An anonymous reader quotes a report from the BBC: A gang of car thieves used a handheld device disguised as a Nintendo Game Boy to steal vehicles worth $245,000. Dylan Armer, Christopher Bowes and Thomas Poulson stole five Mitsubishi Outlanders by using the gadget to bypass the cars' security systems. West Yorkshire Police said the device, worth $27,000 could unlock and start a car "in a matter of seconds." The trio, all from Yorkshire, were jailed at Leeds Crown Court after pleading guilty to conspiracy to steal. CCTV footage of the theft showed them unplug the car from its charging point before using the device to unlock and start it. When officers stopped the three men they found the Game Boy-style gadget hidden in a secret compartment of their car. Police said footage recovered from Poulson's phone showed him demonstrating "how quickly and easily the gadget gave them full access to the vehicles, accompanied by a commentary in mocking tones." The force added that the "significant investment required to buy one of the sophisticated devices suggested the thefts were planned and orchestrated crimes."

The US Department of Justice has created a team to investigate cryptocurrency-related crime. The Verge reports: The National Cryptocurrency Enforcement Team (NCET) will handle investigations of "crimes committed by virtual currency exchanges, mixing and tumbling services, and money laundering infrastructure actors," the agency said in a news release. Mixing and tumbling services can obscure the source of a cryptocurrency transaction, by mixing it with other funds. Cryptocurrency is "used in a wide variety of criminal activity," including ransomware demand payments, money laundering, and for the illegal sales of drugs, weapons, and malware, the agency noted. Several high-profile ransomware cases have involved demands in cryptocurrency, including the Colonial Pipeline attack in May, where the company reportedly paid a $5 million ransom to DarkSide.

The DOJ says the NCET, which will provide expertise in blockchain and cryptocurrency transactions for the Justice Department and other US government agencies, will draw team members from the DOJ's money laundering, intellectual property, and computer crimes divisions, as well as from US attorneys' offices across the country. The team will be under the supervision of Assistant Attorney General Kenneth Polite Jr. to start, but the Justice Department is seeking to hire someone who has "experience with complex criminal investigations and prosecutions, as well as the technology underpinning cryptocurrencies and the blockchain," on a more permanent basis.

An anonymous reader writes: The suspected Russian hackers who used SolarWinds and Microsoft software to burrow into U.S. federal agencies emerged with information about counter-intelligence investigations, policy on sanctioning Russian individuals and the country's response to COVID-19, people involved in the investigation told Reuters. The hacks were widely publicized after their discovery late last year, and American officials have blamed Russia's SVR foreign intelligence service, which denies the activity. But little has been disclosed about the spies' aims and successes. [...] It has been previously reported that the hackers breached unclassified Justice Department networks and read emails at the departments of treasury, commerce and homeland security. Nine federal agencies were breached. The hackers also stole digital certificates used to convince computers that software is authorized to run on them and source code from Microsoft(MSFT.O) and other tech companies. One of the people involved said that the exposure of counter-intelligence matters being pursued against Russia was the worst of the losses.

In an annual threat-review paper released on Thursday, Microsoft said the Russian spies were ultimately looking for government material on sanctions and other Russia-related policies, along with U.S. methods for catching Russian hackers. Cristin Goodwin, general manager of Microsoft's Digital Security Unit, said the company drew its conclusions from the types of customers and accounts it saw being targeted. In such cases, she told Reuters, "You can infer the operational aims from that." Others who worked on the government's investigation went further, saying they could see the terms that the Russians used in their searches of U.S. digital files, including "sanctions."

Chris Krebs, the former head of U.S. cyber-defense agency CISA and now an adviser to SolarWinds and other companies, said the combined descriptions of the attackers' goals were logical. "If I'm a threat actor in an environment, I've got a clear set of objectives. First, I want to get valuable intelligence on government decision-making. Sanctions policy makes a ton of sense," Krebs said. The second thing is to learn how the target responds to attacks, or "counter-incident response," he said: "I want to know what they know about me so I can improve my tradecraft and avoid detection."

