An anonymous reader quotes a report from Reuters: The European Union's top court ruled on Tuesday that national authorities cannot retain phone data in a "general and indiscriminate" manner, but could use specific information to tackle some very serious crime. The court ruled on a case brought by the Supreme Court in Ireland where a man sentenced in 2015 to life imprisonment for murder appealed, saying the court of first instance had wrongly admitted traffic and location data of telephone calls as evidence.

The Luxembourg-based Court of Justice of the EU (ECJ) on Tuesday said it was up to a national court there to decide whether the evidence was allowed. But it also said the bloc's members cannot have laws in place that would allow crime prevention through the "general and indiscriminate" retention of such data. Some circumstances, such as particularly serious crime regarded as a threat to national security, could justify data retention but only in a narrower scope or for a limited time.

German authorities shut down the server infrastructure for the Russian darknet marketplace Hydra, seizing ~$25.2 million worth of Bitcoin in the process, Germany's Federal Crime Police Office (BKA) announced on Tuesday. From a report: Hydra is a large marketplace on the dark web that serves as a hub for drugs, stolen credit card information, counterfeit bills, fake documents, and other illegal goods or services. The market primarily caters to criminals in Russia and surrounding nations. "Treasuremen," or dealers connected with the site, push drugs throughout the region by hiding them in geo-tagged pickup locations. With the shutdown of the German-based server, authorities are now launching an investigation into the "unknown operators and administrators" of Hydra, whom they suspect of selling narcotics and engaging in money laundering. German authorities say they have been investigating the marketplace with the help of the US since August 2021. The BKA told The Verge that no arrests have been made as of yet.

An anonymous reader quotes a report from NPR: Book banning is not new -- in the U.S. alone the practice goes back to Puritan times, when Thomas Morton's book New English Caanan and others opposing this way of life were tossed from Massachusetts. But the American Library Association said Monday that this year there have been more challenges to books than they have seen since they started tracking it in 2000.

The ALA's Office for Intellectual Freedom counted 729 challenges to library, school, and university materials in 2021. It's a significant jump: Last year the group noted 156 challenges -- and in 2019, there were 377. Although the 2020 number was impacted by the pandemic, which forced schools and libraries to shut down, the ALA said they don't usually get more than 500 book challenges in any given year. And sometimes, those challenges contain more than one book title. The number of individual books challenged in 2021 totaled 1,597. In a press release, ALA President Patricia Wong said: "We support individual parents' choices concerning their child's reading and believe that parents should not have those choices dictated by others. Young people need to have access to a variety of books from which they can learn about different perspectives."

The organization is launching a nationwide initiative meant to empower readers to fight censorship.

A letter from the National Archives and Records Administration hints at growing unease with government officials' use of some encrypted messaging apps. NBC News: In October, Laurence Brewer, the chief records officer of the National Archives and Records Administration, told officials at U.S. Customs and Border Protection he was worried about how the agency was using an app called Wickr. The Amazon-owned encrypted messaging platform is known for its ability to automatically delete messages. Brewer, who is responsible for ensuring that government officials handle records correctly, wrote in a letter that he was "concerned about agencywide deployment of a messaging application that has this functionality without appropriate policies and procedures governing its use." Brewer addressed his letter to Eric Hysen, the chief information officer of the Department of Homeland Security. It was uploaded to the National Archives website, and its concerns had not been previously reported. The document offers a rare insight into Customs and Border Protection's use of Wickr, and highlights the broader worries that some officials and watchdogs have about the growing use of messaging apps at all levels of the U.S. government.

Wickr was bought by Amazon's cloud-computing division last June and has contracts with a number of government agencies. Customs and Border Protection (CBP), which has been criticized by human rights activists and immigration lawyers over what they say are its secretive practices, has spent more than $1.6 million on Wickr since 2020, according to public procurement records. But little is known about how the agency has deployed the app, which is popular among security-minded people ranging from journalists to criminals. Its auto-deletion feature has made the platform a cause of concern among government record keepers, as well as external watchdogs, who worry that Wickr and other similar apps are creating ways for customs officials to sidestep government transparency requirements.

