Federal investigators spent years hunting for clues in the 2016 hacking of the Bitfinex cryptocurrency exchange, when thieves stole bitcoin now worth $4.5 billion. In the end, what helped lead them to two suspects was something much more quotidian: a $500 Walmart gift card. From a report: That card and more than a dozen others like it, including for Uber, Hotels.com and PlayStation, were linked to emails and cloud service providers belonging to a young Manhattan couple, Ilya "Dutch" Lichtenstein and Heather R. Morgan, according to a criminal complaint. Authorities arrested the couple after seizing $3.6 billion worth of bitcoin allegedly in their control -- the Justice Department's largest financial seizure ever. New details have since emerged about the investigation, in particular how it took advantage of not only advanced forensic tools but also the growing push to rein in crypto crime, including by the industry itself. The discoveries would have been less likely to happen around the time of the hack, when bitcoin was far outside the mainstream of the financial world.

Senators Jim Risch, Bob Menendez, and Bill Cassidy's Accountability for Cryptocurrency in El Salvador (ACES) Act would require a State Department report on mitigating risks to the U.S. financial system from El Salvador's adoption of Bitcoin as legal tender. CoinDesk reports: "El Salvador recognizing Bitcoin (BTC) as official currency opens the door for money laundering cartels and undermines U.S. interests," said Bill Cassidy (R-La.). "If the United States wishes to combat money laundering and preserve the role of the dollar as a reserve currency of the world, we must tackle this issue head on." If passed, the bill would require the State Department to report on a laundry list of subjects with respect to El Salvador and Bitcoin, including the flow of remittances from the U.S. to El Salvador, bilateral and international efforts to combat transnational illicit activities, and the potential for reduced use by El Salvador of the greenback.

The move quickly drew a partly comic, partly angry response from El Salvador President Nayib Bukele: "OK boomers ... You have zero jurisdiction on a sovereign and independent nation. We are not your colony, your back yard or your front yard. Stay out of our internal affairs. Don't try to control something you can't control."

The Federal Communications Commission has voted to ban the exclusive revenue-sharing deals between landlords and Internet service providers that prevent broadband competition in apartment buildings and other multi-tenant environments. The new ban and other rule changes were adopted in a 4-0 vote announced yesterday. Ars Technica reports: Although the FCC "has long banned Internet service providers from entering into sweetheart deals with landlords that guarantee they are the only provider in the building," evidence submitted to the commission "made it clear that our existing rules are not doing enough and that we can do more to pry open the door for providers who want to offer competitive service in apartment buildings," FCC Chairwoman Jessica Rosenworcel said in her statement on the vote. The broadband industry has sidestepped rules that already exist with "a complex web of agreements between incumbent service providers and landlords that keep out competitors and undermine choice," she said.

With the new rules, "we ban exclusive revenue sharing agreements, where the provider agrees with the building that only it and no other provider can give the building owner a cut of the revenue from the building. We also ban graduated revenue sharing agreements, which increase the percentage of revenue that the broadband provider directs to the landlord as the number of tenants served by the provider go up," Rosenworcel said. Rosenworcel had circulated the proposal to commissioners in late January. The new prohibitions on graduated and exclusive revenue-sharing agreements apply retroactively. "The rules we adopt thus prohibit providers from (1) executing new graduated or exclusive revenue sharing agreements and (2) enforcing existing graduated or exclusive revenue sharing agreements on a going forward basis," the FCC said.

Exclusive marketing agreements are still allowed, but the FCC is requiring broadband providers to disclose those agreements to tenants. "Such disclosure must be included on all written marketing material directed at tenants or prospective tenants of an MTE [multiple tenant environment] subject to the arrangement and must explain in clear, conspicuous, legible, and visible language that the provider has the right to exclusively market its communications services to tenants in the MTE, that such a right does not suggest that the provider is the only entity that can provide communications services to tenants in the MTE, and that service from an alternative provider may be available," the FCC order said. The FCC vote also closes a loophole that ISPs used to enter into exclusive wiring deals with landlords. "We clarify that sale-and-leaseback arrangements violate our existing rules that regulate cable wiring inside buildings," Rosenworcel said. "Since the 1990s, we have had rules that allow buildings and tenants to exercise choice about how to use the wiring in the building when they are switching cable providers, but some companies have circumvented these rules by selling the wiring to the building and leasing it back on an exclusive basis. We put an end to that practice today."