"Tom Voigt, a Zodiac Killer expert and author who runs ZodiacKiller.com, pulls no punches when commenting on the story picked up by FoxNews that is now being posted at various news outlets including Slashdot," writes Slashdot reader ISayWeOnlyToBePolite. Rolling Stone spoke to Voigt on Wednesday about the bombshell report and why, in his opinion, it's "bullshit." From the article: By now obviously you've seen the news about the Zodiac Killer's identification. What's your take on it? Yeah, I've got about a million people on my website right now. It's all bullshit, by the way, just to get that out of the way. This is hot garbage. I don't know why it got any coverage at all. It was basically a press release.

Are you familiar with the Case Breakers? First of all, the funny thing is, I've never heard of any of these people that are these so-called experts. I have been doing this for 25 years and I've never heard of any of them. So that there are some red flags right off the bat. And then the funny thing is, they're matching up lines on foreheads. No witness ever described lines on Zodiac's forehead. Those lines were simply added by the sketch artist to fill in the sketch. The amended sketch, which is supposed to look more like Zodiac, according to witnesses, doesn't really even have any lines. So they got rid of them. So because the witnesses were like, "We're not really happy with that sketch that we gave you a few days ago," they got changed. The lines went away. No witness ever described that.

What about their claim that Poste's name unlocks one of the Zodiac's ciphers? A lot of what they're typing and talking about is nonsense. These people, what I've seen, they don't really have any kind of a command of the basics of the Zodiac case. From what I've read, they've gotten their Zodiac information from the comments section at Facebook. They'd skip the main article and they went right to the comments and they think they know everything about this. Maybe they've saw the Fincher movie, but probably not. Or, they turned it off after the two-hour mark or so.

If you had to put your money on one suspect, who would it be? Richard Gaikowski is my best bet. If I was if I was an employer looking to hire the Zodiac, he'd probably have the most impressive resume in my eyes. But the reality is that Allen is the suspect you just can't quit. I just can't quit that "Big Al," especially now I'm going over all these old emails and tips and leads going back 25 years. And some of the stuff that was that was said to me about about how it is just mind boggling. Yeah. If he wasn't, if he wasn't the Zodiac, he might be responsible for some other murders.

An anonymous reader writes: Cloudflare is not liable for the copyright infringement of websites that use its content-delivery and security services, a federal judge ruled yesterday. Cloudflare was sued in November 2018 by Mon Cheri Bridals and Maggie Sottero Designs, two wedding dress manufacturers and sellers that alleged Cloudflare was guilty of contributory copyright infringement because it didn't terminate services for websites that infringed on the dressmakers' copyrighted designs. The companies sought a jury trial, but Judge Vince Chhabria yesterday granted Cloudflare's motion for summary judgment in a ruling (PDF) in US District Court for the Northern District of California. Chhabria noted that the dressmakers have been harmed "by the proliferation of counterfeit retailers that sell knock-off dresses using the plaintiffs' copyrighted images," and that they have "gone after the infringers in a range of actions, but to no avail -- every time a website is successfully shut down, a new one takes its place." [...] While the ruling resolves the lawsuit's central question in Cloudflare's favor, the judge scheduled a case management conference for October 27 "to discuss what's left of the case."

A defendant is liable for contributory copyright infringement if it has knowledge of another's infringement and materially contributes to or induces that infringement, the judge noted in his ruling against the dressmakers. "Simply providing services to a copyright infringer does not qualify as a 'material contribution,'" he wrote. "Rather, liability in the Internet context follows where a party 'facilitate[s] access' to infringing websites in such a way that 'significantly magnif[ies]' the underlying infringement." Although a defendant can be found to materially contribute to copyright infringement if it acts as "an essential step in the infringement process," this should not be interpreted too broadly, the judge wrote. "As the Ninth Circuit has recognized, the language used in these tests is 'quite broad' and could encompass much innocuous activity if considered out of context. An analysis of contributory copyright infringement must therefore be cognizant of the facts in the key cases in which liability has been found," Chhabria wrote.