What happened after Russia blocked 80 million users of Instagram? Reuters reports: A black and white, melancholy alternative to Instagram that asks users to post sad pictures of themselves may launch in Russia this week, its creators said, to express sadness at the loss of popular services such as the U.S. photo sharing platform....

Although people can still sometimes access [Instagram] using a Virtual Private Network, domestic alternatives have started appearing, the latest being 'Grustnogram', or 'Sadgram' in English. "Post sad pictures of yourself, show this to your sad friends, be sad together," a message on the platform's website read.... "We are very sad that many high quality and popular services are stopping their work in Russia for various reasons," Afisha Daily quoted Alexander Tokarev, one of the service's founders as saying. "We created Grustnogram to grieve about this together and support each other."
Insider looks at the larger landscape now for Russia's social media apps: Rossgram joins a slate of Russian versions of major platforms that seek to mimic larger and more popular social media companies, resulting in a landscape of Russian knockoffs that often struggle to attract users while raising questions about how much access the Kremlin has to users' data.... Russia has been trying to coax internet users to turn to its own versions of popular sites, such as YouTube knockoff RuTube, for years. Authorities this year offered online creators the equivalent of $1,700 a month to move their content to RuTube, according to Coda Story, attempting to make up for its minuscule audience.

A 2021 report by the Levada Center, an independent polling organization, found that YouTube is used by 37% of Russians, Instagram by 34%, and TikTok by 16%. But some native platforms hold influence too. Out of Russia's 70 million active social media users, according to research by Linkfluence, a market research platform, 83% use a social media platform similar to Facebook called VKontakte, and 55% use another called OdnoKlassniki. According to Alyssa Demus, an associate international and defense researcher at Rand corporation, Russia has long been building up an ecosystem of alternative social media platforms. But people tend to be more skeptical and cautious when using them out of fear that the government is involved in their operations and users' information isn't secure.

"Either Russia has a hand in the building of the platform from this start, or they strong arm or co-opt whatever is popular later," Demus told Insider. "I know there's significant use of platforms like WhatsApp or others that are believed to be encrypted for that very reason — so that there can be open communication without the fear of reprisal." Russia has also enacted laws to exert influence on non-Russian social media platforms, including passing legislation stating companies need to place their servers for Russian accounts on Russian territory. "Presumably so they can then sort of meddle and do whatever kind of surveillance they need to," Demus said.
Demus adds at one point that "anything Russia touches has the potential to land you in jail."

But the article also notes that younger tech-savvy Russians are using VPNs to access sites blocked by the government — ultimately resulting in a kind of "generation gap" where they're less aligned with pro-government rhetoric from state-controlled media.

"Google is taking aim at Microsoft's dominance in government technology and security," reports NBC News: Jeanette Manfra, director of risk and compliance for Google's cloud services and a former top U.S. cybersecurity official, said Thursday that the government's reliance on Microsoft — one of Google's top business rivals — is an ongoing security threat.

Manfra also said in a blog post published Thursday that a survey commissioned by Google found that a majority of federal employees believe that the government's reliance on Microsoft products is a cybersecurity vulnerability. "Overreliance on any single vendor is usually not a great idea," Manfra said in a phone interview. "You have an attack on one product that the majority of the government is depending on to do their job, you have a significant risk in how the government can continue to function."

Microsoft pushed back strongly against the claim, calling it "unhelpful." The study comes as Google is positioning itself to challenge Microsoft's dominance in federal government offices, where Windows and Office programs are commonly used....

The blog post comes as hackers continue to discover critical software vulnerabilities at an increasing pace across major tech products, but especially in Microsoft programs. Last year, researchers discovered 21 "zero-days" — an industry term for a critical vulnerability that a company doesn't have a ready solution for — actively in use against Microsoft products, compared to 16 against Google and 12 against Apple. he most prominent zero-day was used against Microsoft's Exchange email program, which cybersecurity experts say was first employed by Chinese cyberspies and then quickly adopted by criminal hackers, leading to hundreds of companies becoming compromised.

This week the New York Times published an opinion piece by three-time Pulitzer Prize winner Thomas L. Friedman arguing that greener energy is the best response to Russia's invasion of Ukraine.