FriendlySolipsist writes: After using the Otter.ai automated transcription service for a recorded interview with an Uyghur human rights activist, Politico journalist Phelim Kine received a disturbing survey from the company asking the purpose of the interview. This was cause for alarm, as the Chinese government is known to aggressively persecute members of the oppressed ethnic and religious minority. Had Chinese intelligence somehow gained access to the recording? Otter eventually provided assurance they do not share uploaded data except pursuant to a valid U.S. subpoena, but journalists need to consider the risk of compromise. Otter does not even allow two-factor authentication except for upper-tier business accounts. "The Freedom of the Press Foundation report recommends that users protect the integrity of data that they commit to transcription app cloud servers with strong passwords and choosing providers that offer two-factor authentication," says Kine. "And it advises users to download and then delete their audio transcripts -- cutting and pasting it to another platform such as Word or Google docs -- to remove them from company servers to reduce exposure risk. But those are individual stopgap solutions in the absence of what cybersecurity experts say is a much-needed federal data privacy law that covers all corporate use of consumer data."

"Until those laws change, journalists and others who rely on transcription apps need to carefully consider the potential dangers."

The Markup reports: When Kurt Wilson, a computer science student at the University of Central Florida, heard that his university was using a controversial online proctoring tool called Honorlock, he immediately wanted to learn more. The company, whose business has boomed during the pandemic, promises to ensure that remote students don't cheat on exams through AI-powered software used by students that "monitors each student's exam session and alerts a live, US-based test proctor if it detects any potential problems." The software can scan students' faces to verify their identity, track specific phrases that their computer microphone captures, and even promises to search for and remove test questions that leak online.

One feature from Honorlock especially piqued Wilson's interest. The company, according to its materials, provides a way to track cheating students through what Honorlock calls "seed sites" or others call "honeypots" -- fake websites that remotely tattle on students who visit them during exams. Wilson pored over a patent for the software to learn more, finding example sites listed. By looking for common code and the same test questions over the past year, Wilson eventually turned up about a dozen honeypots apparently linked to Honorlock, five of which are still operating.

[...] While several companies offer services that tap into students' webcams to track them, setting up fake sites to catch potential cheaters appears to be an innovation -- one that crosses an ethical line for some experts. Before, students searching online for answers may simply have turned up nothing, while now, a potentially incriminating website will be there to tempt them. Ceceilia Parnther, an associate professor at St. John's University who has studied remote proctoring, said the situation is ironic: Students "are being set up" through honeypots, she said, in an attempt to detect academic integrity violations, a practice that's itself ethically questionable.

Apple and Google face a potential class action lawsuit in the Netherlands over app store charges, after a foundation headed by Dutch entrepreneur Alexander Klopping began gathering claimants. Reuters reports: Klopping is a co-founder of Blendle, a digital platform that enables users to buy individual news articles, which he sold in 2020. He told Reuters his determination to pursue the tech giants grew out of his experience at Blendle. "The reason it's getting so much attention right now is that everyone feels in their gut that there's this imbalance of power when it comes to big tech companies." He said while developers have complained most about app store practices, costs are ultimately passed on to consumers.

Klopping's App Store Claims Foundation is being represented by law firm Hausfeld, with funding from Fortress Investment Group. Klopping's App Store Claims Foundation is being represented by law firm Hausfeld, with funding from Fortress Investment Group. Hausfeld lawyer Rob Okhuijsen said the next step will be submitting evidence to the Amsterdam District Court in April. If a judge agrees, the court would then begin weighing the merits of the complaint.

An anonymous reader quotes a report from Ars Technica: The San Francisco Police Department's crime lab has been checking DNA collected from sexual assault victims to determine whether any of the victims committed a crime, according to District Attorney Chesa Boudin, who called for an immediate end to the alleged practice. "The crime lab attempts to identify crime suspects by searching a database of DNA evidence that contains DNA collected from rape and sexual assault victims," Boudin's office said in a press release yesterday. Boudin's release denounced the alleged "practice of using rape and sexual assault victims' DNA to attempt to subsequently incriminate them."

