Security researcher Gabi Cirlig's findings, verified for Forbes by two other independent researchers, reveal that on both Android and iOS versions of UC Browser, every website a user visits, regardless of whether they're in incognito mode or not, is sent to servers owned by UCWeb. From a report: Cirlig said IP addresses -- which could be used to get a user's rough location down to the town or neighborhood of the user -- were also being sent to Alibaba-controlled servers. Those servers were registered in China and carried the .cn Chinese domain name extension, but were hosted in the U.S. An ID number is also assigned to each user, meaning their activity across different websites could effectively be monitored by the Chinese company, though it's not currently clear just what Alibaba and its subsidiary are doing with the data.

"This could easily fingerprint users and tie them back to their real personas," Cirlig wrote in a blog post handed to Forbes ahead of publication on Tuesday. Cirlig was able to uncover the problem by reverse engineering some encrypted data he spotted being sent back to Beijing. Once the key had been cracked, he was able to see that every time he visited a website, it was being encrypted and transmitted back to the Alibaba company. On Apple's iOS, he didn't even need to reverse engineer the encryption because there effectively was none on the device (though it was encrypted when in transit). "This kind of tracking is done on purpose without any regard for user privacy," Cirlig told Forbes. When compared to Google's own Chrome browser, for instance, it does not transfer user web browsing habits when in incognito. Cirlig said he'd looked at other major browsers and found none did the same as UC Browser.

An anonymous reader quotes a report from Ars Technica: The now-unemployed owner of a shuttered ROM distribution site has been ordered to pay $2.1 million in damages to Nintendo after trying and failing to defend himself in the case. In September 2019, Nintendo filed a lawsuit against Los Angeles resident Matthew Storman over his operation of RomUniverse.com, which offered prominent downloads of "Nintendo Switch Scene Roms" and other copyrighted game files. At the time, Nintendo said that the site had been "among the most visited and notorious online hubs for pirated Nintendo video games" for "over a decade."
[...]
In providing summary judgment for Nintendo (as noted by Torrent Freak), the judge suggested that this was a clear case of infringement, one in which "there is no genuine issue of material fact that Plaintiff owns the copyrighted works and Defendant copied the works." While Nintendo sought $4.41 million in copyright damages -- or $90,000 each for 49 games -- the judge lowered the amount to $1.715 million ($35,000 per work). That amount should be sufficient to "compensate Plaintiff for its lost revenue and deter Defendant who is currently unemployed and has already shut down the website," the judge wrote. The judge also awarded an additional $400,000 for RomUniverse's use of Nintendo's trademarked box art, down from a massive $11.2 million ask. But Storman avoided a permanent injunction on "future infringement," with the judge suggesting that there was no "irreparable harm" given the monetary damages and the fact that the site had already been shuttered. Storman invoked the "safe harbor" protections of the Digital Millennium Copyright Act (DMCA), but Nintendo got him to admit that he had uploaded Nintendo's copyrighted ROM files himself. "Another attempted Storman defense based on the 'first sale doctrine' also failed to go anywhere, since the site was distributing copies rather than Storman's personal property," adds Ars.

Companies have spent more than a decade forcing employees and customers to resolve disputes outside the traditional court system, using secretive arbitration proceedings that typically don't allow plaintiffs to team up and extract big-money payments akin to a class action. Now, Amazon is bucking that trend. From a report: With no announcement, the company recently changed its terms of service to allow customers to file lawsuits. Already, it faces at least three proposed class actions, including one brought May 18 alleging the company's Alexa-powered Echo devices recorded people without permission.

The retail giant made the change after plaintiffs' lawyers flooded Amazon with more than 75,000 individual arbitration demands on behalf of Echo users. That move triggered a bill for tens of millions of dollars in filing fees, according to lawyers involved, payable by Amazon under its own policies. Amazon's decision to drop its arbitration requirement is the starkest example yet of how companies are responding to plaintiffs' lawyers pushing the arbitration system to its limits. Arbitration agreements are buried in the contracts consumers sign to do everything from buying a cellphone to using a ride-hailing app. Many employers also require arbitration for adjudicating issues like pay disputes or discrimination claims. The U.S. Supreme Court has repeatedly upheld and strengthened the rights of companies to mandate arbitration.

