it <https://ks.studiolegale.it/>. * https://github.com/puria/ksweb. * https://docassemble.org/. * https://github.com/jhpyle/docassemble <https://github.com/jhpyle/docassemble>. Che cosa sono il Centro Nexa e i cicli di incontri “Mercoledì di Nexa” e “Nexa Lunch Seminar” <https://www.facebook.com/nexa.center/> <https://twitter.com/nexacenter> <https://www.youtube.com/user/NexaCenter> #marcociurcina <https://twitter.com/marcociurcina> #nexawednesday <https://twitter.com/search?q=%23nexawednesday&src=typd> #azizi <https://twitter.com/pna> Il Centro Nexa su Internet & Società del Politecnico di Torino (Dipartimento di Automatica e Informatica) è un centro di ricerca indipendente e interdisciplinare che studia Internet e il suo effetto sulla società. Maggiori informazioni all'indirizzo: http://nexa.polito.it/about. Durante i “*Mercoledì di Nexa*”, che si tengono *ogni 2° mercoledì del mese* alle *ore 18 in punto*, il Centro Nexa su Internet e Società apre le sue porte non solo agli esperti e a tutti coloro i quali lavorano con Internet, ma anche a semplici appassionati e cittadini. Il ciclo di incontri intende approfondire, con un linguaggio preciso ma divulgativo, i temi legati alla Rete: motori di ricerca, Creative Commons, social networks, open source/software libero, neutralità della rete, libertà di espressione, privacy, file sharing, big e open data, smart cities e molto altro. Al centro di quasi tutti gli incontri un ospite pronto a dialogare con i direttori del Centro Nexa, il Prof. Juan Carlos De Martin del Politecnico di Torino e il Prof. Marco Ricolfi dell'Università di Torino, nonché lo staff e i Fellows del Centro Nexa. Maggiori informazioni sui Mercoledì di Nexa, incluso un elenco di tutti i “Mercoledì” passati, sono disponibili all'indirizzo: http://nexa.polito.it/mercoledi. Si segnala inoltre che dal maggio 2012 *ogni 4° mercoledì* del mese *dalle ore 13 alle ore 14* il Centro Nexa organizza anche i "*Nexa Lunch Seminar*". Una lista di tutti i “Lunch Seminar” passati è disponibile all'indirizzo: http://nexa.polito.it/lunch-seminars. See our events calendar <http://nexa.polito.it/events> if you're curious about future luncheons, discussions, lectures, and conferences not listed in this email. Our events are free and open to the public, unless otherwise noted. Responsabile Comunicazione Centro Nexa su Internet & Società: *Francesco Ruggiero*, tel: +39 011 090 7219, Mob: +39 349 1335082, francesco.ruggiero(a)polito.it <mailto:francesco.ruggiero@polito.it>. Maggiori informazioni sui Mercoledì di Nexa e i Nexa Lunch Seminar, sono disponibili all'indirizzo: http://nexa.polito.it/events. Weekly Events Newsletter. Sign up <http://nexa.polito.it/mailing-lists> to receive this newsletter if this email was forwarded to you. To manage your subscription preferences, please click here <https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa>. Connect & get involved: Jobs, internships, and more <http://nexa.polito.it/get-involved>.

1 1

Moratorium call on surveillance technology to end ‘free-for-all’ abuses: UN expert
by Giacomo Tesio July 8, 2019