Mon Cheri Bridals and Maggie Sottero Designs alleged that Cloudflare contributes to copyright infringement by providing performance-improvement services, including its content-distribution network and caching capabilities that improve the quality of webpages and make them load faster, Chhabria wrote. But the "plaintiffs have not presented evidence from which a jury could conclude that Cloudflare's performance-improvement services materially contribute to copyright infringement. The plaintiffs' only evidence of the effects of these services is promotional material from Cloudflare's website touting the benefits of its services. These general statements do not speak to the effects of Cloudflare on the direct infringement at issue here." The plaintiffs did not prove that the faster website-load times enabled by Cloudflare "would be likely to lead to significantly more infringement." Additionally, Cloudflare removing infringing material from its cache would not prevent users from seeing the copyrighted images. "[R]emoving material from a cache without removing it from the hosting server would not prevent the direct infringement from occurring," Chhabria wrote.

The Transportation Security Administration will introduce new regulations that compel the most important U.S. railroad and airport operators to improve their cybersecurity procedures, Homeland Security Secretary Alejandro Mayorkas said on Wednesday. From a report: The upcoming changes will make it mandatory for "higher-risk" rail transit companies and "critical" U.S. airport and aircraft operators to do three things: name a chief cyber official, disclose hacks to the government and draft recovery plans for if an attack were to occur. The planned regulations come after cybercriminals attacked a major U.S. pipeline operator here, causing localized gas shortages along the U.S. East Coast in May. The incident led to new cybersecurity rules for pipeline owners in July.

"Whether by air, land, or sea, our transportation systems are of utmost strategic importance to our national and economic security," Mayorkas said. "The last year and a half has powerfully demonstrated what's at stake." A key concern motivating the new policies comes from a growth in ransomware attacks against critical infrastructure companies.

After Take-Two Interactive sent a legal letter to Github referencing a copyright infringement lawsuit against the people behind the popular re3 and reVC Grand Theft Auto fan projects, Github has now removed the repositories for a second time. Take-Two has also demanded the removal of many project forks and wants Github to take action under its repeat infringer policy. TorrentFreak reports: Just before the weekend, a new entry in Github's DMCA repository revealed the existence of a letter (PDF) sent to Github from Take-Two's legal team. Dated September 9, 2021 (a week after the copyright lawsuit was filed) it informs Github that legal action is underway and it has come to the company's attention that the contentious content (and numerous 'fork' repositories) continue to be made available on Github's website. "We request that Github take expeditious action to remove or disable access to the materials [in the attached exhibit], together with any other instances of the same materials available within the same primary 'GTAmodding/re3' fork network (e.g. in 'private' or newly-created repositories)," it reads.

In common with the first DMCA notice, Github has responded by taking the project's repositories down. Given that the defendants in the case already stand accused of previously sending 'bad faith' counter-notices, it seems unlikely that they will follow up with another set of similar responses that will soon be under the scrutiny of the court. Take-Two also follows up with a line that is becoming more and more popular in copyright infringement matters, one that references so-called 'repeat infringers.' "Furthermore, it is requested that Github take appropriate measures to prevent further infringement by the parties responsible, including pursuant to any 'repeat infringer' policies maintained by Github."

This means that if any of the contentious content is reposted to Github, Take-Two would like the code repository to implement its own 'repeat infringer' process. It states that "in appropriate circumstances and in its sole discretion, [Github will] disable and terminate the accounts of users who may infringe upon the copyrights or other intellectual property rights of GitHub or others." The letter also provides a laundry list of repository forks that, on the basis they are also infringing, should be removed. While Github appears to have complied in many cases, there are two notable exceptions. After being targeted by earlier DMCA takedowns, Github users 'td512' and 'erorcun' filed DMCA counter-notices to have their repositories restored. The former previously informed TorrentFreak that he believed Take-Two's infringement claims to be incorrect. At the time of writing, both repos are still online.

Apple says that as of January 31st, 2022, all applications will need to offer people a method of deleting their accounts. This applies to all iOS, iPadOS and macOS apps. Engadget reports: The company announced this requirement alongside other App Store guideline changes at the Apple Worldwide Developers Conference in June as part of a push to give users more control over their data. As The Verge notes, Apple is only requiring developers to let people "initiate deletion of their account from within the app," so apps might send you to a website or even a chat with an agent before you can actually close your account.

