Facebook

Meta Offers To Limit Use of Ad Data To Address UK Competition Concerns (reuters.com) 11

Britain's competition watchdog on Friday said social media giant Meta had offered to limit its use of other businesses' advertising data for its Facebook Marketplace service to address the regulator's competition concerns. From a report: The Competition and Markets Authority (CMA) said it was minded to accept the commitments, which include advertisers being able to opt out of allowing their data to be used to improve the Facebook Marketplace classified ads platform. CMA executive director of enforcement Michael Grenfell said: "Reducing the risk of Meta unfairly exploiting the data of businesses who advertise on its platform for its own competitive advantage could help many UK businesses who advertise there. We are now consulting on these commitments which we believe, at this stage, will address our concerns."
Security

A Popular Password Hashing Algorithm Starts Its Long Goodbye (wired.com) 17

An anonymous reader quotes a report from Wired: Bcrypt turns 25 this year, and Niels Provos, one of its coinventors, says that looking back, the algorithm has always had good energy, thanks to its open source availability and the technical characteristics that have fueled its longevity. Provos spoke to WIRED about a retrospective on the algorithm that he published this week in Usenix ;login:. Like so many digital workhorses, though, there are now more robust and secure alternatives to bcrypt, including the hashing algorithms known as scrypt and Argon2. Provos himself says that the quarter-century milestone is plenty for bcrypt and that he hopes it will lose popularity before celebrating another major birthday.

A version of bcrypt first shipped with the open source operating system OpenBSD 2.1 in June 1997. At the time, the United States still imposed stringent export limits on cryptography. But Provos, who grew up in Germany, worked on its development while he was still living and studying there. "One thing I found so surprising was how popular it became," he says. "I think in part it's probably because it was actually solving a problem that was real, but also because it was open source and not encumbered by any export restrictions. And then everybody ended up doing their own implementations in all these other languages. So these days, if you are faced with wanting to do password hashing, bcrypt is going to be available in every language that you could possibly operate in. But the other thing that I find interesting is that it's even still relevant 25 years later. That is just crazy."

Provos developed bcrypt with David Mazieres, a systems security professor at Stanford University who was studying at the Massachusetts Institute of Technology when he and Provos collaborated on bcrypt. The two met through the open source community and were working on OpenBSD. [...] Password security is always lagging, though, and both Provos and Mazieres expressed disbelief and disappointment that the state of passwords broadly has not evolved in decades. Even new schemes like passkeys are only just beginning to emerge. "Bcrypt should have been superseded already," Provos says. "It's surprising how much reliance we still have on passwords. If you had asked me 25 years ago, I would not have guessed that."

United States

Supreme Court Limits EPA's Authority Under the Clean Water Act (npr.org) 246

An anonymous reader quotes a report from NPR: The U.S. Supreme Court Court on Thursday significantly curtailed the power of the Environmental Protection Agency to regulate the nation's wetlands and waterways. It was the court's second decision in a year limiting the ability of the agency to enact anti-pollution regulations and combat climate change. The challenge to the regulations was brought by Michael and Chantell Sackett, who bought property to build their dream house about 500 feet away from Idaho's Scenic Priest Lake, a 19-mile stretch of clear water that is fed by mountain streams and bordered by state and national parkland. Three days after the Sacketts started excavating their property, the EPA stopped work on the project because the couple had failed to get a permit for disturbing the wetlands on their land. Now a conservative Supreme Court majority has used the Sackett's case to roll back longstanding rules adopted to carry out the 51-year-old Clean Water Act. While the nine justices agreed that the Sacketts should prevail, they divided 5-to-4 as to how far to go in limiting the EPA's authority.

