An anonymous reader quotes a report from Torrent Freak: On December 21, 2020, Elsevier, Wiley, and American Chemical Society, filed a lawsuit hoping to have the court compel Indian ISPs to block both Sci-Hub and Libgen. Accusing the platforms of blatantly infringing their rights on a massive scale, the publishers said that due to the defiant nature of the platforms, ISP blocking is the only effective solution to hand. The massive complaint, which runs to 2,169 pages, was received by Sci-Hub with little time to review its contents. This not-insignificant issue was quickly pointed out to the Court, with counsel for Sci-Hub asking for an extension. After Sci-Hub assured the Court (pdf) that "no new articles or publications, in which the plaintiffs have copyright" would be uploaded to the site in advance of the next hearing, more time was granted to respond.

The case is set for a hearing tomorrow but in advance of that, interested parties are attempting to put the government under pressure to intervene by preventing a blockade that, according to them, would cause damage to education and society in India. Speaking on behalf of thousands of scientists, academics, teachers and students, the Breakthrough Science Society (BSS) is expressing dismay at the publishers' efforts to prevent the "free flow of information" between those who produce it and those who seek it. [...] Instead of demonizing Sci-Hub founder Alexandra Elbakyan, the group describes her work as an effective solution to make research papers available to all for the benefit of humanity. As a result, the Breakthrough Science Society says it actually supports the work of Sci-Hub and Libgen, arguing that their work is not illegal and should continue unhindered.

In an effort to pressure the Indian government to intervene on behalf of the people, the Breakthrough Science Society has launched a petition, calling on everyone from scientists and academics to teachers and students, to declare that knowledge should be accessible to all, not just those who can afford to pay the publishers' rates. Dr. Ashwani Mahajan, an Associate Professor at the University of Delhi, who among other things describes himself as a policy interventionist, says that if the ISPs are compelled to block Sci-Hub and Libgen, Indian researchers' access to information will be seriously undermined. While acknowledging that the government spends large sums of money to subscribe to journals, Mahajan says that researchers and students are heavily reliant on Sci-Hub and Libgen for information that the publishing industry itself does not pay for.

Not a single one of Google's iOS apps have been updated in almost a month -- an unusually long period for a tech behemoth not to release, at the very least, even a minor bug fix or stability update for one of its dozens of insanely popular iPhone and iPad apps. From a report: And after reviewing the latest release dates for all of Google's iOS apps, one reason for this lack of updates seems more likely than others: It could be related to Apple's new App Store privacy labels. The last time any Google iOS app was updated was on December 7. This includes updates to major Google apps like Google Drive, YouTube, Google Docs, Google Sheets, YouTube Music, Google Duo, Google Authenticator, and Gboard. Why is December 7 a significant date? Because starting on December 8, Apple mandated that any new apps or app updates submitted to the App Store would require the developer to fill out the privacy label information for the app it was submitting. This privacy label reveals exactly what data the app is collecting about the user and how that user data is being used. The label can then be viewed on an app's App Store listing page. The feature is part of Apple's push to make developers be more transparent in the ways they collect and use user data, so users can make more informed choices about the apps they choose to download.

An anonymous reader quotes a report from CoinDesk: Ukraine's government has chosen the Stellar blockchain network as a platform to build a central bank digital currency (CBDC). Announced Monday, the Ministry of Digital Transformation of Ukraine and the Stellar Development Foundation (SDF) signed a Memorandum of Understanding to build out a "virtual assets ecosystem and national digital currency of Ukraine." The National Bank of Ukraine has been researching the possibility of CBDC implementation since 2017, and the Stellar partnership will now be the basis of its virtual currency development, according to Digital Transformation and IT Deputy Minister Oleksandr Bornyakov.

"The Ministry of Digital Transformation is working on creating the legal environment for the development of virtual assets in Ukraine," Bornyakov said in a statement. "We believe our cooperation with the Stellar Development Foundation will contribute to development of the virtual asset industry and its integration into the global financial ecosystem." Stellar Development Foundation CEO Denelle Dixon said the partnership with Ukraine's government and other stakeholders to digitize the hryvnia will officially launch this month. "We've been in conversations with governments and institutions all over the world about the key considerations for issuing CBDCs. It's important to remember many, if not all, of these organizations weren't designed to be technology companies and that they have many audiences that they are supporting," Dixon said via an email. "That makes a public-private partnership so essential to getting this right."