The European Parliament today called for a ban on police use of facial recognition technology in public places, and on predictive policing, a controversial practice that involves using AI tools in hopes of profiling potential criminals before a crime is even committed. Politico reports: In a resolution adopted overwhelmingly in favor, MEPs also asked for a ban on private facial recognition databases, like the ones used by the controversial company Clearview AI. The Parliament also supports the European Commission's attempt in its AI bill to ban social scoring systems, such as the ones launched by China that rate citizens' trustworthiness based on their behavior.

The non-biding resolution sends a strong signal on how the Parliament is likely to vote in upcoming negotiations of the AI Act. The European Commission's proposal of the bill restricts the use of remote biometric identification -- including facial recognition technology -- in public places unless it is to fight "serious" crime, such as kidnappings and terrorism. The AI Act's lead negotiator, Brando Benifei and almost all of his co-negotiators from other political groups in the Parliament have called for a blanket ban on facial recognition. This is in stark contrast to policies implemented in some EU member countries, who are keen to use these technologies to bolster their security apparatuses.

An unknown individual has leaked the source code and business data of video streaming platform Twitch via a torrent file posted on the 4chan discussion board earlier today. From a report: The leaker said they shared the data as a response to the recent "hate raids" --coordinated bot attacks posting hateful and abusive content in Twitch chats -- that have plagued the platform's top streamers over the summer. "Their community is [...] a disgusting toxic cesspool, so to foster more disruption and competition in the online video streaming space, we have completely pwned them, and in part one, are releasing the source code from almost 6,000 internal Git repositories," the leaker said earlier today. The leaker claims that the leak contains the "entirety of twitch.tv, with commit history going back to its early beginnings, mobile, desktop and video game console Twitch clients, various proprietary SDKs and internal AWS services used by Twitch, every other property that Twitch owns including IGDB and CurseForge, an unreleased Steam competitor from Amazon Game Studios, and Twitch SOC internal red teaming tools."

Twitch has confirmed the breach. In a tweet it said, "We can confirm a breach has taken place. Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available."

Evolved Apes is described on NFT marketplace OpenSea as "a collection of 10,000 unique NFTs trapped inside a lawless land." They are "fighting for survival, only the strongest ape will prevail," it says, referring to the project's much-hyped fighting game, which has not materialized. From a report: A week after the project launch, the anonymous developer known as Evil Ape who promised that game, vanished along with the project's official Twitter account and website. But they left traces behind on the blockchain that shows they siphoned 798 ether ($2.7 million) out of the project's funds in multiple transfers. The funds, derived from the initial public sale of NFTs and commissions on the secondary market, were meant for project-related expenses like marketing.

Evolved Ape investors noticed several red flags leading up to Evil Ape's rug pull. After the public sale on September 24, the announcements seemed suspiciously unprofessional and several of the leaders were not around anymore, one investor who requested anonymity due to the ongoing fallout from the scam told Motherboard. But they chalked it down to lack of experience at the time. "I don't think this giant storm was ever what was expected," the investor said. According to Mike_Cryptobull, who did not share their real name due to their standing in the community, the Evolved Apes community discovered that the social-media competition winners (a marketing activity to create buzz) hadn't received their NFT prizes from the project, and the artist hadn't been paid either.

Victims of ransomware attacks would be required to report payments to their hackers within 48 hours under a proposal from Democratic Senator Elizabeth Warren and Democratic Representative Deborah Ross. From a report: The Ransom Disclosure Act would give the Department of Homeland Security data on ransomware payments, including the amount of money demanded and paid, and the type of currency used. The lawmakers say this is essential to bolster the U.S. government's understanding of how hackers operate and the extent of the ransomware threat. "Ransomware attacks are skyrocketing, yet we lack critical data to go after cybercriminals," Warren said in a statement on Tuesday.

