An anonymous reader quotes a report from The Daily Beast: On Sept. 5, 1992, computer engineer Laurie Houts, 25, was found fatally strangled in her car near a California garbage dump. Her boyfriend's roommate was arrested in connection with the case, but two trials -- and two hung juries -- later, a judge dismissed the case. The roommate moved to the Netherlands soon afterward. Over the weekend, the roommate -- now the chief executive of a small software company -- was arrested as he landed at John F. Kennedy International Airport in New York City, according to the Santa Clara County Office of the District Attorney. John Woodward, the 58-year-old CEO and president of ReadyTech, is expected to be extradited to Santa Clara County by the end of the month, District Attorney Jeff Rosen said Monday. Once there, Woodward will be arraigned for the third time in Houts' murder by strangulation.

Houts' body was discovered by a passerby less than a mile from her office at Adobe Systems in Mountain View more than 30 years ago, according to the San Francisco Chronicle. A rope was around her neck, and there were footprints on the inside of her windshield, which were called "a sign of her struggle with Woodward" by the district attorney's office. Forensic science at the time was able to match Woodward to fingerprints found outside the car, but investigators could not prove that he had been inside the vehicle. Still, when Houts' boyfriend made a call, monitored by police, to Woodward soon after the 25-year-old's death, he "did not deny" killing Houts. Instead, according to a police summary of the matter, Woodward asked what evidence the authorities had against him and suggested to the roommate that they "meet in a parking lot" to talk more.

Woodward, who had no alibi for the night Houts was killed, was arrested that same year. Prosecutors alleged that Woodward had developed an "unrequited" romantic interest in Houts' boyfriend. The theory was criticized as homophobic at Woodward's first trial by his defense lawyer in 1995, the The Mercury News reported Monday, and the jury deadlocked on his innocence, voting 8-4 for acquittal. A year later, despite a judge barring the romantic-rival argument, the jury hearing Woodward's second trial again hung itself, this time ruling 7-5. The judge soon dismissed the case for insufficient evidence. But advances in DNA technology allowed detectives to link Woodward to the rope around Houts' neck for the first time last year, Rosen's statement said. Investigators in both the Santa Clara County Crime Lab and Mountain View Police Department matched both Woodward's genetic material and fibers on his sweatpants to "the murder weapon," police said.

Tech companies and data brokers that misuse or misrepresent how they handle Americans' personal data, including reproductive health information, may find themselves on the hook with the Federal Trade Commission, the agency warned this week. From a report: On Monday, the FTC renewed its vow to investigate or sue companies that use Americans' digital data in unfair or deceptive ways, following an executive order by the Biden administration that explicitly called for it and other agencies to consider steps to protect abortion-seekers. Since the Supreme Court decision overturning Roe v. Wade, civil liberties experts have warned that Americans' extensive digital footprints could give away whether they have visited an abortion clinic or sought information on how to access an abortion, prompting questions about the security of that data.

"The misuse of mobile location and health information -- including reproductive health data -- exposes consumers to significant harm," the FTC said in a blog post. "The exposure of health information and medical conditions, especially data related to sexual activity or reproductive health, may subject people to discrimination, stigma, mental anguish, or other serious harms." It added: "The Commission is committed to using the full scope of its legal authorities to protect consumers' privacy. We will vigorously enforce the law if we uncover illegal conduct that exploits Americans' location, health, or other sensitive data."

Sandwich chain Subway can be sued over claims it is allegedly misleading customers when it says its tuna products are in fact "100% tuna," a federal judge in California said Monday. From a report: The suit, originally brought by Oakland-area resident Nilima Amin in January 2021, claims Subway's tuna "partially or wholly lack tuna as an ingredient" and "contain other fish species, animal products, or miscellaneous products aside from tuna." The claims are based on testing performed at a UCLA marine biology laboratory. Subway has responded by saying any product that is not tuna in its tuna products would most likely be the result of cross-contact occurring as one of its employees prepares a sandwich.

An anonymous reader quotes a report from The Drive: Hackers have uncovered ways to unlock and start nearly all modern Honda-branded vehicles by wirelessly stealing codes from an owner's key fob. Dubbed "Rolling Pwn," the attack allows any individual to "eavesdrop" on a remote key fob from nearly 100 feet away and reuse them later to unlock or start a vehicle in the future without owner's knowledge. Despite Honda's dispute that the technology in its key fobs "would not allow the vulnerability," The Drive has independently confirmed the validity of the attack with its own demonstration.

