The Electronic Frontier Foundation (EFF) filed a Freedom of Information Act (FOIA) lawsuit against the U.S. Postal Service and its inspection agency seeking records about a covert program to secretly comb through online posts of social media users before street protests, raising concerns about chilling the privacy and expressive activity of internet users. From the press release: Under an initiative called Internet Covert Operations Program, analysts at the U.S. Postal Inspection Service (USPIS), the Postal Service's law enforcement arm, sorted through massive amounts of data created by social media users to surveil what they were saying and sharing, according to media reports. Internet users' posts on Facebook, Twitter, Parler, and Telegraph were likely swept up in the surveillance program. USPIS has not disclosed details about the program or any records responding to EFF's FOIA request asking for information about the creation and operation of the surveillance initiative. In addition to those records, EFF is also seeking records on the program's policies and analysis of the information collected, and communications with other federal agencies, including the Department of Homeland Security (DHS), about the use of social media content gathered under the program.

Media reports revealed that a government bulletin dated March 16 was distributed across DHS's state-run security threat centers, alerting law enforcement agencies that USPIS analysts monitored "significant activity regarding planned protests occurring internationally and domestically on March 20, 2021." Protests around the country were planned for that day, and locations and times were being shared on Parler, Telegram, Twitter, and Facebook, the bulletin said. "We're filing this FOIA lawsuit to shine a light on why and how the Postal Service is monitoring online speech. This lawsuit aims to protect the right to protest," said Houston Davidson, EFF public interest legal fellow. "The government has never explained the legal justifications for this surveillance. We're asking a court to order the USPIS to disclose details about this speech-monitoring program, which threatens constitutional guarantees of free expression and privacy."

An anonymous reader quotes a report from The Verge: Activison Blizzard employees are staging a walkout on Wednesday, July 28th in response to the company's handling of sexual harassment allegations brought by the state of California. Employees will meet outside Blizzard's main campus in Irvine at 10AM PST. "We believe that our values as employees are not being accurately reflected in the words and actions of our leadership," the organizers said in a statement.

The news comes after California sued the renowned gaming studio and its publisher, saying women were subjected to constant sexual harassment and discrimination at work. One female employee allegedly died by suicide after having nude photos of her passed around the office. Following the suit, numerous employees took to Twitter to detail additional examples of harassment and discrimination. Former Blizzard president Mike Morhaime also issued a statement saying "I am extremely sorry that I failed you." The company denied the allegations, saying the lawsuit was merely "irresponsible behavior from unaccountable State bureaucrats that are driving many of the State's best businesses out of California." Employees are putting forward four demands as part of the walkout: end forced arbitration clauses in all employee contracts; implement new hiring and promotion processes to increase representation across the company; publish salary and promotion data "for all employees of all genders and ethnicities at the company"; and allow a diversity, equity, and inclusion task force to hire a third-party organization to audit the executive staff.

H_Fisher writes: Only one copy exists of the Wu-Tang Clan album Once Upon a Time in Shaolin, and it was owned by "Pharma Bro" Martin Shkreli. Now, NPR reports that this album has been sold by the U.S. government to an unnamed buyer in order to pay Shkreli's civil forfeiture judgment following his conviction for securities fraud. The album, which was originally sold for $2 million, exists only as one physical CD copy. It was seized along with other assets in 2018, and while the sale price and buyer weren't identified, Shkreli's attorney says that his client has now repaid the $7.4 million forfeiture judgement.

A former security supervisor at eBay received an 18-month federal prison sentence Tuesday for his role in a bizarre campaign of cyberstalking aimed at a Natick couple that ran an online newsletter often critical of the e-commerce giant, authorities said. The Boston Globe: The ex-supervisor, Philip Cooke, 56, of San Jose, Cali., had pleaded guilty in US District Court in Boston in October 2020 to conspiracy to commit cyberstalking and conspiracy to tamper with a witness, legal filings show. On Tuesday, prosecutors said, he was sentenced to 18 months in prison, as well as three years of supervised release including a 12-month period of home detention. He was also ordered to pay a $15,000 fine and perform 100 hours of community service, according to the US attorney's office.