An anonymous reader quotes a report from Ars Technica: The Federal Communications Commission hopes to reduce the number of illegal robocalls from overseas with an expansion of rules that require phone companies to implement Caller ID authentication technology and block illegal calls. [T]he FCC is proposing new requirements on domestic gateway providers that accept calls from outside the US. A Notice of Proposed Rulemaking (NPRM) adopted (PDF) Thursday and released on Friday proposes requiring those gateway phone companies to implement STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted Information Using toKENs) protocols, which verify the accuracy of Caller ID by using digital certificates based on public-key cryptography. "This proposal would subject foreign-originated calls, once they enter the United States, to requirements similar to those of domestic-originated calls, by placing additional obligations on gateway providers in light of the large number of illegal robocalls that originate abroad and the risk such calls present to Americans," the NPRM said. Gateway providers would be required to "apply STIR/SHAKEN caller ID authentication to, and perform robocall mitigation on, all foreign-originated calls with US numbers," the FCC said (PDF).

STIR/SHAKEN is already widely deployed in the US on IP networks due to separate requirements that apply to large phone providers. Another newly implemented rule prohibits phone companies from accepting calls from providers that haven't met requirements to deploy STIR/SHAKEN or other robocall-mitigation methods. But the STIR/SHAKEN requirements don't apply to all carriers yet. "We don't want international calling to become a loophole for our policies," FCC Acting Chairwoman Jessica Rosenworcel said on Thursday at a commission meeting. "So today we are proposing that gateway providers in the United States -- the companies that bring in calls from overseas -- take action to stop this stuff from coming in from abroad. That means they need to use STIR/SHAKEN technology, register in our Robocall Mitigation Database, and comply with traceback requests to figure out where these junk calls are originating from overseas."

The FCC said those traceback requests "are used to help block illegal robocalls and inform FCC enforcement investigations." The NPRM also proposes a new call-blocking requirement. When the FCC notifies a gateway provider about an ongoing robocall campaign, the provider would have to conduct "a prompt investigation to determine whether the traffic identified in the Enforcement Bureau's notice is illegal" and "promptly block all traffic associated with the traffic pattern identified in that notice." The NPRM seeks public comment on these proposed rules. Deadlines for initial comments will be 30 days after the NPRM is published in the Federal Register and 60 days after publication for reply comments. The docket is located here.

Ukrainian police have reportedly arrested two members of a ransomware gang -- and while some have fingered REvil, no firm details have been published by cops from multiple countries. The Register reports: A round of speculation was triggered when inter-EU law enforcement body Europol declared this morning that Ukrainian fuzz had arrested "two prolific ransomware operators known for their extortionate demands," claimed to be up to [$81.3 million]. One of the two suspects arrested on September 28, according to the National Police of Ukraine, was a "hacker." The other allegedly "helped to withdraw money obtained by criminal means." $1.3m in cryptocurrency was said to have been frozen. A multinational police operation with input from France's National Gendarmerie and the US Federal Bureau of Investigation helped lead the Ukraine cops to their targets, with support from Europol and Interpol.

The 25-year-old suspect allegedly deployed "virus software," compromising remote-working software, with one attack vector being "through spam-mailings on corporate e-mail boxes of malicious content." "In total, the hacker attacked more than 100 foreign companies in North America and Europe," said the Ukrainian police, adding that they blamed the 25-year-old arrestee for causing $150m of damage to Western organizations. [...] Numerous people speculated on Twitter that the latest Ukrainian arrests were members of the REvil ransomware gang. This was based solely on Europol's claim that the two main accused had once issued an "extortionate" [$81.3 million] ransom demand, which has not been repeated by cops in Ukraine. REvil once issued a ransom demand for $70 millionagainst managed service provider Kaseya) but that is not the same sum...

Clearview AI has stoked controversy by scraping the web for photos and applying facial recognition to give police and others an unprecedented ability to peer into our lives. Now the company's CEO wants to use artificial intelligence to make Clearview's surveillance tool even more powerful. From a report: It may make it more dangerous and error-prone as well. Clearview has collected billions of photos from across websites that include Facebook, Instagram, and Twitter and uses AI to identify a particular person in images. Police and government agents have used the company's face database to help identify suspects in photos by tying them to online profiles. The company's cofounder and CEO, Hoan Ton-That, tells WIRED that Clearview has now collected more than 10 billion images from across the web -- more than three times as many as has been previously reported. Ton-That says the larger pool of photos means users, most often law enforcement, are more likely to find a match when searching for someone. He also claims the larger data set makes the company's tool more accurate.

