An anonymous reader quotes a report from Reuters: Live-streaming service Twitch will ban users for offenses such as hate-group membership or credible threats of mass violence that occur entirely away from the site, in a new approach to moderating the platform, the company said on Wednesday. The Amazon-owned platform, which is popular among video gamers, said under its new rules it would take enforcement actions against offline offenses that posed a "substantial safety risk" to its community.

It said examples of this "severe misconduct" include terrorist activities, child sexual exploitation, violent extremism, credible threats of mass violence, carrying out or deliberately acting as an accomplice to sexual assault and threatening Twitch or its staff. "Taking action against misconduct that occurs entirely off our service is a novel approach for both Twitch and the industry at large, but it's one we believe -- and hear from you -- is crucial to get right," the company said in a blog post. The company said users will be able to report such behaviors but it may also investigate cases proactively, for instance if there is a verified news report that a user has been arrested. Twitch said it would rely more heavily on law enforcement in "off-service" cases and is partnering with an investigative law firm to support its internal team. It declined to name the firm. The new standards will apply even if the target of the offline behaviors is not a Twitch user or if the perpetrator was not a user when they committed the acts. Perpetrators would also be banned from registering a Twitch account, it said.

Twitch said it would take action only when there was evidence, such as screen shots, videos of off-Twitch behavior or police filings, verified by its internal team or third-party investigators. Users who submit a large amount of frivolous reports will face suspension. The company said in cases where the behavior happened in the distant past, users had gone through rehabilitation such as time in a correctional facility, and they no longer presented a danger to the community, it might not take action or might reinstate users on appeal. It said it would share updates with the involved parties but would not share public updates about actions under this policy.

schwit1 shares a report from Ars Technica: Austrian privacy activist Max Schrems has filed a complaint against Google in France alleging that the US tech giant is illegally tracking users on Android phones without their consent. Android phones generate unique advertising codes, similar to Apple's Identifier for Advertisers (IDFA), that allow Google and third parties to track users' browsing behavior in order to better target them with advertising. In a complaint filed on Wednesday, Schrems' campaign group Noyb argued that in creating and storing these codes without first obtaining explicit permission from users, Google was engaging in "illegal operations" that violate EU privacy laws.

Noyb urged France's data privacy regulator to launch a probe into Google's tracking practices and to force the company to comply with privacy rules. It argued that fines should be imposed on the tech giant if the watchdog finds evidence of wrongdoing. "Through these hidden identifiers on your phone, Google and third parties can track users without their consent," said Stefano Rossetti, privacy lawyer at Noyb. "It is like having powder on your hands and feet, leaving a trace of everything you do on your phone -- from whether you swiped right or left to the song you downloaded." Last year, Schrems won a landmark case at Europe's highest court that ruled a transatlantic agreement on transferring data between the bloc and the US used by thousands of corporations did not protect EU citizens' privacy.

A US government committee has described YouTube Kids as a "wasteland of vapid, consumerist content." From a report: In a letter to YouTube chief executive Susan Wojcicki, the US sub-committee on economic and consumer policy said the platform was full of "inappropriate... highly commercial content". Google launched YouTube Kids in 2015 as a safe place for children to view appropriate content. YouTube said it had worked hard to provide "enriching content for kids."

An anonymous reader quotes a report from The Hill: The Environmental Protection Agency (EPA) is preparing to propose stricter emissions standards for vehicles by the end of July, EPA Administrator Michael Regan said Tuesday. Regan told Bloomberg News in an interview that the new standards would be sufficient to meet "the urgency of the climate crisis." "We need to go as far as we can to meet the demands of the day," Regan added. "The science indicates we have a short window in time to reverse the path that we're on and mitigate against certain climate impacts."

An EPA spokesperson told The Hill that the timeline was dictated by an executive order from President Biden that requires the administration to review the former Trump administration's rule that relaxed the emissions limits by July. The spokesperson confirmed that the EPA is on track to meet that timeline. That rule also loosened the requirement for fuel economy standards, which dictate how much gasoline per mile that the U.S. fleet can consume, which the Biden administration could also tighten.

