ZDNet reports: Under the guise of a "cybersecurity exercise," the Kazakhstan government is forcing citizens in its capital of Nur-Sultan (formerly Astana) to install a digital certificate on their devices if they want to access foreign internet services. Once installed, the certificate would allow the government to intercept all HTTPS traffic made from users' devices via a technique called MitM (Man-in-the-Middle).

Starting today, December 6, 2020, Kazakh internet service providers (ISPs) such as Beeline, Tele2, and Kcell are redirecting Nur-Sultan-based users to web pages showing instructions on how to install the government's certificate. Earlier this morning, Nur-Sultan residents also received SMS messages informing them of the new rules.

Kazakhstan users have told ZDNet today that they are not able to access sites like Google, Twitter, YouTube, Facebook, Instagram, and Netflix without installing the government's root certificate.

This is the Kazakh government's third attempt at forcing citizens to install root certificates on their devices after a first attempt in December 2015 and a second attempt in July 2019. Both previous attempts failed after browser makers blacklisted the government's certificates.

"We recommend that you discuss this situation with us in the chat," one caller warned, "or the problems with your network will never end."

ZDNet reports: In attempts to put pressure on victims, some ransomware gangs are now cold-calling victims on their phones if they suspect that a hacked company might try to restore from backups and avoid paying ransom demands. "We've seen this trend since at least August-September," Evgueni Erchov, Director of IR & Cyber Threat Intelligence at Arete Incident Response, told ZDNet on Friday...

"We think it's the same outsourced call center group that is working for all the [ransomware gangs] as the templates and scripts are basically the same across the variants," Bill Siegel, CEO and co-founder of cyber-security firm Coveware, told ZDNet in an email. Arete IR and Emsisoft said they've also seen scripted templates in phone calls received by their customers.

The use of phone calls is another escalation in the tactics used by ransomware gangs to put pressure on victims to pay ransom demands after they've encrypted corporate networks. Previous tactics included the use of ransom demands that double in value if victims don't pay during an allotted time, threats to notify journalists about the victim company's breach, or threats to leak sensitive documents on so-called "leak sites" if companies don't pay.

NBC News reports: The mysterious neurological symptoms experienced by American diplomats in China and Cuba are consistent with the effects of directed microwave energy, according to a long-awaited report by the National Academies of Sciences that cites medical evidence to support the long-held conviction of American intelligence officials.

The report, obtained Friday by NBC News, does not conclude that the directed energy was delivered intentionally, by a weapon, as some U.S. officials have long believed. But it raises that disturbing possibility...

A team of medical and scientific experts who studied the symptoms of as many as 40 State Department and other government employees concluded that nothing like them had previously been documented in medical literature, according to the National Academies of Sciences report... "The committee felt that many of the distinctive and acute signs, symptoms and observations reported by (government) employees are consistent with the effects of directed, pulsed radio frequency (RF) energy," the report says. "Studies published in the open literature more than a half-century ago and over the subsequent decades by Western and Soviet sources provide circumstantial support for this possible mechanism...."

In the last year, as first reported by GQ Magazine and The New York Times, a number of new incidents have been reported by CIA officers in Europe and Asia, including one involving Marc Polymeropoulos, who retired last year after a long and decorated career as a case officer. He told NBC News he is still suffering the effects of what he believes was a brain injury he sustained on a trip to Moscow. A source directly familiar with the matter told NBC News the CIA, using mobile phone location data, had determined that some Russian intelligence agents who had worked on microwave weapons programs were present in the same cities at the same time that CIA officers suffered mysterious symptoms. CIA officials consider that a promising lead but not conclusive evidence.

The State Department, responding to the report, said that "each possible cause remains speculative" and added that the investigation, now three years old, is still "ongoing." Although it praised the National Academies of Sciences for undertaking the effort, the State Department offered a long list of "challenges of their study" and limitations in the data the academies were given access to, suggesting that the report should not be viewed as conclusive...

