Amazon announced a joint operation with the National Intellectual Property Rights Coordination Center (IPR Center) on Tuesday, focused on stopping counterfeit goods from entering the US. The Verge reports: The partnership will rely on intelligence gathered from Amazon's Counterfeit Crimes Unit, logistics company DHL, and US Customs and Border Patrol (CBP) to proactively stop the sale of counterfeit products. "Operation Fulfilled Action" relies on Amazon's dominant positioning as both a distributor and marketplace for products. Because of the amount sold on Amazon's various storefronts, IPR Center and Amazon have shared information previously, even collaborating on a crackdown on fraud related to COVID-19. This new operation marks a more long-term partnership, however.

Prior to Amazon's involvement, IPR Center's focus on "securing the global supply-chain" might be unfamiliar to the average person, but you've actually seen a bit of the Center's work before -- the government warning that plays before every DVD and Blu-ray was created by the organization. As far as counterfeit products are concerned, Amazon says it already investigated and removed potentially fraudulent offenders. A partnership with these new agencies should allow the company to go further and "stop counterfeits at the border, regardless of where bad actors were intending to offer them" said Dharmesh Mehta, vice president of customer trust and partner support at Amazon.

An anonymous reader quotes a report from Ars Technica: A grand jury in California's Santa Clara County has indicted Thomas Moyer, Apple's head of global security, for bribery. Moyer is accused of offering 200 iPads to the Santa County Sheriff's office in exchange for concealed carry permits for four Apple employees. Moyer's attorney says that he did nothing wrong, and notably Apple is standing behind its executive. "We expect all of our employees to conduct themselves with integrity," an Apple spokesperson said in a statement. "After learning of the allegations, we conducted a thorough internal investigation and found no wrongdoing."

Also indicted were two officials in the office of Santa Clara County Sheriff Laurie Smith. These officials are accused of soliciting the alleged bribe. California law gives sheriffs broad discretion to decide who gets permits to carry concealed weapons in the state. Smith has previously faced accusations that her office deliberately withheld permits to carry concealed weapons until applicants did favors for Smith. A June investigation by NBC Bay Area found that donors to Smith's re-election campaign were 14 times more likely to get concealed carry permits than those who didn't donate. A press release from Smith's office described the indictments as "a difficult time for our organization."

Jeff Rosen, the Santa Clara district attorney responsible for the indictments, said that the donation of 200 iPads was scuttled at the last minute after Rosen obtained a search warrant in the case. According to LinkedIn, Moyer is responsible for "strategic management of Apple's corporate and retail security, crisis management, executive protection, investigations and new product secrecy." While two individuals in Sheriff Smith's office were indicted, no charges have been filed against Smith herself. Rosen says the investigation is ongoing. A common prosecutorial strategy is to focus on lower-ranking employees first in order to pressure them to provide evidence against their boss.

India is not done banning Chinese apps. The world's second largest internet market, which has banned over 175 apps with links to the neighboring nation in recent months, said on Tuesday it was banning an additional 43 such apps. From a report: Like with the previous orders, India cited cybersecurity concerns to block these apps. "This action was taken based on the inputs regarding these apps for engaging in activities which are prejudicial to sovereignty and integrity of India, defence of India, security of state and public order," said India's IT Ministry in a statement. The ministry said it issued the order to block these apps "based on the comprehensive reports received from Indian Cyber Crime Coordination Center, Ministry of Home Affairs." The apps that have been banned include popular short video service Snack Video, which had surged to the top of the chart in recent months, as well as e-commerce app AliExpress, delivery app Lalamove, and shopping app Taobao Live. At this point, there doesn't appear to be any Chinese app left in the top 500 apps used in India.

Two Android applications belonging to Chinese tech giant Baidu were removed from the official Google Play Store at the end of October after they were caught collecting sensitive user details. From a report: The two apps -- Baidu Maps and Baidu Search Box -- were removed after Google received a report from US cyber-security firm Palo Alto Networks. Both apps had more than 6 million downloads combined before being removed. According to the US security firm, the two apps contained code that collected information about each user's phone model, MAC address, carrier information, and IMSI (International Mobile Subscriber Identity) number. The data collection code was found in the Baidu Push SDK, used to show real-time notifications inside both apps. Palo Alto Networks security researchers Stefan Achleitner and Chengcheng Xu, who identified the data collection code, said that while some of the collected information is "rather harmless," some data like the IMSI code "can be used to uniquely identify and track a user, even if that user switches to a different phone." The research team said that while the collection of personal user details is not specifically forbidden by Google's policy for Android apps after they reported the issue to Google, the Play Store security team confirmed their findings and "identified [additional] unspecified violations" in the two Baidu apps, which eventually led to the two apps being removed from the official store on October 28.