Cooke was one of seven former eBay employees charged in connection with the stalking, which authorities said targeted Ina and David Steiner, a Natick couple who recently filed a federal lawsuit against the company and other parties linked to the harrassment. Rosemary Scapicchio, a prominent Boston attorney representing the couple in their civil suit, said via phone after Monday's hearing that her clients "were relieved" that Cooke received time behind bars, calling it "the first step in their pursuit of accountability" for all those involved. "There needs to be corporate accountability" as well, Scapicchio said.

Mark Herring had a fatal heart attack after the police swarmed his house after a fake emergency call. A Tennessee man was sentenced to five years in prison in connection with the episode. From a report: Mark Herring was at home in Bethpage, Tenn., one night in April 2020 when the police swarmed his house. Someone with a British accent had called emergency services in Sumner County and reported having shot a woman in the back of the head at Mr. Herring's address. The caller had threatened to set off pipe bombs at the front and back doors if officers came, according to federal court records. When the police arrived, they drew their guns and told Mr. Herring, a 60-year-old computer programmer and grandfather of six, to come out and keep his hands visible. As he walked out, he lost his balance and fell. He was pronounced dead that same night at a nearby hospital. The cause of death was a heart attack, according to court records.

Mr. Herring had been a victim of "swatting," the act of reporting a fake crime in order to provoke a heavily armed response from the police. The caller was a minor living in the United Kingdom, according to federal prosecutors. But the caller knew Mr. Herring's address because Shane Sonderman, 20, of Lauderdale County, Tenn., had posted the information online, prosecutors said. On Wednesday, Mr. Sonderman was sentenced to five years in prison after he pleaded guilty to one count of conspiracy. "The defendant was part of a chain of events," federal prosecutors said in court documents. The police "arrived prepared to take on a life and death situation," prosecutors said. "Mr. Herring died of a heart attack at gunpoint." Mr. Sonderman's lawyer, Bryan R. Huffman, said he had argued for a lesser sentence but believed five years "was fair in light of Shane's culpability."

"Mr. Sonderman has expressed his remorse on multiple occasions. He has expressed his regret regarding Mr. Herring's death," Mr. Huffman said in an email on Saturday. "Mr. Sonderman's family had also expressed their remorse. There are many families affected by Shane's actions, including his own family." Mr. Herring was targeted because he refused to sell his Twitter handle, @Tennessee, according to his family and prosecutors. Smart, blunt and plain-spoken, Mr. Herring had loved computers since he was a teenager and joined Twitter in March 2007, less than a year after it started, his family said. He knew people wanted his handle, which he chose because of his love for the state, where he had been born and raised, and had rebuffed offers of $3,000 to $4,000 to sell it, his daughter Corinna Fitch, 37, said in an interview.

Fossbytes has an article detailing how you can check to see if your mobile device is infected with the "Pegasus" spyware. What's Pegasus you ask? It's phone-penetrating spy software developed by NSO Group and sold to governments to target journalists and activists around the world. The CEO of NSO Group says law-abiding citizens have "nothing to be afraid of," but that doesn't help us sleep any better. Here's how to check if your device has been compromised (heads up: it's a bit of a technical and lengthy process): First off, you'll need to create an encrypted backup and transfer it to either a Mac or PC. You can also do this on Linux instead, but you'll have to install libimobiledevice beforehand for that. Once the phone backup is transferred, you need to download Python 3.6 (or newer) on your system -- if you don't have it already. Here's how you can install the same for Windows, macOS, and Linux. After that, go through Amnesty's manual to install MVT correctly on your system. Installing MVT will give you new utilities (mvt-ios and mvt-android) that you can use in the Python command line. Now, let's go through the steps for detecting Pegasus on an iPhone backup using MVT.

First of all, you have to decrypt your data backup. To do that, you'll need to enter the following instruction format while replacing the placeholder text (marked with a forward slash) with your custom path: "mvt-ios decrypt-backup -p password -d /decrypted /backup". Note: Replace "/decrypted" with the directory where you want to store the decrypted backup and "/backup" with the directory where your encrypted backup is located.

Now, we will run a scan on the decrypted backup, referencing it with the latest IOCs (possible signs of Pegasus spyware), and store the result in an output folder. To do this, first, download the newest IOCs from here (use the folder with the latest timestamp). Then, enter the instruction format as given below with your custom directory path: "mvt-ios check-backup -o /output -i /pegasus.stix2 /backup". Note: Replace "/output" with the directory where you want to store the scan result, "/backup" with the path where your decrypted backup is stored, and "/pegasus.stix2" with the path where you downloaded the latest IOCs.