If you use Alexa, Echo, or any other Amazon device, you have just over a week to opt out of an experiment that leaves your personal privacy and security hanging in the balance. From a report: On June 8, the merchant, Web host, and entertainment behemoth will automatically enroll the devices in Amazon Sidewalk. The new wireless mesh service will share a small slice of your Internet bandwidth with nearby neighbors who don't have connectivity and help you to their bandwidth when you don't have a connection.

By default, Amazon devices including Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers will enroll in the system. And since only a tiny fraction of people take the time to change default settings, that means millions of people will be co-opted into the program whether they know anything about it or not. The Amazon webpage linked above says Sidewalk "is currently only available in the US." [...] Amazon has published a white paper detailing the technical underpinnings and service terms that it says will protect the privacy and security of this bold undertaking. To be fair, the paper is fairly comprehensive, and so far no one has pointed out specific flaws that undermine the encryption or other safeguards being put in place. But there are enough theoretical risks to give users pause.

Denmark's foreign secret service allowed the US National Security Agency to tap into a crucial internet and telecommunications hub in Denmark and spy on the communications of European politicians, a joint investigation by some of Europe's biggest news agencies revealed on Sunday. From a report: The covert spying operation, called Operation Dunhammer, took place between 2012 and 2014, based on a secret partnership signed by the two agencies. The secret pact, signed between the NSA and the Danish Defense Intelligence Service (Danish: Forsvarets Efterretningstjeneste, FE) allowed US spies to deploy a data interception system named XKeyscore on the network of Sandagergardan, an important internet and communications hub in the city of Dragor, near Copenhagen, where several key submarine cables connected Denmark (and continental Europe) to the Scandinavian peninsula.

The NSA allegedly used XKeyscore to mass-sniff internet and mobile traffic and intercept communications such as emails, phone calls, SMS texts, and chat messages sent to the phone numbers and email addresses of European politicians. The covert operation abruptly stopped in 2014 after Danish government officials learned of the NSA-FE collaboration following the Snowden leaks. Danish officials put a stop to the operation after they learned that the NSA had also spied on Danish government members.

NBC News reports: Facebook is grappling with a reputation crisis in the Middle East, with plummeting approval rates and advertising sales in Arab countries, according to leaked documents obtained by NBC News.

The shift corresponds with the widespread belief by pro-Palestinian and free speech activists that the social media company has been disproportionately silencing Palestinian voices on its apps — which include Facebook, Instagram and WhatsApp — during this month's Israel-Hamas conflict... Instagram has taken the greatest reputational hit, according to a presentation authored by a Dubai-based Facebook employee that was leaked to NBC News, with its approval ratings among users falling to a historical low.

The social media company regularly polls users of Facebook and Instagram about how much they believe the company cares about them. Facebook converts the results into a 'Cares About Users' metric which acts as a bellwether for the apps' popularity. Since the start of the latest Israel-Hamas conflict, the metric among Instagram users in Facebook's Middle East and North Africa region is at its lowest in history, and fell almost 5 percentage points in a week, according to the research... Instagram's score measuring whether users think the app is good for the world, referred to as 'Good For World,' has also dropped in the region to its lowest level after losing more than 5 percentage points in a week...

The low approval ratings have been compounded by a campaign by pro-Palestinian and free speech activists to target Facebook with 1-star reviews on the Apple and Google app stores. The campaign tanked Facebook's average rating from above 4 out of 5 stars on both app stores to 2.2 on the App Store and 2.3 on Google Play as of Wednesday. According to leaked internal posts, the issue has been categorized internally as a "severity 1" problem for Facebook, which is the second highest priority issue after a "severity 0" incident, which is reserved for when the website is down. "Users are feeling that they are being censored, getting limited distribution, and ultimately silenced," one senior software engineer said in a post on Facebook's internal message board. "As a result, our users have started protesting by leaving 1 star reviews."

Internal documents connect the reputational damage to a decline in advertising sales in the Middle East. According to the leaked presentation, Facebook's ad sales in the United Arab Emirates, Egypt, Morocco, Saudi Arabia, Kuwait, Qatar and Iraq dropped at least 12 percent in the 10 days after May 7.
NBC adds that pro-Palestinian civil society group believe Israel is flooding Facebook with reports of violations. "The Israeli government is spending millions on digital tools and campaigns targeting social media content," said Mona Shtaya from 7amleh, a nonprofit that focuses on Palestinians' digital rights.

The article points out that Israel "also funds a program that pays students to post and report content on social media in what is described as 'online public diplomacy.'"