The executive order also requires a review this month of the decision to revoke California's ability to set its own tailpipe emissions standards, which have been stricter than the federal government's standards and adopted by a number of other states. Regan told Bloomberg that he is "a firm believer in the state's statutory authority to lead." According to the news outlet, he also did not rule out the possibility for additional regulations in the future that would essentially ban new conventional gas-powered cars.

Khari Johnson writes via VentureBeat: In April 2020, news broke that Banjo CEO Damien Patton, once the subject of profiles by business journalists, was previously convicted of crimes committed with a white supremacist group. According to OneZero's analysis of grand jury testimony and hate crime prosecution documents, Patton pled guilty to involvement in a 1990 shooting attack on a synagogue in Tennessee. Amid growing public awareness about algorithmic bias, the state of Utah halted a $20.7 million contract with Banjo, and the Utah attorney general's office opened an investigation into matters of privacy, algorithmic bias, and discrimination. But in a surprise twist, an audit and report released last week found no bias in the algorithm because there was no algorithm to assess in the first place.

"Banjo expressly represented to the Commission that Banjo does not use techniques that meet the industry definition of artificial Intelligence. Banjo indicated they had an agreement to gather data from Twitter, but there was no evidence of any Twitter data incorporated into Live Time," reads a letter Utah State Auditor John Dougall released last week. The incident, which VentureBeat previously referred to as part of a "fight for the soul of machine learning," demonstrates why government officials must evaluate claims made by companies vying for contracts and how failure to do so can cost taxpayers millions of dollars. As the incident underlines, companies selling surveillance software can make false claims about their technologies' capabilities or turn out to be charlatans or white supremacists -- constituting a public nuisance or worse. The audit result also suggests a lack of scrutiny can undermine public trust in AI and the governments that deploy them.

An anonymous reader quotes a report from Motherboard: A group of bipartisan lawmakers, including the chairman of the intelligence committee, have asked ad networks such as Google and Twitter what foreign companies they provide user data to, over concerns that foreign intelligence agencies could be leveraging them to harvest sensitive information on U.S. users, including their location. "This information would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns," a letter signed by Senators Ron Wyden, Mark Warner, Kirsten Gillibrand, Sherrod Brown, Elizabeth Warren, and Bill Cassidy, reads. The lawmakers sent the letter last week to AT&T, Verizon, Google, Twitter, and a number of other companies that maintain advertisement platforms.

The concerns center around the process of so-called real-time bidding, and the flow of "bidstream" data. Before an advertisement is displayed inside of an app or a browsing session, different companies bid to get their ad into that slot. As part of that process, participating companies obtain sensitive data on the user, even if they don't win the ad placement. "Few Americans realize that some auction participants are siphoning off and storing 'bidstream' data to compile exhaustive dossiers about them. In turn, these dossiers are being openly sold to anyone with a credit card, including to hedge funds, political campaigns, and even to governments," the letter continued. [...] The letter asked the ad companies to name the foreign-headquartered or foreign-majority owned firms that they have provided bidstream data from users in the U.S. to in the past three years. The other companies the lawmakers sent the letter to were Index Exchange, Magnite, OpenX, and PubMatic. Mark Tallman, assistant professor at the Department of Emergency Management and Homeland Security at the Massachusetts Maritime Academy, told Motherboard in an email that "It's difficult to imagine any policy solution or technical sorcery that can fully 'secure' consumers' private data such that applications and platforms can collect it, and the publishing and advertising industries can access it, while guaranteeing that cybercriminals and foreign intelligence agencies will never get it. Our adversaries already know that they can buy (or steal) data from our marketplace that they could only dream of collecting on such a broad swath of Americans twenty years ago."

Merchant groups are forming a national coalition to campaign for stricter antitrust laws, including measures they hope could force Amazon.com to spin off some of its business lines. From a report: The effort is being launched Tuesday by trade groups that represent small hardware stores, office suppliers, booksellers, grocers and others, along with business groups from 12 cities, organizers say. Merchants plan to push their congressional representatives for stricter antitrust laws and tougher enforcement of existing ones. The groups, which collectively represent thousands of businesses, want federal legislation that would prevent the owner of a dominant online marketplace from selling its own products in competition with other sellers, a policy that could effectively separate Amazon's retail product business from its online marketplace. Members of the House Antitrust Subcommittee are considering legislation along those lines as they weigh changes to U.S. antitrust law, though no bill has yet been introduced. The merchant groups also want tougher enforcement of competition laws and legal changes that would make it easier for the government to win antitrust lawsuits against big companies.

