McDonald's equiped 10 of its restaurants in Chicago with automated speech-recognition for their drive-through windows. Now they're facing a potential class-action lawsuit. Long-time Slashdot reader KindMind shares this report from the Register: McDonald's has been accused of illegally collecting and processing customers' voice recordings without their consent in the U.S. state of Illinois... The state has some of the strictest data privacy laws; its Biometric Information Privacy Act (BIPA) states: "No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information." unless it receives written consent.

Shannon Carpenter, a resident of Illinois, sued [PDF] McDonald's in April on behalf of himself and all other affected state residents. He claimed the fast-chow biz has broken BIPA by not obtaining written consent from its customers to collect and process their voice data, nor has it explained in its privacy policy how or if the data is stored or deleted. His lawsuit also stated that McDonald's has been experimenting with AI software taking orders at its drive thrus since last year.

"Plaintiff, like the other class members, to this day does not know the whereabouts of his voiceprint biometrics which defendant obtained," Carpenter's lawsuit stated. Under the BIPA, people can receive up to $5,000 in damages from private entities for each violation committed "intentionally or recklessly," or $1,000 if each violation was from negligence instead.

The suit also claimed the machine-learning software built by McD Tech Labs doesn't just transcribe speech into text, it processes audio samples to glean all sorts of personal information to predict a customer's "age, gender, accent, nationality, and national origin."

An anonymous reader quotes a report from The Wall Street Journal: The Biden administration launched an initiative Thursday aiming to make more government data available to artificial intelligence researchers, part of a broader push to keep the U.S. on the cutting edge of the crucial new technology. The National Artificial Intelligence Research Resource Task Force, a group of 12 members from academia, government, and industry led by officials from the White House Office of Science and Technology Policy and the National Science Foundation, will draft a strategy for potentially giving researchers access to stores of data about Americans, from demographics to health and driving habits. They would also look to make available computing power to analyze the data, with the goal of allowing access to researchers across the country. The task force, which Congress mandated in the National Artificial Intelligence Initiative Act of 2020, is part of an effort across the government to ensure the U.S. remains at the vanguard of technological advancements.

Many researchers, particularly in academia, simply don't have access to these computational resources and data, and this is hampering innovation. One example: The Transportation Department has access to a set of data gathered from vehicle sensors about how people drive, said Erwin Gianchandani, senior adviser at the National Science Foundation and co-chairman of the new AI task force. "Because you have very sensitive data about individuals, there are challenges in being able to make that data available to the broader research community," he said. On the other hand, if researchers could get access, they could develop innovations designed to make driving safer. Census data, medical records, and other data sets could also potentially be made available for research by both private companies and academic institutions, officials said. They said the task force will evaluate how to make such data available while protecting Americans' privacy and addressing other ethical concerns.

A federal judge granted a preliminary order blocking New York state from enforcing a law that requires internet service providers to offer high-speed broadband service to low-income customers at a discount. From a report: U.S. District Judge Denis Hurley in Central Islip, New York, sided with telecom industry groups representing AT&T and Verizon, which sued to block the law. The legislation was enacted in April as part of the state's 2022 budget.

An anonymous reader quotes a report from Ars Technica: Amazon and a who's who of online-only retailers are trying to kill proposed federal and state legislation that would make the companies disclose contact information for third-party sellers. The bills would force Amazon and others to verify the identities of third-party sellers and provide consumers with ways to contact the stores. The proposed legislation is pitting brick-and-mortar retailers -- including Home Depot, Walgreens, and JC Penney, which support the bills -- against online retailers like Amazon, Etsy, eBay, Poshmark, and others, which argue that the legislation would harm small sellers. [...] The online retailers argue that the bills would compromise the privacy of third-party sellers. On some platforms, the majority of merchants run their businesses out of their homes. Etsy, for example, says 97 percent of its sellers do. A survey of Amazon sellers found that 70 percent have work outside of their Amazon businesses, suggesting that they, too, run the business from their homes.

That anonymity, though, provides cover for fraudsters. It's not uncommon to find counterfeit and potentially harmful items on marketplace sites. In 2018, the Government Accountability Office ordered 47 items, including shoes, travel mugs, cosmetics, and phone chargers, from third-party sellers on "popular consumer websites" and determined that 20 of them were counterfeit. Even non-counterfeit items bought from third-party sellers have been implicated in consumer harm. In April 2018, a 19-month-old in Texas was injured after ingesting a battery that fell out of a loose battery compartment in a third-party Apple TV remote. The parents asked Amazon to stop selling the defective product and requested contact information for Hu Xi Jie, who ran the Amazon store "USA Shopping 7693" that sold the remote. Hu Xi Jie never responded, and Amazon was not able to locate the individual. The parents sued Amazon in Texas state court, arguing that the retailer is liable for the defective product. Amazon, on the other hand, says it serves as a middleman and bears no liability. It's that argument, among others, that has brick-and-mortar retailers pushing for changes. Consumer product laws hold businesses like Target and Home Depot liable for injuries if the stores do not take sufficient measures to keep defective products from reaching consumers. Online marketplaces haven't been subject to those rules since they don't control third-party sellers.

