- nexa - server-nexa.polito.it

Nuovo master interdisciplinare in data protection - Dublino
by Edoardo Celeste July 6, 2019

July 6, 2019

Cari tutti, la Dublin City University ha recentemente creato un nuovo master interdisciplinare <https://www.dcu.ie/courses/Postgraduate/law_and_government/MA-Data-Protecti…> in data protection and privacy law (90 ECTS). Si tratta del primo corso in Irlanda che combina moduli relativi al mondo giuridico con corsi della facoltà di Computing (allego il programma dei corsi per chi ne fosse interessato). Requisito per l’iscrizione è la laurea triennale in giurisprudenza o ingegneria informatica (o analoghe). Per maggiori informazioni, non esitate a contattarmi. Cordiali saluti, Edoardo Celeste ___ Edoardo Celeste School of Law and Government | Dublin City University T: @EdoCeles | see my last publication here <https://doi.org/10.1017/S1574019619000038> Henry Grattan Building | DCU Glasnevin Campus | Dublin 9 | Ireland

1 0

London Police Facial Recognition ‘Fails 80% Of The Time And Must Stop Now’
by Alberto Cammozzo July 5, 2019

July 5, 2019

<https://www.forbes.com/sites/thomasbrewster/2019/07/04/london-police-facial…> London’s Metropolitan Police’s controversial trial of facial recognition technology to spot suspects failed to work 80% of the time and could be ruled illegal, according to researchers. The researchers from the University of Essex said the problems were so bad that the use of facial recognition by the Met should be stopped immediately. They were given privileged access to six live trials, watching them from the preinstallation discussions through to deployment and use by police at the Westfield shopping center in Stratford, London. Throughout, “significant operational shortcomings” were uncovered. Over the six trials, the facial recognition tech made 42 matches of people walking around Westfield with individuals on a watchlist. In only eight cases could the report authors say with absolute confidence the technology made correct matches. But the police still deemed it acceptable to stop individuals on 26 occasions. In 14 of those cases, the matches were found to be incorrect. In four cases, the searches were unsuccessful when the person they were hunting disappeared in the crowds. Overall, in just eight cases was a correct match found, meaning the facial recognition was only successful in 19% of cases. The watchlist itself was also flawed, the researchers said, including out of date information. That led to people being stopped even though their case was already concluded. The Met said its tests were legal and successful in finding suspects. Deputy assistant commissioner Duncan Ball told The Guardian the force was “extremely disappointed with the negative and unbalanced tone of this report.” The Met has carried out ten trials of NeoFace, a facial recognition tech provided by Japanese supplier NEC, over the last three years. That included two tests at Notting Hill Carnival. The force is planning more tests in the future at sporting events and other live occassions in the coming months. Wrongful identification Civil rights NGO Big Brother Watch was outraged at the findings. "This report is an utterly damning conclusion to the police’s dangerous experimentation with live facial recognition. It confirms what we have long warned—it’s inaccurate, lawless and must be stopped urgently,” said director Silkie Carlo. “This China-style surveillance is undemocratic and has no place in Britain.” Big Brother Watch has previously detailed a number of cases where people have been falsely identified. In one case, a 14-year-old boy was recognized by the facial recognition system, accosted, questioned and released within ten minutes after the police realized he was not the person they were after. In another case, a man protested his right to hide his face from a trial of facial recognition. He was subsequently issued with a £90 public order fine for “shouting profanities in public view.” [...]

1 0

First fine for the application of GDPR Article 25 in Romania
by Giacomo Tesio July 5, 2019