An anonymous reader quotes a report from ZDNet: Singapore has confirmed its law enforcers will be able to access the country's COVID-19 contact tracing data to aid in their criminal investigations. To date, more than 4.2 million residents or 78% of the local population have adopted the TraceTogether contact tracing app and wearable token, which is one of the world's highest penetration rates. [...] In its efforts to ease privacy concerns, the Singapore government had stressed repeatedly that COVID-19 data would "never be accessed unless the user tests positive" for the virus and was contacted by the contact tracing team. Personal data such as unique identification number and mobile number also would be substituted by a random permanent ID and stored on a secured server.

However, the Singapore government now has confirmed local law enforcement will be able to access the data for criminal investigations. Under the Criminal Procedure Code, the Singapore Police Force can obtain any data and this includes TraceTogether data, according to Minister of State for Home Affairs, Desmond Tan. He was responding to a question posed during parliament Monday on whether the TraceTogether data would be used for criminal probes and the safeguards governing the use of such data. Tan said the Singapore government was the "custodian" of the contact tracing data and "stringent measures" had been established to safeguard the personal data. "Examples of these measures include only allowing authorized officers to access the data, using such data only for authorized purposes, and storing the data on a secured data platform," he said. He added that public officers who knowingly disclose the data without authorization or misuse the data may be fined up to SG$5,000 or jailed up to two years, or both.

Asked if police use of the data violated the TraceTogether privacy pledge, Tan said: "We do not preclude the use of TraceTogether data in circumstances where citizens' safety and security is or has been affected, and this applies to all other data as well." He noted that "authorized police officers" may invoke the Criminal Procedure Code to access TraceTogether data for such purposes as well as for criminal investigation, but this data would, otherwise, be used only for contact tracing and to combat the spread of COVID-19.

Wikileaks founder Julian Assange cannot be extradited to the United States, a court in London has ruled. The BBC reports: The judge blocked the request because of concerns over Mr Assange's mental health and risk of suicide in the U.S. Mr Assange, who is wanted over the publication of thousands of classified documents in 2010 and 2011, says the case is politically motivated. Expressing disappointment at the ruling, the U.S. justice department noted that its legal arguments had prevailed. Its position is that the leaks broke the law and endangered lives.

"While we are extremely disappointed in the court's ultimate decision, we are gratified that the United States prevailed on every point of law raised," the justice department said. The U.S. authorities have 14 days in which to lodge an appeal and are expected to do so. Mr Assange will now be taken back to Belmarsh Prison -- where he is being held -- and a full application for his bail will be made on Wednesday. His lawyer Ed Fitzgerald QC told the court there would be evidence to show Mr Assange would not abscond. [...]

If convicted in the U.S., Mr Assange faces a possible penalty of up to 175 years in jail, his lawyers have said. However the U.S. government said the sentence was more likely to be between four and six years. Mr Assange faces an 18-count indictment from the U.S. government, accusing him of conspiring to hack into U.S. military databases to acquire sensitive secret information relating to the Afghanistan and Iraq wars, which was then published on the Wikileaks website. He says the information exposed abuses by the U.S. military. But U.S. prosecutors say the leaks of classified material endangered lives, and so the U.S. sought his extradition from the UK.

CNET reveals 2020's most popular show among video pirates: It probably won't come as a surprise that Disney Plus smash hit series The Mandalorian has won the (unfortunate) title of most-pirated TV show of 2020 — using popular torrenting site BitTorrent. According to analysis from TorrentFreak (via IndieWire), Game of Thrones was the most-pirated TV show seven years running. But the HBO series ended in 2019, leaving The Mandalorian to improve its ranking from third to No. 1.
The rest of the list, from IndieWire: Prime Video's irreverent superhero series "The Boys" is at number two, HBO's "Westworld" is number three, Prime Video's "Vikings" is number four, CBS' "Star Trek: Picard" is five, followed by Adult Swim's "Rick and Morty," AMC's "The Walking Dead," HBO's "The Outsider," CW's "The Arrow," and CW's "The Flash."

"Axiom Space has announced that it is creating an office park and manufacturing center at the Houston SpacePort at Ellington Field," notes an opinion piece for The Hill by Houston-based space writer Mark R. Whittington.