"Boudin said his office was made aware of the purported practice last week, after a woman's DNA collected years ago as part of a rape exam was used to link her to a recent property crime," the San Francisco Chronicle reported yesterday. The woman "was recently arrested on suspicion of a felony property crime, with police identifying her based on the rape-kit evidence she gave as a victim, Boudin said." That was the only example provided, and Boudin gave few details about the case to protect the woman's privacy. But the database may include "thousands of victims' DNA profiles, with entries over 'many, many years,' Boudin said," according to the Chronicle. "We should encourage survivors to come forward -- not collect evidence to use against them in the future. This practice treats victims like evidence, not human beings. This is legally and ethically wrong," Boudin said.

San Francisco Police Chief Bill Scott said the department will investigate and that he is "committed to ending the practice" if Boudin's allegation is accurate. But Scott also said the suspect cited by Boudin may have been identified from a different DNA database. "We will immediately begin reviewing our DNA collection practices and policies... Although I am informed of the possibility that the suspect in this case may have been identified through a DNA hit in a non-victim DNA database, I think the questions raised by our district attorney today are sufficiently concerning that I have asked my assistant chief for operations to work with our Investigations Bureau to thoroughly review the matter and report back to me and to our DA's office partners," Scott said in a statement published by KRON 4. Scott also said, "I am informed that our existing DNA collection policies have been legally vetted and conform with state and national forensic standards," but he noted that "there are many important principles for which the San Francisco Police Department stands that go beyond state and national standards." "We must never create disincentives for crime victims to cooperate with police, and if it's true that DNA collected from a rape or sexual assault victim has been used by SFPD to identify and apprehend that person as a suspect in another crime, I'm committed to ending the practice," Scott said. Even though the alleged practice may already be illegal under California's Victims' Bill of Rights, State Senator Scott Wiener (D-San Francisco) and District 9 Supervisor Hillary Ronen are planning legislation to stop the alleged misuse of DNA.

Wiener said that "if survivors believe their DNA may end up being used against them in the future, they'll have one more reason not to participate in the rape kit process. That's why I'm working with the DA's office to address this problem through state legislation, if needed."

New Yorkers who live in areas where controversial stop-and-frisk searches happen most frequently are also more likely to be surveilled by facial recognition technology, according to research by Amnesty International and other researchers. From a report: Research also showed that in the Brooklyn, Bronx and Queens boroughs of the city there was a direct correlation between the proportion of non-white residents and the concentration of controversial facial recognition technology. "Our analysis shows that the NYPD's use of facial recognition technology helps to reinforce discriminatory policing against minority communities in New York City," said Matt Mahmoudi, artificial intelligence and human rights researcher at Amnesty International. The research is a part of the global anti-facial recognition technology campaign, Ban the Scan, investigating increasing use of surveillance initiatives in the New York police department (NYPD). Using thousands of digital volunteers through the Decode NYC Surveillance project, more than 25,500 CCTV cameras were mapped across New York City. Data scientists and researchers from Amnesty International compared the data on the camera placement with statistics on police stop-and-frisk. "We have long known that stop-and-frisk in New York is a racist policing tactic. We now know that the communities most targeted with stop-and-frisk are also at greater risk of discriminatory policing through invasive surveillance," said Mahmoudi.

NSO Group's controversial Pegasus spyware should be banned in the European Union, the bloc's in-house privacy watchdog warned on Tuesday. From a report: "The ban on the development and the deployment of spyware with the capability of Pegasus in the EU would be the most effective option to protect our fundamental rights and freedoms," the European Data Protection Supervisor said in a statement on Tuesday. The warning comes amid increasing scrutiny of abuses of surveillance technologies meant to help intelligence and law enforcement agencies fight serious crime and terrorism. While the EU regulator doesn't make decisions for member countries, its influence at the top echelons of the bloc's institutions may encourage other authorities to crack down on surveillance software.