After the scan completion, MVT will generate JSON files in the specified output folder. If there is a JSON file with the suffix "_detected," then that means your iPhone data is most likely Pegasus-infected. However, the IOCs are regularly updated by Amnesty's team as they develop a better understanding of how Pegasus operates. So, you might want to keep running scans as the IOCs are updated to make sure there are no false positives.

An anonymous reader quotes a report from Bloomberg: A U.S. probe into Tether is homing in on whether executives behind the digital token committed bank fraud, a potential criminal case that would have broad implications for the cryptocurrency market. Tether's pivotal role in the crypto ecosystem is now well known because the token is widely used to trade Bitcoin. But the Justice Department investigation is focused on conduct that occurred years ago, when Tether was in its more nascent stages. Specifically, federal prosecutors are scrutinizing whether Tether concealed from banks that transactions were linked to crypto [...]. Criminal charges would mark one of the most significant developments in the U.S. government's crackdown on virtual currencies. That's because Tether is by far the most popular stablecoin -- tokens designed to be immune to wild price swings, making them ideal for buying and selling more volatile coins. The token's importance to the market is clear: Tethers in circulation are worth about $62 billion and they underpin more than half of all Bitcoin trades.

Federal prosecutors have been circling Tether since at least 2018. In recent months, they sent letters to individuals alerting them that they're targets of the investigation, one of the people said. The notices signal that a decision on whether to bring a case could be made soon, with senior Justice Department officials ultimately determining whether charges are warranted. A hallmark of Tether is that its creators have said each token is backed by one U.S. dollar, either through actual money or holdings that include commercial paper, corporate bonds and precious metals. That has triggered concerns that if lots of traders sold stable coins all at once, there could be a run on assets backstopping the tokens. Fitch Ratings has warned that such a scenario could destabilize short-term credit markets.

In the course of its years-long investigation, the Justice Department has examined whether traders used Tether tokens to illegally drive up Bitcoin during an epic rally for cryptocurrencies in 2017. While it's unclear whether Tether the company was a target of that earlier review, the current focus on bank fraud suggests prosecutors may have moved on from pursuing a case tied to market manipulation. [...] Tether has already drawn the ire of regulators. In February, Bitfinex and several Tether affiliates agreed to pay $18.5 million to settle claims from New York Attorney General Letitia James that the firms hid losses and lied that each token was supported by one U.S. dollar. The companies had no access to banking in 2017, making it impossible that they had reserves backing the tokens, James said. The firms settled without admitting or denying the allegations.

Google has updated the schedule for its introduction of "Privacy Sandbox" browser technology and the phasing out of third-party cookies. The Register reports: The new timeline has split the bundle of technologies in the Privacy Sandbox into five phases: discussion, testing, implementation in Chrome (called "Ready for adoption"), Transition State 1 during which Chrome will "monitor adoption and feedback" and then the next stage that involves winding down support for third-party cookies over a three-month period finishing "late 2023." Although "late 2023" might sound a long way off, the timeline has revealed that "discussion" of the contentious FLoC (Federated Learning of Cohorts) is planned to end in Q3 2021 -- just a couple of months away -- and that discussion for First Party Sets, rejected by the W3C Technical Architecture Group as "harmful to the web in its current form," is scheduled to end around mid-November.

Google said that "extended discussions and testing stages often produce better, more complete solutions, and the timeline for testing and ready for adoption of use cases might change accordingly," so the dates are not set in stone. There is no suggestion that any of the proposals will be withdrawn; the company appears to believe it can alleviate concerns by tweaking rather than abandoning its proposals. Discussion of the various pieces is set to take place in the W3C Web Incubator Community Group (WICG), though at a FLEDGE WICG Call last week, Google's Michael Kleber, tech lead for Privacy Sandbox, suggested that the W3C would not be deciding which technologies are implemented, at least in the context of FLEDGE (formerly TURTLEDOVE), which enables auctions for personalized ads in a more private manner than today.