Friedman starts by decrying America's "umpteenth confrontation with a petro-dictator whose viciousness and recklessness are possible only because of the oil wealth he extracts from the ground. "No matter how the war ends in Ukraine, it needs to end with America finally, formally, categorically and irreversibly ending its addiction to oil." Nothing has distorted our foreign policy, our commitments to human rights, our national security and, most of all, our environment than our oil addiction. Let this be the last war in which we and our allies fund both sides.... As long as we're addicted to oil, we are always going to be begging someone, usually a bad guy, to move the price up or down, because we alone are not masters of our own fate. This has got to stop...
Friedman notes that global oil prices collapsing between 1988 and 1992 "helped bankrupt the Soviet Union and hasten its collapse.... We can create the same effects today by overproducing renewables and overemphasizing energy efficiency."

Among his suggestions are requiring power companies to transition faster to renewable energy sources — as well as "eliminating the regulatory red tape around installing rooftop solar systems."

And he's also got a solution for the spike in fuel prices: If you want to lower gasoline prices today, the most surefire, climate-safe method would be to reduce the speed limit on highways to 60 miles per hour and ask every company in America that can do so to let its employees work at home and not commute every day. Those two things would immediately cut demand for gasoline and bring down the price.

Is that too much to ask to win the war against petro-dictators like Putin — a victory in which the byproduct is cleaner air, not burning tanks?

U.S. president Joe Biden "will invoke the Defense Production Act to encourage domestic production of minerals required to make batteries for electric vehicles and long-term energy storage," reports CNBC.

"It will also help the U.S. minimize dependence on foreign supply chains." The president's order could help companies receive government funding for feasibility studies on projects that extract materials, including lithium, nickel, cobalt, graphite and manganese, for EV production.

The Defense Production Act, established by President Harry Truman during the Cold War, allows the president to use emergency authority to prioritize the development of specific materials for national production.... The administration also said it's reviewing further uses of the law to "secure safer, cleaner, and more resilient energy for America."

The transportation sector is one of the largest contributors to U.S. greenhouse gas emissions, representing about one-third of emissions every year. The transition away from gas vehicles to EVs is considered critical to combating human-caused climate change....

The administration in February unveiled a plan to allocate $5 billion to states to fund EV chargers over five years as part of the bipartisan infrastructure package.
The White House said in a statement the move would reduce America's reliance on China and other countries "for the minerals and materials that will power our clean energy future."

In March of 2021 the Krebs on Security blog reported that Ubiquiti, "a major vendor of cloud-enabled Internet of Things devices," had disclosed a breach exposing customer account credentials. But Krebs added that a company source "alleges" that Ubiquiti was downplaying the severity of the incident — which is not true, says Ubiquiti.

Krebs' original post now includes an update — putting the word "breach" in quotation marks, and noting that actually a former Ubiquiti developer had been indicted for the incident...and also for trying to extort the company. It was that extortionist, Ubiquiti says, who'd "alleged" they were downplaying the incident (which the extortionist had actually caused themselves).

Ubiquiti is now suing Krebs, "alleging that he falsely accused the company of 'covering up' a cyberattack," ITWire reports: In its complaint, Ubiquiti said contrary to what Krebs had reported, the company had promptly notified its clients about the attack and instructed them to take additional security precautions to protect their information. "Ubiquiti then notified the public in the next filing it made with the SEC. But Krebs intentionally disregarded these facts to target Ubiquiti and increase ad revenue by driving traffic to his website, www.KrebsOnSecurity.com," the complaint alleged.

It said there was no evidence to support Krebs' claims and only one source, [the indicted former employee] Nickolas Sharp....

According to the indictment issued by the Department of Justice against Sharp in December 2021, after publication of the articles in question on 30 and 31 March, Ubiquiti's stock price fell by about 20% and the company lost more than US$4 billion (A$5.32 billion) in market capitalisation.... The complaint alleged Krebs had intentionally misrepresented the truth because he had a financial incentive to do so, adding, "His entire business model is premised on publishing stories that conform to this narrative...."

"Through its investigation, Ubiquiti learned that Sharp had used his administrative access codes (which Ubiquiti provided to him as part of his employment) to download gigabytes of data. Sharp used a Virtual Private Network (VPN) to mask his online activity, and he also altered log retention policies and related files to conceal his wrongful actions," the complaint alleged. "Ubiquiti shared this information with federal authorities and the company assisted the FBI's investigation into Sharp's blackmail attempt. The federal investigation culminated with the FBI executing a search warrant on Sharp's home on 24 March 2021." The complaint then went into detail about how Sharp contacted Krebs and how the story came to be published.