In the latest SolarWinds mass-phishing attack, "The highest percentage of emails went to the United States, but [incident response firm] Volexity also saw a significant number of victims in Europe..." according to Security Week.

In an article shared by Slashdot reader wiredmikey, they note that the attackers apparently compromised the Constant Contact account of USAID, an independent agency of the United States federal government that is primarily responsible for administering civilian foreign aid and development assistance — and then impersonated it in emails "to roughly 3,000 accounts across over 150 organizations in 24 countries."

So what happens next?

The Associated Press reports: The White House says it believes U.S. government agencies largely fended off the latest cyberespionage onslaught blamed on Russian intelligence operatives, saying the spear-phishing campaign should not further damage relations with Moscow ahead of next month's planned presidential summit. Officials downplayed the cyber assault as "basic phishing" in which hackers used malware-laden emails to target the computer systems of U.S. and foreign government agencies, think tanks and humanitarian groups.

Microsoft, which disclosed the effort late Thursday, said it believed most of the emails were blocked by automated systems that marked them as spam. As of Friday afternoon, the company said it was "not seeing evidence of any significant number of compromised organizations at this time."

Even so, the revelation of a new spy campaign so close to the June 16 summit between President Joe Biden and Russian counterpart Vladimir Putin adds to the urgency of White House efforts to confront the Kremlin over aggressive cyber activity that criminal indictments and diplomatic sanctions have done little to deter. "I don't think it'll create a new point of tension because the point of tension is already so big," said James Lewis, a senior vice president at the Center for Strategic and International Studies. "This clearly has to be on the summit agenda. The president has to lay down some markers" to make clear "that the days when you people could do whatever you want are over."
There's a famous story about Vladimir Putin meeting Joe Biden back in 2011. A decade earlier former U.S. president George W. Bush had said when he'd looked Putin in the eye, "I was able to get a sense of his soul." But as Biden tells it, when he'd met Putin (who was then Russia Prime Minister), "I said, 'Mr. Prime Minister, I'm looking into your eyes, and I don't think you have a soul.'"

"He looked back at me, and he smiled, and he said, 'We understand one another.'"

A birthday party for 17-year-old Adrian Lopez turned into a viral TikTok event that drew thousands of unruly party-goers to Huntington Beach, California, reports the Los Angeles Times.

Just not Adrian Lopez, "who in the days leading up to the party was increasingly nervous about all the attention." When it was over, more than 175 people were arrested, city officials and merchants were adding up the damage, and everyone was wondering who should be blamed and who should be billed...

The high schooler's invitation was picked up by TikTok's "For You" algorithm and viewed by people across the country. The announcement was curious: Who was this mystery teen, and would anyone actually go to his party? Some TikTok users, including internet celebrities, began posting about it, and videos with the hashtag #adrianskickback have since drawn more than 326 million views.

On Saturday night, roughly 2,500 teenagers and young adults — some who say they drove for hours or flew in from other states — converged on the Huntington Beach Pier and downtown area in a gathering that devolved into mayhem. Partygoers blasted fireworks into a mob in the middle of Pacific Coast Highway, jumped on police cars, scaled palm trees and flag poles and leapt from the pier into throngs of people below to crowd-surf. A window at CVS was smashed, businesses were tagged with graffiti, and the roof of Lifeguard Tower 13 collapsed after it was scaled...

Authorities spotted the party announcement when it began circulating last week and immediately began staffing up in preparation for what was being billed as a weekend-long event. In all, more than 150 officers from nearly every police agency in Orange County were called out to the beach Saturday night to help get the crowd under control. Clashes with police broke out Saturday, and officers fired rubber bullets and pepper projectiles as they tried to disperse the crowd. Eventually, authorities issued an overnight curfew to clear the streets...

The majority of those taken into custody over the weekend were not from Orange County, police said.
One 53-year-old watching the crowd told the Times that "Literally they were playing in traffic on the Pacific Coast Highway." But the Times also got a quote from one 18-year-old attendee who "went to last Saturday's party but said he does not condone the debauchery that ensued."

"People my age haven't gone out in a year... It was to get the ball rolling. This is the start of summer."

In March of 2020, Florida's governor was assuring the state that there was no evidence of Covid-19 in Florida, remembers the Washington Post. But there was — as far back as January.

The Miami Herald reports that when questioned Florida's Department of Health told its data manager to hide that data from public view, "emails from within the agency reviewed by the Miami Herald and others show." Eventually that data manager was fired, and within months her home had been raided by gun-toting police officers.