FLEDGE is competing for attention with the Microsoft-devised PARAKEET and MaCAW. Asked by Julien Delhommeau, staff system architect at adtech company Xandr, if the WICG would get a say in whether FLEDGE or PARAKEET/MaCAW would be adopted, Kleber said: "The W3C doesn't get to be the boss of anyone, the decisions are going to be made at each of the browsers. The goal isn't to have one winner and everyone else losing -- the goal of W3C is to put out a bunch of ideas, understand the positives of each, and come to a chimera that has the most necessary features. Every browser seems to want convergence, long term, so figuring out how to make convergence happen is important." [...] According to Kleber, when asked if personalized advertising could be removed from the web, he said "while most of the sites in the world would lose 50-70 per cent of their revenue in the alternative you're advocating for, Google is not one of them." He made this claim on the basis that "Google makes most of its money from the ads that appear on Google Search," which do not require tracking technology.

The Cabinet Office of Japan is co-hosting an event dedicated to "Society 5.0," a future society the government believes Japan should aspire to. Defined by the Cabinet Office as "a human-centered society [helped] by a system that highly integrates cyberspace and physical space," Society 5.0 is a concept intended to broaden the discussion of innovation from science and technology to all of socioeconomic activity. Nikkei Asia Review reports: The government has also established multiple large-scale programs to encourage companies, involved in everything from health care and mobility to energy, to invest in research and development, not only at the level of pure technology but also to bring it to a pilot level. The exhibition includes some achievements from these programs, including Cyberdyne's HAL, standing for "hybrid assistive limb," which the company claims to be the world's first "wearable cyborg." A HAL exoskeleton autonomously walks on a treadmill at the venue. When worn on a leg, HAL can read faint signals sent to muscles from the brain thanks to electrodes attached to the wearer's skin, determining the wearer's desired movements. "Even if your nerves are not connected at first, they gradually recover through the wearing of HAL, and you can eventually move your own body parts without wearing it," said a person from Cyberdyne.

SkyDrive's "flying car" also attracts the attention of visitors, who can observe a full-scale model of the SD-03, which performed the first successful public manned flights of a flying car in Japan in August 2020. Co-founded by former Toyota Motor engineer Tomohiro Fukuzawa, the startup plans to offer commercial mobility service during Expo 2025, to be held in Osaka. "It is as if we are traveling to the future," said Shinji Inoue, a minister of state who heads science and technology policy, when he visited the exhibition last week. Asked by reporters how to make these cutting-edge tools an everyday reality, Inoue spoke of a need to deregulate the market when it comes to obtaining operating permits for such items. Indeed, the government acknowledges challenges in keeping up with the country's capabilities in implementing scientific progress. Digitalization initiatives, the premise for achieving Society 5.0, "could not sufficiently create new business models through data collaboration, like what we see in other countries," said a report from the Cabinet Office analyzing the previous five-year plan through fiscal 2020. Instead, the initiatives aimed at improving the efficiency of existing operations, failing to drive innovation.

An anonymous reader quotes a report from Motherboard: On May 31 last year, 25-year-old Safarain Herring was shot in the head and dropped off at St. Bernard Hospital in Chicago by a man named Michael Williams. He died two days later. Chicago police eventually arrested the 64-year-old Williams and charged him with murder (Williams maintains that Herring was hit in a drive-by shooting). A key piece of evidence in the case is video surveillance footage showing Williams' car stopped on the 6300 block of South Stony Island Avenue at 11:46 p.m. - the time and location where police say they know Herring was shot. How did they know that's where the shooting happened? Police said ShotSpotter, a surveillance system that uses hidden microphone sensors to detect the sound and location of gunshots, generated an alert for that time and place. Except that's not entirely true, according to recent court filings.

That night, 19 ShotSpotter sensors detected a percussive sound at 11:46 p.m. and determined the location to be 5700 South Lake Shore Drive - a mile away from the site where prosecutors say Williams committed the murder, according to a motion filed by Williams' public defender. The company's algorithms initially classified the sound as a firework. That weekend had seen widespread protests in Chicago in response to George Floyd's murder, and some of those protesting lit fireworks. But after the 11:46 p.m. alert came in, a ShotSpotter analyst manually overrode the algorithms and "reclassified" the sound as a gunshot. Then, months later and after "post-processing," another ShotSpotter analyst changed the alert's coordinates to a location on South Stony Island Drive near where Williams' car was seen on camera. "Through this human-involved method, the ShotSpotter output in this case was dramatically transformed from data that did not support criminal charges of any kind to data that now forms the centerpiece of the prosecution's murder case against Mr. Williams," the public defender wrote in the motion.