July 5, 2019

https://www.dataprotection.ro/?page=Comunicat_Amenda_Unicredit&lang=en On the 27th of June 2019, the National Supervisory Authority finalised an investigation at the controller UNICREDIT BANK S.A. and found that it breached the provisions of Article 25 (1) of Regulation (EU) 2016/679 of European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The controller was sanctioned with a fine in the amount of 613,912 lei, the equivalent in euro of 130,000 euros. The sanction was applied to UNICREDIT BANK S.A. as a result of the failure to implement appropriate technical and organisational measures, both within the determination of the processing means and processing operations themselves, designed to effectively implement data protection principles, such as data minimisation, and to integrate the necessary safeguards in the processing, in order to meet the GDPR requirements and to protect the rights of the data subjects. This led to the disclosure of data concerning the personal identification number and the payer’s address (for situations where the payer performs the transaction from an account opened with another credit institution – external transactions and cash deposits) and data concerning the payer’s address (for situations where the payer made the transaction from an account opened with UNICREDIT BANK SA – internal transactions) in the documents containing the details of transactions and made available on-line to payment customers, for a number of 337,042 data subjects, during the period between the 25th of May 2018 – the 10th of December 2018. The sanction was imposed following an intimation addressed to the National Supervisory Authority on the 22nd of November 2018 indicating that the data concerning the personal identification number and the address of the persons performing payments to UNICREDIT BANK S.A., via online transactions, were disclosed to the beneficiary of the transaction through the account statement/details. Pursuant to Article 5 (1) letter c) of GDPR (“Principles relating to processing of personal data”), the controller had the obligation to process the data limited to what is necessary in relation to the purposes for which they are processed. In the same time, Recital (78) of the Regulation states: ”The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.” ____ 130 mila euro per Unicredit credo siano più o meno quanto 13 centesimi per me. Probabilmente molto meno. La multa più bassa che ho pagato negli ultimi anni per aver tardato a rinnovare il parcheggio è di 38 euro. Qualcuno mi spiega perché? Giacomo

1 0

Youtube's ban on "hacking techniques" threatens to shut down all of infosec Youtube
by Giacomo Tesio July 5, 2019

July 5, 2019

https://boingboing.net/2019/07/03/nobus-r-us.html Once upon a time, companies were able to insist -- with a straight face -- that the real problem with the security defects in their products was the researchers who went public with them, warning customers and users that the products they were trusting were not trustworthy. Then came the modern infosec movement, in which hactivists and researchers started to give companies a little grace period before going public, while still rejecting the whole idea of "security through obscurity." If your security depends on no one else independently rediscovering the defects you've identified, you're going to be very disappointed -- just ask all those American cities that are paying out to ransomware creeps who got hold of a defect that the NSA kept secret so they could use it against "bad guys." Infosec's watchword is "sunlight is the best disinfectant." If you want to prove that a product is genuinely defective, it's not enough to make the claim: you have to back it up with demos that anyone else can replicate -- otherwise the companies will straight up call you a liar and assure their customers that there's nothing to worry about. Yesterday, Youtube froze Kody Kinzie's longrunning Cyber Weapons Lab channel, citing a policy that bans "Instructional hacking and phishing: Showing users how to bypass secure computer systems." He now has a "strike," which prevents him from uploading any new videos. This may sound like a commonsense measure, but consider: the "bad guys" can figure this stuff out on their own. The two groups that really benefit from these disclosures are: 1. Users, who get to know which systems they should and should not trust; and 2. Developers, who learn from other developers' blunders and improve their own security. Youtube banning security disclosures doesn't make products more secure, nor will it prevent attackers from exploiting defects -- but it will mean that users will be the last to know that they've been trusting the wrong companies, and that developers will keep on making the same stupid mistakes...forever. > We made a video about launching fireworks over Wi-Fi for the 4th of July only to find out @YouTube gave us a strike because we teach about hacking, so we can't upload it. > > YouTube now bans: "Instructional hacking and phishing: Showing users how to bypass secure computer systems" > > — Kody (@KodyKinzie) July 2, 2019

1 0

Thumbs Down to Facebook’s Cryptocurrency by Joseph E. Stiglitz - Project Syndicate
by J.C. DE MARTIN July 5, 2019

July 5, 2019

Thumbs Down to Facebook’s Cryptocurrency Jul 2, 2019 JOSEPH E. STIGLITZ Only a fool would trust Facebook with his or her financial wellbeing. But maybe that’s the point: with so much personal data on some 2.4 billion monthly active users, who knows better than Facebook just how many suckers are born every minute? https://www.project-syndicate.org/commentary/facebook-libra-facilitates-cri… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Facebook ads funded by 'dark money' are the right's weapon for 2020 | Technology | The Guardian
by Alberto Cammozzo July 5, 2019