But that's not the end of the story. The latest development? That data manager is now instead "officially a whistleblower under Florida law, the Office of the Inspector General told her attorneys Friday," the Miami Herald reports. The Inspector General now says the data manager has indeed shown "reasonable cause to suspect that an employee or agent of an agency or independent contractor has violated [a] federal, state or local law, rule or regulation." Slashdot reader whoever57 notes the move "will grant her certain protections."

The Miami Herald reports: Rebekah Jones, who was responsible for building the COVID-19 data dashboard for the Florida Department of Health, was fired last year after raising concerns about "misleading data" being presented to the public, according to the complaint, which was reviewed by the Miami Herald. In the complaint, filed July 17, 2020, Jones alleged she was fired for "opposition and resistance to instructions to falsify data in a government website." She described being asked to bend data analysis to fit pre-determined policy and delete data from public view after questions from the press — actions she claimed "represent an immediate injury to the public health, safety, and welfare, including the possibility of death to members of the public."

On Friday, the Office of the Inspector General informed Jones that "the information disclosed does meet the criteria for whistleblower status as described by ... Florida statutes," according to the email obtained by the Herald... "It's pretty huge," Jones told the Herald in response to the news. "This isn't vindication but this is a start. It's a big push forward...."

A department spokesperson said at the time that Jones was fired for "insubordination."
There's now an ongoing investigation into Jones' allegations. And in December Florida's Sun-Sentinel newspaper cited other issues with the state government's transparency:

• The Florida Department of Health's county-level spokespeople were ordered in September to stop issuing public statements about COVID-19 until after the Nov. 3 election.

• State officials withheld information about infections in schools, prisons, hospitals and nursing homes, relenting only under pressure or legal action from family members, advocacy groups and journalists.

• The governor highlighted statistics that would paint the rosiest picture possible and attempted to cast doubt on the validity of Florida's rising death toll.

"Unfortunately, the possibility of the Department of Health manipulating information is not a stretch," writes the editorial board of the Miami Herald.

For that reason, they write that Jones' whistleblower victory "stands to be a win over state secrecy for the rest of us."

U.S. President Joe Biden has proposed federal funding for local internet services run by nonprofits and city governments, according to Bloomberg. "That's not sitting well with Comcast, AT&T, Verizon Communications, and other dominant carriers, which don't like the prospect of facing subsidized competitors." Pleasant Grove, Utah shows why established carriers might be vulnerable. With 38,000 residents, it's nestled between the Wasatch Range and the Great Salt Lake Basin, just south of Salt Lake City. When it asked residents about their broadband, almost two-thirds of respondents said they wouldn't recommend their cable service. Almost 90% wanted the city to pursue broadband alternatives... [The city-owned ISP Utopia Fiber] will also reach areas not served by current providers... When the city council voted unanimously to approve Utopia's $18 million build-out in April, the mood was a mix of giddy and vengeful. "I'll be your first customer that signs up and says goodbye to Comcast," said one council member moments before the body voted. "I'm right behind ya," another added.

The events in Pleasant Grove jibe with the rhetoric coming out of the White House. Biden says he wants to reduce prices and ensure that every household in the U.S. gets broadband, including the 35% of rural dwellers the administration says don't have access to fast service. To connect them as well as others languishing with slow service in more built-up places, the president wants to give funding priority to networks from local governments, nonprofits, and cooperatives. Established carriers are pushing back against the proposal; they have long criticized municipal broadband as a potential waste of taxpayer funds, while backing state-level limits on it.

Almost 20 states have laws that restrict community broadband, according to a tally by the BroadbandNow research group.

The carriers say the administration and its Democratic allies are calling for blazing upload speeds that have little practical use for consumers, who already get fast downloads for videos and other common web uses... Republicans want to bar spending on municipal networks and have criticized Biden's broadband plan as too expensive. In response the administration scaled back its plan to $65 billion, from $100 billion.
The article notes that local governments in the U.S. are already offering about 600 networks that serve about 3 million people, according to Christopher Mitchell, director of the Community Broadband Networks program at the Institute for Local Self-Reliance.

Yet it also cites statistics showing that in 14 of America's 50 states, less than 85% of the population has access to broadband.