Writing for the court majority (PDF), Justice Samuel Alito said that the navigable waters of the United States regulated by the EPA under the statute do not include many previously regulated wetlands. Rather, he said, the CWA extends to only streams, oceans, rivers and lakes, and those wetlands with a "continuous surface connection to those bodies." Justice Brett Kavanaugh, joined by the court's three liberal members, disputed Alito's reading of the statute, noting that since 1977 when the CWA was amended to include adjacent wetlands, eight consecutive presidential administrations, Republican and Democratic, have interpreted the law to cover wetlands that the court has now excluded. Kavanaugh said that by narrowing the act to cover only adjoining wetlands, the court's new test will have quote "significant repercussions for water quality and flood control throughout the United States." In addition to joining Kavanaugh's opinion, the court's liberals, signed on to a separate opinion by Justice Elena Kagan. Pointing to the air and water pollution cases, she accused the majority of appointing itself instead of Congress as the national policymaker on the environment.
President Biden, in a statement, called the decision "disappointing." It "upends the legal framework that has protected America's waters for decades," he said. "It also defies the science that confirms the critical role of wetlands in safeguarding our nation's streams, rivers, and lakes from chemicals and pollutants that harm the health and wellbeing of children, families, and communities."

"I don't think its an overstatement to say its catastrophic for the Clean Water act," said Jim Murphy of the National Wildlife Federation. Wetlands play an "enormous role in protecting the nation's water," he said. "They're really the kidneys of water systems and they're also the sponges. They absorb a lot of water on the landscape. So they're very important water features and they're very important to the quality of the water that we drink, swim, fish, boat and recreate in."
Privacy

NSO Spyware Used in Armenia-Azerbaijan Conflict, Report Finds (nbcnews.com) 10

Invasive spyware capable of reading a smartphone's messages and listening to calls was found on the phones of at least 12 Armenian journalists, politicians and civil society members, according to a report published Thursday by a group of nonprofit organizations. From a report: The spyware, called Pegasus and made by the Israeli company NSO, had previously been found on the phones of thousands of people around the world, leading to U.S. sanctions in 2021 and a lawsuit from Apple. But researchers said their most recent findings are unique -- they believe it is the first time that the technology has been weaponized in an armed conflict between countries.

Armenia has intermittently battled its neighbor Azerbaijan for decades. In 2020, a cease-fire was broken in the disputed region of Nagorno-Karabakh, leaving thousands dead. Since then, the two countries have been mired in a sporadic shooting war which has killed dozens more. The report, a collaboration among the international internet rights group Access Now, Amnesty International and the University of Toronto's Citizen Lab, calls for "an immediate moratorium" on the sale and transfer of spyware technology. NSO is the most notorious mercenary spyware developer in the world. It creates powerful programs like Pegasus, which can hack smartphones to reveal information such as contacts, calls and location.

Government

Right-To-Repair Rules Are Now the Law In Minnesota (theverge.com) 31

Minnesota Governor Tim Walz has signed a groundbreaking right-to-repair law, which will come into effect on July 1, 2024. The Verge reports: The rules, part of an omnibus appropriations bill, require electronics manufacturers to let independent repair shops and consumers buy the parts and tools necessary to repair their own equipment. But the rules don't apply to some notable categories, including farm equipment, game consoles, medical devices, and motor vehicles.

The new Minnesota rules take effect July 1st, 2024, and they cover products sold on or after July 1st, 2021. If manufacturers sell a product in the state, they must offer residents the equipment to repair it on "fair and reasonable" terms within 60 days, and they must offer documentation for performing repairs and service free of charge. Failure to do so will violate Minnesota's Deceptive Trade Practices statute, opening manufacturers up to penalties from the attorney general.
"This is the biggest right to repair win to date," said Nathan Proctor, who leads the right to repair initiative at public interest group PIRG, in a statement. PIRG notes that Minnesota is the first state to offer right-to-repair protections for home appliances and commercial and educational computing systems, which were carved out of New York's law. In a blog post, repair site iFixit focused on the free documentation element. "With online documentation, people everywhere in the world -- not just in Minnesota -- will benefit from this," said iFixit CEO Kyle Wiens.
Nintendo