The document is what's known as a Frye motion - a request for a judge to examine and rule on whether a particular forensic method is scientifically valid enough to be entered as evidence. Rather than defend ShotSpotter's technology and its employees' actions in a Frye hearing, the prosecutors withdrew all ShotSpotter evidence against Williams. The case isn't an anomaly, and the pattern it represents could have huge ramifications for ShotSpotter in Chicago, where the technology generates an average of 21,000 alerts each year. The technology is also currently in use in more than 100 cities. Motherboard's review of court documents from the Williams case and other trials in Chicago and New York State, including testimony from ShotSpotter's favored expert witness, suggests that the company's analysts frequently modify alerts at the request of police departments - some of which appear to be grasping for evidence that supports their narrative of events.

Citizen, otherwise known as "the worst kind of hyperlocal app ever created," is now willing to pay people to livestream crimes around New York City. The company is reportedly hiring people in the Big Apple at a starting rate of $25 per hour to run around the city and start streaming crimes to the web in real-time. From a report: The exact nature of these hires -- including their very existence -- is being kept mostly quiet by Citizen. Any public-facing recruiting for these positions is being done on the DL; one post on JournalismJobs.com from last week sought "field team members" to work for "a tech company with user-generated content."

"You will be live-streaming from your phone straight to the app, covering the event as news," the job posting read. Citizen's name was not included anywhere in the now-deleted posting, according to the New York Post. The company does not post these positions on its website, either.

Sunday the BBC reported YouTube influencers were offered money to spread vaccine misinformation.

But according to the New York Times, that's just the tip of the iceberg. "The scheme appears to be part of a secretive industry that security analysts and American officials say is exploding in scale: disinformation for hire: Private firms, straddling traditional marketing and the shadow world of geopolitical influence operations, are selling services once conducted principally by intelligence agencies. They sow discord, meddle in elections, seed false narratives and push viral conspiracies, mostly on social media. And they offer clients something precious: deniability. "Disinfo-for-hire actors being employed by government or government-adjacent actors is growing and serious," said Graham Brookie, director of the Atlantic Council's Digital Forensic Research Lab, calling it "a boom industry."

Similar campaigns have been recently found promoting India's ruling party, Egyptian foreign policy aims and political figures in Bolivia and Venezuela. Mr. Brookie's organization tracked one operating amid a mayoral race in Serra, a small city in Brazil. An ideologically promiscuous Ukrainian firm boosted several competing political parties. In the Central African Republic, two separate operations flooded social media with dueling pro-French and pro-Russian disinformation. Both powers are vying for influence in the country. A wave of anti-American posts in Iraq, seemingly organic, were tracked to a public relations company that was separately accused of faking anti-government sentiment in Israel.

Most trace to back-alley firms whose legitimate services resemble those of a bottom-rate marketer or email spammer... For-hire disinformation, though only sometimes effective, is growing more sophisticated as practitioners iterate and learn. Experts say it is becoming more common in every part of the world, outpacing operations conducted directly by governments. The result is an accelerating rise in polarizing conspiracies, phony citizen groups and fabricated public sentiment, deteriorating our shared reality beyond even the depths of recent years... Commercial firms conducted for-hire disinformation in at least 48 countries last year — nearly double from the year before, according to an Oxford University study. The researchers identified 65 companies offering such services...

Platforms have stepped up efforts to root out coordinated disinformation. Analysts especially credit Facebook, which publishes detailed reports on campaigns it disrupts. Still, some argue that social media companies also play a role in worsening the threat. Engagement-boosting algorithms and design elements, research finds, often privilege divisive and conspiratorial content.
The article also notes "a generation" of populist political leaders around the world who have risen "in part through social media manipulation.

"Once in office, many institutionalize those methods as tools of governance and foreign relations."

Millions of Americans "are being instructed to use ID.me, along with its facial recognition software, to get their unemployment benefits," reports CNN. The software compares their photo ID with a selfie video they take on their phone with the company's software — but some privacy advocates are concerned: A rapidly growing number of U.S. states, including Colorado, California and New York, turned to ID.me in hopes of cutting down on a surge of fraudulent claims for state and federal benefits that cropped up during the pandemic alongside a tidal wave of authentic unemployment claims. As of this month, 27 states' unemployment agencies had entered contracts with ID.me, according to the company, with 25 of them already using its technology. ID.me said it is in talks with seven more...

