schwit1 writes: The Ohio State University has successfully trademarked the word "THE," in a victory for the college and its branding that is sure to produce eye rolls from Michigan fans and other rivals. Stating the full name of the school has become a point of pride for Ohio State's athletes when introducing themselves on television during games. The three-letter article "THE" has also become an important part of the school's merchandise and apparel. The U.S. Patent and Trademark Office approved Ohio State's application Tuesday. The trademark applies to T-shirts, baseball caps and hats.

"'THE' has been a rallying cry in the Ohio State community for many years," said Benjamin Johnson, a spokesman for the university. Ohio State registered the word as a trademark to protect the university's brand, Mr. Johnson said. Ohio State's trademark and licensing program makes about $12.5 million annually for the university, which funds student scholarships and university programs, he said. "Universities historically are very particular about their trademarks, and they go to a lot of lengths to enforce their trademarks," said Josh Gerben, a trademark attorney, who noted Ohio State's trademark application on Twitter. "There is a lot of value in a university's brand."

Long-time Slashdot reader Mr_Blank shares a report from Gerona: China has enacted new regulation for the live-streaming industry, listing 31 prohibited conducts and raising the bar for influencers to speak out on specific topics, in the government's latest effort to regulate the booming digital economy. The 18-point guideline, released Wednesday by the National Radio and Television Administration and the Department of Culture and Tourism, requires influencers to have relevant qualifications to cover some subjects, including law, finance, medicine and education discuss, although the authorities have not specified the necessary qualifications.

The 31 prohibited conducts during live-streaming sessions include posting content that weakens or distorts the leadership of the Chinese Communist Party, the socialist system, or the country's reform and opening-up. Other prohibited behaviors include using deepfake technologies to manipulate the images of party or state leaders and intentionally 'building up' sensitive issues and attracting public attention. Live streamers are also prohibited from showing an extravagant lifestyle, such as showing luxury products and cash, the policy said. This article originally appeared in the South China Morning Post.

An anonymous reader quotes a report from TechCrunch: Another strike against use of Google Analytics in Europe: The Italian data protection authority has found a local web publisher's use of the popular analytics tool to be non-compliant with EU data protection rules owing to user data being transferred to the U.S. -- a country that lacks an equivalent legal framework to protect the info from being accessed by US spooks. The Garante found the web publisher's use of Google Analytics resulted in the collection of many types of user data, including device IP address, browser information, OS, screen resolution, language selection, plus the date and time of the site visit, which were transferred to the U.S. without adequate supplementary measures being applied to raise the level of protection to the necessary EU legal standard.

Protections applied by Google were not sufficient to address the risk, it added, echoing the conclusion of several other EU DPAs who have also found use of Google Analytics violates the bloc's data protection rules over the data export issue. Italy's DPA has given the publisher in question (a company called Caffeina Media Srl) 90 days to fix the compliance violation. But the decision has wider significance as it has also warned other local websites that are using Google Analytics to take note and check their own compliance, writing in a press release [translated from Italian with machine translation]: "[T]he Authority draws the attention of all Italian managers of websites, public and private, to the illegality of transfers made to the United States through GA [Google Analytics], also in consideration of the numerous reports and questions that are being received by the Office, and invites all data controllers to verify the compliance of the methods of use of cookies and other tracking tools used on its websites, with particular attention to Google Analytics and other similar services, with the legislation on the protection of personal data." A Google spokesperson issued the following statement: "People want the websites they visit to be well designed, easy to use, and respectful of their privacy. Google Analytics helps publishers understand how well their sites and apps are working for their visitors -- but not by identifying individuals or tracking them across the web. These organizations, not Google, control what data is collected with these tools, and how it is used. Google helps by providing a range of safeguards, controls and resources for compliance."

Google is reviewing the Italian DPA's decision, according to the spokesperson.