Reuters reports: The White House is warning the chip industry to diversify its supply chain in case Russia retaliates against threatened U.S. export curbs by blocking access to key materials, people familiar with the matter said.

The potential for retaliation has garnered more attention in recent days after Techcet, a market research group, published a report on February 1 highlighting the reliance of many semiconductor manufacturers on Russian and Ukrainian-sourced materials like neon, palladium and others. According to Techcet estimates, over 90 percent of U.S. semiconductor-grade neon supplies come from Ukraine, while 35 percent of U.S. palladium is sourced from Russia. Peter Harrell, who sits of the White House's National Security Council, and his staff have been in touch with members of the chip industry in recent days, learning about their exposure to Russian and Ukrainian chipmaking materials and urging them to find alternative sources, the people said.
A "senior official" told Reuters, "We understand that other sources of key products are available and stand ready to work with our companies to help them identify and diversify their supplies."

Thanks to long-time Slashdot reader schwit1 for sharing the story.

What's the lesson after $3.6 billion in stolen bitcoin was seized by America's Justice Department from the couple who laundering it?

Wired argues it all just shows how hard it is to launder cryptocurrency: In the 24 hours since, the cybersecurity world has ruthlessly mocked their operational security screwups: Lichtenstein allegedly stored many of the private keys controlling those funds in a cloud-storage wallet that made them easy to seize, and Morgan flaunted her "self-made" wealth in a series of cringe-inducing rap videos on YouTube and Forbes columns. But those gaffes have obscured the remarkable number of multi-layered technical measures that prosecutors say the couple did use to try to dead-end the trail for anyone following their money.

Even more remarkable, perhaps, is that federal agents, led by IRS Criminal Investigations, managed to defeat those alleged attempts at financial anonymity on the way to recouping $3.6 billion of stolen cryptocurrency. In doing so, they demonstrated just how advanced cryptocurrency tracing has become — potentially even for coins once believed to be practically untraceable.

Ari Redbord, the head of legal and government affairs for TRM Labs, a cryptocurrency tracing and forensics firm...points to the couple's alleged use of "chain-hopping" — transferring funds from one cryptocurrency to another to make them more difficult to follow — including exchanging bitcoins for "privacy coins" like monero and dash, both designed to foil blockchain analysis. Court documents say the couple also allegedly moved their money through the Alphabay dark web market — the biggest of its kind at the time — in an attempt to stymie detectives....Lichtenstein and Morgan appear to have intended to use Alphabay as a "mixer" or "tumbler," a cryptocurrency service that takes in a user's coins and returns different ones to prevent blockchain tracing....

In July 2017, however — six months after the IRS says Lichtenstein moved a portion of the Bitfinex coins into AlphaBay wallets — the FBI, DEA, and Thai police arrested AlphaBay's administrator and seized its server in a data center in Lithuania. That server seizure isn't mentioned in the IRS's statement of facts. But the data on that server likely would have allowed investigators to reconstruct the movement of funds through AlphaBay's wallets and identify Lichtenstein's withdrawals to pick up their trail again, says Tom Robinson, a cofounder of the cryptocurrency tracing firm Elliptic.
The arrests and "largest financial seizure ever show that cryptocurrency is not a safe haven for criminals..." Deputy Attorney General Lisa O. Monaco said in a press release. "Thanks to the meticulous work of law enforcement, the department once again showed how it can and will follow the money, no matter what form it takes."

Or, as Wired puts it, "Even if your rap videos and sloppy cloud storage accounts don't get you caught, your clever laundering tricks may still not save you from the ever-evolving sophistication of law enforcement's crypto-tracers."

Remember when more than 100,000 Social Security numbers of Missouri teachers were revealed in the HTML code of a state web site? The St. Louis Post-Dispatch's reporter informed the state government and delayed publishings his findings until they'd fixed the hole — but the state's governor then demanded the reporter's prosecution, labelling him "a hacker." In the months that followed, throughout a probe — which for some reason was run by the state's Highway Patrol — the governor had continued to suggest that prosecution of that reporter was imminent.