Older vehicles used static codes for keyless entry. These static codes are inherently vulnerable, as any individual can capture and replay them at will to lock and unlock a vehicle. Manufacturers later introduced rolling codes to improve vehicle security. Rolling codes work by using a Pseudorandom Number Generator (PRNG). When a lock or unlock button is pressed on a paired key fob, the fob sends a unique code wirelessly to the vehicle encapsulated within the message. The vehicle then checks the code sent to it against its internal database of valid PRNG-generated codes, and if the code is valid, the car grants the request to lock, unlock, or start the vehicle. The database contains several allowed codes, as a key fob may not be in range of a vehicle when a button is pressed and may transmit a different code than what the vehicle is expecting to be next chronologically. This series of codes is also known as a "window," When a vehicle receives a newer code, it typically invalidates all previous codes to protect against replay attacks. This attack works by eavesdropping on a paired keyfob and capturing several codes sent by the fob. The attacker can later replay a sequence of valid codes and re-sync the PRNG. This allows the attacker to re-use older codes that would normally be invalid, even months after the codes have been captured.

[...] Contrary to Honda's claim, I independently confirmed the vulnerability by capturing and replaying a sequence of lock and unlock requests with my 2021 Honda Accord and a Software-Defined Radio. Despite being able to start and unlock the car, the vulnerability doesn't allow the attacker to actually drive off with the vehicle due to the proximity functionality of the key fob. However, the fact that a bad actor can get this far is already a bad sign. At this time, the following vehicles may be affected by the vulnerability: 2012 Honda Civic, 2018 Honda X-RV, 2020 Honda C-RV, 2020 Honda Accord, 2021 Honda Accord, 2020 Honda Odyssey, 2021 Honda Inspire, 2022 Honda Fit, 2022 Honda Civic, 2022 Honda VE-1, and 2022 Honda Breeze. It's not yet clear if this affects any Acura-branded vehicles. "[W]e've looked into past similar allegations and found them to lack substance," said a Honda spokesperson in a statement to The Drive. "While we don't yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims."

Myanmar's junta government is installing Chinese-built cameras with facial recognition capabilities in more cities across the country, Reuters reported Monday, citing three people with direct knowledge of the matter. From the report: In tenders to procure and install the security cameras and facial recognition technology, the plans are described as safe city projects aimed at maintaining security and, in some cases, preserving civil peace, said the people who are or have been involved in the projects. Since the February 2021 coup, local authorities have started new camera surveillance projects for at least five cities including Mawlamyine - the country's fourth-largest city, according to information from the three people who asked not to be identified for fear of reprisals by the junta. The new projects are in addition to five cities where camera systems touted as crime prevention measures were either installed or planned by the previous government led by Aung San Suu Kyi, according to the sources and local media.

Elon Musk just tweeted a picture of himself laughing — along with a caption he'd apparently added himself.

"They said I couldn't buy Twitter. Then they wouldn't disclose bot info. Now they want to force me to buy Twitter in court. Now they have to disclose bot info in court."

In fact, tonight The Register cited one of the documents Twitter filed in court after Musk's lawyer argued Twitter had "failed or refused" to provide info on spam accounts. But so far it's just a letter Musk's lawyer wrote to the court on Friday, explaining in more detail why Musk wants to call off the acquisition: One segment of the document claims that Musk and his team sought "a variety of board materials, including a working, bottom-up financial model for 2022, a budget for 2022, an updated draft plan or budget, and a working copy of Goldman Sachs' valuation model underlying its fairness opinion."

"Twitter has provided only a pdf copy of Goldman Sachs' final Board presentation."

Other disclosures, the document states, "come with strings attached, use limitations or other artificial formatting features, which has rendered some of the information minimally useful to Mr. Musk and his advisors.

"For example, when Twitter finally provided access to the eight developer 'APIs' first explicitly requested by Mr. Musk in the May 25 Letter, those APIs contained a rate limit lower than what Twitter provides to its largest enterprise customers. Twitter only offered to provide Mr. Musk with the same level of access as some of its customers after we explained that throttling the rate limit prevented Mr. Musk and his advisors from performing the analysis that he wished to conduct in any reasonable period of time.