McDonald's said hackers stole some data from its systems in markets including the U.S., South Korea and Taiwan, in another example of cybercriminals infiltrating high-profile global companies. From a report: The burger chain said Friday that it recently hired external consultants to investigate unauthorized activity on an internal security system, prompted by a specific incident in which the unauthorized access was cut off a week after it was identified, McDonald's said. The investigators discovered that company data had been breached in markets including the U.S., South Korea and Taiwan, the company said. In a message to U.S. employees, McDonald's said the breach disclosed some business contact information for U.S. employees and franchisees, along with some information about restaurants such as seating capacity and the square footage of play areas.

The company said no customer data was breached in the U.S., and that the employee data exposed wasn't sensitive or personal. The company advised employees and franchisees to watch for phishing emails and to use discretion when asked for information. McDonald's said attackers stole customer emails, phone numbers and addresses for delivery customers in South Korea and Taiwan. In Taiwan, hackers also stole employee information including names and contact information, McDonald's said. The company said the number of files exposed was small without disclosing the number of people affected. The breach didn't include customer payment information, McDonald's said.

Volkswagen says more than 3.3 million customers had their information exposed after one of its vendors left a cache of customer data unsecured on the internet. From a report: The car maker said in a letter that the vendor, used by Volkswagen, its subsidiary Audi, and authorized dealers in the U.S. and Canada, left the customer data spanning 2014 to 2019 unprotected over a two-year window between August 2019 and May 2021. The data, which Volkswagen said was gathered for sales and marketing, contained personal information about customers and prospective buyers, including their name, postal and email addresses, and phone number. But more than 90,000 customers across the U.S. and Canada also had more sensitive data exposed, including information relating to loan eligibility. The letter said most of the sensitive data was driver's license numbers, but that a "small" number of records also included a customer's date of birth and Social Security numbers.

U.S. Senate Majority Leader Chuck Schumer on Thursday said he is initiating a review of recent high-profile cyber attacks on governments and businesses to find out whether a legislative response is needed. From a report: "Today I am asking Chairman Gary Peters of our Homeland Security Committee and our other relevant committee chairs to begin a government-wide review of these attacks and determine what legislation may be needed to counter the threat of cyber crime and bring the fight to the cyber criminals." Schumer noted that the New York City subway system was the victim of a computer hack in early June. This came on the heels of Colonial Pipeline having to shut down some operations, resulting in disrupted fuel supplies in the U.S. Southeast, as a result of a cyber attack.

A Texas man who had boasted that he was at the United States Capitol when swarms of Trump supporters stormed the building on Jan. 6 pleaded guilty on Wednesday to charges of plotting to blow up an Amazon data center in Virginia, prosecutors said. The New York Times reports: The man, Seth Aaron Pendley, 28, of Wichita Falls, Texas, had been arrested in April after he went to pick up what he believed were bombs made of C-4 plastic explosives and detonation cords from an explosives supplier in Fort Worth, but were actually inert objects provided by an undercover F.B.I. agent, prosecutors said. In a conversation recorded by an undercover agent on March 31, Mr. Pendley said he had hoped to anger "the oligarchy" enough to provoke a reaction that would persuade Americans to take action against what he perceived to be a "dictatorship," prosecutors said.

On Wednesday, in an appearance before Magistrate Judge Hal R. Ray Jr. of U.S. District Court for the Northern District of Texas, Mr. Pendley pleaded guilty to a malicious attempt to destroy a building with an explosive. He faces five to 20 years in federal prison. His sentencing has been set for Oct. 1. "Due in large part to the meticulous work of the F.B.I.'s undercover agents, the Justice Department was able to expose Mr. Pendley's twisted plot and apprehend the defendant before he was able to inflict any real harm," Prerak Shah, the acting U.S. attorney for the Northern District of Texas, said in a statement. "We may never know how many tech workers' lives were saved through this operation -- and we're grateful we never had to find out."