Security researchers at Lookout recently tied a previously unattributed Android mobile spyware, dubbed Hermit, to Italian software house RCS Lab. Now, Google threat researchers have confirmed much of Lookout's findings, and are notifying Android users whose devices were compromised by the spyware. From a report: Hermit is a commercial spyware known to be used by governments, with victims in Kazakhstan and Italy, according to Lookout and Google. Lookout says it's also seen the spyware deployed in northern Syria. The spyware uses various modules, which it downloads from its command and control servers as they are needed, to collect call logs, record ambient audio, redirect phone calls and collect photos, messages, emails, and the device's precise location from a victim's device. Lookout said in its analysis that Hermit, which works on all Android versions, also tries to root an infected Android device, granting the spyware even deeper access to the victim's data. Lookout said that targeted victims are sent a malicious link by text message and tricked into downloading and installing the malicious app -- which masquerades as a legitimate branded telco or messaging app -- from outside of the app store.

A security researcher found vulnerabilities in Jacuzzi's SmartTub interface that allowed access to the personal data of every hot tub owner. From a report: Jacuzzi's SmartTub feature, like most Internet of Things (IoT) systems, lets users connect to their hot tub remotely via a companion Android or iPhone app. Marketed as a "personal hot tub assistant," users can make use of the app to control water temperature, switch on and off jets, and change the lights. But as documented by hacker Eaton Zveare, this functionality could also be abused by threat actors to access the personal information of hot tub owners worldwide, including their names and email addresses. It's unclear how many users are potentially impacted, but the SmartTub app has been downloaded more than 10,000 times on Google Play.

"The main concern is their name and email being leaked," Zveare told TechCrunch, adding that attackers could also potentially heat up someone else's hot tub or change the filtration cycles. "That would make things unpleasant the next time the person checked their tub," he said. "But I don't think there is anything truly dangerous that could have been done -- you have to do all chemicals by hand." Eaton first noticed a problem when he tried to log in using the SmartTub web interface, which uses third-party identity provider Auth0, and found that the login page returned an "unauthorized" error. But for the briefest moment Zveare saw the full admin panel populated with user data flash on his screen.

The U.S. Food and Drug Administration is preparing to order Juul Labs Inc to take its e-cigarettes off the market in the United States, the Wall Street Journal reported on Wednesday, citing people familiar with the matter. Reuters reports: Juul has faced heightened scrutiny from regulators, lawmakers and state attorneys general over the appeal of its nicotine products to teenagers. Under pressure, the company in late 2019 had halted U.S. sales of several flavors. "This clearly comes as a surprise to the market ... we would expect that Juul would appeal the decision, and remain on the market through that process, which would likely take a year or more," Cowen analyst Vivien Azer said.

The looming verdict comes nearly two years after Juul had applied for approval to keep selling e-cigarettes in the country. The FDA's review of the applications was based on whether the e-cigarettes are effective in getting smokers to quit and, if so, whether the benefits to smokers outweigh the health damage to new users, including teenagers. [...] The estimated fair value of Altria's investment in Juul was $1.6 billion as of March end, a fraction of the $12.8 billion it paid in 2018, as a crackdown on vaping has upended the once fast-growing industry.

Crypto's structural flaws make it an unsuitable basis for a monetary system, according to the Bank for International settlements (BIS). Instead, monetary systems could be built around central bank digital currencies (CBDCs), which are digital representations of central bank money. CoinDesk reports: The BIS, an association of the world's major central banks, dedicates a 42-page chapter in its "2022 Annual Economic Report" to laying out a blueprint for the future of the global monetary system. In that vision, there is room for only some of crypto's underlying technical features, like programmability and tokenization, not for cryptocurrencies themselves. "Our broad conclusion is captured in the motto, "Anything that crypto can do, CBDCs can do better,'" said Hyun Song Shin, an economic adviser and head of research at the BIS, during a press briefing on Monday.

The chapter, which will be published Tuesday ahead of the full report, identifies a number of limitations of crypto, including the lack of a stable nominal anchor. In monetary policy that is a variable -- such as a currency peg -- that can be used to control price levels. Stablecoins, cryptocurrencies pegged to the value of assets like sovereign currencies, are the crypto world's search for such an anchor, Shin said. Stablecoins attempt to "piggyback on the stability of real money issued by central banks."