A right-to-repair bill died in the Colorado state legislature on March 25, 2021. After almost three hours of testimony from business leaders, disabled advocates, and a 9-year-old activist, legislators said there were too many unanswered questions and that the proposed law was too broad. Motherboard reports: Colorado's proposed right-to-repair law was simple and clear. At 11 pages, the legislation spent most of its word count defining terms, but the gist was simple: It would let people fix their own stuff without needing to resort to the manufacturer and force said manufacturer to support people who want to fix stuff. "For the purpose of providing services for digital electronic equipment sold or used in this state, an original equipment manufacturer shall, with fair and reasonable terms and cost, make available to an independent repair provider or owner of the manufacturer's equipment any documentation, parts, embedded software, firmware, or tools that are intended for use with the digital electronic equipment, including updates to documentation, information, or embedded software," the proposed bill said.

The Colorado House Business Affairs & Labor committee met to consider the law on March 25. Twelve legislators voted to indefinitely postpone considering the bill. Only one voted for it. "I still have a lot of questions. I still have a lot of concerns," Rep. Monica Duran (D) said at the end of the committee hearing. She voted no on the bill. It was a stunning statement given just how many people testified on behalf of the right-to-repair legislation and how few questions the committee asked them. [...] In their own comments, the legislators repeated lines Apple and other companies often use to defend their repair monopolies. Shannon Bird (D), for example, said that manufacturers have the right to dictate how a customer uses its product. She stressed that Apple can sell licenses to whatever it wants. "Apple Music is different than purchasing a CD," she said. "I have a hard time believing that we would call it Apple having a monopoly on its own product."

Many of the legislators on the committee conflated the repair market with the phone market itself. Others said that a right-to-repair bill would increase the cost of phones for everyone. Rep. Steven Woodrow (D), a sponsor of the bill, explained why this didn't make any sense. "We're not talking about the market for phones. We're talking about the market for repairs, it's a secondary market," he said. "By restricting competition in that market they're engaged in manipulation. The cost should go down. By allowing for repairs you're increasing the supply. Basic econ says that as the supply increases the price decreases."

An anonymous reader quotes a report from The Intercept: The popular legal research and data brokerage firm LexisNexis signed a $16.8 million contract to sell information to U.S. Immigration and Customs Enforcement, according to documents shared with The Intercept. The deal is already drawing fire from critics and comes less than two years after the company downplayed its ties to ICE, claiming it was "not working with them to build data infrastructure to assist their efforts." Though LexisNexis is perhaps best known for its role as a powerful scholarly and legal research tool, the company also caters to the immensely lucrative "risk" industry, providing, it says, 10,000 different data points on hundreds of millions of people to companies like financial institutions and insurance companies who want to, say, flag individuals with a history of fraud. LexisNexis Risk Solutions is also marketed to law enforcement agencies, offering "advanced analytics to generate quality investigative leads, produce actionable intelligence and drive informed decisions" -- in other words, to find and arrest people.

The LexisNexis ICE deal appears to be providing a replacement for CLEAR, a risk industry service operated by Thomson Reuters that has been crucial to ICE's deportation efforts. In February, the Washington Post noted that the CLEAR contract was expiring and that it was "unclear whether the Biden administration will renew the deal or award a new contract." LexisNexis's February 25 ICE contract was shared with The Intercept by Mijente, a Latinx advocacy organization that has criticized links between ICE and tech companies it says are profiting from human rights abuses, including LexisNexis and Thomson Reuters. The contract shows LexisNexis will provide Homeland Security investigators access to billions of different records containing personal data aggregated from a wide array of public and private sources, including credit history, bankruptcy records, license plate images, and cellular subscriber information. The company will also provide analytical tools that can help police connect these vast stores of data to the right person. In a statement to The Intercept, a LexisNexis Risk Solutions spokesperson said: "Our tool contains data primarily from public government records. The principal non-public data is authorized by Congress for such uses in the Drivers Privacy Protection Act and Gramm-Leach-Bliley Act statutes." They declined to say exactly what categories of data the company would provide ICE under the new contract, or what policies, if any, will govern how agency agency uses it.