Nintendo Sued For 'Immoral' Mario Kart Loot Boxes (axios.com) 57

Nintendo is facing a potential class-action lawsuit filed by a young gamer and backed by his father, alleging that the microtransactions in the mobile game Mario Kart Tour are "immoral." Axios reports: The suit calls for refunds for all minors in the U.S. who paid to use Mario Kart Tour's "Spotlight Pipes," which delivered players in-game rewards using undisclosed odds. Until last year, Mario Kart Tour players could spend real money to repeatedly activate the pipes, in the hope they'd randomly produce useful upgrades. The suit alleges that Nintendo intentionally made the game difficult to proceed in without paying, using "dark patterns," an industry term for tricking consumers, to steer players toward spending more.

The suit was filed in March but emerged on the federal docket last week after it was moved out of state court. Its plaintiff, identified as N.A., spent more than $170 on Mario Kart Tour microtransactions, via his father's credit card, which was linked to their Nintendo user account. "Defendant's lootbox mechanism capitalized on and encouraged addictive behaviors akin to gambling," according to N.A.'s suit. It states that minors are particularly susceptible to systems that involve surprise rewards.
Axios notes that Nintendo "discontinued use of spotlight pipes in Mario Kart Tour last September, switching to a system that lets players directly purchase items offered in its in-game shop."
Privacy

'iRecorder Screen Recorder' App Turns Malicious, Sends Mic Recordings Every 15 Minutes (arstechnica.com) 31

An anonymous reader quotes a report from Ars Technica: An app that had more than 50,000 downloads from Google Play surreptitiously recorded nearby audio every 15 minutes and sent it to the app developer, a researcher from security firm ESET said. The app, titled iRecorder Screen Recorder, started life on Google Play in September 2021 as a benign app that allowed users to record the screens of their Android devices, ESET researcher Lukas Stefanko said in a post published on Tuesday. Eleven months later, the legitimate app was updated to add entirely new functionality. It included the ability to remotely turn on the device mic and record sound, connect to an attacker-controlled server, and upload the audio and other sensitive files that were stored on the device.

The secret espionage functions were implemented using code from AhMyth, an open source RAT (remote access Trojan) that has been incorporated into several other Android apps in recent years. Once the RAT was added to iRecorder, all users of the previously benign app received updates that allowed their phones to record nearby audio and send it to a developer-designated server through an encrypted channel. As time went on, code taken from AhMyth was heavily modified, an indication that the developer became more adept with the open source RAT. ESET named the newly modified RAT in iRecorder AhRat.

Stefanko installed the app repeatedly on devices in his lab, and each time, the result was the same: The app received an instruction to record one minute of audio and send it to the attacker's command-and-control server, also known colloquially in security circles as a C&C or C2. Going forward, the app would receive the same instruction every 15 minutes indefinitely. [...] Stefanko said it's possible that iRecord is part of an active espionage campaign, but so far, he has been unable to determine if that's the case. "Unfortunately, we don't have any evidence that the app was pushed to a particular group of people, and from the app description and further research (possible app distribution vector), it isn't clear if a specific group of people was targeted or not," he wrote. "It seems very unusual, but we don't have evidence to say otherwise."

Books

European Commission Calls for Pirate Site Blocking Around the Globe (torrentfreak.com) 29

The European Commission has published its biannual list of foreign countries with problematic copyright policies. One of the highlighted issues is a lack of pirate site blocking, which is seen as an effective enforcement measure, writes TorrentFreak, a news website that tracks piracy news. Interestingly, the EU doesn't mention the United States, which is arguably the most significant country yet to implement an effective site-blocking regime.
The Courts

Supreme Court Declines To Hear Challenge To Warrantless Pole Camera Surveillance (aclu.org) 120