The report says more investigation is required [and] recommends that the State Department establish a response mechanism for similar incidents that allows new cases to be studied more quickly and effectively [as well as neurological assessments for all State Department employees on foreign assignments].
NBC notes that the study examined four possible causes: Infection, chemicals, psychological factors and microwave energy. The report concludes that "Among the plausible mechanisms that the committee considered, directed radio frequency (RF) energy, especially in those with the distinct early manifestations, appears most germane, along with persistent postural perceptual dizziness (PPPD) as a secondary reinforcing mechanism, as well as the additive effects of psychological conditions.

"The committee cannot rule out other possible mechanisms, and again, considers it likely that a multiplicity of factors explains some cases and the differences between others."

"After months of wrangling, proposals, court rulings and a few extensions, a deadline set by the Trump Administration's Treasury Department mandated a sale for TikTok by December 4th," remembers Engadget. But that's not what happened.

"Instead, Bloomberg and Reuters report, based on anonymous sources, that the Chinese company and the US government will continue negotiations."

Bloomberg reports: While the deadline has been extended multiple times, TikTok isn't expected to receive a new one, said the people, who asked not to be identified because the decision isn't yet public... The U.S. Treasury Department told TikTok and Chinese parent company ByteDance Ltd. that they won't face a fine or other punishment for missing the deadline because the sides are still negotiating. The deal, which has been in the works for months, is close to being finished, and the administration is eager to complete it before President-elect Joe Biden takes office on Jan. 20, according to one of the people.

An anonymous reader quotes a report from CBC.ca: The U.S. Justice Department is talking to representatives of Meng Wanzhou about a potential deal that would allow the Chinese telecom executive to return home from Canada in exchange for signing a deferred prosecution agreement admitting criminal wrongdoing, according to a report in the Wall Street Journal. Meng, the chief financial officer of Huawei Technologies Co., was detained in December 2018 while she was changing planes in Vancouver. She was arrested on a U.S. extradition request over allegations she lied to a Hong Kong banker in August 2013 about Huawei's control of a subsidiary that's accused of violating U.S. sanctions against Iran. She has consistently denied the charges against her.

Shortly after that arrest, Canadians Michael Kovrig and Michael Spavor were detained in China, where they remain in detention and face charges of spying for Canada. The report also says the proposed deal could pave the way for China to return Kovrig and Spavor, which is a factor that is in part motivating the discussions, according to the paper's sources. In a report in the Wall Street Journal -- which CBC had not independently verified -- sources say the agreement with Meng would require her to admit to criminal wrongdoing. The newspaper reports that if she does that, U.S. prosecutors would defer the charges against her, and could even drop them at a later date.

Netflix is the target of yet another employee-poaching lawsuit. From a report: In a suit on Friday, Activision Blizzard accused the streamer of showing "contempt" for state employment law when it poached the company's chief financial officer two years ago. Netflix has been sued twice before -- by Fox and Viacom -- for allegedly luring away employees who are in the middle of fixed-term agreements. In the latest case, Activision alleges that Netflix hired away CFO Spencer Neumann when he was less than two years into a three-year contract. "Netflix has demonstrated a pattern of caring only about attracting and employing whoever Netflix wants, regardless of whether it violates the law along the way," Activision's lawyers allege. "Netflix's unlawful conduct is not trailblazing or innovative -- it is just reflective of Netflix's contempt for the law of the State of California." The suit notes that Netflix has been making forays into the video game market since 2017, making it a direct competitor with Activision.

President Donald Trump on Thursday signed an executive order that aims to guide how federal agencies adopt artificial intelligence (AI) as part of efforts to build public trust in the government using this technology. From a report: The order itself directs federal agencies to be guided by nine principles when designing, developing, acquiring, and using AI. These principles emphasise that AI use by federal agencies be lawful; purposeful and performance-driven; accurate, reliable, and effective; safe, secure, and resilient; understandable; responsible and traceable; regularly monitored; transparent; and accountable. To implement these principles, the order directs the Office of Management and Budget to create a roadmap by the end of May 2021 for how the government will better support the use of AI. This roadmap will include a schedule for engaging with the public and timelines for finalising relevant policy guidance. The order also calls on agencies to continue to use voluntary consensus standards developed with industry participation. "This order recognises the potential for AI to improve government operations, such as by reducing outdated or duplicative regulations, enhancing the security of federal information systems, and streamlining application processes," Trump said in a statement. Federal agencies will also be required to prepare an inventory of AI use cases, as well as review and assess these use cases for consistency. The General Services Administration, meanwhile, has been directed to establish an AI track within the Presidential Innovation Fellows program to attract experts from industry and academia to work within agencies to further the design, development, acquisition, and use of AI in government.

