- nexa - server-nexa.polito.it

First fine for the application of GDPR Article 25 in Romania
by Giacomo Tesio July 5, 2019

July 5, 2019

https://www.dataprotection.ro/?page=Comunicat_Amenda_Unicredit&lang=en On the 27th of June 2019, the National Supervisory Authority finalised an investigation at the controller UNICREDIT BANK S.A. and found that it breached the provisions of Article 25 (1) of Regulation (EU) 2016/679 of European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The controller was sanctioned with a fine in the amount of 613,912 lei, the equivalent in euro of 130,000 euros. The sanction was applied to UNICREDIT BANK S.A. as a result of the failure to implement appropriate technical and organisational measures, both within the determination of the processing means and processing operations themselves, designed to effectively implement data protection principles, such as data minimisation, and to integrate the necessary safeguards in the processing, in order to meet the GDPR requirements and to protect the rights of the data subjects. This led to the disclosure of data concerning the personal identification number and the payer’s address (for situations where the payer performs the transaction from an account opened with another credit institution – external transactions and cash deposits) and data concerning the payer’s address (for situations where the payer made the transaction from an account opened with UNICREDIT BANK SA – internal transactions) in the documents containing the details of transactions and made available on-line to payment customers, for a number of 337,042 data subjects, during the period between the 25th of May 2018 – the 10th of December 2018. The sanction was imposed following an intimation addressed to the National Supervisory Authority on the 22nd of November 2018 indicating that the data concerning the personal identification number and the address of the persons performing payments to UNICREDIT BANK S.A., via online transactions, were disclosed to the beneficiary of the transaction through the account statement/details. Pursuant to Article 5 (1) letter c) of GDPR (“Principles relating to processing of personal data”), the controller had the obligation to process the data limited to what is necessary in relation to the purposes for which they are processed. In the same time, Recital (78) of the Regulation states: ”The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.” ____ 130 mila euro per Unicredit credo siano più o meno quanto 13 centesimi per me. Probabilmente molto meno. La multa più bassa che ho pagato negli ultimi anni per aver tardato a rinnovare il parcheggio è di 38 euro. Qualcuno mi spiega perché? Giacomo

1 0

Youtube's ban on "hacking techniques" threatens to shut down all of infosec Youtube
by Giacomo Tesio July 5, 2019

July 5, 2019

https://boingboing.net/2019/07/03/nobus-r-us.html Once upon a time, companies were able to insist -- with a straight face -- that the real problem with the security defects in their products was the researchers who went public with them, warning customers and users that the products they were trusting were not trustworthy. Then came the modern infosec movement, in which hactivists and researchers started to give companies a little grace period before going public, while still rejecting the whole idea of "security through obscurity." If your security depends on no one else independently rediscovering the defects you've identified, you're going to be very disappointed -- just ask all those American cities that are paying out to ransomware creeps who got hold of a defect that the NSA kept secret so they could use it against "bad guys." Infosec's watchword is "sunlight is the best disinfectant." If you want to prove that a product is genuinely defective, it's not enough to make the claim: you have to back it up with demos that anyone else can replicate -- otherwise the companies will straight up call you a liar and assure their customers that there's nothing to worry about. Yesterday, Youtube froze Kody Kinzie's longrunning Cyber Weapons Lab channel, citing a policy that bans "Instructional hacking and phishing: Showing users how to bypass secure computer systems." He now has a "strike," which prevents him from uploading any new videos. This may sound like a commonsense measure, but consider: the "bad guys" can figure this stuff out on their own. The two groups that really benefit from these disclosures are: 1. Users, who get to know which systems they should and should not trust; and 2. Developers, who learn from other developers' blunders and improve their own security. Youtube banning security disclosures doesn't make products more secure, nor will it prevent attackers from exploiting defects -- but it will mean that users will be the last to know that they've been trusting the wrong companies, and that developers will keep on making the same stupid mistakes...forever. > We made a video about launching fireworks over Wi-Fi for the 4th of July only to find out @YouTube gave us a strike because we teach about hacking, so we can't upload it. > > YouTube now bans: "Instructional hacking and phishing: Showing users how to bypass secure computer systems" > > — Kody (@KodyKinzie) July 2, 2019

1 0

Thumbs Down to Facebook’s Cryptocurrency by Joseph E. Stiglitz - Project Syndicate
by J.C. DE MARTIN July 5, 2019

July 5, 2019

Thumbs Down to Facebook’s Cryptocurrency Jul 2, 2019 JOSEPH E. STIGLITZ Only a fool would trust Facebook with his or her financial wellbeing. But maybe that’s the point: with so much personal data on some 2.4 billion monthly active users, who knows better than Facebook just how many suckers are born every minute? https://www.project-syndicate.org/commentary/facebook-libra-facilitates-cri… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Facebook ads funded by 'dark money' are the right's weapon for 2020 | Technology | The Guardian
by Alberto Cammozzo July 5, 2019