But it's not. The St. Louis Post-Dispatch reports: A St. Louis Post-Dispatch journalist will not be charged after pointing out a weakness in a state computer database, the prosecuting attorney for Cole County said Friday. Prosecutor Locke Thompson issued a statement to television station KRCG Friday, saying he appreciated Gov. Mike Parson for forwarding his concerns but would not be filing charges....

Parson, who had suggested prosecution was imminent throughout the probe, issued a statement saying Thompson's office believed the decision "was properly addressed...." Post-Dispatch Publisher Ian Caso said in a statement Friday: "We are pleased the prosecutor recognized there was no legitimate basis for any charges against the St. Louis Post-Dispatch or our reporter. While an investigation of how the state allowed this information to be accessible was appropriate, the accusations against our reporter were unfounded and made to deflect embarrassment for the state's failures and for political purposes...."

There is no authorization required to examine public websites, but some researchers say overly broad hacking laws in many jurisdictions let embarrassed institutions lob hacking allegations against good Samaritans who try to flag vulnerabilities before they're exploited....

A political action committee supporting Parson ran an ad attacking the newspaper over the computer incident, saying the governor was "standing up to the fake news media."
Thanks to long-time Slashdot reader UnknowingFool for submitting the story.

"Apple said Thursday it plans to add more safeguards to AirTags to cut down on unwanted tracking," reports CNN, "following reports that the devices have been used to stalk people and steal cars." In a blog post, Apple said it has worked with safety groups and law enforcement agencies to identify more ways to update its AirTag safety warnings, including alerting people sooner if the small Bluetooth tracker is suspected to be tracking someone. (Right now, it can take hours for an AirTag to chirp if it has been separated from its owner.)

Other updates coming later this year include tweaking the tracker's tone sequence so the device is louder and easier to find, and allowing someone to see its distance and direction of an AirTag through the iOS precision finding tool. In addition, Apple will warn AirTag users during the setup process that tracking people without their consent is a crime.
That warning also reminds users "that law enforcement can request identifying information about the owner of the AirTag," Apple writes in their blog post: We have been actively working with law enforcement on all AirTag-related requests we've received. Based on our knowledge and on discussions with law enforcement, incidents of AirTag misuse are rare; however, each instance is one too many. Every AirTag has a unique serial number, and paired AirTags are associated with an Apple ID. Apple can provide the paired account details in response to a subpoena or valid request from law enforcement. We have successfully partnered with them on cases where information we provided has been used to trace an AirTag back to the perpetrator, who was then apprehended and charged.
"We condemn in the strongest possible terms any malicious use of our products," Apple's blog post adds.

Daring Fireball supplies some analysis: The same features that help prevent AirTags from being used to stalk people without their knowing could also alert a thief that whatever it is they've stolen has an AirTag attached. There's no way for AirTags to serve both purposes, so Apple is increasing the protections against unwanted tracking, and emphasizing that AirTags are solely intended for finding your own lost items.

A "shadowy hacker group" named Modified Elephant has been targeting people throughout India "for at least a decade," reports Gizmodo, "sometimes using its digital powers to plant fabricated evidence of criminal activity on their devices. That phony evidence has, in turn, often provided a pretext for the victims' arrest."

They cite a new report from cybersecurity firm Sentinel One "illuminating the way in which its digital dirty tricks have been used to surveil and target "human rights activists, human rights defenders, academics, and lawyers" throughout India. The most prominent case involving Elephant centers around Maoist activist Rona Wilson and a group of his associates who, in 2018, were arrested by India security services and accused of plotting to overthrow the government. Evidence for the supposed plot — including a word document detailing plans to assassinate the nation's prime minister, Narendra Modi — was found on the Wilson's laptop. However, later forensic analysis of the device showed that the documents were actually fake and had been artificially planted using malware. According to Sentinel researchers, it was Elephant that put them there.

This case, which gained greater exposure after being covered by the Washington Post, was blown open after the aforementioned laptop was analyzed by a digital forensics firm, Boston-based Arsenal Consulting. Arsenal ultimately concluded that Wilson and all of his so-called co-conspirators, as well as many other activists, had been targeted with digital manipulation....