The U.K.-based security company NCC Group and consumer advocacy group Which? have found vulnerabilities in 11 "smart" doorbells sold on popular platforms like Amazon and eBay. CyberScoop reports: One flaw could allow a remote attacker to break into the wireless network by swiping login credentials. Another critical bug, which has been around for years, could enable attackers to intercept and manipulate data on the network. The investigation focused on doorbells made by often obscure vendors, but which nonetheless earned top reviews and featured prominently on Amazon and eBay. The researchers raised concerns that some of the devices were storing sensitive data, including location data and audio and video captured by the doorbell's camera, on insecure servers. One device made by a company called Victure, for example, sent a user's wireless name and password, unencrypted, to servers in China, according to the researchers.

In a statement, Amazon said it requires products sold on its site to be compliant with applicable laws and regulations, and that it has tools to detect "unsafe or non-compliant products from being listed in our stores." eBay said it takes down listings that violate its safety standards, but that the devices flagged by the researchers did not meet that threshold. Victure did not immediately respond to a request for comment. The NCC Group-Which? team said they tried to contact the various vendors of the vulnerable smart doorbells, with mixed success. The unnamed vendor of one device, for example, removed an online listing for the product after the researchers shared their findings.

A trove of more than two dozen internal Amazon reports reveal in stark detail the company's obsessive monitoring of organized labor and social and environmental movements in Europe, particularly during Amazon's "peak season" between Black Friday and Christmas. From a report: The reports, obtained by Motherboard, were written in 2019 by Amazon intelligence analysts who work for the Global Security Operations Center, the company's security division tasked with protecting Amazon employees, vendors, and assets at Amazon facilities around the world. The documents show Amazon analysts closely monitor the labor and union-organizing activity of their workers throughout Europe, as well as environmentalist and social justice groups on Facebook and Instagram. They also reveal, and an Amazon spokesperson confirmed, that Amazon has hired Pinkerton operatives -- from the notorious spy agency known for its union-busting activities -- to gather intelligence on warehouse workers. Internal emails sent to Amazon's Global Security Operations Center obtained by Motherboard also reveal that all the division's team members around the world receive updates on labor organizing activities at warehouses that include the exact date, time, location, the source who reported the action, the number of participants at an event (and in some cases a turnout rate of those expected to participate in a labor action), and a description of what happened, such as a "strike" or "the distribution of leaflets." Other documents reveal that Amazon intelligence analysts keep close tabs on how many warehouse workers attend union meetings; specific worker dissatisfactions with warehouse conditions, such as excessive workloads; and cases of warehouse-worker theft, from a bottle of tequila to $15,000 worth of smart watches.

Karan Bajaj, an Indian entrepreneur who teaches meditation and in his recent book invites others to live a life away from the noise, is going after the most vocal critics of his startup. From a report: Bajaj, founder of coding platform WhiteHat Jr, has filed a defamation case against Pradeep Poonia, an engineer who has publicly criticized the firm for its marketing tactics, the quality of the courses on the platform, and aggressive takedowns of such feedback. On Monday, WhiteHat Jr, filed a similar case against Aniruddha Malpani, an investor who has shared unflattering feedback about the startup. Most of the customers of WhiteHat Jr, which is aimed at kids, live in America, and demand for its one-to-one classes has surged nearly 90% this year, according to the startup. In the lawsuit against Poonia -- in which Bajaj is seeking $2.7 million in damages -- Poonia has been accused of infringing trademarks and copyright of properties owned by WhiteHat Jr, defaming and spreading misleading information about the startup and its founder, and accessing the company's private communications app.