Clearview combined web-crawling techniques, advances in machine learning that have improved facial recognition, and a disregard for personal privacy to create a surprisingly powerful tool. Ton-That demonstrated the technology through a smartphone app by taking a photo of the reporter. The app produced dozens of images from numerous US and international websites, each showing the correct person in images captured over more than a decade. The allure of such a tool is obvious, but so is the potential for it to be misused. Clearview's actions sparked public outrage and a broader debate over expectations of privacy in an era of smartphones, social media, and AI. [...] The pushback has not deterred Ton-That. He says he believes most people accept or support the idea of using facial recognition to solve crimes. "The people who are worried about it, they are very vocal, and that's a good thing, because I think over time we can address more and more of their concerns," he says.

Some of Clearview's new technologies may spark further debate. Ton-That says it is developing new ways for police to find a person, including "deblur" and "mask removal" tools. The first takes a blurred image and sharpens it using machine learning to envision what a clearer picture would look like; the second tries to envision the covered part of a person's face using machine learning models that fill in missing details of an image using a best guess based on statistical patterns found in other images. These capabilities could make Clearview's technology more attractive but also more problematic. It remains unclear how accurately the new techniques work, but experts say they could increase the risk that a person is wrongly identified and could exacerbate biases inherent to the system.

The Guardian reports on "a new breed of scambaiters...taking over TikTok and YouTube."

And one of them has more than 1.5 million followers across both video platforms. "Three to four days a week, for one or two hours at a time, Rosie Okumura, 35, telephones thieves and messes with their minds," reports the Guardian: For the past two years, the LA-based voice actor has run a sort of reverse call centre, deliberately ringing the people most of us hang up on — scammers who pose as tax agencies or tech-support companies or inform you that you've recently been in a car accident you somehow don't recall. When Okumura gets a scammer on the line, she will pretend to be an old lady, or a six-year-old girl, or do an uncanny impression of Apple's virtual assistant Siri. Once, she successfully fooled a fake customer service representative into believing that she was Britney Spears. "I waste their time," she explains, "and now they're not stealing from someone's grandma...."

Batman became Batman to avenge the death of his parents; Okumura became a scambaiter after her mum was scammed out of $500... Thankfully, the bank was able to stop the money leaving her mother's account, but Okumura wanted more than just a refund. She asked her mum to give her the number she'd called and called it herself, spending an hour and 45 minutes wasting the scammer's time. "My computer's giving me the worst vibes," she began in Kim Kardashian's voice. "Are you in front of your computer right now?" asked the scammer. "Yeah, well it's in front of me, is that... that's like the same thing?" Okumura put the video on YouTube and since then has made over 200 more videos, through which she earns regular advertising revenue (she also takes sponsorships directly from companies).

"A lot of it is entertainment — it's funny, it's fun to do, it makes people happy," she says when asked why she scambaits. "But I also get a few emails a day saying, 'Oh, thank you so much, if it weren't for that video, I would've lost $1,500.'" Okumura isn't naive — she knows she can't stop people scamming, but she hopes to stop people falling for scams. "I think just educating people and preventing it from happening in the first place is easier than trying to get all the scammers put in jail...."
The Guardian also describes Jim Browning, a Northern Irish YouTuber with nearly 3.5 million subscribers who's been posting scambaiting videos for seven years. "Browning regularly gets access to scammers' computers and has even managed to hack into the closed-circuit TV footage of call centres in order to identify individuals. He then passes this information to the 'relevant authorities' including the police, money-processing firms and internet service providers...."

And they also tell the story of an American software engineer who joined with friends to convince a scammer he'd been offered a high-paying job — only to end up stranded in Laos after paying for a 600-miles flight.

"He was crying... that was the one where I was like, 'Ah, maybe I'm taking things a little too far.'"