Shin said the recent crash of terraUSD, a dollar stablecoin with a market capitalization of $18 billion in early May that rapidly lost its peg, illustrated how stablecoins, despite their name, are unstable and don't make good units of account. Unlike other leading stablecoins, such as USDC and USDT, which are reportedly backed by dollar-denominated reserves, terraUSD is an algorithmic stablecoin backed by another cryptocurrency (in this case LUNA) with an algorithm in place to regulate supply and demand of the stablecoin and maintain its peg. "The second important finding is that crypto and stablecoins fail to achieve the full network effects that we normally expect of money," Shin said. Money, Shin said, is the perfect example of a virtuous circle of greater use and greater acceptance. Crypto's decentralized nature, on the other hand, achieves exactly the opposite, namely fragmentation.

Mullvad has taken the decision to completely remove the ability to create new subscriptions -- all in the name of storing less data about their users. TechRadar reports: "Subscriptions clearly offer a lot of convenience but as we've seen that convenience comes at a cost and we no longer think this is an acceptable trade-off. We care deeply about usability but when it comes down to it, privacy has to win," wrote the provider in a blog post.

This move is a step forward in Mullvad's commitment to its users' privacy. It's actually one of the few services not to ask for any email address or other personal information to create an account. However, when it came to recurring subscription, the provider was forced to retain record of payments in order to provide refunds, charge the user again after their initial period of cover or recover a missing account. Therefore, one-time payments appear to be the only solution.

"We are constantly looking for ways to reduce the amount of data we store while still providing a usable service. Nowhere is the tension between privacy and usability more apparent than in the area of payments." Mullvad's monthly fee has always been the same on every plan - around $5.50. This is very different than almost every other consumer VPN, but there's no need to stress about a price rise. What's more, those who currently have an active Mullvad subscription do not need to worry either. Their account will keep running as usual for at least six months, or until their subscription comes to the end of a term.

An anonymous reader quotes a report from the Electronic Frontier Foundation: Copyright law cannot be used as a shortcut around the First Amendment's strong protections for anonymous internet users, a federal trial court ruled on Tuesday. The decision by a judge in the United States District Court for the Northern District of California confirms that copyright holders issuing subpoenas under the Digital Millennium Copyright Act must still meet the Constitution's test before identifying anonymous speakers.

The case is an effort to unmask an anonymous Twitter user (@CallMeMoneyBags) who posted photos and content that implied a private equity billionaire named Brian Sheth was romantically involved with the woman who appeared in the photographs. Bayside Advisory LLC holds the copyright on those images, and used the DMCA to demand that Twitter take down the photos, which it did. Bayside also sent Twitter a DMCA subpoena to identify the user. Twitter refused and asked a federal magistrate judge to quash Bayside's subpoena. The magistrate ruled late last year that Twitter must disclose the identity of the user because the user failed to show up in court to argue that they were engaged in fair use when they tweeted Bayside's photos. When Twitter asked a district court judge to overrule the magistrate's decision, EFF and the ACLU Foundation of Northern California filed an amicus brief in the case, arguing that the magistrate's ruling sidestepped the First Amendment when it focused solely on whether the user's tweets constituted fair use of the copyrighted works. [...]

EFF is pleased with the district court's decision, which ensures that DMCA subpoenas cannot be used as a loophole to the First Amendment's protections. The reality is that copyright law is often misused to silence lawful speech or retaliate against speakers. For example, in 2019 EFF successfully represented an anonymous Reddit user that the Watchtower Bible and Tract Society sought to unmask via a DMCA subpoena, claiming that they posted Watchtower's copyrighted material. We are also grateful that Twitter stood up for its user's First Amendment rights in court.