According to the Sentinel One's report, Elephant uses common hacking tools and techniques to gain a foothold in victims' computers. Phishing emails, typically tailored to the victim's interests, are loaded with malicious documents that contain commercially available remote access tools (RATs) — easy-to-use programs available on the dark web that can hijack computers....

An entirely different group is believed to have conducted similar operations against Baris Pehlivan, a journalist in Turkey who was incarcerated for 19 months in 2016 after the Turkish government accused him of terrorism. Digital forensics later revealed that the documents used to justify Pehlivan's charges had been artificially implanted, much like those on Wilson's laptop.

A U.S. district judge "sentenced a Nintendo Switch hacker to 40 months in federal prison," reports the Independent: Gary Bowser, 52, is one of the leaders of the "Team Xecuter" hacker criminal enterprise, a notorious video game piracy gang, authorities said. The gang sold software to hack and download stolen games to various consoles. Besides the Nintendo Switch console, Team Xecuter also targeted the Nintendo 3DS, the Nintendo Entertainment System Classic Edition, the Sony PlayStation Classic and Microsoft's Xbox.

Bowser, a Canadian citizen, was the public face of the group and handled Team Xecuter's public relations and operated its websites. He was arrested in October 2020 in the Dominican Republic and extradited to the US to stand trial in New Jersey. He pleaded guilty in October 2021 to two criminal counts — conspiracy to circumvent technological measures and to traffic in circumvention devices, and trafficking in circumvention devices. As part of his plea deal, Bowser agreed to pay $4.5m in restitution to Nintendo.

Federal agents said that he caused a loss of about $65m (about £48m) to gaming companies.
"The hacking group was initially adamant that its hardware and software modifications that circumvented copyright protections were intended for homebrew application development, not to enable users to steal software..." notes Hot Hardware.

"Following the guilty plea, Bowser settled a civil lawsuit with Nintendo to the tune of $10 million, on top of the $4.5 million in restitution he already owed."

America's Internal Revenue service abandoned plans to make face-scanning mandatory for access to your tax records.

Unfortunately, before this change of heart the IRS had already directed 7 million Americans to facial recognition vendor ID.me, reports the Washington Post. Now the chair of the House Oversight Committee is urging IRS Commissioner Charles Rettig to instruct ID.me to destroy the biometric data and ensure the data isn't used for "unapproved or unauthorized purposes." "Those Americans' highly personal information may continue to be held by a third party outside of the IRS's direct control — increasing the potential for exposure due to bad actors and other cybersecurity incidents," [head of the committee] . Maloney wrote.... ID.me said on Wednesday that it would drop the facial recognition requirement in its software, which is used by 30 states and 10 federal agencies. The company also told The Washington Post that effective March 1, anyone would be able to delete their selfie or photo data....

The letter follows years of controversy over the government's expanding use of facial recognition software, despite warnings from the General Services Administration that the face-scanning technology has too many problems to justify its use.... There is no federal law regulating how facial recognition can be used or how it should be secured....

Maloney also writes that 13 percent of ID.me users since June had struggled to use the software and were referred to customer service, where representatives would attempt to verify their identities over video chat. The letter says this underscores the "widespread issues related to the use of the nascent facial recognition technology."
In fact, the Verge reports that "Internal documents and former ID.me employees say the company was beset by disorganization and staffing shortages throughout 2021, as shortcomings in the automated systems created tensions among the company's workforce, particularly the human verification workers who have to step in when the algorithms fail." Current and former employees who spoke to The Verge paint a picture of a company described as being in "permanent crisis mode," changing policies rapidly to keep up with fluctuating demand for its services and fight a slew of negative press. In particular, they say a lack of human review capacity has been a chokepoint for the company, leading to stress, pressure, and a failure to meet quality standards. It's an unexpected challenge for a biometrics system that's usually seen as automatic, pointing to the often-ignored workers needed to support automated systems at scale.