"The development is a hopeful sign that, despite foot dragging by Congress, a commercial replacement for the International Space Station may well happen." The United States has a chance to avoid a "space gap" when the ISS reaches the end of its operational life, like the one that happened between the end of the space shuttle program and the first launch of the SpaceX commercial crew Dragon mission. When Jim Bridenstine became NASA administrator, one of the questions confronting him was what to do about maintaining a presence in low Earth orbit after the ISS. The idea that he and experts at NASA have been pushing is to encourage private companies to build their own space station.

NASA would provide needed support by pledging to become an anchor tenant for such orbiting facilities. However, the commercial space stations would also have to find private customers. The problem is that Congress has been remarkably stingy when it comes to putting up real money for this approach. The fiscal 2020 budget request included $150 million for commercial space stations. Congress funded support for private orbiting labs for a grand total of $15 million...

Axiom Space has won the nod to attach one of its own modules to the ISS. Not waiting for Congress to cough up funding for NASA, Axiom has announced a facility to manufacture space station modules at the Ellington SpacePort in Houston. The company will also have private astronaut training facilities. Besides employing 1,000 people, the new Axiom facility represents a commitment to creating a commercial space station industry... It is also likely no accident that the Axiom facility is about a five-hour drive from the growing SpaceX spaceport in Boca Chica near the southern tip of Texas. No doubt SpaceX CEO Elon Musk would be pleased to launch finished modules to space, using the mighty Starship rocket, and later crews and cargo.

In the midst of a pandemic, part of a space future is taking shape in South Texas. This time it's being driven by the private sector. NASA had best jump on board or risk being left behind.

CNN reports that some critics are now questioning whether America's Cybersecurity and Infrastructure Security Agency (CISA) is equipped to protect the integrity of government systems from adversaries: Some of the nearly half-dozen government agencies affected by the hack have recently reached out to CISA for help with addressing the known vulnerabilities that were exploited in the attack but were told the agency did not have enough resources to provide direct support, according to a source familiar with the requests. The person noted the slow response has only increased the perception that CISA is overstretched. Multiple sources told CNN that CISA, which operates as the Department of Homeland Security's cyber arm, does not have the appropriate level of funding or necessary resources to effectively handle an issue of this magnitude.

"It's a two-year-old agency with about 2,000 employees, so clearly that level of responsibility is not commensurate with the resources that they have," Kiersten Todt, a former Obama cybersecurity official and managing director of the Cyber Readiness Institute, recently told CNN....

"CISA is not capable," according to James Andrew Lewis, cybersecurity and technology expert at the Center for Strategic and International, who added that the agency's failure to detect the breach months ago was largely due to the fact its attention and resources were consumed by efforts to secure the 2020 presidential election. "CISA has always been and will continue to be slammed by the responsibilities heaped on it by law," Daniel Dister, New Hampshire's chief information security officer, told CNN. "They have been overloaded with work from the start and have had a hard time coming up to the level of expertise that DoD/CYBERCOM/NSA has enjoyed."
Yesterday the New York Times noted the breach wasn't detected by any U.S. government cyberdefense agency (or the Department of Homeland Security), but by private cybersecurity firm FireEye. "It's clear the United States government missed it," the Times was told by Senator Mark Warner, ranking member of the Senate Intelligence Committee. "And if FireEye had not come forward, I'm not sure we would be fully aware of it to this day." The breach is far broader than first believed. Initial estimates were that Russia sent its probes only into a few dozen of the 18,000 government and private networks they gained access to when they inserted code into network management software made by a Texas company named SolarWinds. But as businesses like Amazon and Microsoft that provide cloud services dig deeper for evidence, it now appears Russia exploited multiple layers of the supply chain to gain access to as many as 250 networks.

The hackers managed their intrusion from servers inside the United States, exploiting legal prohibitions on the National Security Agency from engaging in domestic surveillance and eluding cyberdefenses deployed by the Department of Homeland Security. "Early warning" sensors placed by Cyber Command and the National Security Agency deep inside foreign networks to detect brewing attacks clearly failed. There is also no indication yet that any human intelligence alerted the United States to the hacking.

Since 1976 "Project Censored," a U.S.-based nonprofit media watchdog organization, has been identifying "the news that didn't make the news," the most significant stories it believes are being systematically overlooked. Slashdot ran stories about its annual list of the year's most censored news stories in 1999, 2003, 2004, and in 2007, when they'd presciently warned that the media was ignoring the issue of net neutrality.