Unidentified operatives have been using the fitness tracking app Strava to spy on members of the Israeli military, tracking their movements across secret bases around the country and potentially observing them as they travel the world on official business. From a report: By placing fake running "segments" inside military bases, the operation -- the affiliation of which has not been uncovered -- was able to keep tabs on individuals who were exercising on the bases, even those who have applied the strongest possible account privacy settings. In one example seen by the Guardian, a user running on a top-secret base thought to have links to the Israeli nuclear programme could be tracked across other military bases and to a foreign country.

The surveillance campaign was discovered by the Israeli open-source intelligence outfit FakeReporter. The group's executive director, Achiya Schatz, said: "We contacted the Israeli security forces as soon as we became aware of this security breach. After receiving approval from the security forces to proceed, FakeReporter contacted Strava, and they formed a senior team to address the issue." Strava's tracking tools are designed to allow anyone to define and compete over "segments," short sections of a run or bike ride that may be regularly raced over, like a long uphill climb on a popular cycling route or a single circuit of a park. Users can define a segment after uploading it from the Strava app, but can also upload GPS recordings from other products or services.

Paige Thompson, a former Amazon employee accused of stealing the personal information of 100 million customers by breaching banking giant CapitalOne in 2019, has been found guilty by a Seattle jury on charges of wire fraud and computer hacking. From a report: Thompson, 36, was accused of using her knowledge as a software engineer working in the retail giant's cloud division, Amazon Web Services, to identify cloud storage servers that were allegedly misconfigured to gain access to the cloud stored data used by CapitalOne. That included names, dates of birth, Social Security numbers, email addresses and phone numbers, and other sensitive financial information, such as credit scores, limits and balances. Some one million Canadians were also affected by the CapitalOne breach. Thompson also accessed the cloud stored data of more than 30 other companies, according to a superseding indictment filed by the Justice Department almost two years after Thompson was first charged, which reportedly included Vodafone, Ford, Michigan State University and the Ohio Department of Transportation.

An anonymous reader quotes a report from The Register: More than half of the 24.6 billion stolen credential pairs available for sale on the dark web were exposed in the past year, the Digital Shadows Research Team has found. Data recorded from last year reflected a 64 percent increase over 2020's total (Digital Shadows publishes the data every two years), which is a significant slowdown compared to the two years preceding 2020. Between 2018 and the year the pandemic broke out, the number of credentials for sale shot up by 300 percent, the report said. Of the 24.6 billion credentials for sale, 6.7 billion of the pairs are unique, an increase of 1.7 billion over two years. This represents a 34 percent increase from 2020.

With all those credentials available for sale online, account takeover attacks have proliferated as well, the report said. Seventy-five percent of the passwords for sale online were not unique, noted Digital Shadows, which said everyone needs to be wary. Proactive account protection, consistent application of good authentication habits, and awareness of one's organizational digital footprint are necessary to protect against account takeover attacks, the study found. Individuals, the report said, should "use multi-factor authentication, password managers, and complex, unique passwords."

Fraudsters who exploit LinkedIn to lure users into cryptocurrency investment schemes pose a "significant threat" to the platform and consumers, according to Sean Ragan, the FBI's special agent in charge of the San Francisco and Sacramento, California, field offices. From a report: "It's a significant threat," Ragan said in an exclusive interview. "This type of fraudulent activity is significant, and there are many potential victims, and there are many past and current victims." The scheme works like this: A fraudster posing as a professional creates a fake profile and reaches out to a LinkedIn user. The scammer starts with small talk over LinkedIn messaging, and eventually offers to help the victim make money through a crypto investment. Victims interviewed by CNBC say since LinkedIn is a trusted platform for business networking, they tend to believe the investments are legitimate. Typically, the fraudster directs the user to a legitimate investment platform for crypto, but after gaining their trust over several months, tells them to move the investment to a site controlled by the fraudster. The funds are then drained from the account.