The company's rapid advance at state unemployment agencies marks the latest chapter in the story of facial recognition software's spread across the United States. It also highlights how this controversial technology gained a foothold during the pandemic and now appears destined to remain part of our lives for the foreseeable future...

Several ID.me users told CNN Business about problems they had verifying their identities with the company, which ranged from the facial recognition technology failing to recognize their face to waiting for hours to reach a human for a video chat after encountering problems with the technology. A number of people who claim to have had issues with ID.me have taken to social media to beg the company for help with verification, express their own concerns about its face-data collection or simply rant, often in response to ID.me's own posts on Twitter... From ID.me's perspective, its service is making it easier for a wide range of people to access essential government services, as it avoids the common practice of using information gleaned from data brokers and credit bureaus as a means of checking identities. The company said this lets it give a green light to those who don't have a credit history, or may have changed their name, for instance — people who might otherwise have more trouble getting verified.

However, it doesn't sit well with employee and privacy advocates and civil rights groups interviewed by CNN Business. They have concerns about the facial recognition technology itself and for the ID.me verification process's reliance on access to a smartphone or computer and the internet, which may be out of reach for the people to whom unemployment dollars are most critical... ID.me said it does not sell user data — which includes biometric and related information such as selfies people upload, data related to facial analyses, and recordings of video chats users participate in with ID.me — but it does keep it. Biometric data, like the facial geometry produced from a user's selfie, may be kept for years after a user closes their account... In March, ID.me announced raising $100 million in funding from investors including hedge fund Viking Global Investors and CapitalG, which is Google parent company Alphabet's independent growth fund. With that funding round, ID.me said it was valued at $1.5 billion... "We're verifying more than 1% of the American adult population each quarter, and that's starting to compress more to like 45 or 50 days," Hall said. The company has more than 50 million users, he said, and signs up more than 230,000 new ones each day.
CNN also quotes a man who complains the state never gave him an option. "If I wanted unemployment, I had no choice but to do this."

The owner of the EZ Mart gas station is suing Colonial Pipeline, accusing it of lax security, reports the Washington Post: He and his lawyers are hoping to also represent the hundreds of other small gas stations that were hurt by the hack. It's just one of several class-action lawsuits that are popping up in the wake of high-profile ransomware attacks. Another lawsuit filed against Colonial in Georgia in May seeks to get damages for regular consumers who had to pay higher gas prices. A third is in the works, with law firm Chimicles Schwartz Kriner & Donaldson-Smith LLP seeking to mount a similar effort.

Colonial isn't the only company that's been targeted. Another suit was launched in June against the San Diego based hospital system Scripps Health after it was hit by a ransomware attack...

In the case of Colonial Pipeline, hundreds of gas stations were shut down, leading to huge lines of cars waiting for what little fuel remained. The rise in suits may mean companies and organizations that are hacked are no longer just on the hook for reimbursing people who had their data stolen. They could now be liable for all kinds of damages that go well beyond a heightened risk of identity theft or credit card fraud...

The potential for lawsuits will keep growing as ransomware attacks do. And if lawyers can reasonably show that a company made some kind of mistake in protecting its system, victims will have an avenue to sue.

The New York Times' On Tech newsletter shares a thought-provoking story: This week, a top official in the Roman Catholic Church's American hierarchy resigned after a news site said that it had data from his cellphone that appeared to show the administrator using the L.G.B.T.Q. dating app Grindr and regularly going to gay bars. Journalists had access to data on the movements and digital trails of his mobile phone for parts of three years and were able to retrace where he went.

I know that people will have complex feelings about this matter. Some of you may believe that it's acceptable to use any means necessary to determine when a public figure is breaking his promises, including when it's a priest who may have broken his vow of celibacy. To me, though, this isn't about one man. This is about a structural failure that allows real-time data on Americans' movements to exist in the first place and to be used without our knowledge or true consent. This case shows the tangible consequences of practices by America's vast and largely unregulated data-harvesting industries. The reality in the United States is that there are few legal or other restrictions to prevent companies from compiling the precise locations of where we roam and selling that information to anyone.