July 8, 2019

https://news.un.org/en/story/2019/06/1041231 Surveillance technology should be banned immediately until “effective” national or international controls are put in place to lessen its harmful impact, a UN-appointed independent rights expert said on Tuesday. David Kaye, who’s the United Nations Special Rapporteur on freedom of opinion and expression, made the appeal as he prepared to present his latest report to the Human Rights Council in Geneva. He highlighted that while States were largely responsible, companies appeared to be “operating without constraint” too, in a “free for all” private surveillance industry environment. “Surveillance tools can interfere with human rights, from the right to privacy and freedom of expression to rights of association and assembly, religious belief, non-discrimination, and public participation,” the Special Rapporteur said in statement. “And yet they are not subject to any effective global or national control.” ## Surveillance linked to detention, torture, extrajudicial killings According to Mr. Kaye’s report, the surveillance of journalists, activists, opposition figures, critics and UN investigators can lead to arbitrary detention. It has also been linked to torture and possibly to extrajudicial killings, the Special Rapporteur said, citing various ways that States and other actors monitor individuals who exercise their right to freedom of expression. These include hacking computers, networks and mobile phones, using facial recognition surveillance and other sophisticated surveillance tools to shadow journalists, politicians, UN investigators and human rights advocates. Among the Special Rapporteur’s recommendations is an appeal to States to adopt domestic safeguards to protect individuals from unlawful surveillance, in line with international human rights law. In particular, Mr. Kaye calls for the development of publicly-owned mechanisms for the approval and oversight of surveillance technology. In addition, countries should strengthen export controls and provide assurances of legal redress to victims. “It is imperative that States limit the uses of such technologies to lawful ones only, subjected to the strictest sorts of oversight and authorisation,” he said. “And that States condition export of such technologies on the strictest human rights due diligence”. ## Companies operate in ‘free-for-all’ snooping environment Addressing the issue of corporate responsibility, Mr. Kaye insisted that companies should adhere to their human rights responsibilities, as they “appear to be operating without constraint”. To remedy this, firms should disclose data transfers, conduct “rigorous” human rights impact assessments, and avoid transfers to States unable to guarantee compliance with human rights norms, the Special Rapporteur said. “The private surveillance industry is a free for all,” Kaye noted, “an environment in which States and industry are collaborating in the spread of technology that is causing immediate and regular harm to individuals and organisations that are essential to democratic life – journalists, activists, opposition figures, lawyers, and others. “It is time for governments and companies to recognise their responsibilities and impose rigorous requirements on this industry, with the goal of protecting human rights for all,” Mr. Kaye said. ___ Vi sarebbero molte cose da dire. Per esempio, nell'elenco dei surveillance tools andrebbero inseriti diversi browser open source, come Firefox e Chromium che sono sviluppati da team internazionali (seppur controllati, nei fatti, da Google) e dunque da persone soggette a giurisdizioni diverse. E peraltro, si rifiutano di mitigare gravi vulnerabilità architetturali che al momento sono ancora sfruttate dal Governo Russo (e da chissà quanti altri) contro i propri cittadini (e chissà quanti altri). E' bello osservare che altri iniziano a parlare una responsabilità politica dello sviluppo: nel frattempo l'adozione del POLITICS.txt si sta lentamente diffondendo nell'underground informatico. Rimane il fatto che una moratoria può solo (forse) punire (come? sanzioni economiche?) l'uso di questi strumenti DOPO che è stato scoperto. Sposta i costi. Ma non impedisce la sorveglianza o la detenzione, la tortura o le uccisioni che questa permette. C'è solo un modo per proteggere la popolazione e le istituzioni. Una educazione informatica di massa: insegnando la programmazione e il debugging sin dalle elementari. Giacomo

1 0

Top VPNs secretly owned by Chinese firms
by Luigi Scorca July 7, 2019

July 7, 2019

Nearly a third of top VPNs are secretly owned by Chinese companies, while other owners are based in countries with weak or no privacy laws, potentially putting users at risk, security researchers warn https://www-computerweekly-com.cdn.ampproject.org/c/s/www.computerweekly.co…

1 0

Nuovo master interdisciplinare in data protection - Dublino
by Edoardo Celeste July 6, 2019

July 6, 2019

Cari tutti, la Dublin City University ha recentemente creato un nuovo master interdisciplinare <https://www.dcu.ie/courses/Postgraduate/law_and_government/MA-Data-Protecti…> in data protection and privacy law (90 ECTS). Si tratta del primo corso in Irlanda che combina moduli relativi al mondo giuridico con corsi della facoltà di Computing (allego il programma dei corsi per chi ne fosse interessato). Requisito per l’iscrizione è la laurea triennale in giurisprudenza o ingegneria informatica (o analoghe). Per maggiori informazioni, non esitate a contattarmi. Cordiali saluti, Edoardo Celeste ___ Edoardo Celeste School of Law and Government | Dublin City University T: @EdoCeles | see my last publication here <https://doi.org/10.1017/S1574019619000038> Henry Grattan Building | DCU Glasnevin Campus | Dublin 9 | Ireland

1 0

London Police Facial Recognition ‘Fails 80% Of The Time And Must Stop Now’
by Alberto Cammozzo July 5, 2019