An anonymous reader shares a press release from the American Civil Liberties Union (ACLU): The U.S. Supreme Court [Monday] declined to hear Moore v. United States, leaving in place a patchwork of lower court decisions on an important and recurring question about privacy rights in the face of advancing surveillance technology. In this case, police secretly attached a small camera to a utility pole, using it to surveil a Massachusetts home 24/7 for eight months -- all without a warrant. Law enforcement could watch the camera's feed in real time, and remotely pan, tilt, and zoom close enough to read license plates and see faces. They could also review a searchable, digitized record of this footage at their convenience. The camera captured every coming and going of the home's residents and their guests over eight months. As a result, the government targeted the home of a community pillar -- a lawyer, respected judicial clerk, devoted church member, and a grandmother raising her grandkids -- to cherry-pick images from months of unceasing surveillance in an effort to support unwarranted criminal charges against an innocent person.

Federal courts of appeals and state supreme courts have divided on the question of whether such sweeping surveillance is a Fourth Amendment search requiring a warrant. The highest courts of Massachusetts, Colorado, and South Dakota have held that long-term pole camera surveillance of someone's home requires a warrant. In Moore v. United States, the members of the full en banc U.S. Court of Appeals for the First Circuit split evenly on the question, with three judges explaining that a warrant is required, and three judges expressing the belief that the Fourth Amendment imposes no limit on this invasive surveillance. This issue will continue to arise in the lower courts; the ACLU filed an amicus brief on the question in the U.S. Court of Appeals for the Tenth Circuit earlier this month.
"The Supreme Court's decision not to hear this case means that people across the country remain vulnerable to law enforcement's claim of unfettered authority to surveil any of us at our homes, for as long as they wish, with no judicial oversight," said Nathan Freed Wessler, deputy director of the ACLU's Speech, Privacy, and Technology Project. "As the cost of surveillance technology falls and its use by law enforcement expands, the need to resolve whether the Fourth Amendment poses any constraint has become all the more urgent. We will continue fighting for essential privacy protections."
Privacy

Driver's Licenses, Addresses, Photos: Inside How TikTok Shares User Data (nytimes.com) 11

Employees of the Chinese-owned video app TikTok have regularly posted user information on a messaging and collaboration tool called Lark, according to internal documents. The New York Times: In August 2021, TikTok received a complaint from a British user, who flagged that a man had been "exposing himself and playing with himself" on a livestream she hosted on the video app. She also described past abuse she had experienced. To address the complaint, TikTok employees shared the incident on an internal messaging and collaboration tool called Lark, according to company documents obtained by The New York Times. The British woman's personal data -- including her photo, country of residence, internet protocol address, device and user IDs -- were also posted on the platform, which is similar to Slack and Microsoft Teams. Her information was just one piece of TikTok user data shared on Lark, which is used every day by thousands of employees of the app's Chinese owner, ByteDance, including by those in China.

According to the documents obtained by The Times, the driver's licenses of American users were also accessible on the platform, as were some users' potentially illegal content, such as child sexual abuse materials. In many cases, the information was available in Lark "groups" -- essentially chat rooms of employees -- with thousands of members. The profusion of user data on Lark alarmed some TikTok employees, especially since ByteDance workers in China and elsewhere could easily see the material, according to internal reports and four current and former employees. Since at least July 2021, several security employees have warned ByteDance and TikTok executives about risks tied to the platform, according to the documents and the current and former workers. "Should Beijing-based employees be owners of groups that contain secret" data of users, one TikTok employee asked in an internal report last July. The user materials on Lark raise questions about TikTok's data and privacy practices and show how intertwined it is with ByteDance, just as the video app faces mounting scrutiny over its potential security risks and ties to China.

Social Networks

Surgeon General: There Isn't Enough Evidence That Social Media Is Safe For Kids (statnews.com) 137

An anonymous reader quotes a report from STAT News: Amid what he called the worst youth mental health crisis in recent memory, U.S. Surgeon General Vivek Murthy issued an advisory Tuesday warning about social media's impact on developing young brains. "Through the last two and a half years I've been in office, I've been hearing concerns from kids and parents," Murthy told STAT. "Parents are asking 'Is social media safe for my kids?' Based on our review of the data, there isn't enough evidence that it is safe for our kids."