"Just days after violent conflict erupted in Israel and the Palestinian territories, both Facebook and Twitter copped to major faux pas: The companies had wrongly blocked or restricted millions of mostly pro-Palestinian posts and accounts related to the crisis," reports the Washington Post: Activists around the world charged the companies with failing a critical test: whether their services would enable the world to watch an important global event unfold unfettered through the eyes of those affected. The companies blamed the errors on glitches in artificial intelligence software.

In Twitter's case, the company said its service mistakenly identified the rapid-firing tweeting during the confrontations as spam, resulting in hundreds of accounts being temporarily locked and the tweets not showing up when searched for. Facebook-owned Instagram gave several explanations for its problems, including a software bug that temporarily blocked video-sharing and saying its hate speech detection software misidentified a key hashtag as associated with a terrorist group.

The companies said the problems were quickly resolved and the accounts restored. But some activists say many posts are still being censored. Experts in free speech and technology said that's because the issues are connected to a broader problem: overzealous software algorithms that are designed to protect but end up wrongly penalizing marginalized groups that rely on social media to build support... Despite years of investment, many of the automated systems built by social media companies to stop spam, disinformation and terrorism are still not sophisticated enough to detect the difference between desirable forms of expression and harmful ones. They often overcorrect, as in the most recent errors during the Israeli-Palestinian conflict, or they under-enforce, allowing harmful misinformation and violent and hateful language to proliferate...

Jillian York, a director at the Electronic Frontier Foundation, an advocacy group that opposes government surveillance, has researched tech company practices in the Middle East. She said she doesn't believe that content moderation — human or algorithmic — can work at scale... Palestinian activists and experts who study social movements say it was another watershed historical moment in which social media helped alter the course of events...

Payment app Venmo also mistakenly suspended transactions of humanitarian aid to Palestinians during the war. The company said it was trying to comply with U.S. sanctions and had resolved the issues.

There's something new in Amazon's video-enabled Echo Show smart speakers. "If you have the version with a built-in camera, you can now turn your Show into a security device..." writes Kim Komando. "Once the monitoring has been set up, you can remotely view the feed from the Alexa app.

CNET reports on Alexa's new "Home Monitoring" setting, "found deep within your Amazon Echo Show's device settings." It doesn't record video and you can only put it where you'd otherwise put a smart display... But still, it's useful for checking in on things, like kids, pets or your house while you're away... it might just replace that security camera you were thinking of buying. Plus, if you have the latest Echo Show 10, you can not only view the camera feed, but you can pan the room left to right (although, unfortunately, not up and down)...

At first, only the new Echo Show 10 could pull it off, but a recent update seems to have changed all that and now the first-gen Echo Show 5 and Echo Show 8 have a Home Monitoring setting (presumably, so will the updated Show 5 and 8 when the arrive June 9)... Setting up your Amazon Echo Show smart display to appear as a security camera in the Alexa app is a bit trickier than enabling most features — for security reasons, you have to set it up on the device itself, not from within the app.
Their article also notes two caveats:

• You can't record the video.
• There's no quick and easy way to set up motion-alert notifications.

it's high time for companies to start adding cybersecurity professionals to their teams, reports CNN. "The only hitch: There's a massive, longstanding labor shortage in the cybersecurity industry." "It's a talent war," said Bryan Orme, principal at GuidePoint Security. "There's a shortage of supply and increased demand."

Experts have been tracking the cybersecurity labor shortage for at least a decade — and now, a new surge in companies looking to hire following recent attacks could exacerbate the problem. The stakes are only growing, as technology evolves and bad actors become more advanced. In the United States, there are around 879,000 cybersecurity professionals in the workforce and an unfilled need for another 359,000 workers, according to a 2020 survey by (ISC)2, an international nonprofit that offers cybersecurity training and certification programs. Globally, the gap is even larger at nearly 3.12 million unfilled positions, the group says... The U.S. Bureau of Labor Statistics projects "information security analyst" will be the 10th fastest growing occupation over the next decade, with an employment growth rate of 31% compared to the 4% average growth rate for all occupations.