This data is in the hands of companies that we deal with daily, like Facebook and Google, and also with information-for-hire middlemen that we never directly interact with. This data is often packaged in bulk and is anonymous in theory, but it can often be traced back to individuals, as the tale of the Catholic official shows...

Losing control of our data was not inevitable. It was a choice — or rather a failure over years by individuals, governments and corporations to think through the consequences of the digital age.

We can now choose a different path.
"Data brokers are the problem," writes the EFF, arguing that the incident "shows once again how easy it is for anyone to take advantage of data brokers' stores to cause real harm." This is not the first time Grindr has been in the spotlight for sharing user information with third-party data brokers... But Grindr is just one of countless apps engaging in this exact kind of data sharing. The real problem is the many data brokers and ad tech companies that amass and sell this sensitive data without anything resembling real users' consent.

Apps and data brokers claim they are only sharing so-called "anonymized" data. But that's simply not possible. Data brokers sell rich profiles with more than enough information to link sensitive data to real people, even if the brokers don't include a legal name. In particular, there's no such thing as "anonymous" location data. Data points like one's home or workplace are identifiers themselves, and a malicious observer can connect movements to these and other destinations. Another piece of the puzzle is the ad ID, another so-called "anonymous" label that identifies a device. Apps share ad IDs with third parties, and an entire industry of "identity resolution" companies can readily link ad IDs to real people at scale.

All of this underlines just how harmful a collection of mundane-seeming data points can become in the wrong hands... That's why the U.S. needs comprehensive data privacy regulation more than ever. This kind of abuse is not inevitable, and it must not become the norm.

"Hackers working for the Chinese government compromised more than a dozen U.S. pipeline operators nearly a decade ago, the Biden administration revealed Tuesday while also issuing first-of-its-kind cybersecurity requirements on the pipeline industry," reports the Wall Street Journal. The disclosure of previously classified information about the aggressive Chinese hacking campaign, though dated, underscored the severity of foreign cyber threats to the nation's infrastructure, current and former officials said. In some cases, the hackers possessed the ability to physically damage or disrupt compromised pipelines, a new cybersecurity alert said, though it doesn't appear they did so. Previously, senior administration officials had warned that China, Russia and others were capable of such cyber intrusions. But rarely has so much information been released about a specific and apparently successful campaign.

Chinese state-sponsored hackers between 2011 and 2013 had targeted nearly two dozen U.S. oil and natural gas pipeline operators with the specific goal of "holding U.S. pipeline infrastructure at risk," the Federal Bureau of Investigation and the Department of Homeland Security said in Tuesday's joint alert. Of the known targets, 13 were successfully compromised and an additional eight suffered an "unknown depth of intrusion," which officials couldn't fully assess because the victims lacked complete computer log data, the alert said. Another three targets were described as "near misses" of the Chinese campaign, which relied heavily on spear phishing attacks.
Newsweek adds that the same day the U.S. Department of Homeland Security "announced new requirements for U.S. pipeline operators to bolster cybersecurity following a May ransomware attack that disrupted gas delivery across the East Coast." In a statement, DHS said it would require operators of federally designated critical pipelines to implement "specific mitigation measures" to prevent ransomware attacks and other cyber intrusions. Operators must also implement contingency plans and conduct what the department calls a "cybersecurity architecture design review."

U.S. Rep. Earl Blumenauer (D-Oregon) plans to introduce legislation called the Securing Protections Against Carbon Emissions (SPACE) Tax Act, which would impose new excise taxes on space tourism trips. Space.com reports: "Space exploration isn't a tax-free holiday for the wealthy. Just as normal Americans pay taxes when they buy airline tickets, billionaires who fly into space to produce nothing of scientific value should do the same, and then some," Blumenauer said in a statement issued by his office. "I'm not opposed to this type of space innovation," added Blumenauer, a senior member of the House of Representatives' Ways and Means Committee. "However, things that are done purely for tourism or entertainment, and that don't have a scientific purpose, should in turn support the public good."