Ring gets a lot of criticism, not just for its massive surveillance network of home video doorbells and its problematic privacy and security practices, but also for giving that doorbell footage to law enforcement. While Ring is making moves towards transparency, the company refuses to disclose how many users had their data given to police. From a report: The video doorbell maker, acquired by Amazon in 2018, has partnerships with at least 1,800 U.S. police departments (and growing) that can request camera footage from Ring doorbells. Prior to a change this week, any police department that Ring partnered with could privately request doorbell camera footage from Ring customers for an active investigation. Ring will now let its police partners publicly request video footage from users through its Neighbors app. The change ostensibly gives Ring users more control when police can access their doorbell footage, but ignores privacy concerns that police can access users' footage without a warrant. [...] Ring received over 1,800 legal demands during 2020, more than double from the year earlier, according to a transparency report that Ring published quietly in January. Ring does not disclose sales figures but says it has "millions" of customers. But the report leaves out context that most transparency reports include: how many users or accounts had footage given to police when Ring was served with a legal demand? When reached, Ring declined to say how many users had footage obtained by police.

According to the BBC, details claiming to reveal how little U.S. billionaires pay in income tax have been leaked to investigative website ProPublica. From the report: ProPublica says it has seen the tax returns of some of the world's richest people, including Jeff Bezos, Elon Musk and Warren Buffett. The website alleges Amazon's Mr Bezos paid no tax in 2007 and 2011, while Tesla's Mr Musk's paid nothing in 2018. The FBI and tax authorities are looking into the source of the leak. ProPublica said it was analyzing what it called a "vast trove of Internal Revenue Service data" on the taxes of the billionaires, and would release further details over coming weeks.

ProPublica said the richest 25 Americans pay less in tax -- an average of 15.8% of adjusted gross income -- than most mainstream US workers. The website said: "Using perfectly legal tax strategies, many of the uber-rich are able to shrink their federal tax bills to nothing or close to it." The wealthy, as with many ordinary citizens, are able to reduce their income tax bills via such things as charitable donations and drawing money from investment income rather wage income.

An anonymous reader quotes a report from The Hill: Ohio Attorney General Dave Yost (R) on Tuesday filed a lawsuit asking the court to declare Google a public utility, which would subject the Silicon Valley giant to government regulation. Yost's complaint, filed in Delaware County Court, alleges Google has used its dominance as a search engine to prioritize its own products over "organic search results" in a way that "intentionally disadvantages competitors." "Google uses its dominance of internet search to steer Ohioans to Google's own products -- that's discriminatory and anti-competitive," Yost said in a statement. "When you own the railroad or the electric company or the cellphone tower, you have to treat everyone the same and give everybody access." The complaint alleges that as a result of Google's "self-preferencing Results-page architecture," nearly two-thirds of Google searches in 2020 were completed without users leaving Google-owned platforms, meaning users either never left the search page, or clicked to another Google platform such as YouTube, Google Flights, Google Maps, Google News, Google Shopping or Google Travel. A Google spokesperson said Yost's lawsuit would "make Google Search results worse and make it harder for small businesses to connect directly with customers." They added: "Ohioans simply don't want the government to run Google like a gas or electric company. This lawsuit has no basis in fact or law and we'll defend ourselves against it in court."

The EU is facing a backlash over new AI rules that allow for limited use of facial recognition by authorities -- with opponents warning the carveouts could usher in a new age of biometric surveillance. From a report: A coalition of digital rights and consumer protection groups across the globe, including Latin America, Africa and Asia are calling for a global ban on biometric recognition technologies that enable mass and discriminatory surveillance by both governments and corporations. In an open letter, 170 signatories in 55 countries argue that the use of technologies like facial recognition in public places goes against human rights and civil liberties. "It shows that organizations, groups, people, activists, technologists around the world who are concerned with human rights, agree to this call," said Daniel Leufer of U.S. digital rights group Access Now, which co-authored the letter. The use of facial recognition technology is becoming widespread. But along with everyday applications like unlocking phones, it's increasingly being used by governments and companies to surveil people, whether by law enforcement to scan public places for criminals or by grocery stores claiming to use it to catch thieves. The letter is in part a response to the EU's AI bill that restricts the practice, but does not prohibit it outright.

Apple on Monday said a new "private relay" feature designed to obscure a user's web browsing behavior from internet service providers and advertisers will not be available in China for regulatory reasons. From a report: The feature was one of a number of privacy protections Apple announced at its annual software developer conference on Monday, the latest in a years-long effort by the company to cut down on the tracking of its users by advertisers and other third parties. Apple's decision to withhold the feature in China is the latest in a string of compromises the company has made on privacy in a country that accounts for nearly 15% of its revenue.