A grand jury has indicted a California resident accused of stealing Shopify customer data on over a hundred merchants, TechCrunch reported Monday. From the report: The indictment charges Tassilo Heinrich with aggravated identity theft and conspiracy to commit wire fraud by allegedly working with two Shopify customer support agents to steal merchant and customer data from Shopify customers to gain a competitive edge and "take business away from those merchants," the indictment reads. The indictment also accuses Heinrich, believed to be around 18-years-old at the time of the alleged scheme, of selling the data to other co-conspirators to commit fraud. A person with direct knowledge of the security breach confirmed Shopify was the unnamed victim company referenced in the indictment.

Last September, Shopify, an online e-commerce platform for small businesses, revealed a data breach in which two "rogue members" of its third-party customer support team of "less than 200 merchants." Shopify said it fired the two contractors for engaging "in a scheme to obtain customer transactional records of certain merchants." Shopify said the contractors stole customer data, including names, postal addresses and order details, like which products and services were purchased. One merchant who received the data breach notice from Shopify said the last four digits of affected customers' payment cards were also taken, which the indictment confirms. Another one of the victims was Kylie Jenner's cosmetics and make-up company, Kylie Cosmetics, the BBC reported.

For more than six months, federal prosecutors say, a New York man used inside information to make illegal profits in the stock market -- and a core element of his alleged scheme was his interaction with Bloomberg News, which published several stories shortly after the trader arranged to make significant purchases of the companies' shares. From a report: Last month, a federal grand jury indicted Jason Peltz on multiple counts of securities fraud, money laundering, tax evasion and lying to the FBI. Peltz, 38, is accused of working with over a half-dozen unnamed and unindicted co-conspirators to learn about impending takeovers and other market-moving news, and to move money between accounts as a way to hide his role and profits. The indictment notes that Peltz's moves were timed closely to stories that ran at "a financial news organization."

While the newsroom isn't named, federal officials cite five stories and their timestamps -- all of which match precisely to pieces that ran on Bloomberg News' website. Each of those stories had shared bylines, but only one reporter is identified as an author for all of the articles: Ed Hammond, who worked at the Financial Times before coming to Bloomberg more than six years ago to cover mergers and acquisitions. In 2017, Hammond was named Bloomberg's senior deals reporter in New York -- a highly prestigious post in that newsroom. The feds allege that Peltz used disposable "burner" phones and encrypted apps to communicate with a journalist, and that the reporter provided "material nonpublic information about forthcoming articles" which Peltz used to trade in the market "just prior to publication of an article about each company written by the reporter." The indictment describes "numerous contacts" between Peltz and a reporter, including at least one in-person meeting. Neither Hammond nor Bloomberg is named in the indictment; the filing says a financial-news reporter's identity was made known to the grand jury that heard the case. No one at Bloomberg is accused by prosecutors of wrongdoing or of being aware that these stories might be linked to an insider-trading scheme. Prosecutors make no allegation that the stories contained any inaccurate information, nor do any of the stories display corrections.

Last fall, Justice Clarence Thomas argued that it was time to rein in Section 230 immunity. Now, Justice Thomas is laying out an argument for why companies like Facebook, Twitter and Google should be regulated as utilities. From a report: On Monday, the Supreme Court vacated a lower court ruling in finding that President Trump had acted unconstitutionally by blocking people on Twitter. That case, which the justices deemed moot, hinged on the idea that the @realdonaldtrump account was a public forum run by the President of the United States, and therefore, was constitutionally prohibited from stifling private speech. In his concurrence, Justice Thomas agrees with the decision, but argues that, in fact, Twitter's recent ban of the @realdonaldtrump account suggests that it's platforms themselves, not the government officials on them, that hold all the power. "As Twitter made clear, the right to cut off speech lies most powerfully in the hands of private digital platforms," Thomas writes. "The extent to which that power matters for purposes of the First Amendment and the extent to which that power could lawfully be modified raise interesting and important questions."