The advisory calls on policymakers and technology companies to take steps to minimize the risks of social media. "This is not going to be an issue that we solve with one sector alone," Murthy said. Policymakers, according to the report, need to develop age restrictions and safety standards for social media -- much like the regulations that the U.S. has in place for everything from cars to medicine. Specifically, Murthy would like to see policymakers require a higher standard of data privacy for children to protect them from potential harms like exploitation and abuse. Technology companies, meanwhile, need to be more transparent about the data they share, according to Murthy. He calls on companies to assess the potential risks of online interactions and take active steps to prevent potential misuse. He also suggests the establishment of scientific advisory committees to inform approaches and policies aimed at creating safe online environments for children.

The advisory also suggests families attempt to protect young people's mental health by developing a family media plan aimed at establishing healthy technology boundaries at home, such as creating "tech-free zones" that restrict phone use during certain hours or family mealtime. But Murthy noted that parents are already at the end of their rope in trying to manage how their children are exposed to and using this rapidly evolving technology. That responsibility has fallen entirely on them up to this point. "We've got to move quickly," he said. "None of us should be satisfied until we have clear evidence that these platforms are safe."
The surgeon general's report comes two weeks after the American Psychological Association issued a health advisory on teens and social media use. The group noted the increased risk of anxiety and depression among adolescents who are exposed to discrimination and bullying online. "Other research has shown that adolescents ages 12-15 who spent more than three hours per day on social media face a heightened risk of experiencing poor mental health outcomes compared to those who spent less time online," adds STAT News.
Piracy

'More Than 600,000 Students and Teachers Use Z-Library' (torrentfreak.com) 21

According to email addresses associated with Z-Library, more than 600,000 students and teachers are using the pirate eBook repository. TorrentFreak notes that this is "likely an underestimation," especially since the United States is excluded from the analysis. From the report: The team analyzed its user database to check how many user email-addresses are linked to universities, colleges and schools. This gives an impression of how many students and employees use the site but it's likely a low estimate, as students may very well use their personal email addresses to sign up. Still, the overall outcome and the global distribution of users is worth highlighting. China is the top country in absolute numbers, followed by India and Indonesia. This is no surprise, perhaps, as these countries also have the largest populations. Looking at the full database, Z-Library linked 600,000 email addresses to a total of 30,000 educational institutions around the world.

The only country missing from the top list, population-wise, is the United States. Z-Library notes that it intentionally excluded the country due to the criminal prosecution of two of the site's alleged operators. "It should be noted that when compiling statistics, we excluded all data related to the United States due to illegal arrest of two Russian citizens on suspicion of involvement in Z-Library," the shadow library writes on Telegram. There are also some relatively smaller countries in the top list, such as Australia. With a population of just over 25 million, Z-Library is relatively popular there, beating Brazil and Vietnam, which both have much larger populations.

The Australian Monash University also gets a special mention. Apparently, it is the educational institution where users have created the most public booklists. These lists are personal book collections that can be focused on any theme, including educational topics. Trinity College Dublin, in Ireland, is the runner-up based on the number of created booklists. It's worth a separate mention, however, as it also appears in the top 5 universities that donated to Z-Library. The list of most avid Z-Library supported is led by the top Chinese universities, which are grouped for the purpose of this analysis.

The Courts

Apple Faces Billionaire Khosla in Goliath v. Goliath Tech Suits (bloomberg.com) 16

The iPhone maker, VC veteran are fighting for heart-health tracking market. From a report: There's an unwritten rule for technology startups: Never challenge Apple in court if you want to survive. The world's most valuable company has a track record of success in a long string of David versus Goliath battles over cutting-edge, life-changing technologies. But billionaire Vinod Khosla is no lightweight. He's one of Silicon Valley's most celebrated venture capitalists, and he's used to playing long odds on the startups he backs. Khosla Ventures LLC put itself on a collision course with Apple when it moved into the personal health and fitness space a decade ago and invested in AliveCor, a maker of cardiac monitoring devices and software. What might have been a big partnership opportunity for AliveCor in the years following the release of the Apple Watch in 2015, to offer watch bands that monitor heart health, has turned into a messy court fight.