"Additionally, those APIs contained an artificial 'cap' on the number of queries that Mr. Musk and his team can run regardless of the rate limit — an issue that initially prevented Mr. Musk and his advisors from completing an analysis of the data in any reasonable period of time," the document states.

Musk and his team raised the issue of query limits on June 29, but Twitter did not change the limit until July 6 — after Musk asked for its removal a second time.... Musk felt Twitter was in breach of the merger agreement. So he pulled the plug, leaving open the questions of why Twitter might have provided only limited access to its APIs, or why it could not offer more access given it operates at significant scale.
In fact, it's one of three reasons for ending the acquisition that Musk's lawyer makes in the letter. Materially-relevant figures on spam accounts were reason number one. ("Twitter has not provided information that Mr. Musk has requested for nearly two months notwithstanding his repeated, detailed clarifications intended to simplify Twitter's identification, collection, and disclosure of the most relevant information sought in Mr. Musk's original requests.")

But there's more... Musk's lawyer also argues Twitter is in breach of the merger agreement because of "materially inaccurate representations" — specifically their figures on monetizable daily active users. While Musk's analysis "remains ongoing, all indications suggest that several of Twitter's public disclosures...are either false or materially misleading." While Twitter has claimed they have a reasoned process for calculating monetizable daily active users (and the percentage of spam accounts), Musk's lawyer argues that instead the process "appears to be arbitrary and ad hoc," rendering Twitter's statements "false and misleading." And thus, "Mr. Musk has the right to seek rescission of the Merger Agreement in the event these material representations are determined to be false."

But finally Musk's lawyer provides a third reason for ending the acquisition. Twitter was required to "seek and obtain consent before deviating from its obligation to conduct its business in the ordinary course and 'preserve substantially intact the material components of its current business organization.'" The lawyer's letter argues that didn't happen: Twitter's conduct in firing two key, high-ranking employees, its Revenue Product Lead and the General Manager of Consumer, as well as announcing on July 7 that it was laying off a third of its talent acquisition team, implicates the ordinary course provision. Twitter has also instituted a general hiring freeze which extends even to reconsideration of outstanding job offers. Moreover, three executives have resigned from Twitter since the Merger Agreement was signed: the Head of Data Science, the Vice President of Twitter Service, and a Vice President of Product Management for Health, Conversation, and Growth.
But Twitter hadn't received "consent for changes in the conduct of its business, including for the specific changes listed above," according to Musk's lawyer, which "therefore constitute a material breach of Section 6.1 of the Merger Agreement."

The New York Times describes Pegasus as "a 'zero-click' hacking tool that can remotely extract everything from a target's mobile phone [and] turn the mobile phone into a tracking and recording device." But they also report that the tool's "notorious" maker, NSO Group, was visited "numerous times" in recent months by a executives from American military contractor L3Harris — makes of the cellphone-tracking Stingray tool — who'd wanted to negotiate a purchase of the company.

Their first problem? The U.S. government had blacklisted NSO Group in November, saying Pegasus had been used to compromise phones of political leaders, human rights activists and journalists. But five people familiar with the negotiations said that the L3Harris team had brought with them a surprising message that made a deal seem possible. American intelligence officials, they said, quietly supported its plans to purchase NSO, whose technology over the years has been of intense interest to many intelligence and law enforcement agencies around the world, including the F.B.I. and the C.I.A.

The talks continued in secret until last month, when word of NSO's possible sale leaked and sent all the parties scrambling. White House officials said they were outraged to learn about the negotiations, and that any attempt by American defense firms to purchase a blacklisted company would be met by serious resistance.... Left in place are questions in Washington, other allied capitals and Jerusalem about whether parts of the U.S. government — with or without the knowledge of the White House — had seized an opportunity to try to bring control of NSO's powerful spyware under U.S. authority, despite the administration's very public stance against the Israeli firm....

[NSO Group] had seen a deal with the American defense contractor as a potential lifeline after being blacklisted by the Commerce Department, which has crippled its business. American firms are not allowed to do business with companies on the blacklist, under penalty of sanctions. As a result, NSO cannot buy any American technology to sustain its operations — whether it be Dell servers or Amazon cloud storage — and the Israeli firm has been hoping that being sold to a company in the United States could lead to the sanctions being lifted....