America's federal agents "have begun questioning U.S. technology companies on how their computer chips ended up in Russian military equipment recovered in Ukraine," reports the Washington Post: Commerce Department agents who enforce export controls are conducting the inquiries together with the FBI, paying joint visits to companies to ask about Western chips and components found in Russian radar systems, drones, tanks, ground-control equipment and littoral ships, according to people familiar with the matter, who spoke on the condition of anonymity to discuss sensitive investigations. "Our goal is to actually try to track that back, all the way back to the U.S. supplier" to determine "how did it find its way into that weapons system," one Commerce Department official said of the probes....

It isn't clear which specific components are being probed. But investigators from a variety of countries have identified Western electronics in Russian weaponry found in Ukraine. Many of those components appear to have been manufactured years ago, before the United States tightened export restrictions after Russia seized Crimea in 2014. But others were manufactured as recently as 2020, according to Conflict Armament Research (CAR), a research group in London that has examined some of the parts....

CAR last month sent investigators to Ukraine to examine Russian weaponry and communications equipment, and reported finding components from 70 companies based in the United States and Europe. They found the parts in military radios, airborne defense systems and in remnants of cruise missiles that the Ukrainians recovered in various towns and villages, Damien Spleeters, one of the CAR investigators, said in an interview.
An associate professor of electrical/computer engineering at Purdue tells the Post "Most of the items they are listing are available through any commercial computer parts supplier or digital parts supplier."

But the Post spoke to a lawyer representing one of the contacted technology companies. "Among the questions federal agents are asking: whether tech companies sold their products to a specific list of companies, including middlemen, that may have been involved in the supply chain."

The Los Angeles Times reports on "a massive surge of criminal fraud that has been pummeling crypto users with unknown billions of dollars in losses with little relief in sight." The growth in crypto fraud has turned exponential in recent years. The reported losses from crypto scams in 2021 were 60 times larger than in 2018, the Federal Trade Commission reported earlier this month, with crypto now accounting for 1 out of every 4 dollars lost to fraud in the reports monitored by the agency. Over 46,000 people lost more than $1 billion in crypto to scams since 2021, but the real sum of losses is likely vastly larger because most frauds are not reported, the agency said.... "Since 2021, $575 million of all crypto fraud losses reported to the FTC were about bogus investment opportunities, far more than any other fraud type," the agency reported.

Financial losses specifically from NFT crimes just through May this year were already more than 600% higher than for all of 2021, with the space seeing twice as many hacks and bigger and bigger heists, according to analysis from digital privacy firm Top10VPN.

For many victims, there's little hope of getting their lost art back. The marketplaces where NFTs get sold — crypto exchanges — can't cancel or reverse fraudulent transactions the way a traditional bank or credit card company might; the whole point of crypto was to cut out these sorts of financial middlemen, which many crypto fans greatly distrust. Crypto technology was built out of a "libertarian ethos" in which "there's no nanny state that's going to take care of you," said Jeremy Goldman, an intellectual property attorney who specializes in legal issues involving crypto assets. "These are the consequences when there's a mistake ... there's no one to unwind it, you can't call customer service, you can't go back to the mothership, you can't go back to the bank."

But at the same time, law enforcement agencies in the U.S. have also shown a growing willingness and ability to mount sophisticated investigations into crypto fraud.... [I]n March, federal agents sought a court order to seize roughly $165,000 worth of Ethereum in a digital Binance.US wallet. Officials said the cryptocurrency had been stolen from an Orange County investor, nicknamed "P.M.," who got tricked into giving up his coins by an fraudster pretending to be a Coinbase technical support representative.
On the bright side, BuzzFeed notes that actor Seth Green has recovered his prized Bored Ape NFT from "Mr Cheese" for $297,000 worth of Ether.

But the Los Angeles Times points out that another victim of a Bored Ape heist has sued the creators of Bored Apes. Their lawyer argues the company "refuses to police their own community. They're the gatekeepers, they can lock out the thieves if they wanted to, and they won't do it."