Krebs was accused of two counts of defamation, with Ubiquiti seeking a jury trial and asking for a judgment against him that awarded compensatory damages of more than US$75,000, punitive damages of US$350,000, all expenses and costs including lawyers' fees and any further relief deemed appropriate by the court.
Krebs' follow-up post in December had included more details: Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp's Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads...

Several days after the FBI executed its search warrant, Sharp "caused false or misleading news stories to be published about the incident," prosecutors say. Among the claims made in those news stories was that Ubiquiti had neglected to keep access logs that would allow the company to understand the full scope of the intrusion. In reality, the indictment alleges, Sharp had shortened to one day the amount of time Ubiquiti's systems kept certain logs of user activity in AWS.
Thanks to Slashdot reader juul_advocate for sharing the story...

"According to The Verge, health providers writing Google reviews about patients with identifiable information is a HIPAA violation," writes Slashdot reader August Oleman. From the report: In the past few years, the phrase 'HIPAA violation' has been thrown around a lot, often incorrectly. People have cited the law, which protects patient health information, as a reason they can't be asked if they're vaccinated or get a doctor's note for an employer. But asking someone if they're vaccinated isn't actually a HIPAA violation. That's a fine and not-illegal thing for one non-doctor to ask another non-doctor. What is a HIPAA violation is what U. Phillip Igbinadolor, a dentist in North Carolina, did in September 2015, according to the Department of Health and Human Services. After a patient left an anonymous, negative Google review, he logged on and responded with his own post on the Google page, saying that the patient missed scheduled appointments. [...]

In the post, he used the patient's full name and described, in detail, the specific dental problem he was in for: "excruciating pain" from the lower left quadrant, which resulted in a referral for a root canal. That's what a HIPAA violation actually looks like. The law says that healthcare providers and insurance companies can't share identifiable, personal information without a patient's consent. In this case, the dentist (a healthcare provider) publicly shared a patient's name, medical condition, and medical history (personal information). As a result, the office was fined $50,000 (PDF).

A controversial facial recognition company that's built a massive photographic dossier of the world's people for use by police, national governments and -- most recently -- the Ukrainian military is now planning to offer its technology to banks and other private businesses. The Washington Post reports: Clearview AI co-founder and CEO Hoan Ton-That disclosed the plans Friday to The Associated Press in order to clarify a recent federal court filing that suggested the company was up for sale. "We don't have any plans to sell the company," he said. Instead, he said the New York startup is looking to launch a new business venture to compete with the likes of Amazon and Microsoft in verifying people's identity using facial recognition.

The new "consent-based" product would use Clearview's algorithms to verify a person's face, but would not involve its ever-growing trove of some 20 billion images, which Ton-That said is reserved for law enforcement use. Such ID checks that can be used to validate bank transactions or for other commercial purposes are the "least controversial use case" of facial recognition, he said. That's in contrast to the business practice for which Clearview is best known: collecting a huge trove of images posted on Facebook, YouTube and just about anywhere else on the publicly-accessible internet.

A Twitter user from the UK named Joseph Kelly has been sentenced to 150 hours of community service for posting a "grossly offensive" tweet about Captain Sir Tom Moore, a British Army officer who raised money for the NHS during the pandemic. The Verge reports: Moore became a national figure in the UK after walking 100 laps around his garden before his 100th birthday. He was later knighted by the Queen. The day after his death, Kelly, 36, tweeted "the only good Brit soldier is a deed one, burn auld fella buuuuurn." Kelly was found guilty in February last year and faced possible jail time. His case brought attention to an often-criticized piece of UK legislation that allows social media users to be prosecuted for sending "grossly offensive" messages.