July 5, 2019

<https://www.theguardian.com/technology/2019/jul/05/facebook-ads-2020-dark-m…> In the weeks leading up to a tightly contested 2018 midterm election in Virginia, a Facebook page called “Wacky Wexton Not” ran an ad that pictured Democratic congressional candidate Jennifer Wexton next to Nazi troops. Another labeled her an “evil socialist”. Yet another referenced Nazi uniforms, stating, “Wexton and her modern day brown shirts. They Are Evil. They Hate America. They Hate You.” Who spent $211 launching 24 anti-Wexton ads? It’s unclear. The ads state they were “Paid for by a freedom loving American Citizen exercising my natural law right, protected by the 1st Amendment and protected by the 2nd Amendment.” But there’s nothing in them – or in Facebook’s new ad library that’s designed to shine light on who’s funding political adss – that provides personal information about the person or group behind the attack on Wexton (who won her race). This small incident highlights a bigger problem as the 2020 election looms. How so-called untraceable “dark money” Facebook ads persist via easily exploitable loopholes in the ad archive, a database created in response to foreign interference and disinformation campaigns during the 2016 election. Now heading into the 2020 election, dark money ads remain a potent political weapon that the Republican party and conservative media in particular are using to push a rightwing agenda and get Donald Trump re-elected. [...]

1 0

Boeing’s 737 Max Software Outsourced to $9-an-Hour Engineers
by J.C. DE MARTIN July 4, 2019

July 4, 2019

*Boeing’s 737 Max Software Outsourced to $9-an-Hour Engineers** * By Peter Robison 28 June 2019, 22:46 CEST […] Continua qui: https://www.bloomberg.com/news/articles/2019-06-28/boeing-s-737-max-softwar…

1 0

Email Tracking Is Creepy and Invasive and No One Should Do It - VICE
by J.C. DE MARTIN July 3, 2019

July 3, 2019

https://www.vice.com/en_us/article/a3xpwj/email-tracking-is-creepy-and-inva… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Fwd: [DNAmazon Admits Alexa Voice Recordings Saved Indefinitely
by Matteo G.P. Flora July 3, 2019

July 3, 2019

"After U.S. Senator Chris Coons (D-Del.) demanded Amazon outline its data privacy policies, Amazon in a letter that was publicly disclosed on Tuesday said that consumers have the option to delete their recordings – but even if they do, the company or third-party developers may still save records of customers’ interactions with Alexa." Articolo: < https://threatpost.com/amazon-admits-alexa-voice-recordings-saved-indefinit… > PDF della risposta: < https://www.coons.senate.gov/imo/media/doc/Amazon%20Senator%20Coons__Respon… > Che diranno i Garanti Europei? M -- Matteo G.P. Flora Founder and CEO at TF Group A Via Vitruvio 1, Milano (MI) M +39.347.9676430 E mf(a)thefool.it W http://thefool.it

1 0

Libra: US Congress asks Facebook to pause development | Technology | The Guardian
by Alberto Cammozzo July 3, 2019

July 3, 2019

<https://www.theguardian.com/technology/2019/jul/03/libra-us-congress-asks-f…> The US Congress has asked Facebook to pause development on its Libra cryptocurrency until lawmakers have had more time to investigate the ramifications of the company’s actions. In a letter from the Democratic heads of the house committee on financial services and its subcommittees, the legislators ask the company to “immediately cease implementation plans”. “Because Facebook is already in the hands of over a quarter of the world’s population, it is imperative that Facebook and its partners immediately cease implementation plans until regulators and Congress have an opportunity to examine these issues and take action,” the letter says. “During this moratorium, we intend to hold public hearings on the risks and benefits of cryptocurrency-based activities and explore legislative solutions. Failure to cease implementation before we can do so risks a new Swiss-based financial system that is too big to fail.” [...]

1 0