Thomas argues that some digital platforms are "sufficiently akin" to common carriers like telephone companies. "A traditional telephone company laid physical wires to create a network connecting people," Thomas writes. "Digital platforms lay information infrastructure that can be controlled in much the same way." Thomas argues that while private companies aren't subject to the First Amendment, common carriers are unique to other private businesses in that they do not have the "right to exclude." Thomas suggests that large tech platforms with substantial market power should be bound by the same restrictions. "If the analogy between common carriers and digital platforms is correct, then an answer may arise for dissatisfied platform users who would appreciate not being blocked: laws that restrict the platform's right to exclude," Thomas writes.

The file-sharing blog TorrentFreak reports: Google was asked to remove a TorrentFreak article from its search results this week. The article in question reported that "The Mandalorian" was the most pirated TV show of 2020.

This notice claims to identify several problematic URLs that allegedly infringe the copyrights of Disney's hit series The Mandalorian. This is not unexpected, as The Mandalorian was the most pirated TV show of last year, as we reported in late December. However, we didn't expect to see our article as one of the targeted links in the notice. Apparently, the news that The Mandalorian is widely pirated — which was repeated by dozens of other publications — is seen as copyright infringement?

Needless to say, we wholeheartedly disagree. This is not the way.
TorrentFreak specifies that the article in question "didn't host or link to any infringing content." (TorrentFreak's article was even linked to by major sites including CNET, Forbes, Variety, and even Slashdot.)

TorrentFreak also reports that it wasn't Disney who filed the takedown request, but GFM Films... At first, we thought that the German camera company GFM could have something to do with it, as they worked on The Mandalorian. However, earlier takedown notices from the same sender protected the film "The Last Witness," which is linked to the UK company GFM Film Sales. Since we obviously don't want to falsely accuse anyone, we're not pointing fingers.
So what happens next? We will certainly put up a fight if Google decides to remove the page. At the time of writing, this has yet to happen. The search engine currently lists the takedown request as 'pending,' which likely means that there will be a manual review. The good news is that Google is usually pretty good at catching overbroad takedown requests. This is also true for TorrentFreak articles that were targeted previously, including our coverage on the Green Book screener leak.

Long-time Slashdot reader destinyland writes: Friday Tesla decided to appeal a U.S. National Labor Relations Board ruling that it violated America's labor laws, reports Reuters. And they're even appealing its order that Elon Musk delete a 2018 tweet which the Board said "coercively threatened" workers considering unionization with the loss of stock options.

But Tesla is also facing growing unionization efforts in other countries. Tesla is building a giant plant in Germany, but "it hasn't yet made nice with the mighty auto union" IG Metall, reports Business Insider, noting that a battle with the union "could threaten Tesla's ambitious plans for the European market."
And this union is especially motivated, Stephen Silvia, a professor at American University researching comparative labor relations, tells Business Insider: Allowing a massive non-union plant to build cars in Germany would set the dangerous precedent that companies don't need to engage in collective bargaining, he said. It would also mean thousands of members would potentially go without the contractually enforced job security, wages, and benefits the rest of the industry enjoys. Moreover, IG Metall stands to lose bargaining power with other automakers if it can't get Tesla to play ball, said Arthur Wheaton, an automotive industry expert at Cornell University's School of Industrial and Labor Relations. It's especially crucial that IG Metall preserve all the sway it can at a time when carmakers are pivoting to EV production, which, Wheaton said, requires roughly 30% fewer workers than traditional auto manufacturing....

Silvia, who has spoken to the union about its plans, anticipates a public relations campaign and protests to exert political and social pressure on Tesla to "be a good corporate citizen."

"It's very difficult to force a completely unwilling company," Silvia said. "They'll just have to make [Tesla's] life as uncomfortable as possible..." Wheaton, however, thinks IG Metall's main weapon for putting the squeeze on Tesla is blocking the completion of the factory altogether. IG Metall could work with environmentalist groups to slow down construction, he said.