If demand for cybersecurity professionals in the private sector increases dramatically, some experts say talented workers could leave the government for more lucrative corporate jobs — a risk that is especially acute for smaller, local government agencies that manage critical infrastructure in their communities but have limited budgets. "Think of the criticality of what your local government does: water purification, waste treatment, traffic management, communications for law enforcement, public safety, emergency management," said Mike Hamilton, chief information security officer at Critical Insight. "But Amazon is out there waving around bags of cash to protect their retail operation." Hamilton — who was the former chief information security officer for Seattle, Washington, from 2006 to 2013 — added that local governments "cannot attract and retain these people when the competition for them is so high, which is why we've got to make lots of them."
The article notes educational training/up-skilling programs working to address the shortage, including GuidePoint, which helps train veterans leaving the military for cybersecurity careers. CNN also notes U.S. President Joe Biden's $2 trillion American Jobs Plan included $20 billion for state, local and tribal governments to update and improve cybersecurity controls for their energy systems.

"Still, experts say more needs to be done, suggesting a broad rethinking of education systems from elementary school through higher education to include more cybersecurity training."

Iran banned bitcoin mining this week, after four months of continuous blackouts partially due to what officials say is a huge energy suck from illegal mining. Gizmodo reports: President Hassan Rouhani said at a cabinet meeting Wednesday that a drought in the region was responsible for crippling the country's supply of hydroelectric power. But, he said, the huge amount of illegal bitcoin mining that happens in Iran was tapping a staggering 2 gigawatts of power each day from the already-stressed grid. (Legal operations, meanwhile, used somewhere between 200 and 300 megawatts.)

Rouhani said around 85% of this 2-gigawatt power suck was from unlicensed operations. Iran has become a hotspot for illegal mining after many miners began to decamp there to take advantage of the country's heavily subsidized energy (partially due to the fact that Iran can't sell its oil due to international sanctions). Around 4.5% of the world's total bitcoin mining now takes place in Iran, making it one of the top 10 bitcoin-producing countries in the world. The crackdown by the government may knock it off the chart, but miners will surely sniff out another cheap source of electricity somewhere else in the world and set up shop there. [...] The ban in Iran will take effect immediately and be in place until at least September, officials say, and will include legal as well as illegal operations.
UPDATE: NBC News has additional converage — including these two interesting details:

• "Tehran allows cryptocurrencies mined in Iran to pay for imports of goods, which can help it get around the wide-ranging U.S. sanctions that had been imposed on the country..."
• "Around 4.5 percent of all bitcoin mining globally took place in Iran between January and April of this year, according to blockchain analytics firm Elliptic. That put it among the top 10 in the world, while China came in first place at nearly 70 percent."

Since it was first announced in January, WhatsApp's new privacy policy has received a lot of criticism not only for sharing a significant amount of user data with Facebook but because the app threatened to cut functionality over time if users didn't accept it. Now, according to The Next Web, the Facebook-owned app says it won't restrict any functionality, even if you don't accept the policy for now. From the report: [WhatsApp said in statement:] "Given recent discussions with various authorities and privacy experts, we want to make clear that we currently have no plans to limit the functionality of how WhatsApp works for those who have not yet accepted the update. Instead, we will continue to remind users from time to time about the update as well as when people choose to use relevant optional features, like communicating with a business that is receiving support from Facebook."

In the future, this could change, but WhatsApp is trying to keep its user base, and governments around the world happy. After the policy was first introduced in January, a ton of users started shifting to other platforms such as Telegram and Signal. Last week, India asked WhatsApp to retract its privacy policy. It sent a notice to WhatsApp saying that the new policy is in violation of the country's laws.

phalse phace shares a report from the BBC: A suspected Bitcoin "mining" operation illegally stealing electricity has been found by police who were searching for a cannabis farm. Officers had been tipped off about the site on the Great Bridge Industrial Estate, Sandwell, and raided it on May 18, West Midlands Police said. Instead of cannabis plants they found a bank of about 100 computer units. The force said the cryptocurrency "mine" had effectively stolen thousands of pounds of electricity. Inquiries with network operator Western Power Distribution found an illegal connection to the electricity supply.

Detectives said they were tipped off about lots of people visiting the unit throughout the day and a police drone picked up a lot of heat coming from the building. Sgt Jennifer Griffin said, given the signs, they had expected to find a cannabis farm. "It had all the hallmarks of a cannabis cultivation set-up and I believe it is only the second such crypto mine we have encountered in the West Midlands," she said. The computer equipment has been seized but no arrests have been made, the force said.