[...] The lawsuit, riddled with spelling and grammatical errors, appears to be also indicative of just how little criticism WhiteHat Jr, owned by India's second most valuable startup Byju's, is willing to accept. According to internal posts of a Slack channel of WhiteHat Jr shared by Poonia, the startup has aggressively used copyright protection to take down numerous unflattering feedback about the startup in recent months. The suit also raises concern with Poonia accusing WhiteHat Jr of "murdering" an imaginary kid that featured in one of its earlier ads. A 12-year-old child named "Wolf Gupta" appeared in earlier ads of WhiteHat Jr, which claimed that the kid had landed a lucrative job at Google. The kid does not exist, the lawyers of Bajaj say in the suit. Ironically that was also the argument Poonia, who spent a long time trying to unearth more information about this supposed poster child of WhiteHat Jr, was making in his tweets.

Long-time Slashdot reader t0qer has a question: why haven't we gone to an open source, Public Key Infrastructure-based voting system? "I'm fairly well versed in PKI technology, and quoting this site, it would take traditional computers 300 trillion years to break RSA-2048 for a single vote." SSL.com has a pretty interesting piece on using Public Key Infrastructure in voting. There's also a GitHub project that leverages PKI and IBM blockchain technology...

It just seems like paper at this point has outlived its secureness. A closed sourced voting system doesn't really seem like the kind of thing Slashdot would really get behind.
SSL's article points out that the technology seems to exist already. Nearly half the population of Estonia already votes online, and four U.S. states (Arizona, Colorado, Missouri and North Dakota) already have web portals that allow for absentee voting. (And West Virginia has a mobile voting app that uses blockchain technology.) [L]uckily, the groundwork for securing the practice of remote, online voting is already there. We have been conducting many delicate transactions online for some time — the secure transfer of information has been a cornerstone for many industries that have successfully shifted online such as personal banking and investing, and those methods of securing and authenticating information can be employed in voting as well. For years, people have suggested that the use of blockchain technology could be used to secure elections and increase voter turnout.
Share your own thoughts in the comments. Why haven't we implemented Public Key Infrastructure voting?

Shotgun (Slashdot reader #30,919) shared these thoughts from The Register: Every now and again the U.S. Congress manages to do its job and yesterday was one of those days: the Senate passed a new IoT cybersecurity piece of legislation that the House also approved, and it will now move to the President's desk.

As we noted back in March when the IoT Cybersecurity Improvement Act was introduced, the law bill is actually pretty good: it asks America's National Institute of Standards and Technology (NIST) to come up with guidelines for Internet-of-Things devices and would require any federal agency to only buy products from companies that met the new rules. It gives a minimum list of considerations to be covered: secure code, identity management, patching and configuration management. It also requires the General Services Administration — the arm of the federal government that sources products and comms for federal agencies — to come up with guidelines that would require each agency to report and publish details of security vulnerabilities, and how they resolved them, and coordinate with other agencies.

Industry has also got behind the effort — Symantec, Mozilla, BSA The Software Alliance (which includes Apple, Microsoft, IBM, Cloudflare, the CTIA and others) — and Congress has managed to keep its fingers out of things it knows nothing about by leaving the production of standards with the experts, using federal procurement to create a de facto industry standard.
Though it will still be legal sell insecure IoT devices, "for those looking for good, secure products, there will be a baseline standard across the industry..." the article concludes.

"[T]his is an essential first step to getting secure IoT in place."

"Security researchers are blasting Apple for a feature in the latest Big Sur release of macOS that allows some Apple apps to bypass content filters and VPNs..." reports Threatpost. "While users assumed Apple would fix the flaw before the OS emerged from beta into full release, this doesn't appear to have happened."

"Beginning with macOS Catalina released last year, Apple added a list of 50 Apple-specific apps and processes that were to be exempted from firewalls like Little Snitch and Lulu," explains Ars Technica: The undocumented exemption, which didn't take effect until firewalls were rewritten to implement changes in Big Sur, first came to light in October. Patrick Wardle, a security researcher at Mac and iOS enterprise developer Jamf, further documented the new behavior over the weekend. To demonstrate the risks that come with this move, Wardle — a former hacker for the NSA — demonstrated how malware developers could exploit the change to make an end-run around a tried-and-true security measure...

Wardle tweeted a portion of a bug report he submitted to Apple during the Big Sur beta phase. It specifically warns that "essential security tools such as firewalls are ineffective" under the change.

Apple has yet to explain the reason behind the change.

This year Amazon followed up its cylindrical Echo (and its hockey puck-shaped Echo Dot) with a cloth-wrapped sphere-shaped Echo device. And Fast Company reports that one significant change was to the light pipe, "that glowing ring on top of the Echo that signals it's talking or thinking.