An anonymous reader quotes a report from BleepingComputer: Cisco advises owners of end-of-life Small Business RV routers to upgrade to newer models after disclosing a remote code execution vulnerability that will not be patched. The vulnerability is tracked as CVE-2022-20825 and has a CVSS severity rating of 9.8 out of 10.0. According to a Cisco security advisory, the flaw exists due to insufficient user input validation of incoming HTTP packets on the impacted devices. An attacker could exploit it by sending a specially crafted request to the web-based management interface, resulting in command execution with root-level privileges.

The vulnerability impacts four Small Business RV Series models, namely the RV110W Wireless-N VPN Firewall, the RV130 VPN Router, the RV130W Wireless-N Multifunction VPN Router, and the RV215W Wireless-N VPN Router. This vulnerability only affects devices with the web-based remote management interface enabled on WAN connections. [...] Cisco states that they will not be releasing a security update to address CVE-2022-20825 as the devices are no longer supported. Furthermore, there are no mitigations available other than to turn off remote management on the WAN interface, which should be done regardless for better overall security. Users are advised to apply the configuration changes until they migrate to Cisco Small Business RV132W, RV160, or RV160W Routers, which the vendor actively supports.

Brave CEO Brendan Eich took aim at rival DuckDuckGo on Wednesday by challenging the web search engine's efforts to brush off revelations that its Android, iOS, and macOS browsers gave, to a degree, Microsoft Bing and LinkedIn trackers a pass versus other trackers. The Register reports: Eich drew attention to one of DuckDuckGo's defenses for exempting Microsoft's Bing and LinkedIn domains, a condition of its search contract with Microsoft: that its browsers blocked third-party cookies anyway. "For non-search tracker blocking (e.g. in our browser), we block most third-party trackers," explained DuckDuckGo CEO Gabriel Weinberg last month. "Unfortunately our Microsoft search syndication agreement prevents us from doing more to Microsoft-owned properties. However, we have been continually pushing and expect to be doing more soon."

However, Eich argues this is disingenuous because DuckDuckGo also includes exceptions that allow Microsoft trackers to circumvent third-party cookie blocking via appended URL parameters. "Trackers try to get around cookie blocking by appending identifiers to URL query parameters, to ID you across sites," he explained. DuckDuckGo is aware of this, Eich said, because its browser prevents Google, Facebook, and others from appending identifiers to URLs in order to bypass third-party cookie blocking. "[DuckDuckGo] removes Google's 'gclid' and Facebook's 'fbclid'," Eich said. "Test it yourself by visiting https://example.org/?fbclid=sample in [DuckDuckGo]'s macOS browser. The 'fbclid' value is removed." "However, [DuckDuckGo] does not apply this protection to Microsoft's 'msclkid' query parameter," Eich continued. "[Microsoft's] documentation specifies that 'msclkid' exists to circumvent third-party cookie protections in browsers (including in Safari's browser engine used by DDG on Apple OSes)." Eich concluded by arguing that privacy-focused brands need to prioritize privacy. "Brave categorically does not and will not harm user privacy to satisfy partners," he said.

A spokesperson for DuckDuckGo characterized Eich's conclusion as misleading. "What Brendan seems to be referring to here is our ad clicks only, which is protected in our agreement with Microsoft as strictly non-profiling (private)," a company spokesperson told The Register in an email. "That is these ads are privacy protected and how he's framed it is ultimately misleading. Brendan, of course, kept the fact that our ads are private out and there is really nothing new here given everything has already been disclosed." In other words, allowing Bing to append its identifier to URLs enables Bing advertisers to tell whether their ad produced a click (a conversion), but not to target DuckDuckGo browser users based on behavior or identity.

DuckDuckGo's spokesperson pointed to Weinberg's attempt to address the controversy on Reddit and argued that DuckDuckGo provides very strong privacy protections. "This is talking about link tracking which no major browser protects against (see https://privacytests.org/), however we've started protecting against link tracking, and started with the primary offenders (Google and Facebook)," DuckDuckGo's spokesperson said. "To note, we are planning on expanding this to more companies, including Twitter, Microsoft, and more. We are not restricted from this and will be doing so."