An anonymous reader quotes a report from The New York Times: The government has interpreted a high-profile provision of the Patriot Act as empowering F.B.I. national security investigators to collect logs showing who has visited particular web pages, documents show. But the government stops short of using that law to collect the keywords people submit to internet search engines because it considers such terms to be content that requires a warrant to gather, according to letters produced by the Office of the Director of National Intelligence. The disclosures come at a time when Congress is struggling with new proposals to limit the law, known as Section 215 of the Patriot Act. The debate ran aground in the spring amid erratic messages from President Trump, but is expected to resume after President-elect Joseph R. Biden Jr. takes the oath of office in January.

In May, 59 senators voted to bar the use of Section 215 to collect internet search terms or web browsing activity, but negotiations broke down in the House. During that period, Senator Ron Wyden, Democrat of Oregon and one of the sponsors of the proposal ban, wrote to the director of national intelligence seeking clarity about any such use. Six months later, the Trump administration finally replied -- initially, it turned out, in a misleading way. In a Nov. 6 letter to Mr. Wyden, John Ratcliffe, the intelligence director, wrote that Section 215 was not used to gather internet search terms, and that none of the 61 orders issued last year under that law by the Foreign Intelligence Surveillance Court involved collection of "web browsing" records. Mr. Wyden's office provided that letter to The New York Times, arguing that it meant Mr. Wyden's proposal in May -- which he sponsored with Senator Steve Daines, Republican of Montana -- could be enacted into law without any operational costs.

But The Times pressed Mr. Ratcliffe's office and the F.B.I. to clarify whether it was defining "web browsing" activity to encompass logging all visitors to a particular website, in addition to a particular person's browsing among different sites. The next day, the Justice Department sent a clarification to Mr. Ratcliffe's office, according to a follow-up letter he sent to Mr. Wyden on Nov. 25. In fact, "one of those 61 orders resulted in the production of information that could be characterized as information regarding browsing," Mr. Ratcliffe wrote in the second letter. Specifically, one order had approved collection of logs revealing which computers "in a specified foreign country" had visited "a single, identified U.S. web page." Mr. Ratcliffe expressed regret "that this additional information was not included in my earlier letter" to the senator, and suggested his staff might take further "corrective action." In a statement, Mr. Wyden said the letters raise "all kinds of new questions, including whether, in this particular case, the government has taken steps to avoid collecting Americans' web browsing information." "More generally," Mr. Wyden continued, "the D.N.I. has provided no guarantee that the government wouldn't use the Patriot Act to intentionally collect Americans' web browsing information in the future, which is why Congress must pass the warrant requirement that has already received support from a bipartisan majority in the Senate."

The personal information of more than 243 million Brazilians, including alive and deceased, has been exposed online after web developers left the password for a crucial government database inside the source code of an official Brazilian Ministry of Health's website for at least six months. From a report: The security snafu was discovered by reporters from Brazilian newspaper Estadao, the same newspaper that last week discovered that a Sao Paolo hospital leaked personal and health information for more than 16 million Brazilian COVID-19 patients after an employee uploaded a spreadsheet with usernames, passwords, and access keys to sensitive government systems on GitHub. Estadao reporters said they were inspired by a report filed in June by Brazilian NGO Open Knowledge Brasil (OKBR), which, at the time, reported that a similar government website also left exposed login information for another government database in the site's source code. Since a website's source code can be accessed and reviewed by anyone pressing F12 inside their browser, Estadao reporters searched for similar issues in other government sites.