Chinese-speaking hackers are masquerading as the United Nations in ongoing cyber-attacks against Uyghurs, according to the cybersecurity firms Check Point and Kaspersky. MIT Technology Review reports: Researchers identified an attack in which hackers posing as the UN Human Rights Council send a document detailing human rights violations to Uyghur individuals. It is in fact a malicious Microsoft Word file that, once downloaded, fetches malware: the likely goal, say the two companies, is to trick high-profile Uyghurs inside China and Pakistan into opening a back door to their computers. "We believe that these cyber-attacks are motivated by espionage, with the endgame of the operation being the installation of a back door into the computers of high-profile targets in the Uyghur community," said Lotem Finkelstein, head of threat intelligence at Check Point, in a statement. "The attacks are designed to fingerprint infected devices, including all of [their] running programs. From what we can tell, these attacks are ongoing, and new infrastructure is being created for what look like future attacks."

In addition to pretending to be from the United Nations, the hackers also built a fake and malicious website for a human rights organization called the "Turkic Culture and Heritage Foundation," according to the report. The group's fake website offers grants -- but in fact, anybody who attempts to apply for a grant is prompted to download a false "security scanner" that is in fact a back door into the target's computer, the researchers explained. "The attackers behind these cyber-attacks send malicious documents under the guise of the United Nations and fake human rights foundations to their targets, tricking them into installing a backdoor to the Microsoft Windows software running on their computers," the researchers wrote. This allows the attackers to collect basic information they seek from the victim's computer, as well as running more malware on the machine with the potential to do more damage. The researchers say they haven't yet seen all the capabilities of this malware. The researchers weren't able to determine an exact known hacking group, but the code in these attacks "was found to be identical to code found on multiple Chinese-language hacking forums and may have been copied directly from there," the report notes.

Late 2019, Internet provider Cox Communications lost its legal battle against a group of major record labels. Now it's appealing it. From a report: Following a two-week trial, a Virginia jury held Cox liable for its pirating subscribers. The ISP failed to disconnect repeat infringers and was ordered to pay $1 billion in damages. Heavily disappointed by the decision, Cox later asked the court to set the jury verdict aside and decide the issue directly. In addition, the company argued that the "shockingly excessive" damages should be lowered. Both requests were denied by the court, which upheld the original damages award.

Despite the setbacks, Cox isn't giving up. The company believes that the district court's ruling isn't just a disaster for Internet providers. If it stands, the verdict will have dramatic consequences for the general public as well. This week the ISP submitted its opening brief at the Court of Appeals for the Fourth Circuit, hoping to reverse the lower court's judgment. The filing begins by placing the lawsuit in a historical context. "The music industry is waging war on the internet," Cox's lawyers write. First, the music companies went after thousands of file-sharers and software companies such as Napster. When those tactics didn't deliver the desired result, Internet providers became a target.

Two tech industry organizations are suing Florida over its newly passed rules for social networks, claiming it violates private companies' constitutional rights. The Verge reports: SB 7072, which Florida Governor Ron DeSantis signed earlier this week, restricts how large social apps and websites can moderate user-generated content. It makes banning any Florida political candidate or "journalistic enterprise" unlawful, lets users sue if they believe they were banned without sufficient reason, requires an option to "opt out" of sorting algorithms, and places companies that break the law on an "antitrust violator blacklist" that bars them from doing business with public entities in Florida. Notably, it includes an exception for companies that operate a theme park.

NetChoice and the CCIA say SB 7072 conflicts with both constitutional protections and federal Section 230 rules. "As private businesses, Plaintiffs' members have the right to decide what content is appropriate for their sites and platforms," their complaint says. "The Act requires members to display and prioritize user-generated content that runs counter to their terms, policies, and business practices; content that will likely offend and repel their users and advertisers; and even content that is unlawful, dangerous to public health and national security, and grossly inappropriate for younger audiences." The lawsuit claims Florida lawmakers and DeSantis specifically tailored the law to punish services whose moderation policies they disagreed with, while adding the arbitrary theme park exception to pacify Disney, Comcast NBCUniversal, and a handful of other big companies.

The Indonesian government has blocked access inside its borders to Raid Forums, a well-known cybercrime hub, in an attempt to limit the spread of a sensitive data leak. From a report: The ban, which the government wants internet service providers to implement, comes after a threat actor claimed in a Raid Forums post on May 12 to be in possession and selling the personal data of 279 million Indonesians. The threat actor, an individual known as Kotz, leaked a sample of one million citizens' details to prove their claims. The leaked data included citizen names, national ID numbers, tax registration information, mobile phone numbers, and for some citizens also came with headshots and salary-related information.