When the automated systems fail — ID.me says roughly 10 percent of users will need video chat assistance — it's workers and subjects who are left to manage the consequences.... To keep up with demand, the company added 1,300 new employees between January and September 2021, including 500 to be based in a new office in Tampa, Florida, dedicated to customer support. But as adoption increased, so did complaints. A Vice report found dozens of complaints from applicants who said they had been locked out of unemployment benefits when ID.me's verification service had failed to identify them. When the automated system failed, applicants often faced long wait times to reach human reviewers, according to the report — wait times that became even more burdensome and difficult to navigate for people without access to reliable internet connections....

Many staff were unhappy about the end of work-from-home policies, which were being phased out at the company at the same time as first the delta and then omicron variants hit the US. As in-office staffing levels rose, more ID.me employees began to contract COVID at work, sources said, in some cases taking whole teams offline at once.
One Id.me employee complained to the Verge that "In terms of worker treatment, it's like the Amazon of identity protection."

The article also notes that an ID.me video chat agent was terminated after engaging in "inappropriate conduct," and while the company added new procedures to prevent this, "sources said that these quality checks have begun to fall by the wayside under the pressure of clearing through the backlog of video verification requests."

Popular video conferencing platform Zoom this week released an important update to its macOS app following user reports about the microphone not being disabled after ending a conference. Luckily, according to the company, this was just a bug that has now been fixed. 9to5Mac reports: Since December last year, a number of users have been complaining about this bug in the Zoom Community (via The Register). According to them, the Mac's microphone stayed active even after ending a Zoom conference -- which certainly raised privacy concerns.

Zoom has confirmed that there was a bug in its macOS app that could cause the orange microphone-in-use indicator to appear even after leaving a call. According to a company representative, the latest version of the app no longer has this problem: "We experienced a bug relating to the Zoom client for macOS, which could show the orange indicator light continue to appear after having left a meeting, call, or webinar. This bug was addressed in the Zoom client for macOS version 5.9.3 and we recommend you update to version 5.9.3 to apply the fix."

An anonymous reader quotes a report from the New York Times, written by journalist Kashmir Hill: In mid-January, my husband and I were having an argument. Our 1-year-old had just tested positive for Covid-19 and was occasionally grunting between breaths. I called urgent care and was told we should take her to the emergency room. But, because I had been up all night with her, I was too exhausted to drive. "I'm worried," I told my husband. "I want you to take her to the hospital." "Doctors always tell us to take the baby to the E.R. whenever we call about anything," he replied, exasperated. (This was true.) "She is fine. She is eating and playing and happy. This is not an emergency." He eventually caved and set out for the hospital a half-hour away. Knowing he was already annoyed by me, I did not want to pepper him with questions about how it was going. Instead, I turned to the location-monitoring devices that I had secretly stashed in our car a week earlier.

I put a quarter-sized Apple AirTag in a seat pocket; a flat, credit card-shaped Bluetooth tracker made by Tile in a dashboard pocket; and a hockey-puck-like GPS tracker from a company called LandAirSea in the glove compartment. I realize I sound like the worst wife ever, so let me explain. It was for journalism. [...] I shared the feed from the LandAirSea GPS tracker with the photographer Todd Heisler so he could follow my husband around New York City. When my colleague and I reported on this, experts we spoke with were of two minds about Apple's attempts to prevent nefarious use, with some saying the alerts were inadequate and others praising the company for unearthing a larger problem: widespread surreptitious tracking, usually done with devices that don't notify a person of their presence. I decided to examine both claims by planting three AirTags, three Tiles, and a GPS tracker on my husband and his belongings to see how precisely they revealed his movements and which ones he discovered. [...]

Thirty minutes after my husband and youngest departed for the hospital, I opened an app linked to the most precise tracker in my arsenal, the $30 LandAirSea device. To activate it costs extra, because it needs a cellular plan to relay where global positioning satellites have placed it. I chose the cheapest plan, $19.95 monthly, to get location updates every three minutes; the most expensive plan, for updates every three seconds, was $49.95. The app has an "InstaFence" feature that can alert me when the car moves, and a "Playback" option to show where the car has been, so I could see the exact route on windy roads my husband had taken. I saw that he parked at 4:55 p.m., so I wasn't surprised when I got a text from him 12 minutes later reporting that they were in the waiting room. The other trackers in the car -- the $34.99 Tile and $29 AirTag -- didn't work as well in real time out in the sparsely populated area where we live. The AirTag, designed to find keys left behind "at the beach," took an hour or so to reveal that the car was in the hospital parking lot. The Tile, intended to "find misplaced things nearby and far away," never realized it had moved from our garage. That's because these devices rely on Bluetooth technology. Hill went on to say that she hid an AirTag in her husband's backpack, which became her most powerful tracker, "outperforming the GPS device, and allowing me to tell a photographer exactly where he was at all times."