An anonymous reader quotes a report from Reuters: A group of U.S. states led by New York is investigating Facebook for possible antitrust violations and plans to file a lawsuit against the social media giant next week, four sources familiar with the matter said on Wednesday. The complaint would be the second major lawsuit filed against a Big Tech company this year. The Justice Department sued Alphabet's Google in October. More than 40 states plan to sign on to the lawsuit, one source said, without naming them.

It is not known what the states plan to include in their complaint. One allegation often made against Facebook is that it has strategically sought to buy small potential rivals, often at a big premium. These include Instagram in 2012 and WhatsApp in 2014. Facebook Chief Executive Mark Zuckerberg has argued in congressional testimony that the company has a range of competitors, including other tech giants. He has defended controversial acquisitions like Instagram and WhatsApp by saying the social media platform helped them expand from small, insignificant companies into powerhouses.

An anonymous reader quotes a report from Ars Technica: President Donald Trump has long been an outspoken foe of big technology companies. And in recent months, he has focused his ire on Section 230, a provision of the 1996 Communications Decency Act that shields online platforms from liability for content posted by their users. In May, Trump called on the Federal Communications Commission to reinterpret the law -- though it's not clear the agency has the power to do that. Since then, he has tweeted about the issue incessantly. On Tuesday evening, Trump ratcheted up his campaign against Section 230. In a tweet, he called the law "a serious threat to our National Security & Election Integrity." He warned that "if the very dangerous & unfair Section 230 is not completely terminated as part of the National Defense Authorization Act (NDAA), I will be forced to unequivocally VETO the Bill."

The NDAA is a massive spending bill that Congress passes each year to authorize funding for the military. This year's version, now under active discussion on Capitol Hill, is expected to cost around $740 billion. The NDAA is seen as a "must pass" bill because no one wants to be blamed for holding up funding for the troops. So inserting language into it can be a way to pass proposals that might not stand on their own. But there's also a risk of a backlash -- especially if a measure is seen as unrelated to the military. This may be why Trump has started claiming that Section 230 is a "threat to our national security," since that would theoretically make it germane to a defense funding bill. Trump's campaign to repeal Section 230 appears to go beyond mere tweets. The White House is reportedly telling members of Congress the same thing in private that the president is telling his 88 million Twitter followers: that he will veto the NDAA if it doesn't repeal or at least overhaul Section 230.

sciencehabit writes: The U.K. government today invited communities around the country to volunteer a site for a prototype fusion reactor, which would be the first -- it is hoped -- to put electricity into the grid. The project, called Spherical Tokamak for Energy Production (STEP), began last year with an initial 222 million pounds over 5 years to develop a design. The U.K. Atomic Energy Authority, the government agency overseeing the effort, says construction could begin as soon as 2032, with operations by 2040.

Still, spherical tokamaks also come with drawbacks. The hot dense plasma in a smaller device is more punishing on materials, so components may need to be replaced more often. And STEP is unlikely to be capable of breeding tritium, one of two hydrogen isotopes that fuels the reactor. Tritium is radioactive with a half-life of 12 years and global supplies are low. A working reactor will have to breed its own tritium by surrounding the vessel with patches of lithium that produce tritium when bombarded by neutrons from the fusion reaction.

An anonymous reader quotes a report from Music Business Worldwide: According to a document published last week, Daniel Ek's company is seeking a patent for its "Plagiarism Risk Detector And Interface" technology, which pertains to "Methods, systems and computer program products..for testing a lead sheet for plagiarism." As explained in the filing -- and as our songwriter/musician readers will already know -- a "lead sheet" is a type of music score or musical notation for songs denoting their melody, chords and sometimes lyrics or additional notes. Spotify's invention would allow for a lead sheet to be fed through the platform's "plagiarism detector," which would then, "having been trained on a plurality of preexisting encoded lead sheets," immediately compare the composition in question to all other songs stored in its database.