As reported by The National, Kelly was sentenced on Wednesday. His defense argued that Kelly had few followers on Twitter at the time; that he had been drinking before writing the post; and that he deleted the tweet just 20 minutes after sending it. "He accepts he was wrong. He did not anticipate what would happen. He took steps almost immediately to delete the tweet but the genie was out of the bottle by then," said Kelly's defence agent Tony Callahan. "His level of criminality was a drunken post, at a time when he was struggling emotionally, which he regretted and almost instantly removed." Kelly was sentenced to 18 months of supervision and 150 hours of unpaid work in the form of a Scottish Community Payback Order (CPO).

slack_justyb writes: After the failure of the Chrome user-tracking system that was called FLoC, Google's latest try at topic tracking to replace the 3rd party cookie (that Chrome is the only browser to still support) is FLEDGE and the most recent drop of Canary has this on full display for users and privacy advocates to dive deeper into. This recent release shows Google's hand that it views user tracking as a mandatory part of internet usage, especially given this system's eye-rolling name of "Privacy Sandbox" and the tightness in the coupling of this new API to the browser directly.

The new API will allow the browser itself to build what it believes to be things that you are interested in, based on broad topics that Google creates. New topics and methods for how you are placed into those topics will be added to the browser's database and indexing software via updates from Google. The main point to take away here though is that the topic database is built using your CPU's time. At this time, opting out of the browser building this interest database is possible thus saving you a few cycles from being used for that purpose. In the future there may not be a way to stop the browser from using cycles to build the database; the only means may be to just constantly remove all interest from your personal database. At this time there doesn't seem to be any way to completely turn off the underlying API. A website that expects this API will always succeed in "some sort of response" so long as you are using Chrome. The response may be that you are interested in nothing, but a response none-the-less. Of course, sending a response of "interested in nothing" would more than likely require someone constantly, and timely, clearing out the interest database, especially if at some later time the option to turn off the building of the database is removed.

With 82% of Google's empire based on ad revenue, this latest development in Chrome shows that Google is not keen on any moves to threaten their main money maker. Google continues to argue that it is mandatory that it builds a user tracking and advertising system into Chrome, and the company says it won't block third-party cookies until it accomplishes that -- no matter what the final solution may ultimately be. The upshot, if it can be called that, of the FLEDGE API over FLoC, is that abuse of FLEDGE looks to yield less valuable results. And attempting to use the API alone to pick out an individual user via fingerprinting or other methods employed elsewhere seems to be rather difficult to do. But only time will tell if that remains true or just Google idealizing this new API. As for the current timeline, here's what the company had to say in the latest Chromium Blog post: "Starting today, developers can begin testing globally the Topics, FLEDGE, and Attribution Reporting APIs in the Canary version of Chrome. We'll progress to a limited number of Chrome Beta users as soon as possible. Once things are working smoothly in Beta, we'll make API testing available in the stable version of Chrome to expand testing to more Chrome users."

Blocking access to internet resources requires lots of hardware but due to sanctions, there are fears in Russia that a breakdown in systems operations may be just months away. Andy Maxwell, reporting for TorrentFreak: Russia's invasion of Ukraine has been going on for more than a month. It isn't going to plan. In parallel with the terrible images being shared around the world, Russia is using its infamous site-blocking systems to deny access to websites that dare to challenge the Kremlin's narrative of Putin's 'Special Operation.' Telecoms regulator Roscomnadzor is working harder than ever to maintain its blockades against everything from Google News, Twitter, Facebook, and Instagram, to the thousands of pirate sites and other resources on the country's blacklists. But, like the invasion itself, things aren't going to plan here either.

A little over a week ago, local telecoms operators supplying internet access to Russian citizens were ordered to carry out "urgent checks" on their ability to continue blocking sites deemed illegal by the state. ISPs were required to carry out an audit and liaise with telecoms regulator Roscomnadzor. Today is the reporting deadline but according to several sources, problems are apparent in the system. With accurate and critical reporting being all but strangled by the state, it is not absolutely clear who or what ordered the review but the consensus is that prescribed blocking standards aren't being met. As previously reported, local torrent site RuTracker suddenly found itself unblocked earlier this month, reportedly due to issues at an ISP. Problems are also reported with the Roscomnadzor-controlled 'TSPU' Deep Packet Inspection (DPI) system embedded into the networks of around 80 local ISPs and recently used to restrict Tor, VPNs and Twitter traffic.