But their latest list of underreported stories includes this disturbing headline: "Antibiotic Abuse: Pharmaceutical Profiteering Accelerates Superbugs." Pharmaceutical giants Abbott and Sun Pharma are providing dangerous amounts of antibiotics to unlicensed doctors in India and incentivizing them to overprescribe. In August 2019 the Bureau of Investigative Journalism (BIJ) reported that these unethical business practices are leading to a rise in superbugs, or bacterial infections that are resistant to antibiotic treatment. Bacteria naturally evolve a resistance to antibiotics over time, but the widespread and inappropriate use of antibiotics accelerates this process. Superbugs are killing at least 58,000 babies each year and rendering a growing number of patients untreatable with all available drugs.

India's unlicensed medical practitioners, known as "quack" doctors, are being courted by Abbott and Sun Pharma, billion-dollar companies that do business in more than one hundred countries, including the United States. The incentives these companies provide to quack doctors to sell antibiotics have included free medical equipment, gift cards, televisions, travel, and cash, earning some doctors nearly a quarter of their salary. "Sales representatives would also offer extra pills or money as an incentive to buy more antibiotics, encouraging potentially dangerous overprescription," a Sun Pharma sales representative revealed to an undercover BIJ reporter... [P]atients without access to better care often turn to quack doctors for treatment, and many are unaware that their local medical "professionals" have no formal training and are being bribed to sell unnecessary antibiotics.

In September 2019, the BIJ reported on similar problems with broken healthcare systems, medical corruption, and dangerous superbugs in Cambodia. Their account describes how patients often request antibiotics for common colds, to pour onto wounds, and to feed to animals. Illegally practicing doctors and pharmacists in Cambodia admitted that they would often prescribe based on customer requests rather than appropriate medical guidelines. As the BIJ noted, "This kind of misuse speeds up the creation of drug resistant bacteria, or superbugs, which are predicted to kill 10 million people by 2050 if no action is taken...."

Although superbugs have attracted some attention, their cause and importance remain poorly understood by the public. The Independent and BuzzFlash republished the Bureau of Investigative Journalism's report; otherwise, the role of pharmaceutical companies in the rise of dangerous superbugs has been drastically underreported.
The site's list of the top 25 censored stories of 2019 - 2020 also includes:

• Growing interest in so-called "public" banks, "not legally obligated to maximize profits, as private banks are; instead, public banks are mandated to serve their communities."

• How rising sea levels and warmer waters will impact nuclear power plants, "posing increased risks of nuclear disasters."

• Proposals to revitalize journalism through public funding.

• How the U.S. military represents "a massive, hidden contributor to the climate crisis."

"A carefully designed four-day week could be introduced in the UK immediately and be affordable for most firms with more than 50 workers, a think tank has said," reports the Guardian, citing new research from a not-for-profit think tank: A report by Autonomy – which is campaigning for a shorter working week without loss of pay – said the majority of 50,000 firms studied would be able to cope with the change through higher productivity or by raising prices. The think tank said the government should investigate ways of rolling out a four-day week, starting with the public sector. Although many companies are struggling with the lingering impact of the UK's deepest slump in more than 300 years, Autonomy said that even under its "worst-case" scenario, a four-day week would be affordable for most firms once the initial phase of the Covid-19 pandemic had passed.

It accepted, however, that some firms in sectors where labour costs were high and profit margins thin would experience cashflow problems if changes were implemented too quickly. Will Stronge, director of research at Autonomy, said: "For the large majority of firms, reducing working hours is an entirely realistic goal for the near future. By providing a hypothetical 'stress test', we can dispel any myths about the affordability of a four-day working week.

After Russia's massive breach of both government and private networks in the U.S., American intelligence officials "have expressed anger that Microsoft did not detect the attack earlier.

But new criticisms are also falling on SolarWinds: Some of the compromised SolarWinds software was engineered in Eastern Europe, and American investigators are now examining whether the incursion originated there, where Russian intelligence operatives are deeply rooted.... SolarWinds moved much of its engineering to satellite offices in the Czech Republic, Poland and Belarus, where engineers had broad access to the Orion network management software that Russia's agents compromised. The company has said only that the manipulation of its software was the work of human hackers rather than of a computer program. It has not publicly addressed the possibility of an insider being involved in the breach.

None of the SolarWinds customers contacted by The New York Times in recent weeks were aware they were reliant on software that was maintained in Eastern Europe. Many said they did not even know they were using SolarWinds software until recently.