The proposed new tax would likely be levied on a per-passenger basis, as is done with commercial aviation, the statement said. "Exemptions would be made available for NASA spaceflights for scientific research purposes," the statement reads. "In the case of flights where some passengers are working on behalf of NASA for scientific research purposes and others are not, the launch excise tax shall be the pro rata share of the non-NASA researchers." There would be two taxation tiers, one for suborbital flights and another for missions that reach orbit. The statement did not reveal how much the tax would be in either case or if the collected revenue would be earmarked for any specific purpose. Such a purpose could be the fight against climate change, if the proposed act's full name is any guide. Blumenauer is concerned about the potential carbon footprint of the space tourism industry once it gets fully up and running, the statement said.

Criminals have hacked into a Gumtree-style website used for buying and selling firearms, making off with a 111,000-entry database containing partial information from a CRM product used by gun shops across the UK. The Register reports: The Guntrader breach earlier this week saw the theft of a SQL database powering both the Guntrader.uk buy-and-sell website and its electronic gun shop register product, comprising about 111,000 users and dating between 2016 and 17 July this year. The database contains names, mobile phone numbers, email addresses, user geolocation data, and more including bcrypt-hashed passwords. It is a severe breach of privacy not only for Guntrader but for its users: members of the UK's licensed firearms community. Guntrader spokesman Simon Baseley told The Register that Guntrader.uk had emailed all the users affected by the breach on July 21 and issued a further update yesterday.

Guntrader is roughly similar to Gumtree: users post ads along with their contact details on the website so potential purchasers can get in touch. Gun shops (known in the UK as "registered firearms dealers" or RFDs) can also use Guntrader's integrated gun register product, which is advertised as offering "end-to-end encryption" and "daily backups", making it (so Guntrader claims) "the most safe and secure gun register system on today's market." [British firearms laws say every transfer of a firearm (sale, drop-off for repair, gift, loan, and so on) must be recorded, with the vast majority of these also being mandatory to report to the police when they happen...]

The categories of data in the stolen database are: Latitude and longitude data; First name and last name; Police force that issued an RFD's certificate; Phone numbers; Fax numbers; bcrypt-hashed passwords; Postcode; Postal addresses; and User's IP addresses. Logs of payments were also included, with Coalfire's Barratt explaining that while no credit card numbers were included, something that looks like a SHA-256 hashed string was included in the payment data tables. Other payment information was limited to prices for rifles and shotguns advertised through the site. The Register recommends you check if your data is included in the hack by visiting Have I Been Pwned. If you are affected and you used the same password on Guntrader that you used on other websites, you should change it as soon as possible.

The CEO of NSO Group, whose spyware tools have reportedly been used to target journalists and activists, says that people who aren't criminals shouldn't be afraid of being surveilled AppleInsider reports: Shalev Hulio, 39, recently spoke to Forbes after investigations indicated that NSO Group's Pegasus spyware was used by authoritarian governments to hack and surveil the mobile devices of world leaders, high-profile journalists, and activists. NSO Group says that it sells its tools to governments to help them catch serious criminals like terrorists or gangsters. However, Hulio admitted that it can't control what governments ultimately do with the tools. "We are selling our products to governments. We have no way to monitor what those governments do," he said.

Hulio did note that NSO Group has mechanisms in place to detect when abuse happens so that the company can "shut them down." He says that NSO Group has "done it before and will continue to do so. On the other hand, he said that NSO Group shouldn't be responsible for government misuse. Additionally, Hulio said that the average smartphone has nothing to worry about. While NSO Group's spyware can break into the latest iPhones running up-to-date software, often without any action from the user, it's only aimed at criminals. "The people that are not criminals, not the Bin Ladens of the world -- there's nothing to be afraid of. They can absolutely trust on the security and privacy of their Google and Apple devices," Hulio said.

An anonymous reader quotes a report from Ars Technica: SpaceX can keep launching broadband satellites despite a lawsuit filed by Viasat, a federal appeals court ruled Tuesday. Viasat sued the Federal Communications Commission in May and asked judges for a stay that would halt SpaceX's ongoing launches of low Earth orbit (LEO) satellites that power Starlink Internet service. To get a stay, Viasat had to show that it is likely to win its lawsuit alleging that the FCC improperly approved the satellite launches. A three-judge panel at the US Court of Appeals for the District of Columbia Circuit was not persuaded, saying in a short order that "Viasat has not satisfied the stringent requirements for a stay pending court review." The judges did grant a motion to expedite the appeal, however, so the case should move faster than normal.