In 2018, Apple moved the digital keys used to lock Chinese users' iCloud data, allowing authorities to work through domestic courts to gain access to the information. China's ruling Communist Party maintains a vast surveillance system to keep a close eye on how citizens use the country's heavily controlled internet. Under President Xi Jinping, the space for dissent in China has narrowed, while censorship has expanded. Apple's "private relay" feature first sends web traffic to a server maintained by Apple, where it is stripped of a piece of information called an IP address. From there, Apple sends the traffic to a second server maintained by a third-party operator who assigns the user a temporary IP address and sends the traffic onward to its destination website.

An anonymous reader quotes a report from TechCrunch: Twitter disclosed on Monday that it blocked four accounts in India to comply with a new legal request from the Indian government. The American social network disclosed on Lumen Database, a Harvard University project, that it took action on four accounts -- including those of hip-hop artist L-Fresh the Lion and singer and song-writer Jazzy B -- to comply with a legal request from the Indian government it received over the weekend. The accounts are geo-restricted within India but accessible from outside of the South Asian nation. (As part of their transparency efforts, some companies including Twitter and Google make requests and orders they receive from governments and other entities public on Lumen Database.)

All four accounts, like several others that the Indian government ordered to be blocked in the country earlier this year, had protested New Delhi's agriculture reforms and some had posted other tweets that criticized Prime Minister Narendra Modi's seven years of governance in India, an analysis by TechCrunch found. The new legal request, which hasn't been previously reported, comes at a time when Twitter is making efforts to comply with the Indian government's new IT rules, new guidelines that several of its peers including Facebook and Google have already complied with. On Saturday, India's Ministry of Electronics and Information Technology had given a "final notice" to Twitter to comply with its new rules, which it unveiled in February this year. The new rules require significant social media firms to appoint and share contact details of representatives tasked with compliance, nodal point of reference and grievance redressals to address on-ground concerns. Last month, police in Delhi visited Twitter offices to "serve a notice" to Twitter's India head. Twitter responded by calling the visit a form of intimidation, and requested the government respect citizens' rights to free speech.

On Monday, the Federal Trade Commission charged the executives of the long-defunct MoviePass app over allegations that they fraudulently blocked customers from using the service as advertised while failing to protect their data privacy. The FTC also announced that it had reached a settlement with MoviePass and its executives as a result of the investigation. The Verge reports: Under the proposed settlement, MoviePass, its parent company Helios and Matheson Analytics, its CEO Mitch Lowe, and chairman Ted Farnsworth are forbidden from falsely representing their business and data security practices to customers. Any businesses controlled by these entities are also required to roll out comprehensive information security programs to protect consumers. "MoviePass and its executives went to great lengths to deny consumers access to the service they paid for while also failing to secure their personal information," Daniel Kaufman, FTC acting director of the Bureau of Consumer Protection said in a statement Monday. "The FTC will continue working to protect consumers from deception and to ensure that businesses deliver on their promises."

The FTC's complaint accuses the company of deceptively marketing its "one movie per day" service to subscribers and barring customers from using the service as advertised. It also alleges that the company falsely invalidated customer passwords over "suspicious activity or potential fraud" in order to ban frequent moviegoers from the service. The FTC also says that MoviePass initiated a ticket verification program as a means of discouraging people from using the service. As part of the settlement, MoviePass' operators must put comprehensive data security programs into place in any future ventures after saving MoviePass customer data in plain text, the FTC said.

An anonymous reader quotes a report from BleepingComputer: The latest Notepad++ release has removed support for Bing search from the app after the "tank man" fiasco Microsoft had to deal with on Friday afternoon. "Microsoft Bing is removed from Notepad++ settings for Search on Internet command, due to its poor reliability," the Notepad++ v8 announcement reads. Don Ho, the creator of Notepad++, one of the most popular open-source Notepad replacements, revealed on GitHub that the motivation behind this decision is Bing censoring results instead of doing "its job." "When a search engine does the censorship instead of its job, the search result loses its quality and it's not reliable anymore," Don Ho said in the GitHub commit removing Bing support. "Hence, Microsoft Bing is removed from Notepad++ for "Search on Internet" command." "While there was no immediate explanation to the problem, it is a widely known fact that China forces companies with businesses within its borders to abide by its censorship rules requiring to block references to China's 1989 crackdown on Tiananmen Square protests," notes BleepingComputer. A Microsoft spokesperson said it was "due to an accidental human error."