A "Science of Love" app analyzed text conversations uploaded by its users to assess the degree of romantic feelings (based on the phrases and emojis used and the average response time). Then after more than four years, its parent company ScatterLab introduced a conversational A.I. chatbot called Lee-Luda — which it said had been trained on 10 billion such conversational logs.

But because it used billions of conversations from real people, its problems soon went beyond sexually explicit comments and "verbally abusive" language: It also soon became clear that the huge training dataset included personal and sensitive information. This revelation emerged when the chatbot began exposing people's names, nicknames, and home addresses in its responses. The company admitted that its developers "failed to remove some personal information depending on the context," but still claimed that the dataset used to train chatbot Lee-Luda "did not include names, phone numbers, addresses, and emails that could be used to verify an individual." However, A.I. developers in South Korea rebutted the company's statement, asserting that Lee-Luda could not have learned how to include such personal information in its responses unless they existed in the training dataset. A.I. researchers have also pointed out that it is possible to recover the training dataset from the AI chatbot. So, if personal information existed in the training dataset, it can be extracted by querying the chatbot.

To make things worse, it was also discovered that ScatterLab had, prior to Lee-Luda's release, uploaded a training set of 1,700 sentences, which was a part of the larger dataset it collected, on Github. Github is an open-source platform that developers use to store and share code and data. This Github training dataset exposed names of more than 20 people, along with the locations they have been to, their relationship status, and some of their medical information...

[T]his incident highlights the general trend of the A.I. industry, where individuals have little control over how their personal information is processed and used once collected. It took almost five years for users to recognize that their personal data were being used to train a chatbot model without their consent. Nor did they know that ScatterLab shared their private conversations on an open-source platform like Github, where anyone can gain access.
What makes this unusual, the article points out, is how the users became aware of just how much their privacy had actually been compromised. "[B]igger tech companies are usually much better at hiding what they actually do with user data, while restricting users from having control and oversight over their own data."

And "Once you give, there's no taking back."

Time magazine reports: On March 10, photos and videos on Twitter were loading more slowly than usual for users in Russia. It was not a network fault or server error but a deliberate move by Russia's state internet regulator Roskomnadzor to limit traffic to the social media site, in what experts say was the first public use of controversial new technology that the Russian authorities introduced after 2019... The action came after Russian authorities had accused Twitter and other social networks in January of failing to delete posts urging children to take part in anti-government protests... In response to the slowdown, Twitter said it did not support any "unlawful behaviour" and was "deeply concerned" by the regulator's attempts to block online public conversation.

But on March 16 Roskomnadzor gave a fresh warning that if Twitter refused to comply with its removal requests within a month, the regulator will consider blocking access to the social network in Russia outright... Twitter has only 700,000 monthly active users in Russia, a fraction of the 68.7 million in the U.S. Despite its use by opposition politicians and journalists the Kremlin doesn't consider it "the most dangerous" platform, says Andrei Soldatov, a Russian cyber expert. Experts say that the authorities used the Twitter slowdown to test technology that could be used to disrupt other, more popular social networks like Facebook, which has an estimated 23 million active monthly users in Russia...

As the government has ramped up its efforts to control what citizens can access online it also has several projects in the pipeline that experts say is part of a strategy to push foreign tech companies out of the Russian market completely. From April 1, Roskomnadzor requires tech companies selling smartphones in Russia to prompt users to download government-approved apps, including search engines, maps and payment systems... In November 2019, the Kremlin made its most controversial move yet toward controlling the country's Internet infrastructure with the so-called "sovereign Internet" law. A series of amendments to existing laws theoretically enabled the Russian authorities to isolate "RuNet" — the unofficial name for websites hosted in Russia and sites on Russian domain names — from the global web in vaguely defined times of crisis, giving the Russian authorities control over flows of data coming in and out of the country... The "sovereign Internet" law required Internet Service Providers to install Deep Packet Inspection (DPI) equipment, which has been used by some countries, like China, for censorship. DPI equipment enables Russia to circumvent providers, automatically block content the government has banned and reroute internet traffic.