"Within two hours of my putting all the trackers in our car, my husband, who has an iPhone, got an alert about the AirTag, after running an errand," adds Hill. "The problem was that he couldn't find it. [...] The one time his iPhone connected to the AirTag in the car, so he could play the noise, it was so hard to tell where it was coming from that he gave up looking for it after five minutes."

In response to the surreptitious tracking, Hill's husband said: "For all the bad press the AirTags have gotten, and as flaky as the detection mechanisms were, at least I was consistently getting notifications they were following me. The privacy dangers of the other trackers were way worse."

Google's plan to phase out third-party cookies and replace them with a bundle of new standards referred to as the "Privacy Sandbox" just overcame a key regulatory hurdle. From a report: The UK's competition regulator, the Competition and Markets Authority (CMA), has formally accepted Google's commitments about how it'll develop the new standards so they don't harm competition or unfairly benefit the search giant's own advertising business, the regulator announced today. Google's plans are still in flux, and it's not yet clear exactly what technologies Privacy Sandbox will use to replace third-party cookies. Just last month, Google abandoned one planned approach, FLoC, in favor of a new system called Topics API. Today's approval is for Google's approach, rather than any one specific technology. The regulator notes that in the next phase it will "supervise Google to ensure the Privacy Sandbox is developed in a way that benefits consumers."

An anonymous reader quotes a report from TechCrunch: Use of Google Analytics has now been found to breach European Union privacy laws in France -- after a similar decision was reached in Austria last month. The French data protection watchdog, the CNIL, said today that an unnamed local website's use of Google Analytics is non-compliant with the bloc's General Data Protection Regulation (GDPR) -- breaching Article 44 which covers personal data transfers outside the bloc to so-called third countries which are not considered to have essentially equivalent privacy protections. The U.S. fails this critical equivalence test on account of having sweeping surveillance laws which do not provide non-U.S. citizens with any way to know whether their data is being acquired, how it's being used or to seek redress for any misuse.

France's CNIL has been investigating one of 101 complaints filed by European privacy advocacy group, noyb, back in August 2020 -- after the bloc's top court invalidated the EU-U.S. Privacy Shield agreement on data transfers. Since then (indeed, long before) the legality of transatlantic transfers of personal data have been clouded in uncertainty. While it has taken EU regulators some time to act on illegal data transfers -- despite an immediate warning from the European Data Protection Board of no grace period in the wake of the July 2020 CJEU ruling (aka 'Schrems II) -- decisions are now finally starting to flow. Including another by the European Data Protection Supervisor last month, also involving Google Analytics. In France, the CNIL has ordered the website which was the target of one of noyb's complaints to comply with the GDPR -- and "if necessary, to stop using this service under the current conditions" -- giving it a deadline of one month to comply.

"[A]lthough Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for U.S. intelligence services," the CNIL writes in a press release announcing the decision. "There is therefore a risk for French website users who use this service and whose data is exported." The CNIL does leave open the door to continued use of Google Analytics -- but only with substantial changes that would ensure only "anonymous statistical data" gets transferred. The French regulator is also very emphatic that under "current conditions" use of Google Analytics is non-compliant -- and may therefore need to cease in order for the site in question to comply with the GDPR. The CNIL also suggests use of an alternative analytics tool which does not involve a transfer outside the EU to end the breach. Additionally, it says it's launched an evaluation program to determine which website audience measurement and analysis services may be exempt from the need to obtain user consent (i.e. because they only produce anonymous statistical data which can be exported legally under GDPR). Which suggests the CNIL could issue guidance in future that recommends GDPR compliant alternatives to Google Analytics.