July 5, 2019

<https://www.forbes.com/sites/thomasbrewster/2019/07/04/london-police-facial…> London’s Metropolitan Police’s controversial trial of facial recognition technology to spot suspects failed to work 80% of the time and could be ruled illegal, according to researchers. The researchers from the University of Essex said the problems were so bad that the use of facial recognition by the Met should be stopped immediately. They were given privileged access to six live trials, watching them from the preinstallation discussions through to deployment and use by police at the Westfield shopping center in Stratford, London. Throughout, “significant operational shortcomings” were uncovered. Over the six trials, the facial recognition tech made 42 matches of people walking around Westfield with individuals on a watchlist. In only eight cases could the report authors say with absolute confidence the technology made correct matches. But the police still deemed it acceptable to stop individuals on 26 occasions. In 14 of those cases, the matches were found to be incorrect. In four cases, the searches were unsuccessful when the person they were hunting disappeared in the crowds. Overall, in just eight cases was a correct match found, meaning the facial recognition was only successful in 19% of cases. The watchlist itself was also flawed, the researchers said, including out of date information. That led to people being stopped even though their case was already concluded. The Met said its tests were legal and successful in finding suspects. Deputy assistant commissioner Duncan Ball told The Guardian the force was “extremely disappointed with the negative and unbalanced tone of this report.” The Met has carried out ten trials of NeoFace, a facial recognition tech provided by Japanese supplier NEC, over the last three years. That included two tests at Notting Hill Carnival. The force is planning more tests in the future at sporting events and other live occassions in the coming months. Wrongful identification Civil rights NGO Big Brother Watch was outraged at the findings. "This report is an utterly damning conclusion to the police’s dangerous experimentation with live facial recognition. It confirms what we have long warned—it’s inaccurate, lawless and must be stopped urgently,” said director Silkie Carlo. “This China-style surveillance is undemocratic and has no place in Britain.” Big Brother Watch has previously detailed a number of cases where people have been falsely identified. In one case, a 14-year-old boy was recognized by the facial recognition system, accosted, questioned and released within ten minutes after the police realized he was not the person they were after. In another case, a man protested his right to hide his face from a trial of facial recognition. He was subsequently issued with a £90 public order fine for “shouting profanities in public view.” [...]

1 0

First fine for the application of GDPR Article 25 in Romania
by Giacomo Tesio July 5, 2019

July 5, 2019

https://www.dataprotection.ro/?page=Comunicat_Amenda_Unicredit&lang=en On the 27th of June 2019, the National Supervisory Authority finalised an investigation at the controller UNICREDIT BANK S.A. and found that it breached the provisions of Article 25 (1) of Regulation (EU) 2016/679 of European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The controller was sanctioned with a fine in the amount of 613,912 lei, the equivalent in euro of 130,000 euros. The sanction was applied to UNICREDIT BANK S.A. as a result of the failure to implement appropriate technical and organisational measures, both within the determination of the processing means and processing operations themselves, designed to effectively implement data protection principles, such as data minimisation, and to integrate the necessary safeguards in the processing, in order to meet the GDPR requirements and to protect the rights of the data subjects. This led to the disclosure of data concerning the personal identification number and the payer’s address (for situations where the payer performs the transaction from an account opened with another credit institution – external transactions and cash deposits) and data concerning the payer’s address (for situations where the payer made the transaction from an account opened with UNICREDIT BANK SA – internal transactions) in the documents containing the details of transactions and made available on-line to payment customers, for a number of 337,042 data subjects, during the period between the 25th of May 2018 – the 10th of December 2018. The sanction was imposed following an intimation addressed to the National Supervisory Authority on the 22nd of November 2018 indicating that the data concerning the personal identification number and the address of the persons performing payments to UNICREDIT BANK S.A., via online transactions, were disclosed to the beneficiary of the transaction through the account statement/details. Pursuant to Article 5 (1) letter c) of GDPR (“Principles relating to processing of personal data”), the controller had the obligation to process the data limited to what is necessary in relation to the purposes for which they are processed. In the same time, Recital (78) of the Regulation states: ”The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.” ____ 130 mila euro per Unicredit credo siano più o meno quanto 13 centesimi per me. Probabilmente molto meno. La multa più bassa che ho pagato negli ultimi anni per aver tardato a rinnovare il parcheggio è di 38 euro. Qualcuno mi spiega perché? Giacomo