Even with its software installed throughout federal networks, employees said SolarWinds tacked on security only in 2017, under threat of penalty from a new European privacy law. Only then, employees say, did SolarWinds hire its first chief information officer and install a vice president of "security architecture." Ian Thornton-Trump, a former cybersecurity adviser at SolarWinds, said he warned management that year that unless it took a more proactive approach to its internal security, a cybersecurity episode would be "catastrophic." After his basic recommendations were ignored, Mr. Thornton-Trump left the company.

SolarWinds declined to address questions about the adequacy of its security. In a statement, it said it was a "victim of a highly-sophisticated, complex and targeted cyberattack" and was collaborating closely with law enforcement, intelligence agencies and security experts to investigate. But security experts note that it took days after the Russian attack was discovered before SolarWinds' websites stopped offering clients compromised code.
And privately U.S. officials are now also considering the security of the U.S. power grid: Publicly, officials have said they do not believe the hackers from Russia's S.V.R. pierced classified systems containing sensitive communications and plans. But privately, officials say they still do not have a clear picture of what might have been stolen. They said they worried about delicate but unclassified data the hackers might have taken from victims like the Federal Energy Regulatory Commission, including Black Start, the detailed technical blueprints for how the United States plans to restore power in the event of a cataclysmic blackout. The plans would give Russia a hit list of systems to target to keep power from being restored in an attack like the one it pulled off in Ukraine in 2015, shutting off power for six hours in the dead of winter. Moscow long ago implanted malware in the American electric grid, and the United States has done the same to Russia as a deterrent....

Slashdot reader Charlotte Web quotes SiliconValley.com: Bay Area ride-hailing giant Lyft is accused in a series of new lawsuits of failing to protect female passengers from rape by drivers. One plaintiff claims she was 15 when her driver raped her and then forced her to take an anti-pregnancy pill. The December legal actions are part of a "mass tort" lawsuit initiated in August 2019 by 20 women alleging sexual assault by Lyft drivers. Several dozen women joined the case soon after, and lawyers for the plaintiffs plan to add hundreds more alleged victims. A trial is scheduled for January 2022... The suits also allege that Lyft "does not cooperate with police when a driver commits an illegal sexual attack on its passengers," requiring that "extensive standards be met" before it will consider police requests for information, and only releasing information in response to a subpoena...

Lyft could, the suits allege, ensure that video is taken and saved of all rides, and the firm could track drivers if they leave their cars for any reason other than to provide temporary help to a passenger, and it could set up a system in which passengers must confirm their intention to significantly change routes or destinations. Lyft said it has developed in-app features allowing riders to share their location with family and friends, and to quickly and easily obtain emergency help from a security firm that can alert police upon a passenger's request.

The plaintiffs are seeking unspecified damages, including punitive damages.

The firm's rival, Uber, has also faced a torrent of allegations that it doesn't protect female passengers from sexual assault. After admitting last year that thousands of sexual assaults were reported during rides, Uber was fined $59 million this December for allegedly defying demands by California regulators for details about the reported attacks and its responses to them. Uber in response noted that its publicly issued safety report that acknowledged the sexual assaults was an industry first, and the San Francisco company described regulators' efforts to obtain details as a violation of victims' privacy.

As part of its "Year in Review" series, the EFF shares their dramatic behind-the-scenes details about 2020's fight over the future of .org domains. It begins when the Internet Society (ISOC) announced plans to sell the Public Interest Registry — which manages the .org top-level domain (TLD) — to private equity firm Ethos Capital.

"If you come at the nonprofit sector, you'd best not miss." EFF and other leaders in the NGO community sprung to action, writing a letter to ISOC urging it to stop the sale. What follows was possibly the most dramatic show of solidarity from the nonprofit sector of all time. And we won.

Prior to the announcement, EFF had spent six months voicing our concerns to the Internet Corporation for Assigned Names and Numbers (ICANN) about the 2019 .ORG Registry Agreement, which gave the owner of .ORG new powers to censor nonprofits' websites (the agreement also lifted a longstanding price cap on .ORG registrations and renewals)... Throughout that six-month process of navigating ICANN's labyrinthine decision-making structure, none of us knew that ISOC would soon be selling PIR. With .ORG in the hands of a private equity firm, those fears of censorship and price gouging became a lot more tangible for nonprofits and NGOs. The power to take advantage of .ORG users was being handed to a for-profit company whose primary obligation was to make money for its investors....