An Iowa data scientist with a computer engineering degree and a Harvard MBA has come forward as the whistleblower leaking damaging information about Facebook to the Wall Street Journal — and that's just the beginning. They've now also filed at least eight complaints with America's Securities and Exchange Commission, "which has broad oversight over financial markets and has the power to bring charges against companies suspected of misleading investors," reports the Washington Post. To buttress the complaints, the whistleblower secretly copied "tens of thousands" of pages of internal Facebook research, according to a report tonight on the CBS News show 60 Minutes, which summarizes her ultimate conclusion: "that the company is lying to the public about making significant progress against hate, violence and misinformation.

"One study she found from this year says 'We estimate that we may action as little as 3 to 5% of hate, and about 0.6% of violence and incitement on Facebook. Despite being the best in the world at it." Another internal Facebook document admits point-blank that "We have evidence from a variety of sources that hate speech, divisive political speech and misinformation on Facebook and the family of apps are affecting societies around the world."

60 Minutes points out that Facebook "has 2.8 billion users, which is 60% of all internet-connected people on Earth."

[Whistleblower Frances] Haugen told us the root of Facebook's problem is in a change that it made in 2018 to its algorithms — the programming that decides what you see on your Facebook news feed... "One of the consequences of how Facebook is picking out that content today is it is optimizing for content that gets engagement, or reaction. But its own research is showing that content that is hateful, that is divisive, that is polarizing, it's easier to inspire people to anger than it is to other emotions... Facebook has realized that if they change the algorithm to be safer, people will spend less time on the site, they'll click on less ads, they'll make less money."
60 Minutes reports that Facebook was even contacted by "major political parties across Europe," according to leaked internal documents which say the parties specifically complained that a change Facebook's algorithm "has forced them to skew negative in their communications on Facebook... leading them into more extreme policy positions." (Or, as 60 Minutes puts it, "The European political parties were essentially saying to Facebook the way you've written your algorithm is changing the way we lead our countries." The whistleblower sees their position as "You are forcing us to take positions that we don't like, that we know are bad for society. We know if we don't take those positions, we won't win in the marketplace of social media." Haugen says Facebook understood the danger to the 2020 Election. So, it turned on safety systems to reduce misinformation — but many of those changes, she says, were temporary. "And as soon as the election was over, they turned them back off or they changed the settings back to what they were before, to prioritize growth over safety. And that really feels like a betrayal of democracy to me." Facebook says some of the safety systems remained. But, after the election, Facebook was used by some to organize the January 6th insurrection....

After the attack, Facebook employees raged on an internal message board copied by Haugen. "...Haven't we had enough time to figure out how to manage discourse without enabling violence?"
The whistleblower will now appear Tuesday before a U.S. Senate Commerce consumer protection subcommittee — and has already shared some of their documents with Congressional offices probing Facebook, according to the Washington Post. "It's important because Big Tech is at an inflection point," the whistleblower's lawyer tells the newspaper. They argue that ultimately Big Tech "touches every aspect of our lives — whether it's individuals personally or democratic institutions globally. With such far reaching consequences, transparency is critical to oversight.

"And lawful whistleblowing is a critical component of oversight and holding companies accountable."

"Cyber criminals using a ransomware-as-a-service scheme have been spotted complaining that the group they rent the malware from could be using a hidden backdoor to grab ransom payments for themselves," reports ZDNet: REvil is one of the most notorious and most common forms of ransomware around and has been responsible for several major incidents. The group behind REvil lease their ransomware out to other crooks in exchange for a cut of the profits these affiliates make by extorting Bitcoin payments in exchange for the ransomware decryption keys that the victims need. But it seems that cut isn't enough for those behind REvil: it was recently disclosed that there's a secret backdoor coded into their product, which allows REvil to restore the encrypted files without the involvement of the affiliate. This could allow REvil to takeover negotiations with victims, hijack the so-called "customer support" chats — and steal the ransom payments for themselves.