The Biden administration is divided over whether to impose sanctions on Kaspersky Lab, a Russian cybersecurity giant that officials warn could be used by the Kremlin as a surveillance tool against its customers, The Wall Street Journal reported Thursday, citing people familiar with the matter. From the report: The White House's National Security Council has pressed the Treasury Department to ready the sanctions as part of the broad Western campaign to punish Russia for its invasion of Ukraine, according to officials familiar with the matter. While Treasury officials have been working to prepare the package, sanctions experts within the department have raised concerns over the size and scope of such a move. The company's software is used by hundreds of millions of customers across the world, making it difficult to enforce the sanctions. In addition, some officials in the U.S. and Europe fear sanctioning Kaspersky Lab will increase the likelihood of triggering a cyberattack against the West by Moscow, even potentially leveraging the software itself. It wasn't clear whether the sanctions would go forward, and one official said the idea had been put on hold for now. The debate reflects how agencies within the Biden administration are weighing in real time options to deliver more economic pain to the Russian economy in response to its invasion of Ukraine.

As the SEC signals that it wants more oversight of digital asset markets, the industry makes it clear it prefers to be supervised by the smaller CFTC. From a report: It was a classic Washington networking party. Sam Bankman-Fried, the co-founder and chief executive officer of FTX, one of the world's largest crypto trading platforms, held court on a February evening in a private room at the Park Hyatt hotel on the edge of Georgetown. Drinks flowed from an open bar, and hors d'oeuvres were served to the clutch of congressional aides, financial lobbyists, and former regulators. The goal of Bankman-Fried, a 30-year-old billionaire, was to showcase his new lobbying operation -- and to persuade influential Washingtonians that crypto needs more regulation. It may seem strange that a crypto magnate is seeking federal oversight. But as lawmakers and bureaucrats grapple with how to police a fast-growing and risky $2 trillion market, new rules seem inevitable. In March, President Joe Biden signed an executive order calling on federal agencies to work out policies on crypto. Bankman-Fried, whose company last year bought the naming rights to the Miami Heat's basketball arena, is pushing his own ideas of what regulation ought to look like, as well as who his main watchdog should be.

He's arguing for a bigger role for the U.S. Commodity Futures Trading Commission. The relatively small agency monitors futures contracts in basic goods such as crude oil, corn, and pork, as well as financial derivatives such as interest-rate swaps. It also oversees U.S. futures and options contracts on the popular cryptocurrencies Bitcoin and Ether. A U.S. affiliate of the Bahamas-based FTX offers such crypto derivatives, so part of its business is already under the CFTC's purview. Bankman-Fried wants Congress to expand the CFTC's authority to cover trading in the coins themselves. Currently, the CFTC only claims jurisdiction over cash token markets in cases of suspected fraud or manipulation that could affect the performance of crypto derivatives. In February testimony to the Senate, he said this lack of clarity is bad for investors and the industry. Other trading platforms are also starting to see the merits of being overseen primarily by the CFTC, say industry leaders who asked not to be named talking about private discussions.

An anonymous reader quotes a report from Ars Technica: With Russian gamers effectively cut off from purchases on most major gaming platforms due to corporate sanctions against the country, the Russian game developer behind indie darling Loop Hero is encouraging Russian customers to pirate the game. In a Sunday post on Russian social network VK (Google translated version), Loop Hero developer Four Quarters said, "In such difficult times, we can only help everyone to raise the pirate flag (together with vpn)" to get the game. The developer then included a link to a copy of Loop Hero on a popular Russian torrent tracker to aid in that process directly.

In a follow-up post the next day (Google translated version), Four Quarters insisted that "we didn't do anything special, there's nothing wrong with torrents." The company also notes that players wanting to offer the developer donations in lieu of buying the game should refrain. "The truth is that everything is fine with us, send this support to your family and friends at this difficult time," they wrote.

While players outside of Russia should still be able to purchase Loop Hero on Steam, Valve said earlier this month that banking issues prevented it from sending payments to developers in Russia, Belarus, and Ukraine (ironically enough). Valve recently told PC Gamer that developers in these countries will have to provide "intermediary banking information" in a foreign country to receive the payments they're due. "It's a very frustrating situation, and we hope to find the resolution soon," Valve wrote in a note to affected developers. Russia is reportedly considering legalizing software piracy to combat the sanctions imposed on the country for its invasion of Ukraine.