L3 Harris's representatives told the Israelis that U.S. intelligence agencies supported the acquisition as long as certain conditions were met, according to five people familiar with the discussions. One of the conditions, those people said, was that NSO's arsenal of "zero days" — the vulnerabilities in computer source code that allow Pegasus to hack into mobile phones — could be sold to all of the United States' partners in the so-called Five Eyes intelligence sharing relationship. The other partners are Britain, Canada, Australia and New Zealand.
"Several people familiar with the talks said there have been attempts to resuscitate the negotiations..."

"Today at the Electronic Frontier Foundation, we're celebrating 32 years of fighting for technology users around the world," reads a new announcement posted at EFF.org: If you were online back in the 90s, you might remember that it was pretty wild. We had bulletin boards, FTP, Gopher, and, a few years later, homespun websites. You could glimpse a future where anyone, anywhere in the world could access information, float new ideas, and reach each other across vast distances. It was exciting and the possibilities seemed endless.

But the founders of EFF also knew that a better future wasn't automatic. You don't organize a team of lawyers, technologists, and activists because you think technology will magically fix everything — you do it because you expect a fight.

Three decades later, thanks to those battles, the internet does much of what it promised: it connects and lifts up major grassroots movements for equity, civil liberties, and human rights and allows people to connect and organize to counteract the ugliness of the world.

But we haven't yet won that future we envisioned. Just as the web connects us, it also serves as a hunting ground for those who want to surveil and control our actions, those who wish to harass and spread hate, as well as others who seek to monetize our every move and thought. Information collected for one purpose is freely repurposed in ways that oppress us, rather than lift us up. The truth is that digital tools allow those with horrible ideas to connect with each other just as it does those with beautiful, healing ones.

EFF has always seen both the beauty and destructive potential of the internet, and we've always put our marker down on the side of justice, freedom, and innovation.

We work every day toward a future we want to live in, and we don't do it alone. Support from the public makes every one of EFF's activism campaigns, software projects, and court filings possible. Together, we anchor the movement for a better digital world, and ensure that technology supports freedom, justice, and innovation for all people of the world.

In fact, I invite every digital freedom supporter to join EFF during our summer membership drive. Right now, you can be a member for as little as $20, get some special new gear, and ensure that tech users always have a formidable defender in EFF.

So how does the EFF team celebrate this auspicious anniversary? EFF does what it does best: stand up for users and innovators in the courts, in the halls of power, in the public conversation. We build privacy-protecting tools, teach skills to community members, share knowledge with allies, and preserve the best aspects of the wild web.

In other words, we use every tool in our deep arsenal to fight for a better and brighter digital future for all. Thank you for standing with EFF when it counts.

The Washington Post shares details from "a trove of more than 124,000 previously undisclosed Uber records." For example, in 2015 Uber CEO Travis Kalanick often pulled an emergency kill switch on its data — that is, "ordered the computer systems in Amsterdam cut off from Uber's internal network, making data inaccessible to authorities as they raided its European headquarters, documents show." "Please hit the kill switch ASAP," Kalanick had emailed, ordering a subordinate to block the office laptops and other devices from Uber's internal systems. "Access must be shut down in AMS," referring to Amsterdam. Uber's use of what insiders called the "kill switch" was a brazen example of how the company employed technological tools to prevent authorities from successfully investigating the company's business practices as it disrupted the global taxi industry, according to the documents.

During this era, as Uber's valuation was surging past $50 billion, government raids occurred with such frequency that the company distributed a Dawn Raid Manual to employees on how to respond. It ran more than 2,600 words with 66 bullet points. They included "Move the Regulators into a meeting room that does not contain any files" and "Never leave the Regulators alone."

That document, like the text and email exchanges related to the Amsterdam raid, are part of the Uber Files, an 18.7-gigabyte trove of data obtained by the Guardian and shared with the International Consortium of Investigative Journalists, a nonprofit newsroom in Washington that helped lead the project, and dozens of other news organizations, including The Washington Post. The files, spanning 2013 to 2017, include 83,000 emails and other communications, presentations and direct messages. They show that Uber developed extensive systems to confound official inquiries, going well past what has been known about its efforts to trip up regulators, government inspectors and police. Far from simply developing software to connect drivers and customers seeking rides, Uber leveraged its technological capabilities in many cases to gain a covert edge over authorities....