"For the fourth generation, that light pipe has been moved to the bottom of the device, to reflect off tables or countertops, and provide a more ambient lighting experience that blends into one's environment — with a catch." Once you hit the privacy button on your Echo, deafening it from hearing your speech, the ring glows a DEFCON 2 red until you unmute it. (Note: Google uses an orange to convey mute for its Assistant, as does Sony's new PS5 controller that has a mic built in.) It's not just overt; it's borderline warlike, adding a Red October glow to your space. Echos have always glowed red when muted. Now your environment does, too.

When I mention this design decision, which seems to punish consumers who prefer privacy, Miriam Daniel, vice president of Echo and Alexa devices at Amazon, acknowledges, but brushes off, the criticism. "[Red] makes for a strong [statement]. There's always a tradeoff. Is it too bright? Annoying? Too in your face?" she muses. But she argues that the greater benefit is that "it gives people a sense of comfort knowing the mic isn't working."
The article notes that in 2019, Amazon announced it had already sold 100 million Alexa-powered devices.

On October 23rd GitHub initially complied with a takedown request for the open-source project youtube-dl — and then after 24 days, reinstated it.

"If there's a silver lining to the episode, it's that GitHub is implementing new policies to avoid a repeat of a repeat situation moving forward," reports Engadget: First, it says a team of both technical and legal experts will manually evaluate every single section 1201 claim. In instances where there's any ambiguity to a claim, the company says it will err on the side of developers and leave their repository online. If the company's technical and legal teams ultimately find any issues with a project, GitHub will give its owners the chance to address those problems before it takes down their work. Following a takedown, it will continue to give people the chance to recover their data — provided it doesn't include any offending code.

GitHub is also establishing a $1 million defense fund to provide legal aid to developers against suspect section 1201 claims, as well as doubling down on its lobbying work to amend the DMCA and other similar copyright laws across the world.

An anonymous reader quotes a report from Wired: In the U.S., a complicated combination of corporate interests and pre-smartphone era legislation has resulted in more than two decades of back and forth about the legality of phone locking. It's looking like that battle could ramp up again next year. The transition to a Biden administration could shake up the regulatory body that governs these rules. The timing also coincides with a congressional proceeding that takes place every three years to determine what tweaks should be made to digital rights laws. 2021 could be the year of the truly unlocked phone. For some activists, it's a glimmer of light at the end of a very long tunnel.

[H]ow could carriers be forced to provide phones that are unlocked by default? There are a couple of promising avenues, though neither are a given. The "agenda" here meaning something to be decided by a regulating body. In the UK, the regulator Ofcom made that call. The US Ofcom equivalent is the Federal Communications Commission. Under its current leadership of Trump appointee Ajit Pai, the FCC has been staunchly pro-business, passing legislation like the repeal of net neutrality at the behest of companies like AT&T. "Getting this done in an Ajit Pai FCC would be extremely difficult and very unlikely, given how friendly that FCC has been toward private companies and broadband providers," Sheehan says. "Whether or not that could happen in a Biden administration, we don't know. I think it would be much more possible."

Another route would be to take the problem back to its source: Section 1201 itself. Every three years, the US Library of Congress and Copyright Office hold a rulemaking proceeding that takes public comment. It's a chance for advocates to make their case for amending Section 1201, assuming they can afford the legal fees necessitated by such an involved, drawn out process. It's a less overtly political process, as the key decisionmakers at the two institutions don't come and go with each presidential administration like they usually do at the FCC. These sessions have already yielded positive outcomes for fans of repairability, like an exemption that took effect in 2016 that made it legal to hack car computers and other devices. The next proceeding is currently underway. If citizens want to urge the government to amend Section 1201, the first round of comments are required to be in by December 14. Responses and additional proposals will go back and forth through the spring of 2021, until the Copyright Office ultimately decides which changes to implement. Both Sheehan and Wiens are working with other advocates to make their case for a future of unlockability.

Global internet companies Facebook, Google and Twitter and others have banded together and threatened to leave Pakistan after the South Asian nation granted blanket powers to local regulators to censor digital content. From a report: Earlier this week, Pakistan Prime Minister Imran Khan granted the Pakistan Telecommunication Authority the power to remove and block digital content that pose "harms, intimidates or excites disaffection" toward the government or in other ways hurt the "integrity, security, and defence of Pakistan." Through a group called the Asia Internet Coalition (AIC), the tech firms said that they were "alarmed" by the scope of Pakistan's new law targeting internet firms." In addition to Facebook, Google, and Twitter, AIC represents Apple, Amazon, LinkedIn, SAP, Expedia Group, Yahoo, Airbnb, Grab, Rakuten, Booking.com, Line, and Cloudflare.