According to Bloomberg, Apple and Meta "provided customer data to hackers who masqueraded as law enforcement officials." Bloomberg's William Turton reports: Apple and Meta provided basic subscriber details, such as a customer's address, phone number and IP address, in mid-2021 in response to the forged "emergency data requests." Normally, such requests are only provided with a search warrant or subpoena signed by a judge, according to the people. However, the emergency requests don't require a court order. Snap Inc. received a forged legal request from the same hackers, but it isn't known whether the company provided data in response. It's also not clear how many times the companies provided data prompted by forged legal requests.

Cybersecurity researchers suspect that some of the hackers sending the forged requests are minors located in the U.K. and the U.S. [...] The fraudulent legal requests are part of a months-long campaign that targeted many technology companies and began as early as January 2021. The forged legal requests are believed to be sent via hacked email domains belonging to law enforcement agencies in multiple countries. The forged requests were made to appear legitimate. In some instances, the documents included the forged signatures of real or fictional law enforcement officers. By compromising law enforcement email systems, the hackers may have found legitimate legal requests and used them as a template to create forgeries. Further reading: Hackers Gaining Power of Subpoena Via Fake 'Emergency Data Requests'

School surveillance companies are not doing enough to determine whether their products unfairly target minority groups, according to a report released by U.S. Senators Elizabeth Warren and Ed Markey. From a report: Democratic senators sent questions to four of the most prominent companies that make education software monitoring students' online activity. The resulting report about their findings said that parents and schools are not fully informed about the extent and risks associated with the tracking software made by GoGuardian, Gaggle.Net, Bark Technologies and Securly. The report also said that because the products could increase students' contact with law enforcement, the software "may be exacerbating the school-to-prison pipeline."

Online education during the pandemic led to unprecedented levels of digital surveillance of children, as schools rushed to find ways to keep track of students, Bloomberg Businessweek reported in October. Private equity-backed GoGuardian, officially named Liminex, is one of the most popular makers of education surveillance tools. Its software helps teachers and administrators track what students are doing on school-issued devices, and sometimes personal devices when kids are logged into school accounts. The senators' report says none of the companies has assessed whether their algorithms are biased or track whether they over-target students of color or LGBTQ students. Each of the companies told the senators' offices that they do not study the effects of their products on specific populations due to privacy concerns.

An anonymous reader quotes a report from NPR: A nearly decade-long scheme to steal millions of dollars of computers and iPads from Yale University's School of Medicine is officially over. Former Yale administrator Jamie Petrone, 42, pleaded guilty Monday in federal court in Hartford, Conn., to two counts of wire fraud and a tax offense for her role in the plot. Petrone's ploy started as far back as 2013 and continued well into 2021 while she worked at the university, according to the U.S. Attorney's Office for the District of Connecticut. Until recently, her role was the director of finance and administration for the Department of Emergency Medicine at Yale. As part of this job, Petrone had the authority to make and authorize certain purchases for the department -- as long as the amount was below $10,000.

Starting in 2013, Petrone would order, or have a member of her staff order, computers and other electronics, which totaled to thousands of items over the years, from Yale vendors using the Yale School of Medicine's money. She would then arrange to ship the stolen hardware, whose costs amounted to millions of dollars, to a business in New York, in exchange for money once the electronics were resold. Investigators said Petrone would report on documents to the school that the equipment was for specific needs at the university, like medical studies that ultimately didn't exist. She would break up the fraudulent purchases into orders that were below $10,000 each so that she wouldn't need to get additional approval from school officials. Petrone would ship this equipment out herself to the third-party business that would resell the equipment. It would later pay Petrone by wiring funds into an account of Maziv Entertainment LLC, a company she created.

Petrone used the money to live the high life, buy real estate and travel, federal prosecutors say. She bought luxury cars as well. At the time of her guilty pleas, she was in possession of two Mercedes-Benz vehicles, two Cadillac Escalades, a Dodge Charger and a Range Rover. [...] At the time of her guilty plea, she agreed to forfeit the luxury vehicles as well as three homes in Connecticut. A property she owns in Georgia may also be seized. Petrone has also agreed to forfeit more than $560,000 that was seized from the Maziv Entertainment LLC bank account. Federal prosecutors say the loss to Yale totals approximately $40,504,200.