Now, instead of riding Apple's coattails as a prominent player in the wearable medical device market, forecast to grow to $132.5 billion by 2031, AliveCor's Food and Drug Administration-approved technology is inaccessible to the tens of millions of people who buy Apple Watches every year. The startup is in its third year of trying to prove to judges that the iPhone maker brazenly copied its heart-monitoring technology and sabotaged AliveCor's ability to offer its own product on the Apple Watch. Apple has parried with claims that its smaller rival's patent-infringement and antitrust claims are meritless -- and with counterattacks alleging that AliveCor is the imitator.

AI

White House Takes New Steps To Study AI Risks, Determine Impact on Workers (reuters.com) 27

The White House said on Tuesday it would ask workers how their employers use artificial intelligence (AI) to monitor them, as it allocates federal investments in the technology, which is expected to change the nature of work. From a report: The White House will hold a listening session with workers to understand their experience with employers' use of automated technologies for surveillance, monitoring and evaluation. The call will include gig work experts, researchers, and policymakers. Millions of users have tried AI apps and tools, which supporters say can make medical diagnoses, write screenplays, create legal briefs and debug software, leading to growing concern about how the technology could lead to privacy violations, skew employment decisions, and power scams and misinformation campaigns. As part of its evaluation of the technology, the administration will also announce new steps, including an updated roadmap for federal investments in AI research, a request for public input on AI risks and with a new report from the Department of Education on how AI affects teaching, learning and research.
United States

FBI Abused Spy Law 280,000 Times In a Year (theregister.com) 151

The FBI misused surveillance powers granted by Section 702 of the Foreign Intelligence Surveillance Act (FISA) over 278,000 times between 2020 and early 2021 to conduct warrantless searches on George Floyd protesters, January 6 Capitol rioters, and donors to a congressional campaign, according to a newly unclassified court opinion. The Register reports: On Friday, the US Foreign Intelligence Surveillance Court made public a heavily redacted April 2022 opinion [PDF] that details hundreds of thousands of violations of Section 702 of the Foreign Intelligence Surveillance Act (FISA) -- the legislative instrument that allows warrantless snooping. The Feds were found to have abused the spy law in a "persistent and widespread" manner, according to the court, repeatedly failing to adequately justify the need to go through US citizens' communications using a law aimed at foreigners.

The court opinion details FBI queries run on thousands of individuals between 2020 and early 2021. This includes 133 people arrested during the George Floyd protests and more than 19,000 donors to a congressional campaign. In the latter, "the analyst who ran the query advised that the campaign was a target of foreign influence, but NSD determined that only eight identifiers used in the query had sufficient ties to foreign influence activities to comply with the querying standard," the opinion says, referring to the Justice Department's National Security Division (NSD). In other words, there wasn't a strong enough foreign link to fully justify the communications search.

For the Black Lives Matter protests, the division determined that the FBI queries "were not reasonably likely to retrieve foreign intelligence information or evidence of a crime." Again, an overreach of foreign surveillance powers. Additional "significant violations of the querying standard" occurred in searched related to the January 6, 2021 breach of the US Capitol, domestic drug and gang investigations, and domestic terrorism probes, according to the court. It's said that more than 23,000 queries were run on people suspected of storming the Capitol.

Earth

France Unveils Plan To Cut Greenhouse Gas Emissions By 50 Percent By 2030 (france24.com) 107

An anonymous reader quotes a report from Agence France-Presse: The French government unveiled a plan on Monday to accelerate cuts to its greenhouse gas emissions, targeting a reduction of 50 percent by 2030 compared with 1990 levels. Unveiled by Prime Minister Elisabeth Borne, the roadmap includes detailed figures for reductions for individual sectors of the economy, ranging from the transport industry to households. The objectives -- from speeding up the transition to electric cars or switching freight from road to rivers -- are aimed at bringing France's ambitions for slashing carbon pollution into line with the EU's target for 2030.