In August 2020, China banned Notepad++ after Don Ho protested against China's human rights violations of the Uyghur people and the Hong Kong political unrest by releasing two versions dubbed 'Stand with Hong Kong' and 'Free Uyghur.'

At WWDC today, Apple announced an update to its Wallet app that will let you add information from an ID card in certain supported U.S. states. One of the first partners to support the digital identities will be the U.S. Transportation Security Administration. AppleInsider reports: All of the information in Wallet will be stored in a secure and encrypted fashion. Like an actual ID, it will include a person's legal name, date of birth, photo, and Real ID status. In addition to the support for IDs, Apple is also expanding the types of keys that users can add to Wallet. That includes keys to a smart home lock, keys to hotel rooms, and work badges that can be scanned to gain entry to a workplace. For example, Hyatt is rolling out its support for digital keys in Wallet to more than 1,000 properties later in 2021. The company says your license or state ID will be encrypted and stored in the iPhone's secure enclave. It's also working on adding features for unlocking cars from various manufacturers using their ultra-wideband chip (UWB) found in the new iPhones and Apple Watches.

Apple is rolling out some updates to iCloud under the name iCloud+. Existing paid iCloud users are going to get those iCloud+ features for the same monthly subscription price. From a report: In Safari, Apple is going to launch a new privacy feature called Private Relay. It sounds a bit like the new DNS feature that Apple has been developing with Cloudflare. Originally named Oblivious DNS-over-HTTPS, Private Relay could be a better name for something quite simple -- a combination of DNS-over-HTTPS with proxy servers. When Private Relay is turned on, nobody can track your browsing history -- not your internet service provider, anyone standing in the middle of your request between your device and the server you're requesting information from.

The second iCloud+ feature is 'Hide my email.' It lets you generate random email addresses when you sign up to a newsletter or when you create an account on a website. If you've used 'Sign in with Apple,' you know that Apple offers you the option to use fake iCloud email addresses. This works similarly, but for any app. Finally, Apple is overhauling HomeKit Secure Video. With the name iCloud+, Apple is separating free iCloud users from paid iCloud users. Basically, you used to pay for more storage. Now, you pay for more storage and more features. Subscriptions start at $0.99 per month for 50GB (and iCloud+ features).

Lisa Hone, a longtime Federal Communications Commission attorney with deep expertise in broadband policy, has joined the National Economic Council team to steer the Biden administration's broadband expansion efforts. From a report: Expanding broadband internet service to all Americans is a top priority for the Biden White House. Hone's primary focus is ensuring that money Congress allocated through the American Rescue Plan Act is spent appropriately. The administration is trying to include broadband in infrastructure legislation, as the pandemic underscored the importance of reliable and affordable broadband connections to Americans' ability to participate in remote school, work, tele-health and e-commerce. Hone, who officially started her job as as senior adviser for broadband and technology policy last week, is now the White House's point person on broadband deployment efforts happening across the government.

An anonymous reader quotes Ars Technica: The now-unemployed owner of a shuttered ROM distribution site has been ordered to pay $2.1 million in damages to Nintendo after trying and failing to defend himself in the case.

In September 2019, Nintendo filed a lawsuit against Los Angeles resident Matthew Storman over his operation of RomUniverse.com, which offered prominent downloads of "Nintendo Switch Scene Roms" and other copyrighted game files. At the time, Nintendo said that the site had been "among the most visited and notorious online hubs for pirated Nintendo video games" for "over a decade." Storman has admitted that, in 2019, the site made up the bulk of his $30,000 to $36,000 a year in income. This included direct revenue from the sale of "premium unlimited accounts" for $30 per year that provided users with faster downloads and no limits.

By the time Storman signed a September 2020 agreement with Nintendo to shut the site down, he said he was deriving $800 a month from the site. According to court documents, Storman's income is now derived primarily from "unemployment and food stamps."

In a motion for dismissal, Storman invoked the "safe harbor" protections of the Digital Millennium Copyright Act (DMCA), arguing that he was just a neutral service provider for users sharing files. He also pointed out that he had agreed to Nintendo's DMCA takedown requests in the past. During a deposition, though, Nintendo got Storman to admit that he had uploaded Nintendo's copyrighted ROM files himself, obliterating any attempts at a "safe harbor" claim...

While Nintendo originally claimed that RomUniverse was responsible for "hundreds of thousands" of copyrighted downloads, that number was lowered to 50,000 based on evidence gleaned from screenshots of the site. Nintendo argued that each download cost it between $20 and $60 (the average cost of new games it sells) and that it had therefore lost between $1 and $3 million in revenue.