July 5, 2019

<https://www.theguardian.com/technology/2019/jul/05/facebook-ads-2020-dark-m…> In the weeks leading up to a tightly contested 2018 midterm election in Virginia, a Facebook page called “Wacky Wexton Not” ran an ad that pictured Democratic congressional candidate Jennifer Wexton next to Nazi troops. Another labeled her an “evil socialist”. Yet another referenced Nazi uniforms, stating, “Wexton and her modern day brown shirts. They Are Evil. They Hate America. They Hate You.” Who spent $211 launching 24 anti-Wexton ads? It’s unclear. The ads state they were “Paid for by a freedom loving American Citizen exercising my natural law right, protected by the 1st Amendment and protected by the 2nd Amendment.” But there’s nothing in them – or in Facebook’s new ad library that’s designed to shine light on who’s funding political adss – that provides personal information about the person or group behind the attack on Wexton (who won her race). This small incident highlights a bigger problem as the 2020 election looms. How so-called untraceable “dark money” Facebook ads persist via easily exploitable loopholes in the ad archive, a database created in response to foreign interference and disinformation campaigns during the 2016 election. Now heading into the 2020 election, dark money ads remain a potent political weapon that the Republican party and conservative media in particular are using to push a rightwing agenda and get Donald Trump re-elected. [...]

1 0

Boeing’s 737 Max Software Outsourced to $9-an-Hour Engineers
by J.C. DE MARTIN July 4, 2019

July 4, 2019

*Boeing’s 737 Max Software Outsourced to $9-an-Hour Engineers** * By Peter Robison 28 June 2019, 22:46 CEST […] Continua qui: https://www.bloomberg.com/news/articles/2019-06-28/boeing-s-737-max-softwar…

1 0

Email Tracking Is Creepy and Invasive and No One Should Do It - VICE
by J.C. DE MARTIN July 3, 2019

July 3, 2019

https://www.vice.com/en_us/article/a3xpwj/email-tracking-is-creepy-and-inva… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Fwd: [DNAmazon Admits Alexa Voice Recordings Saved Indefinitely
by Matteo G.P. Flora July 3, 2019

July 3, 2019

"After U.S. Senator Chris Coons (D-Del.) demanded Amazon outline its data privacy policies, Amazon in a letter that was publicly disclosed on Tuesday said that consumers have the option to delete their recordings – but even if they do, the company or third-party developers may still save records of customers’ interactions with Alexa." Articolo: < https://threatpost.com/amazon-admits-alexa-voice-recordings-saved-indefinit… > PDF della risposta: < https://www.coons.senate.gov/imo/media/doc/Amazon%20Senator%20Coons__Respon… > Che diranno i Garanti Europei? M -- Matteo G.P. Flora Founder and CEO at TF Group A Via Vitruvio 1, Milano (MI) M +39.347.9676430 E mf(a)thefool.it W http://thefool.it

1 0

Libra: US Congress asks Facebook to pause development | Technology | The Guardian
by Alberto Cammozzo July 3, 2019

July 3, 2019

<https://www.theguardian.com/technology/2019/jul/03/libra-us-congress-asks-f…> The US Congress has asked Facebook to pause development on its Libra cryptocurrency until lawmakers have had more time to investigate the ramifications of the company’s actions. In a letter from the Democratic heads of the house committee on financial services and its subcommittees, the legislators ask the company to “immediately cease implementation plans”. “Because Facebook is already in the hands of over a quarter of the world’s population, it is imperative that Facebook and its partners immediately cease implementation plans until regulators and Congress have an opportunity to examine these issues and take action,” the letter says. “During this moratorium, we intend to hold public hearings on the risks and benefits of cryptocurrency-based activities and explore legislative solutions. Failure to cease implementation before we can do so risks a new Swiss-based financial system that is too big to fail.” [...]

1 0

Are computers making work more routine and less social? | Eurofound
by J.C. DE MARTIN July 3, 2019

July 3, 2019

https://www.eurofound.europa.eu/publications/blog/are-computers-making-work… The spread of ICT in the economy is changing both the types of jobs that employ people and the types of tasks that people perform in their jobs. The latest research on the content of work suggests that computerisation has boosted the proportion of jobs with social interaction at their core, while at the same time reducing social tasks within certain jobs (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Chinese border guards put secret surveillance app on tourists' phones
by Alberto Cammozzo July 3, 2019

July 3, 2019

<https://www.theguardian.com/world/2019/jul/02/chinese-border-guards-surveil…> Chinese border police are secretly installing surveillance apps on the phones of visitors and downloading personal information as part of the government’s intensive scrutiny of the remote Xinjiang region, the Guardian can reveal. The Chinese government has curbed freedoms in the province for the local Muslim population, installing facial recognition cameras on streets and in mosques and reportedly forcing residents to download software that searches their phones. An investigation by the Guardian and international partners has found that travellers are being targeted when they attempt to enter the region from neighbouring Kyrgyzstan. Border guards are taking their phones and secretly installing an app that extracts emails, texts and contacts, as well as information about the handset itself. Tourists say they have not been warned by authorities in advance or told about what the software is looking for, or that their information is being taken. The investigation, with partners including Süddeutsche Zeitung and the New York Times, has found that people using the remote Irkeshtam border crossing into the country are routinely having their phones screened by guards. [...]

1 0