According to the documents and interviews with former employees, the company used a program called Greyball to keep authorities from hailing cars — and potentially impounding them and arresting their drivers. It used a technology called "geofencing" that, based on location data, blocked ordinary use of the app near police stations and other places where authorities might be working. And it used corporate networking management software to remotely cut computers' access to network files after they had been seized by authorities.... Greyball was created as a fraud-fighting tool to limit scammers' access to the app, a former executive said, and was at times used to frustrate violent Uber opponents hunting drivers. But Uber operations executives took control of the program and redeployed it against the government, former employees said.
The International Consortium of Investigative Journalists describes their trove of documents as "the secret story of how the tech giant won access to world leaders, cozied up to oligarchs and dodged taxes amid chaotic global expansion."

15-year-old Ellis Pinsky stole $23.8 million worth of cryptocurrency — and his life was never the same. For example, Rolling Stone reports, in his last year of high school, "Four men wearing ski masks and gloves, armed with knives, rope, brass knuckles, and a fake 9 mm," crept around the back of his home in the suburbs: Two weeks before the break-in, a lawsuit had been filed against him, and news stories had circulated connecting him to the hack. He knew that the thieves wanted this money, the millions and millions of dollars he had stolen. He also knew that he couldn't give it to them. He didn't have it. Not anymore.
The magazine paints the portrait of "an anxious young man in Invisalign braces" who describes the revelation he'd had at the age of 13. "The internet held such secrets. All he had to do was uncover them." As he soon found, there were plenty of people working to uncover them all the time, and willing to share their methods — for a price.... Realizing that a lot of the information social engineers used came from hacked databases, he began teaching himself to program, particularly to do the Structured Query Language injections and cross-site scripting that allowed him to attack companies' database architecture. The terabyte upon terabyte of databases he extracted, traded, and hoarded made him valuable to OGUsers as well as to others, like the Russian hackers he was able to converse with thanks to his fluency with his mother's native language... By the time he was 14, he tells me, "I think it's fair to say I had the capabilities to hack anyone."
The article describes him as "attending high school by day and extracting the source code of major corporations by night.... He was 14 years old and taken with the thrill of possessing a hidden superpower, of spending his nights secretly tapping into an underground world where he was esteemed and even feared. And then, in the morning, being called downstairs to breakfast." He wrote a Python script to comb through social media networks and seek out any mentions of working for a [cellphone] carrier. Then he'd reach out with an offer of compensation for helping him with a task. Every fifth or sixth person — underpaid and often working a short-term contract — would say they were game, as Pinsky tells it. For a couple hundred dollars' worth of bitcoin, they'd be willing to do a SIM swap, no questions asked. Eventually, Pinsky says, he had employees at every major carrier also working for him. Then the stakes got even higher. It was only a matter of time before OG hackers, known to each other as "the Community," realized that if they could use the SIM-swapping method to steal usernames, they could just as easily use it to steal cryptocurrency...
In one massive heist Pinksky stole 10% of all the Trigger altcoins on the market from crypto impresario Michael Terpin. ("As Pinsky's money launderers were converting it, the market was crashing in real time.") Pinsky recruited a crew to launder the money — at least one of which simply kept it — but even with all the conversion fees, he still made off with millions. And then... For a while, he half-expected the FBI to knock on his door at any moment, just like in the movies; but as time passed, he grew less anxious.... He says he moved on to learning different types of programming. He ran a sneaker business that used bots and scripts to snap up limited pairs then flip them... He went to soccer practice. He and his friends had started hanging out with girls on the weekend, driving down to the docks where you could see the glowing lights from the Tappan Zee Bridge.
Until Terpin figured out it was Pinsky who'd robbed him: Pinsky and his legal team preempted his arrest by contacting the U.S. attorney directly and offering his cooperation. In February 2020, he voluntarily returned every last thing he says he got from the Terpin heist: 562 bitcoins, the Patek watch, and the cash he'd stored in the safe under his bed.... When I ask if he has also worked with the FBI to help bring down other hackers, he blinks quickly and then changes the subject.
Pinsky has not been criminally charged — partly because he was a minor, but also because of his cooperation with law enforcement. But filing a civil suit, Terpin wants to be compensated with triple the amount stolen, arguing that the teenager who robbed him was running an organized crime racket and that he should be heavily punished to set an example.

Rolling Stone's article raisees the question: what should happen next?