If the message sounds familiar, it's because this is not the first time these tech giants have publicly expressed their concerns over the new law, which was proposed by Khan's ministry in February this year. After the Pakistani government made the proposal earlier this year, the group had threatened to leave, a move that made the nation retreat and promise an extensive and broad-based consultation process with civil society and tech companies. That consultation never happened, AIC said in a statement on Thursday, reiterating that its members will be unable to operate in the country with this law in place.

When it comes to protecting sensitive information from foreign hackers, President-elect Joe Biden's team is largely on its own. The federal government, which has some of the most sophisticated antihacking technologies in the world, is offering limited assistance to Mr. Biden's transition operation in securing its email and other communications, despite concerns that the team is likely a top espionage target for Russia, China, and other adversaries, WSJ reported Friday, citing people familiar with the transition. From the report: The lack of government cybersecurity support is among the obstacles the Biden transition team has faced as a result of the Trump administration's refusal to acknowledge Mr. Biden's election victory and make available the resources of the federal government ahead of his inauguration in two months. Normally, the General Services Administration would own and manage the setup of government email accounts for a presidential transition team, which are typically assigned the "ptt.gov" domain. The cybersecurity wing of the Department of Homeland Security typically assists in helping a transition to protect those newly created government email accounts, according to current and former officials, and could rely on information from U.S. intelligence agencies to inform its protective efforts. The Trump administration is blocking many of the transition-related resources usually provided to a president-elect, including government email accounts. The GSA so far has declined to identify Mr. Biden as the winner of the election, citing ongoing litigation, even though Mr. Trump has no clear path to victory, according to legal experts. Frozen out of the government network, the transition team is relying on a standard, paid Google Workspace network, the report said.

Apple has slammed Facebook and other internet giants for their ad-targeting practices in response to a letter questioning a decision by the iPhone maker to delay a new privacy feature. From a report: The Cupertino, California-based technology company criticized Facebook's approach to advertising and user tracking, according to a written reply sent to several human rights and privacy organizations, including the Electronic Frontier Foundation and Human Rights Watch: "By contrast, Facebook and others have a very different approach to targeting. Not only do they allow the grouping of users into smaller segments, they use detailed data about online browsing activity to target ads. Facebook executives have made clear their intent is to collect as much data as possible across both first and third party products to develop and monetize detailed profiles of their users, and this disregard for user privacy continues to expand to include more of their products."

Apple's letter, reviewed by Bloomberg News, defended the company's decision to delay an iPhone feature that requires users to give explicit permission before letting apps track them for advertising purposes. The enhancement was added as part of the company's iOS 14 operating system in September, but a requirement that all apps use it was delayed until early 2021 after several developers, including Facebook, said the change would hurt their businesses. The human rights and privacy organizations criticized the delay in a letter earlier this year to Apple.

Go SMS Pro, one of the most popular messaging apps for Android, is exposing photos, videos and other files sent privately by its users. Worse, the app maker has done nothing to fix the bug. TechCrunch reports: Security researchers at Trustwave discovered the flaw in August and contacted the app maker with a 90-day deadline to fix the issue, as is standard practice in vulnerability disclosure to allow enough time for a fix. But after the deadline elapsed without hearing back, the researchers went public. Trustwave shared its findings with TechCrunch this week.

When a Go SMS Pro user sends a photo, video or other file to someone who doesn't have the app installed, the app uploads the file to its servers, and lets the user share a web address by text message so the recipient can see the file without installing the app. But the researchers found that these web addresses were sequential. In fact, any time a file was shared -- even between app users -- a web address would be generated regardless. That meant anyone who knew about the predictable web address could have cycled through millions of different web addresses to users' files. Go SMS Pro has more than 100 million installs, according to its listing in Google Play.