1 0

Youtube's ban on "hacking techniques" threatens to shut down all of infosec Youtube
by Giacomo Tesio July 5, 2019

July 5, 2019

https://boingboing.net/2019/07/03/nobus-r-us.html Once upon a time, companies were able to insist -- with a straight face -- that the real problem with the security defects in their products was the researchers who went public with them, warning customers and users that the products they were trusting were not trustworthy. Then came the modern infosec movement, in which hactivists and researchers started to give companies a little grace period before going public, while still rejecting the whole idea of "security through obscurity." If your security depends on no one else independently rediscovering the defects you've identified, you're going to be very disappointed -- just ask all those American cities that are paying out to ransomware creeps who got hold of a defect that the NSA kept secret so they could use it against "bad guys." Infosec's watchword is "sunlight is the best disinfectant." If you want to prove that a product is genuinely defective, it's not enough to make the claim: you have to back it up with demos that anyone else can replicate -- otherwise the companies will straight up call you a liar and assure their customers that there's nothing to worry about. Yesterday, Youtube froze Kody Kinzie's longrunning Cyber Weapons Lab channel, citing a policy that bans "Instructional hacking and phishing: Showing users how to bypass secure computer systems." He now has a "strike," which prevents him from uploading any new videos. This may sound like a commonsense measure, but consider: the "bad guys" can figure this stuff out on their own. The two groups that really benefit from these disclosures are: 1. Users, who get to know which systems they should and should not trust; and 2. Developers, who learn from other developers' blunders and improve their own security. Youtube banning security disclosures doesn't make products more secure, nor will it prevent attackers from exploiting defects -- but it will mean that users will be the last to know that they've been trusting the wrong companies, and that developers will keep on making the same stupid mistakes...forever. > We made a video about launching fireworks over Wi-Fi for the 4th of July only to find out @YouTube gave us a strike because we teach about hacking, so we can't upload it. > > YouTube now bans: "Instructional hacking and phishing: Showing users how to bypass secure computer systems" > > — Kody (@KodyKinzie) July 2, 2019

1 0

Thumbs Down to Facebook’s Cryptocurrency by Joseph E. Stiglitz - Project Syndicate
by J.C. DE MARTIN July 5, 2019

July 5, 2019

Thumbs Down to Facebook’s Cryptocurrency Jul 2, 2019 JOSEPH E. STIGLITZ Only a fool would trust Facebook with his or her financial wellbeing. But maybe that’s the point: with so much personal data on some 2.4 billion monthly active users, who knows better than Facebook just how many suckers are born every minute? https://www.project-syndicate.org/commentary/facebook-libra-facilitates-cri… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Facebook ads funded by 'dark money' are the right's weapon for 2020 | Technology | The Guardian
by Alberto Cammozzo July 5, 2019

July 5, 2019

<https://www.theguardian.com/technology/2019/jul/05/facebook-ads-2020-dark-m…> In the weeks leading up to a tightly contested 2018 midterm election in Virginia, a Facebook page called “Wacky Wexton Not” ran an ad that pictured Democratic congressional candidate Jennifer Wexton next to Nazi troops. Another labeled her an “evil socialist”. Yet another referenced Nazi uniforms, stating, “Wexton and her modern day brown shirts. They Are Evil. They Hate America. They Hate You.” Who spent $211 launching 24 anti-Wexton ads? It’s unclear. The ads state they were “Paid for by a freedom loving American Citizen exercising my natural law right, protected by the 1st Amendment and protected by the 2nd Amendment.” But there’s nothing in them – or in Facebook’s new ad library that’s designed to shine light on who’s funding political adss – that provides personal information about the person or group behind the attack on Wexton (who won her race). This small incident highlights a bigger problem as the 2020 election looms. How so-called untraceable “dark money” Facebook ads persist via easily exploitable loopholes in the ad archive, a database created in response to foreign interference and disinformation campaigns during the 2016 election. Now heading into the 2020 election, dark money ads remain a potent political weapon that the Republican party and conservative media in particular are using to push a rightwing agenda and get Donald Trump re-elected. [...]

1 0