Russia's major ISPs have now installed DPI equipment, according to Alena Epifanova, a researcher at the German Council on Foreign Relations. But no one knows if or when Russia will be able to cut off its Internet from the global web.
The article also notes Russia passed a law in December which gives Roskomnadzor "the power to restrict or fully block websites that, according to officials, discriminate against Russian state media."

HealthITSecurity writes: The patient data from multiple providers appears to have been captured and subsequently leaked on the data repository GitHub Arctic Code Vault by third-party vendor MedData, according to a new collaborative report from security researcher Jelle Ursem and Dissent Doe of DataBreaches.net.

Through his research, Ursem detected troves of protected health information tied to a single developer... The databases were taken down on December 17. MedData recently released a notice that detailed the massive patient data breach, which involved information provided to the vendor for processing services... Officials discovered that an employee had saved files to personal folders created on the GitHub repository between December 2018 and September 2019, during their employment...

The impacted data included patient names combined with one or more data elements, such as subscriber ID,Social Security numbers, diagnoses, conditions, claims data, dates of services, medical procedure codes, insurance policy numbers, provider names, contact details, and dates of birth. All affected patients will receive free credit monitoring and identity protection services... This is the second report from Ursem and Dissent on GitHub repositories leaking patient data in the last six months. In August, they reported that at least nine GitHub repositories leveraging improper access controls leaked data from more than 150,000 to 200,000 patients. The data belonged to multiple providers.

The incidents highlight the importance of vendor management and the need to ensure security policies are aligned. Previous reports have shown about one-third of healthcare databases stored in the cloud, or even locally, are actively leaking data online. What's worse, misconfigured databases can be hacked in about eight hours.
DataBreaches.net wonders what happened after Med-Data reached out to GitHub about the vault's logs and removal of the code. Did GitHub provide the logs? If so, what did they show? Is anyone's Protected Health Information in GitHub's Arctic Code Vault? And if so, what happens? Will GitHub remove it...? Or will code just be left there for researchers to explore in 1,000 years so they can wade through the personal and protected health information or other sensitive information of people who trusted others to protect their privacy?

In November, 2020, Ursem posed the question to GitHub on Twitter. They never replied.

Slashdot reader quonset quotes Business Insider: A user in a low level hacking forum on Saturday published the phone numbers and personal data of hundreds of millions of Facebook users for free online.

The exposed data includes personal information of over 533 million Facebook users from 106 countries, including over 32 million records on users in the US, 11 million on users in the UK, and 6 million on users in India. It includes their phone numbers, Facebook IDs, full names, locations, birthdates, bios, and — in some cases — email addresses.

Insider reviewed a sample of the leaked data and verified several records by matching known Facebook users' phone numbers with the IDs listed in the data set. We also verified records by testing email addresses from the data set in Facebook's password reset feature, which can be used to partially reveal a user's phone number.

A Facebook spokesperson told Insider that the data was scraped due to a vulnerability that the company patched in 2019.

Ashkan Soltani was the Chief Technologist of America's Federal Trade Commission in 2014 — and earlier was a staff technologist in its Division of Privacy and Identity Protection helping investigate tech companies including Google and Facebook

Friday on Twitter he accused another group of privacy violations: the nonprofit rights organization, the American Civil Liberties Union. Yesterday, the ACLU updated their privacy statement to finally disclose that they share constituent information with 'service providers' like Facebook for targeted advertising, flying in the face of the org's public advocacy and statements.

In fact, I was retained by the ACLU last summer to perform a privacy audit after concerns were raised internally regarding their data sharing practices. I only agreed to do this work on the promisee by ACLU's Executive Director that the findings would be made public. Unfortunately, after reviewing my findings, the ACLU decided against publishing my report and instead sat on it for ~6 months before quietly updating their terms of service and privacy policy without explanation for the context or motivations for doing so. While I'm bound by a nondisclosure agreement to not disclose the information I uncovered or my specific findings, I can say with confidence that the ACLU's updated privacy statements do not reflect the full picture of their practices.