More NGOs began to take notice of the .ORG sale and the danger it posed to nonprofits' freedom of expression online. Over 500 organizations and 18,000 individuals had signed our letter by the end of 2019, including big-name organizations like Greenpeace, Consumer Reports, Oxfam, and the YMCA of the USA. At the same time, questions began to emerge (PDF) about whether Ethos Capital could possibly make a profit without some drastic changes in policy for .ORG. By the beginning of 2020, the financial picture had become a lot clearer: Ethos Capital was paying $1.135 billion for .ORG, nearly a third of which was financed by a loan. No matter how well-meaning Ethos was, the pressure to sell "censorship as a service" would align with Ethos' obligation to produce returns for its investors...

Six members of Congress wrote a letter to ICANN in January urging it to scrutinize the sale more carefully. A few days later, EFF, nonprofit advocacy group NTEN, and digital rights groups Fight for the Future and Demand Progress participated in a rally outside of the ICANN headquarters in Los Angeles. Our message was simple: stop the sale and create protections for nonprofits. Before the protest, ICANN staff reached out to the organizers offering to meet with us in person, but on the day of the protest, ICANN canceled on us. That same week, Amnesty International, Access Now, the Sierra Club, and other global NGOs held a press conference at the World Economic Forum to tell world leaders that selling .ORG threatens civil society. All of the noise caught the attention of California Attorney General Xavier Becerra, who wrote to ICANN (PDF) asking it for key information about its review of the sale...
Click through to read the conclusion...

A few hours ago and after years of preparation, amendments to Japan's copyright law came into effect, aiming to criminalize those who download unlicensed manga, magazines, and academic texts from the Internet. From a report: While uploading pirated content has always been illegal, the new law is quite specific in that it criminalizes the downloading of unlicensed content. While that could take place in a simultaneous upload environment such as BitTorrent, it seems most likely that people will obtain content from websites instead. That presents some roadblocks to enforcement so we asked Ina how, from a technical perspective, will the authorities track, obtain evidence, and prosecute people who simply download content (comics, movies, music etc) to their machines but don't distribute? "The authorities shall use digital forensic technologies to track suspects' activities and collect evidence. The details of such technologies have not been publicly available," Masaharu Ina from Japan-based anti-piracy group CODA explained. "There are certain special units specialized in cyber crimes in each prefecture. For example, the Tokyo Metropolitan Police has its own Cyber Crime Control Unit. But the police do not investigate unless the person commits the crime repeatedly, intentionally and maliciously, i.e. innocent light downloaders shall not be prosecuted."

Alphabet's drone delivery unit Wing criticized Trump administration rules issued this week mandating broadcast-based remote identification of drones, saying they should be revised to allow for internet-based tracking. From a report: On Monday, the Federal Aviation Administration (FAA) issued rules that will allow small drones to fly over people and at night in the United States and mandate remote identification technology for nearly all drones. The rules eliminate requirements that drones, known formally as unmanned aerial vehicles, be connected to the internet to transmit location data but requires them to broadcast remote ID messages via radio frequency broadcast. "This approach creates barriers to compliance and will have unintended negative privacy impacts for businesses and consumers," Wing said Thursday in a blog post, adding "an observer tracking a drone can infer sensitive information about specific users, including where they visit, spend time, and live and where customers receive packages from and when." Wing added that "American communities would not accept this type of surveillance of their deliveries or taxi trips on the road. They should not accept it in the sky."

T-Mobile has announced a data breach exposing customers' proprietary network information (CPNI), including phone numbers and call records. From a report: Starting this week, T-Mobile began texting customers that a "security incident" exposed their account's information. According to T-Mobile, its security team recently discovered "malicious, unauthorized access" to their systems. After bringing in a cybersecurity firm to perform an investigation, T-Mobile found that threat actors gained access to the telecommunications information generated by customers, known as CPNI. The information exposed in this breach includes phone numbers, call records, and the number of lines on an account.