France has so far cut its emissions by 25 percent compared with 1990 levels, requiring major fresh efforts if it is to hit the new 50-percent target. "We're asking for a bit from the smallest (polluters) and a lot from the biggest," an aide to Borne told reporters, meaning around half of efforts would be for companies, a quarter for households and a quarter for local administrations.
"Among other developed countries, the United Kingdom has the most ambitious short-term goals of any major economy, with an objective of 2030 emissions being 68 percent below 1990 levels," notes AFP. "The United States has committed to cut greenhouse gases 50-52 percent by 2030 below 2005 levels, while Germany has set a 65 percent reduction target compared to 1990."
Social Networks

TikTok Is Suing Montana Over Law Banning the App In the State (engadget.com) 71

According to the Wall Street Journal, TikTok filed a lawsuit against Montana claiming the state's law banning the app violates the First Amendment. Engadget reports: "Montana's ban abridges freedom of speech in violation of the First Amendment, violates the U.S. Constitution in multiple other respects, and is preempted by federal law," the lawsuit reads. The law prohibits the ByteDance-owned platform from operating in the state, as well as preventing Apple's and Google's app stores from listing the TikTok app for download. Although it isn't clear how Montana plans to enforce the ban, it states that violations will tally fines of $10,000 per day. However, individual TikTok users won't be charged. The lawsuit comes just days after a group of content creators sued the state for similar reasons. "Montana has no authority to enact laws advancing what it believes should be the United States' foreign policy or its national security interests, nor may Montana ban an entire forum for communication based on its perceptions that some speech shared through that forum, though protected by the First Amendment, is dangerous," the suit states. "Montana can no more ban its residents from viewing or posting to TikTok than it could ban the Wall Street Journal because of who owns it or the ideas it publishes."
Encryption

Leaked Government Document Shows Spain Wants To Ban End-to-End Encryption (wired.com) 76

An anonymous reader quotes a report from Wired: Spain has advocated banning encryption for hundreds of millions of people within the European Union, according to a leaked document obtained by WIRED that reveals strong support among EU member states for proposals to scan private messages for illegal content. The document, a European Council survey of member countries' views on encryption regulation, offered officials' behind-the-scenes opinions on how to craft a highly controversial law to stop the spread of child sexual abuse material (CSAM) in Europe. The proposed law would require tech companies to scan their platforms, including users' private messages, to find illegal material. However, the proposal from Ylva Johansson, the EU commissioner in charge of home affairs, has drawn ire from cryptographers, technologists, and privacy advocates for its potential impact on end-to-end encryption.

For years, EU states have debated whether end-to-end encrypted communication platforms, such as WhatsApp and Signal, should be protected as a way for Europeans to exercise a fundamental right to privacy -- or weakened to keep criminals from being able to communicate outside the reach of law enforcement. Experts who reviewed the document at WIRED's request say it provides important insight into which EU countries plan to support a proposal that threatens to reshape encryption and the future of online privacy. Of the 20 EU countries represented in the document leaked to WIRED, the majority said they are in favor of some form of scanning of encrypted messages, with Spain's position emerging as the most extreme. "Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption," Spanish representatives said in the document. The source of the document declined to comment and requested anonymity because they were not authorized to share it.