A set of messages would then be displayed -- describing a detected level of plagiarism regarding "a plurality of elements" such as a chord sequence, melodic fragments, harmony, etc. of a song. The AI software would also potentially calculate "a similarity value" of the song in question vs. other songs in the Spotify lead sheet library. These technology could work the other way around, too, says Spotify's filing, reassuring a songwriter that "the melodic fragment [of your song] appears to be completely new." One particularly interesting element of this is that it would take place in near-real time, allowing a songwriter or composer to tweak elements of their work to avoid infringement before they (and/or their record label) spent the big bucks on recording a final version. Spotify's filing adds that "in some embodiments a link to the media content item that might be infringed (e.g., a track of an album) is provided so that a [songwriter] can quickly... listen to the potentially plagiarized work."

The American Civil Liberties Union is suing federal authorities over their alleged use of cellphone location data -- particularly in immigration enforcement. From a report: The nonprofit organization today filed a lawsuit against the Department of Homeland Security, U.S. Customs and Border Protection and U.S. Immigration and Customs Enforcement to force the agencies to release records about purchasing cellphone location data for immigration enforcement and other purposes. The lawsuit follows multiple news reports earlier this year about the Trump administration buying access to commercial databases that track cellphone locations and then using that data to detect people who might be entering the country illegally.

"It's critical we uncover how federal agencies are accessing bulk databases of Americans' location data and why," Nathan Freed Wessler, senior staff attorney with the ACLU's Speech, Privacy, and Technology Project, said in a statement. "There can be no accountability without transparency." Senate Democrats, such as privacy advocate Sen. Ron Wyden (D-Ore.), had written a letter to DHS asking for more information on how such data was being used. On Wednesday morning, they disclosed that the department's inspector general would take up the matter.

An anonymous reader quotes a report from TechCrunch: Massachusetts lawmakers have voted to pass a new police reform bill that will ban police departments and public agencies from using facial recognition technology across the state. The bill was passed by both the state's House and Senate on Tuesday, a day after senior lawmakers announced an agreement that ended months of deadlock.

The police reform bill also bans the use of chokeholds and rubber bullets, and limits the use of chemical agents like tear gas, and also allows police officers to intervene to prevent the use of excessive and unreasonable force. But the bill does not remove qualified immunity for police, a controversial measure that shields serving police from legal action for misconduct, following objections from police groups. Critics have for years complained that facial recognition technology is flawed, biased and disproportionately misidentifies people and communities of color. But the bill grants police an exception to run facial recognition searches against the state's driver license database with a warrant. In granting that exception, the state will have to publish annual transparency figures on the number of searches made by officers. "The Massachusetts Senate voted 28-12 to pass, and the House voted 92-67," notes the report. "The bill will now be sent to Massachusetts governor Charlie Baker for his signature."

A reader writes: Italian regulators have fined Apple $12 million for making misleading and unfair claims about iPhone water resistance. The fine was imposed by L'Autorita Garante della Concorrenza e del Mercato (AGCM), which translates literally as the guarantee authority for competition and the market. This is the competition watchdog responsible for ensuring that companies treat both consumers and competitors fairly.

First, it says, Apple made water resistance claims without making it clear to consumers that these were true only in ideal laboratory conditions, and phones had not passed the same tests in real-life conditions. [...] Second, and more seriously, Apple made iPhone water resistance claims in its marketing, but then refused warranty service on phones which suffered water damage.

Apple has been fined ten million Euros, and additionally ordered to publish a notice on its Italian website through a "Consumer protection information" link. The potentially opens the way for similar rulings in other European Union countries, and could conceivably lead to class action lawsuits in the US and elsewhere, now that the issue has been highlighted. SetteBIT notes that the ruling references three Apple ads. Apple tends to delete older ads from its YouTube channel, but the site archives its own copies, providing proof of the claims originally made.

An anonymous reader quotes a report from Reuters: Ford is urging major automakers to consider backing a framework deal with California on vehicle emissions in a bid to reach industry consensus before President-elect Joe Biden takes office, according to a letter seen by Reuters on Monday. Major automakers are set to discuss next steps at a virtual meeting of their auto trade association Tuesday, which comes a week after General Motors abruptly announced it would no longer back the Trump administration's ongoing effort to bar California from setting its own vehicle emissions rules.