"Mexico's president submitted a bill Tuesday to end daylight saving time, putting an end to the practice of changing clocks twice a year," reports the Associated Press: Health Secretary Jorge Alcocer said Mexico should return to "God's clock," or standard time, arguing that setting clocks back or forward damages people's health...

The change would mean central Mexican time, which covers most of the country, potentially could be permanently two hours behind the east coast of the United States; it is now one hour behind for most of the year.
Here's how Reuters summarizes the Mexican government's position. Changing to daylight saving time in 1996 "was unpopular and did not generate many benefits for the country."

Howard Altman writes via The Drive: In an effort to protect those with information about unidentified aerial phenomena (UAP) and increase the influx of reports about them, Rep. Mike Gallagher (R-Wisc) has introduced (PDF) an amendment to the Fiscal Year 2023 National Defense Authorization Act. "The amendment would establish a process within the government for reporting UAPs and provide whistleblower-like protections," Gallagher's spokesman Jordan Dunn told The War Zone Thursday morning. For a multitude of reasons, U.S. troops and government contractors have traditionally been reluctant to come forward with information about these incidents, regardless of their validity. Beyond that, there have also been long-standing allegations that the government and defense contractors could be hiding previous UFO-related programs and evidence. This would allow those with information to come forward without retribution. Some have even posited that language like that in Gallagher's amendment could lead to "UFO disclosure."

In essence, it says that regardless of any previous written or oral non-disclosure agreements "that could be interpreted as a legal constraint on reporting by a witness of an unidentified aerial phenomena," those with information about UAPs, more commonly known as UFOs, would not be violating federal classified information laws if they come forward. The amendment also calls for the head of the new Airborne Object Identification and Management Synchronization Group (AOIMSG), tasked with investigating UAPs on behalf of the Defense Secretary and Director of National Intelligence, to establish "a secure system" for receiving reports of "any events relating to" UAPs and any government or government contractor activity or program related to UAPs. The reporting system shall be administered by "designated and widely known, easily accessible, and appropriately cleared Department of Defense and intelligence community employees or contractors" as part of AOIMSG, which is a much enhanced and more deeply mandated effort that replaced the Unidentified Aerial Phenomena Task Force.

Any information would first be screened "to prevent unauthorized public reporting or compromise of properly classified military and intelligence systems, programs, and related activity, including all categories and levels of special access and compartmented access programs, current, historical, and future." However, federal agencies and contractors working with the government would be precluded from taking actions, including suspending security clearances, for those who report UAP incidents and information. And those who are retaliated against "may bring a private civil action for all appropriate remedies, including injunctive relief and compensatory and punitive damages, against the Government or other employer who took the personnel action, in the United States Court of Federal Claims," the amendment states.

A new study published by the IMDEA Networks Institute shows just how common it is for government websites to install third-party cookies in visitors' web browsers. HotHardware reports: The study makes a distinction between third-party (TP) cookies and third-party tracking (TPT) cookies, because not all third-party cookies are "set by domains that are known to be tracking users for data collection purposes." The chart [here] shows the percentage of government websites for each country that install at least one third-party cookie, as well as the percentage of said cookies that are associated with domains that are known to be tracking users. Russia tops out the list with over 90% of its government websites installing third-party cookies in visitors' web browsers. Meanwhile, nearly 60% of US government websites install at least one third-party cookie. Germany sits at the bottom of the list with a little under 30% of government websites serving up third-party cookies.

Most of the third-party cookies installed by government websites are known tracking cookies, except in the case of Germany, where under 10% of third-party cookies are associated with domains that are known to track users. The researchers also found that, depending on the country, 20% to 60% of the third party cookies installed by government websites remain in visitors' browsers without expiring for a year or more. That's a long time for a tracker installed without your knowledge or consent to remain active. Beyond specifically tracking cookies, the researchers measured the number of trackers of any kind present on government websites. The Russian gov.ru has the most trackers out of any government website analyzed by the researchers, numbering 31 trackers in total. However, Brazil and Canada aren't far behind, with 25 trackers present on both investexportbrasil.gov.br and nac-cna.ca. The US government website with the most trackers is hhs.gov, which has 13.

The researchers point out that both third-party tracking cookies are automatically installed in visitors' web browsers without their consent. However, the researchers guess that web developers and administrators likely include third-party content without intending to add trackers to their websites. A great many websites now rely on third-party resources and include social content that come with trackers built-in.