An anonymous reader quotes a report from ZDNet: A team of academics has detailed this week novel research that converted a smart vacuum cleaner into a microphone capable of recording nearby conversations. Named LidarPhone, the technique works by taking the vacuum's built-in LiDAR laser-based navigational component and converting it into a laser microphone. [...] They tested the LidarPhone attack with various objects, by varying the distance between the robot and the object, and the distance between the sound origin and the object. Tests focused on recovering numerical values, which the research team said they managed to recover with a 90% accuracy. But academics said the technique could also be used to identify speakers based on gender or even determine their political orientation from the music played during news shows, captured by the vacuum's LiDAR.

But while the LidarPhone attack sounds like a gross invasion of privacy, users need not panic for the time being. This type of attack revolves around many prerequisites that most attacks won't bother. There are far easier ways of spying on users than overwriting a vacuum's firmware to control its laser navigation system, such as tricking the user on installing malware on their phone. The LidarPhone attack is merely novel academic research that can be used to bolster the security and design of future smart vacuum robots. In fact, the research team's main recommended countermeasure for smart vacuum cleaning robot makers is to shut down the LiDAR component if it's not rotating. Additional details about the research are available in a research paper titled "Spying with Your Robot Vacuum Cleaner: Eavesdropping via Lidar Sensors."

An anonymous reader quotes a report from Ars Technica: Researchers have uncovered a massive hacking campaign that's using sophisticated tools and techniques to compromise the networks of companies around the world. The hackers, most likely from a well-known group that's funded by the Chinese government, are outfitted with both off-the-shelf and custom-made tools. One such tool exploits Zerologon, the name given to a Windows server vulnerability, patched in August, that can give attackers instant administrator privileges on vulnerable systems. Symantec uses the code name Cicada for the group, which is widely believed to be funded by the Chinese government and also carries the monikers of APT10, Stone Panda, and Cloud Hopper from other research organizations. The group has been active in espionage-style hacking since at least 2009 and almost exclusively targets companies linked to Japan. While the companies targeted in the recent campaign are located in the United States and other countries, all of them have links to Japan or Japanese companies.

The attacks make extensive use of DLL side-loading, a technique that occurs when attackers replace a legitimate Windows dynamic-link library file with a malicious one. Attackers use DLL side-loading to inject malware into legitimate processes so they can keep the hack from being detected by security software. The campaign also makes use of a tool that's capable of exploiting Zerologon. Exploits work by sending a string of zeros in a series of messages that use the Netlogon protocol, which Windows servers use to let users log into networks. People with no authentication can use Zerologon to access an organization's crown jewels -- the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network. Microsoft patched the critical privilege-escalation vulnerability in August, but since then attackers have been using it to compromise organizations that have yet to install the update. Both the FBI and Department of Homeland Security have urged that systems be patched immediately. Among the machines compromised during attacks discovered by Symantec were domain controllers and file servers. Company researchers also uncovered evidence of files being exfiltrated from some of the compromised machines.

Researchers from the University of Michigan used their own automated censorship tracking system to collect more than 21 billion measurements over 20 months in 221 countries. They discovered that citizens in what are considered the world's freest countries aren't safe from internet censorship. From a press release: [Roya Ensafi, U-M assistant professor of electrical engineering and computer science who led the development of the tool, and her team] found that censorship is increasing in 103 of the countries studied, including unexpected places like Norway, Japan, Italy, India, Israel and Poland. These countries, the team notes, are rated some of the world's freest by Freedom House, a nonprofit that advocates for democracy and human rights. They were among nine countries where Censored Planet found significant, previously undetected censorship events between August 2018 and April 2020. They also found previously undetected events in Cameroon, Ecuador and Sudan. While the United States saw a small uptick in blocking, mostly driven by individual companies or internet service providers filtering content, the study did not uncover widespread censorship. However, Ensafi points out that the groundwork for that has been put in place here.

"When the United States repealed net neutrality, they created an environment in which it would be easy, from a technical standpoint, for ISPs to interfere with or block internet traffic," she said. "The architecture for greater censorship is already in place and we should all be concerned about heading down a slippery slope." It's already happening abroad, the researchers found. "What we see from our study is that no country is completely free," said Ram Sundara Raman, U-M doctoral candidate in computer science and engineering and first author of the study. "We're seeing that many countries start with legislation that compels ISPs to block something that's obviously bad like child pornography or pirated content. But once that blocking infrastructure is in place, governments can block any websites they choose, and it's a very opaque process. That's why censorship measurement is crucial, particularly continuous measurements that show trends over time." The study is titled "Censored Planet: An Internet-wide, Longitudinal Censorship Observatory."