In a previously unreported letter, Ford Americas President Kumar Galhotra on Wednesday said with Biden's win, the fight over Trump's effort to preempt California on vehicle emissions "is now, at least for the next set of years, essentially moot. The more relevant issue is thus the question of the standards." Galhotra urged automakers "to actively consider embracing the California framework." He added: "The Biden Administration will not let the Trump standards stand, and either by way of litigation and/or a regulatory reboot, the new team will move in a different, more stringent direction." A Ford spokeswoman declined comment on the letter but said the California agreement "should be the foundation for new regulations as the Biden administration considers stronger fuel economy standards in 2021."

An anonymous reader quotes a report from The Verge: Martin Tripp, the former Tesla worker who has been embroiled in a bitter legal battle with CEO Elon Musk for over two years, was ordered to pay his former employer $400,000 after admitting to leaking confidential information to a reporter. The settlement is intended to bring an end to one of the more sordid stories at Tesla, in which Tripp, a former process technician, locked horns with the billionaire CEO over allegations that Tesla was wasting a "jaw-dropping" amount of raw material as it ramped up production of the Model 3 sedan.

Musk later accused Tripp of "sabotage" and personally ordered investigators to hack Tripp's phone and spy on his messages. Tesla even misled local police about a potential mass shooting by Tripp at the company's Nevada factory. But in the end, Tripp came out on the losing side. The payment is part of a proposed settlement to a lawsuit filed by Tesla in 2018 alleging that Tripp hacked the electric car company's system and transferred "gigabytes" of data to third parties. As part of the agreement, Tripp admitted to violating laws related to trade secrets and computer crimes when he told a Business Insider reporter that Tesla was wasting a significant amount of raw materials during production of its Model 3. Tripp also agreed to pay $25,000 to Tesla for continuing to reveal information about the company, despite being ordered to stop by a judge.

Microsoft says it will make changes in its new Productivity Score feature, including removing the ability for companies to see data about individual users, to address concerns from privacy experts that the tech giant had effectively rolled out a new tool for snooping on workers. From a report: "Going forward, the communications, meetings, content collaboration, teamwork, and mobility measures in Productivity Score will only aggregate data at the organization level -- providing a clear measure of organization-level adoption of key features," wrote Jared Spataro, Microsoft 365 corporate vice president, in a post this morning. "No one in the organization will be able to use Productivity Score to access data about how an individual user is using apps and services in Microsoft 365." The company rolled out its new "Productivity Score" feature as part of Microsoft 365 in late October. It gives companies data to understand how workers are using and adopting different forms of technology. It made headlines over the past week as reports surfaced that the tool lets managers see individual user data by default. As originally rolled out, Productivity Score turned Microsoft 365 into a "full-fledged workplace surveillance tool," wrote Wolfie Christl of the independent Cracked Labs digital research institute in Vienna, Austria. "Employers/managers can analyze employee activities at the individual level (!), for example, the number of days an employee has been sending emails, using the chat, using 'mentions' in emails etc."

An anonymous reader quotes a report from Ars Technica: Verizon has agreed to bring FiOS fiber-to-the-home service to another 500,000 households in New York City by July 2023, settling a lawsuit over Verizon's failure to wire up the entire city as required in a franchise agreement. "Today's settlement will ensure that 500,000 households that previously lacked Verizon broadband access because of a corporate failure to invest in the necessary infrastructure will have the option of fiber broadband and create critical cost competition in areas where today only one provider exists," NYC Mayor Bill de Blasio's office said in an announcement last week. The settlement's full text is available here.

New York City sued Verizon in March 2017, saying the company failed to complete a citywide fiber rollout by 2014 as required in its cable-TV franchise agreement. At the time the lawsuit was filed, Verizon said it had brought its fiber network to 2.2 million of NYC's 3.1 million households. The settlement will cover many but not all of the remaining residential housing units where FiOS is currently not available. As of July 2019, Verizon had brought FiOS to 2.7 million households, a number that will rise to 3.2 million households once Verizon complies with the settlement, de Blasio's office told Ars today. The city estimates there are now 3.45 million households, so about 250,000 will be left without FiOS. With the settlement providing coverage of over 90 percent of households, "this is part of our overall strategy to increase competition in the market," a de Blasio spokesperson told Ars.