Spyware maker NSO Group used real phone location data on thousands of unsuspecting people when it demonstrated its new COVID-19 contact-tracing system to governments and journalists, researchers have concluded. From a report: NSO, a private intelligence company best known for developing and selling governments access to its Pegasus spyware, went on the charm offensive earlier this year to pitch its contact-tracing system, dubbed Fleming, aimed at helping governments track the spread of COVID-19. Fleming is designed to allow governments to feed location data from cell phone companies to visualize and track the spread of the virus. NSO gave several news outlets each a demo of Fleming, which NSO says helps governments make public health decisions "without compromising individual privacy." But in May, a security researcher told TechCrunch that he found an exposed database storing thousands of location data points used by NSO to demonstrate how Fleming works -- the same demo seen by reporters weeks earlier. TechCrunch reported the apparent security lapse to NSO, which quickly secured the database, but said that the location data was "not based on real and genuine data." NSO's claim that the location data wasn't real differed from reports in Israeli media, which said NSO had used phone location data obtained from advertising platforms, known as data brokers, to "train" the system. Academic and privacy expert Tehilla Shwartz Altshuler, who was also given a demo of Fleming, said NSO told her that the data was obtained from data brokers, which sell access to vast troves of aggregate location data collected from the apps installed on millions of phones.

Detente is ending in the global fight over tech taxes. Earlier this year, France agreed to suspend collection of a tax on digital revenue from large technology companies such as Facebook, Amazon and Alphabet's Google. Meanwhile, the U.S. delayed the application of tariffs it was putting on French goods in retaliation for the tax. But now France has resumed collecting what is known as its digital-services tax, a French official said. Other countries, including Italy and the U.K., whose similar taxes went into effect this year, are also set to begin collection in coming months. From a report: The U.S., meanwhile, is set on Jan. 6 to impose tariffs on $1.3 billion of French imports, including cosmetics and handbags. Washington also has pending investigations that could lead to similar tariffs on 10 other countries, including the U.K., Italy, India and Spain. At issue in the dispute is how to tax an increasingly digital economy. For decades, tax treaties have generally allocated corporate profit based on where value is created. But modern multinationals -- particularly ones with digital offerings -- can sell their products across borders in ways that leave little taxable profit in a country where those products are consumed.

France and some other big European countries say tech companies should pay more taxes in the countries where their users and clients are located, something that could boost their tax revenues. But in long-running multilateral talks on how to update the tax system, the U.S. has opposed any solution that is too targeted at tech companies -- slowing progress. "These taxes are a reaction to dissatisfaction with how long it has taken to get a global multilateral solution," said Manal Corwin, who served as deputy assistant secretary for international affairs at the U.S. Treasury Department in the Obama administration, and now works at accounting firm KPMG. "You may need some trade battles back and forth before there's a strong incentive to say, 'OK, enough.'"

VMware said that one of its former top executives, Rajiv Ramaswami, violated his contractual obligations while being courted to be the chief executive officer of rival Nutanix, adding another dimension to a bitter rivalry between the two software makers. From a report: VMware's lawsuit against Ramaswami, who was named CEO on Dec. 9, was filed Monday in California state court in San Jose. The company accused its former chief operating officer of products and cloud services of meeting with Nutanix executives and board members while helping VMware craft a strategy and acquisitions road map. VMware, majority owned by Dell Technologies, said the executive's actions and knowledge of its plans has caused "irreparable injury." Nutanix, which wasn't named as a defendant in the suit, called the case "misguided" and said it's an attempt by VMware to hurt a competitor.

"We cannot unring the bell of that conflict that existed during that two-month period that he was engaged with Nutanix while involved in planning for us," Brooks Beard, a VMware vice president and deputy general counsel, said in an interview. "Through this lawsuit, we're hoping that we can find a way to protect VMware's rights and interests, steps that we would have taken, could have taken, had he alerted us of this conflict." The Palo, Alto-based software maker may seek to recoup its compensation to Ramaswami during the time period and wants to "meaningfully engage" with the executive and his new employer to ensure they won't use confidential VMware information to make competitive decisions, Beard added.

Apple is researching keyboards with small displays on the keys to dynamically change the label on each key, according to a newly-granted patent filing. From a report: The filing is titled "Electronic devices having keys with coherent fiber bundles" and was granted to Apple by the U.S. Patent and Trademark Office on the final patent day of this year. The patent explains how each key on a keyboard could have "an associated key display" connected to "control circuitry in the keyboard" via a "coherent fiber bundle." Apple proposes that each key would be "formed from a fiber optic plate" with "opposing first and second surfaces." While the patent stipulates that each key would need to contain a small display to provide the label, of which any compatible pixel array would work, the foremost technology put forwards by Apple is OLED. The key may be made from materials such as glass, ceramic, metal, or polymer, or even crystalline materials such as sapphire.