An anonymous reader quotes a report from Ars Technica: Arizona passed a law making it harder to record police by limiting how close bystanders can be while recording specified law enforcement activity. [...] The new Arizona law requires any bystanders recording police activity in the state to stand at a minimum of 8 feet away from the action. If bystanders move closer after police have warned them to back off, they risk being charged with a misdemeanor and incurring fines of up to $500, jail time of up to 30 days, or probation of up to a year. Sponsored by Republican state representative John Kavanagh, the law known as H.B. 2319 makes it illegal to record police at close range. In a USA Today op-ed, Kavanagh said it is important to leave this buffer for police to protect law enforcement from being assaulted by unruly bystanders. He said "there's no reason" to come closer and predicted tragic outcomes for those who do, saying, "Such an approach is unreasonable, unnecessary, and unsafe, and should be made illegal."

This week, Kavanagh has succeeded in making close-range recording illegal in Arizona, with only a few exceptions. Perhaps most critically, the person involved in the police activity -- someone being questioned, arrested, or handled by police -- can record, as long as it doesn't interfere with police actions. The same exception extends to anyone recording while in a vehicle involved in a police stop. Additionally, anyone recording activity from an enclosed structure on private property still has a right to record police within 8 feet -- unless law enforcement "determines that the person is interfering" or "it is not safe" for them to be in the area. That caveat potentially gives police a lot of discretion over who can record and when.

Kavanagh said he decided to push for this change in Arizona law after some Tucson officers complained that bystanders sometimes stood a foot or two behind them while recording arrests. The state representative also told USA Today that his decision to set the minimum distance at 8 feet "is based upon 8 feet being established by the US Supreme Court as being a reasonable distance as they applied it to people entering and leaving abortion clinics when faced with protesters." Responding to critics who think citizens should be able to get closer to law enforcement activity, Kavanagh said, "The argument that filming from 8 feet away does not allow for a proper view of the scene is ridiculous." He cited impactful police brutality recordings that were recorded from further distances, including Rodney King (100 feet) and Freddie Gray ("clearly 8 to 10 feet away"). In 2017, a federal appeals court ruled that the First Amendment protects individuals' right to film police officers performing their official duties.

The ACLU says this law is a "chilling" use of the "public's most effective tool against police wrongdoing in violation of our First Amendment rights." ACLU staff attorney K.M. Bell added: "By limiting our ability to record police interactions, this law will undoubtedly make it even more difficult to hold police officers accountable for misconduct."

A Miami-based CEO has been arrested for allegedly importing $1 billion worth of counterfeit Cisco equipment from China and then selling it on Amazon and eBay. From a report: The Justice Department announced today that it had indicted 38-year-old Onur "Ron" Aksoy for selling the counterfeit Cisco gear via numerous online storefronts. Allegedly, Aksoy imported tens of thousands of fraudulent Cisco devices from China and Hong Kong. He then created at least 19 companies in New Jersey and Florida, dubbed the "Pro Network," to help him resell the hardware as genuine through the e-commerce sites.

"The operation allegedly generated over $100 million in revenue, and Aksoy received millions of dollars for his personal gain," the Justice Department said. The Cisco equipment Aksoy allegedly sold was usually older, lower-end models that were previously bought or discarded. Counterfeiters in China then modified the equipment, making the devices appear as if they were newer or more expensive Cisco product models. "As alleged, the Chinese counterfeiters often added pirated Cisco software and unauthorized, low-quality, or unreliable components -- including components to circumvent technological measures added by Cisco to the software to check for software license compliance and to authenticate the hardware," the Justice Department said. In addition, the counterfeit products were packaged with authentic-looking labels, boxes, and documentation.

Calls for an investigation into the security risks posed by the video app TikTok are widening, adding to pressure on President Biden to make good on his year-old promise to get tough on apps that could share Americans' personal data with foreign adversaries. From a report: The Democratic chairman of the Senate Intelligence Committee and the panel's top Republican sent a joint letter to the Federal Trade Commission this week urging an investigation of TikTok's data-handling and other practices. TikTok's parent, ByteDance, has its headquarters in Beijing. The letter from Sens. Mark Warner (D., Va.) and Marco Rubio (R., Fla.) followed reports by BuzzFeed that ByteDance's employees in China have repeatedly accessed U.S. users' personal data.