Analysis of underground forums by cybersecurity researchers at Flashpoint suggests that the disclosure of the REvil backdoor hasn't gone down well with affiliates. One forum user claimed to have had suspicions of REvil's tactics, and said their own plans to extort $7 million from a victim was abruptly ended. They believe that one of the REvil authors took over the negotiations using the backdoor and made off with the money.

Miami is a city "that unblushingly loves rule-breaking and money," according to a new article in New York magazine, wondering whether Miami could ever really replace Silicon Valley as "a more natural home — and maybe even an accelerant — for the next generation of disruption fiends." On December 4, Delian Asparouhov, a venture capitalist in San Francisco, posted, "ok guys hear me out, what if we move silicon valley to Miami," and Miami mayor Francis Suarez, lying in bed at home in Coconut Grove, replied, "How can I help...?" Ever since, Suarez has been on a mission to rebrand Miami — long a place to spend money, rather than earn it — as a haven for founders who feel underappreciated in more calcified urban climes. He bought (with money from a venture capitalist) billboards in San Francisco featuring his Twitter handle and an invitation to "DM me." As he put it, "I saw the tsunami coming, got out my surfboard, and started paddling."

The flood of new Miamians who have arrived, full or part time, during the pandemic includes tech investors (Peter Thiel, David Sacks), cryptocurrency bulls (Anthony Pompliano, Ari Paul), new-media tycoons (Bryan Goldberg, Dave Portnoy), start-up founders (Alexandra Wilkis Wilson, Steven Galanis), and many more who aren't yet billionaires but think the Magic City will give them their best shot... The boom is visible in the city's crane-spiked skyline, too, with deals for Spotify, Microsoft, Apple, and TikTok either signed or in the offing. In greater South Florida, a related incursion by the finance industry — Goldman Sachs, Citadel, Elliott — is in full swing... In July, according to Redfin, Miami was the top migration destination for home buyers in the U.S., while San Francisco had the largest homeowner exodus. Suarez told me about a playful text he recently received from the mayor there, London Breed: "Stop stealing my techies." He says he replied, "Sorry, London, I love you, but no."

Already, Suarez has made gains in turning Miami into the most cryptocurrency-friendly city in the U.S. In the past six months, the world's largest bitcoin conference happened here; a crypto exchange called FTX paid $135 million for the naming rights to the NBA arena (edging out the hometown porn studio BangBros); and a city-sanctioned currency called MiamiCoin debuted, generating millions in fees for municipal coffers. Suarez also accepts campaign contributions in bitcoin. He's running for reelection this November and looks certain to win, thanks in part to hefty donations and cheerleading from Silicon Valley eminences...

The tech case for Miami isn't wholly persuasive. (The most notable local start-up is a company that sells kibble.) But it is infectious.
The article notes, for example, that "For all his enthusiasm, Suarez acknowledges that a robust tech ecosystem needs one thing he can't simply market into existence: a standout university" (with a world-class engineering department to fuel startups). Suarez's solution appears to be offering Miami land parcels to Florida Polytechnic University for a possible satellite campus teaching DeFi/crypto/blockchain/NFT technologies.

The article also points out the possibility of global warming-induced hurricanes and rising sea levels, the city's widening income gap and rising cost of living, and Miami's record number of pediatric-ICU COVID admissions.

"American luxury retailer Neiman Marcus Group has just disclosed a major data breach impacting approximately 4.6 million customers," reports Ars Technica.

"The breach occurred sometime in May 2020 after 'an unauthorized party' obtained the personal information of some Neiman Marcus customers from their online accounts." Neiman Marcus is working with law enforcement agencies and has selected cybersecurity company Mandiant to assist with the investigation. Thursday, Neiman Marcus disclosed that its 2020 data breach impacted about 4.6 million customers with Neiman Marcus online accounts. The personal information of these customers was potentially compromised during the incident. The bits of information include:

- Names, addresses, contact information

- Usernames and passwords of Neiman Marcus online accounts

- Payment card numbers and expiration dates (although no CVV numbers)

- Neiman Marcus virtual gift card numbers (without PINs)

- Security questions of Neiman Marcus online accounts
"Although the data breach occurred over a year ago, Neiman Marcus states it became aware of the incident this September."