For example, public transparency data from Google shows that the ACLU has paid Google nearly half a million dollars to deliver targeted advertisements since 2018 (when the data first was made public). The ACLU also opted to only disclose its advertising relationship with Facebook only began in 2021, when in truth, the relationship spans back years totaling over $5 million in ad-spend. These relationships fly against the principles and public statements of the ACLU regarding transparency, control, and disclosure before use, even as the organization claims to be a strong advocate for privacy rights at the federal and state level. In fact, the NY Attorney General conducted an inquiry into whether the ACLU had violated its promises to protect the privacy of donors and members in 2004. The results of which many aren't aware of. And to be clear, the practices described would very much constitute a 'sale' of members' PII under the California Privacy Rights Act (CPRA).

The irony is not lost on me that the ACLU vehemently opposed the CPRA — the toughest state privacy law in the country — when it was proposed. While I have tremendous respect for the work the ACLU and other NGOs do, it's important that nonprofits are bound by the same privacy standards they espouse for everyone else. (Full disclosure: I'm on the EFF advisory board and was recently invited to join EPIC's board.)

My experience with the ACLU further amplifies the need to have strong legal privacy protections that apply to nonprofits as well as businesses — partially since many of the underlying practices, particularly in the area of fundraising and advocacy, are similar if not worse.
Soltani also re-tweeted an interesting response from Alex Fowler, a former EFF VP who was also Mozilla's chief privacy officer for three years: I'm reminded of EFF co-founder John Gilmore telling me about the Coders' Code: If you find a bug or vulnerability, tell the coder. If coder ignores you or refuses to fix the issue, tell the users.

An anonymous reader shares an excerpt from a Washington Post article, written by Matthew Cappucci and Jason Samenow: The National Weather Service experienced a major, systemwide Internet failure Tuesday morning, making its forecasts and warnings inaccessible to the public and limiting the data available to its meteorologists. The outage highlights systemic, long-standing issues with its information technology infrastructure, which the agency has struggled to address as demands for its services have only increased. In addition to Tuesday morning's outage, the Weather Service has encountered numerous, repeated problems with its Internet services in recent months, including: a bandwidth shortage that forced it to propose and implement limits to the amount of data its customers can download; the launch of a radar website that functioned inadequately and enraged users; a flood at its data center in Silver Spring, Md., that has stripped access to key ocean buoy observations; and multiple outages to NWS Chat, its program for conveying critical information to broadcasters and emergency managers, relied upon during severe weather events. The Weather Service is working to evaluate and implement solutions to these problems which are, in the meantime, impacting its ability to fulfill its mission of protecting life and property. [...]

Problems with the Weather Service's Internet systems have persisted for years, in part because of increasing demand from users, which the agency has struggled to meet. In December, because of an escalating bandwidth shortage, the Weather Service proposed limiting users to 60 connections per minute on a large number of its websites. Constituents complained about the quota and, earlier this month, the Weather Service announced it would instead impose a data limit of 120 requests per minute and only on servers hosting model data, beginning April 20. Meanwhile, on March 9, the Weather Service's headquarters in Silver Spring "experienced a ruptured water pipe, which caused significant and widespread flooding," which affected a data center, the agency said in a statement. "Some NWS data stopped flowing, including data from ocean buoys," the statement said, noting some of the buoys are used "to detect and locate a seismic event that could cause a tsunami."

Neil Jacobs, former acting head of the National Oceanic Atmospheric Administration, which oversees the Weather Service, said many of the agency's Internet infrastructure problems are tied to the fact they run on internal hardware rather than through cloud service providers such as Amazon Web Services, Microsoft and Google Cloud. "I've demanded in writing that NWS transition these applications to our Cloud partners. It's part of an internal strategy I've laid out," Jacobs, a Trump administration appointee, told the Capital Weather Gang in an email before he left office. In July, NOAA released its Cloud Strategy, which stated, "the volume and velocity of our data are expected to increase exponentially with the advent of new observing system and data-acquisition capabilities, placing a premium on our capacity and wherewithal to scale the IT infrastructure and services to support this growth. Modernizing our infrastructure requires leveraging cloud services as a solution to meet future demand."