Over the past year, large-scale robberies have swept through stores like Louis Vuitton in San Francisco's Union Square and a nearby Nordstrom, which was robbed by 80 people. Law enforcement and retailers have warned the public that this isn't traditional shoplifting. Rather, what they're seeing is theft organized by criminal networks. And there's a reason it's on the rise. From a report: "What fuels this as an enterprise is the ease of reselling stolen merchandise on online marketplaces," said Illinois Attorney General Kwame Raoul, who convened a national task force of state attorneys to make it easier to investigate across state lines. "It's no longer the age where it's done at flea markets or in the alley or in parking lots." Retailers say a total of $68.9 billion of products were stolen in 2019. In 2020, three-quarters said they saw an increase in organized crime and more than half reported cargo theft. Some big chains blame organized theft for recent store closures or for their decisions to limit hours.

For the U.S. Government's Homeland Security Investigations unit, organized retail crime probes are on the rise. Arrests and indictments increased last year from 2020, along with the value of stolen goods that was seized. While data is imprecise about the perpetrators, there's growing consensus that an entirely different group should be held accountable: e-commerce sites. Amazon, eBay and Facebook are the places where these stolen goods are being sold, and critics say they're not doing enough to put an end to the racket. The companies disagree.

The U.K. government has published its final response to a data 'reform' consultation it kicked off last year, laying out how it intends to diverge from EU-based data protection rules. From a report: At first pass, it looks like it has stepped away from some of the more extreme 'reforms' it had been tossing around -- such as removing the right for human review of automated/AI decisions; which the consultation admits was opposed by the "vast majority" of respondents (ergo, the government writes that it "recognises the importance of appropriate safeguards, and will not pursue this proposal"; although it says it's still considering how to amend Article 22 of the U.K. GDPR -- so watch that space).

That said, there are still a lot of potentially wide-ranging amendments being announced in this package -- such as a switch to an opt-out model for most online tracking; which the government is spinning as an end to cookie consent pop-ups but which raises plenty of wider questions -- and changes to the U.K.'s data protection regulator that could still sum to substantial differences for the rights of citizens, businesses and other types of data processors operating in the country. There's plenty more incoming from the U.K. government on the digital policy front too -- such as the sprawling Online Safety Bill, which is currently making its way through parliament, and is set to dramatically ramp up compliance demands for all sorts of businesses. So it pays to keep the wider picture in mind as the government spins its pitch of post-Brexit, rebooted data laws that will give British business a "boost" by cutting EU 'red tape.'

Speaking of TikTok moving US users' data to Oracle, a new report says that ByteDance staff in China accessed US TikTok users' data between September 2021 and January 2022. From the report: For years, TikTok has responded to data privacy concerns by promising that information gathered about users in the United States is stored in the United States, rather than China, where ByteDance, the video platform's parent company, is located. But according to leaked audio from more than 80 internal TikTok meetings, China-based employees of ByteDance have repeatedly accessed nonpublic data about US TikTok users -- exactly the type of behavior that inspired former president Donald Trump to threaten to ban the app in the United States.

The recordings, which were reviewed by BuzzFeed News, contain 14 statements from nine different TikTok employees indicating that engineers in China had access to US data between September 2021 and January 2022, at the very least. Despite a TikTok executive's sworn testimony in an October 2021 Senate hearing that a "world-renowned, US-based security team" decides who gets access to this data, nine statements by eight different employees describe situations where US employees had to turn to their colleagues in China to determine how US user data was flowing. US staff did not have permission or knowledge of how to access the data on their own, according to the tapes.

"Everything is seen in China," said a member of TikTok's Trust and Safety department in a September 2021 meeting. In another September meeting, a director referred to one Beijing-based engineer as a "Master Admin" who "has access to everything." (While many employees introduced themselves by name and title in the recordings, BuzzFeed News is not naming anyone to protect their privacy.) The recordings range from small-group meetings with company leaders and consultants to policy all-hands presentations and are corroborated by screenshots and other documents, providing a vast amount of evidence to corroborate prior reports of China-based employees accessing US user data.