In its response, Spain said it is "imperative that we have access to the data" and suggests that it should be possible for encrypted communications to be decrypted. Spain's interior minister, Fernando Grande-Marlaska, has been outspoken about what he considers the threat posted by encryption. When reached for comment about the leaked document, Daniel Campos de Diego, a spokesperson for Spain's Ministry of Interior, says the country's position on this matter is widely known and has been publicly disseminated on several occasions. Edging close to Spain, Poland advocated in the leaked document for mechanisms through which encryption could be lifted by court order and for parents to have the power to decrypt children's communications.
Several other countries say they would give law enforcement access to people's encrypted messages and communications. "Cyprus, Hungary, and Spain very clearly see this law as their opportunity to get inside encryption to undermine encrypted communications, and that to me is huge," says Ella Jakubowska, a senior policy advisor at European Digital Rights (EDRI) who reviewed the document. "They are seeing this law is going far beyond what DG home is claiming that it's there for."
China

UC Berkeley Neglected To Disclose $220 Million Deal With China To the US Government (thedailybeast.com) 63

schwit1 shares a report from The Daily Beast: U.C. Berkeley has failed to disclose to the U.S. government massive Chinese state funding for a highly sensitive $240 million joint tech venture in China that has been running for the last eight years. The Californian university has not registered with the U.S. government that it received huge financial support from the city of Shenzhen for a tech project inside China, which also included partnerships with Chinese companies that have since been sanctioned by the U.S. or accused of complicity in human rights abuses.

The university has failed to declare a $220 million investment from the municipal government of Shenzhen to build a research campus in China. A Berkeley spokesperson told The Daily Beast that the university had yet to declare the investment -- announced in 2018 -- because the campus is still under construction. However, a former Department of Education official who used to help manage the department's foreign gifts and contracts disclosure program said that investment agreements must be disclosed within six months of signing, not when they are fully executed. Berkeley admitted that it had also failed to disclose to the U.S. government a $19 million contract in 2016 with Tsinghua University, which is controlled by the Chinese government's Ministry of Education.

The project's Chinese backers promised lavish funding, state-of-the-art equipment, and smart Ph.D. students for Berkeley academics researching national security-sensitive technologies, according to contract documents exclusively obtained by The Daily Beast. After the project got underway, Berkeley researchers granted Chinese officials private tours of their cutting-edge U.S. semiconductor facilities and gave "priority commercialization rights" for intellectual properties (IP) they produced to Chinese government-backed funds. A Berkeley spokesman said that Berkeley only pursued fundamental research through TBSI, meaning that all research projects were eventually publicly published and accessible to all; it did not conduct any proprietary research that exclusively benefited a Chinese entity. Still, Berkeley's ties to the Chinese government and sanctioned Chinese companies are sure to raise eyebrows in Washington, where U.S. policymakers are increasingly concerned about the outflow of U.S. technology to China, especially those with military applications.

Privacy

Freenet 2023: a Drop-in Decentralized Replacement for the Web - and More (freenet.org) 54

Wikipedia describes Freenet as "a peer-to-peer platform for censorship-resistant, anonymous communication," released in the year 2000. "Both Freenet and some of its associated tools were originally designed by Ian Clarke," Wikipedia adds. (And in 2000 Clarke answered questions from Slashdot's readers...)

And now Ian Clarke (aka Sanity — Slashdot reader #1,431) returns to share this announcement: Freenet, a familiar name to Slashdot readers for over 23 years, has undergone a radical transformation: Freenet 2023, or "Locutus". While the original Freenet was like a decentralized hard drive, the new Freenet is like a full decentralized computer, allowing the creation of entirely decentralized services like messaging, group chat, search, social networking, among others. The new Freenet is implemented in Rust and designed for efficiency, flexibility, and transparency to the end user.
"Designed for simplicity and flexibility, Freenet 2023 can be used seamlessly through your web browser, providing an experience that feels just like using the traditional web," explains the announcement...

And in the comments below, Ian points out that "When the new Freenet is up and running, I think it will be the first system of any kind that could host something like Wikipedia, not just the data but the wiki CMS system it's built on. An editable wikipedia, entirely decentralized and very scalable...

"We've already had interest from everyone from video game developers who want to build a decentralized MMORPG, to political advocacy groups across the political spectrum. Plenty of people value freedom."

Slashdot Top Deals