"We ask that your agency immediately initiate [an] investigation on the basis of apparent deception by TikTok" concerning its data-handling and corporate- governance practices, said the lawmakers' letter. It called for the FTC to coordinate its work with any investigation that might be initiated by the Justice Department. The FTC and DOJ declined to comment. TikTok said that it is making progress in sharply limiting access to its data on Americans.

A former investment manager at Celsius Network sued the crypto lender on Thursday, saying it used customer deposits to rig the price of its own crypto token and failed to properly hedge risk, causing it to freeze customer assets. From a report: The complaint said Celsius ran a Ponzi scheme to benefit itself through "gross mismanagement of customer deposits," and defrauded the plaintiff KeyFi Inc, run by the former manager Jason Stone, into providing services worth millions of dollars and refusing to pay for them.

Sunny Balwani, the former president and chief operating officer of bankrupt blood-testing company Theranos, on Thursday was found guilty of 12 counts of conspiracy and fraud against certain investors and patients. Axios reports: It's a similar verdict to one handed down in January to Theranos founder and ex-CEO Elizabeth Holmes, who once dated Balwani. Balwani isn't a household name like Holmes, but he was instrumental in building a billion-dollar house of cards that duped both investors and patients. Balwani's attorneys tried to pin the blame for Theranos' failures on Holmes, much as her attorneys had tried to blame Balwani.

As we wrote when the trial began: Holmes tried to thread an incredibly narrow rhetorical needle, denying the existence of fraud while also redirecting blame. Balwani seems to be attempting something similar; claiming he was a savvy executive with lots of past success, but also a naif who was bamboozled by Holmes. But prosecutors, who originally wanted to try the pair together, often used Balwani's own words against him. For example, they presented a text message from Balwani to Holmes that read: "I am responsible for everything at Theranos." One big difference between the trials, however, was that Balwani didn't testify in his own defense.

The FBI operation in which the agency intercepted messages from thousands of encrypted phones around the world was powered by cobbled together code. From a report: Motherboard has obtained that code and is now publishing sections of it that show how the FBI was able to create its honeypot. The code shows that the messages were secretly duplicated and sent to a "ghost" contact that was hidden from the users' contact lists. This ghost user, in a way, was the FBI and its law enforcement partners, reading over the shoulder of organized criminals as they talked to each other.

Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. Anom was marketed to criminals, and ended up in the hands of over 300 criminal syndicates worldwide. The landmark operation has led to more than 1,000 arrests including alleged top tier drug traffickers and massive seizures of weapons, cash, narcotics, and luxury cars. Motherboard has obtained this underlying code of the Anom app and is now publishing sections of it due to the public interest in understanding how law enforcement agencies are tackling the so-called Going Dark problem, where criminals use encryption to keep their communications out of the hands of the authorities. The code provides greater insight into the hurried nature of its development, the freely available online tools that Anom's developers copied for their own purposes, and how the relevant section of code copied the messages as part of one of the largest law enforcement operations ever.

What is likely one of history's largest heists of personal data -- and the largest known cybersecurity breach in China -- occurred because of a common vulnerability that left the data open for the taking on the internet, say cybersecurity experts who discovered the security flaw earlier this year. WSJ: The Shanghai police records -- containing the names, government ID numbers, phone numbers and incident reports of nearly 1 billion Chinese citizens -- were stored securely, according to the cybersecurity experts. But a dashboard for managing and accessing the data was set up on a public web address and left open without a password, which allowed anyone with relatively basic technical knowledge to waltz in and copy or steal the trove of information, they said. "That they would leave this much data exposed is insane," said Vinny Troia, founder of dark web intelligence firm Shadowbyte, which scans the web for unsecured databases and found the Shanghai police database in January.

The database stayed exposed for more than a year, from April 2021 through the middle of last month, when its data was suddenly wiped clean and replaced with a ransom note for the Shanghai police to discover, according to Bob Diachenko, owner of the cybersecurity research firm SecurityDiscovery, which similarly found the database -- and later the note -- through its periodic web scans earlier this year. "your_data_is_safe," the ransom note read, according to screenshots provided by Mr. Diachenko. "contact_for_your_data...recovery10btc," meaning the data would be returned for 10 bitcoin, roughly $200,000. The ransom amount matches the price that an anonymous user began asking for last Thursday on an online cybercrime forum in exchange for access to a database the user claimed contained billions of records of Chinese citizens' information stolen from a Shanghai national police database.