Crypto entrepreneur Sam Bankman-Fried was sentenced Thursday to 25 years [non-paywalled link] in prison for a massive fraud that unraveled with the collapse of FTX, once one of the world's most popular platforms for exchanging digital currency. From a report: Bankman-Fried, 32, was convicted in November of fraud and conspiracy -- a dramatic fall from a crest of success. U.S. District Judge Lewis A. Kaplan imposed the sentence in the same Manhattan courtroom where, four months ago, Bankman-Fried testified that his intention had been to revolutionize the emerging cryptocurrency market with his innovative and altruistic ideas, not to steal.

Kaplan said the sentence reflected "that there is a risk that this man will be in position to do something very bad in the future. And it's not a trivial risk at all." He added that it was "for the purpose of disabling him to the extent that can appropriately be done for a significant period of time." Prior to sentencing, Bankman-Fried had said, "My useful life is probably over. It's been over for a while now, from before my arrest."

An anonymous reader quotes a report from Techdirt: Nigeria doesn't exactly have a stellar reputation when it comes to respecting the speech rights of its own citizens, nor the rights of platforms that its citizens use. But I will admit that even with that reputation in place, I'm a bit at a loss as to why the country decided to arrest and charge a woman for violating those same laws because she wrote an unkind review of a can of tomato puree on Facebook: "A Nigerian woman who wrote an online review of a can of tomato puree is facing imprisonment after its manufacturer accused her of making a 'malicious allegation' that damaged its business. Chioma Okoli, a 39-year-old entrepreneur from Lagos, is being prosecuted and sued in civil court for allegedly breaching the country's cybercrime laws, in a case that has gripped the West African nation and sparked protests by locals who believe she is being persecuted for exercising her right to free speech."

By now you're wondering what actually happened here. Well, Okoli got on Facebook after having tried a can of Nagiko Tomato Mix, made by local Nigerian company Erisco Foods. Her initial post essentially complained about it being too sugary. So pretty standard fair for a review-type post on Facebook. When she started getting some mixed replies, some of them told her to stop trying to ruin the company and just buy something else, with one such message supposedly coming from a relative of the company's ownership. To that, she replied: "Okoli responded: 'Help me advise your brother to stop ki***ing people with his product, yesterday was my first time of using and it's pure sugar.'"

By the way, you can see all of this laid out by Erisco Foods itself on its own Facebook page. The company also claims that she exchanged messages with others talking about how she wanted to trash the product online so that nobody would buy it and that sort of thing. Whatever the truth about that situation is, this all stems from a poor review of a product posted online, which is the kind of speech countries with free speech laws typically protect. In Okoli's case, she was arrested shortly after those posts. [...] Okoli is pregnant and was placed in a cell during her arrest that had water leaking into it, by her account. She was also forced to apologize to Erisco Foods as part of her bond release, which she then publicly stated was done under duress and refused to apologize once out of holding. Okoli is also countersuing both Erisco Foods and the police, arguing for a violation of her speech rights.

An anonymous reader quotes a report from Ars Technica: Oregon Governor Tina Kotek today signed the state's Right to Repair Act, which will push manufacturers to provide more repair options for their products than any other state so far. The law, like those passed in New York, California, and Minnesota, will require many manufacturers to provide the same parts, tools, and documentation to individuals and repair shops that they provide to their own repair teams. But Oregon's bill goes further, preventing companies from implementing schemes that require parts to be verified through encrypted software checks before they will function. Known as parts pairing or serialization, Oregon's bill, SB 1596, is the first in the nation to target that practice. Oregon State Senator Janeen Sollman (D) and Representative Courtney Neron (D) sponsored and pushed the bill in the state senate and legislature.

Oregon's bill isn't stronger in every regard. For one, there is no set number of years for a manufacturer to support a device with repair support. Parts pairing is prohibited only on devices sold in 2025 and later. And there are carve-outs for certain kinds of electronics and devices, including video game consoles, medical devices, HVAC systems, motor vehicles, and -- as with other states -- "electric toothbrushes." "By eliminating manufacturer restrictions, the Right to Repair will make it easier for Oregonians to keep their personal electronics running," said Charlie Fisher, director of Oregon's chapter of the Public Interest Research Group (PIRG), in a statement. "That will conserve precious natural resources and prevent waste. It's a refreshing alternative to a 'throwaway' system that treats everything as disposable."

TikTok is being investigated by the FTC over its data and security practices, "a probe that could lead to a settlement or a lawsuit against the company," reports the Associated Press. From the report: In its investigation, the FTC has been looking into whether TikTok violated a portion of federal law that prohibits "unfair and deceptive" business practices by denying that individuals in China had access to U.S. user data, said the person, who is not authorized to discuss the investigation. The agency also is scrutinizing the company over potential violations of the Children's Online Privacy Protection Act, which requires kid-oriented apps and websites to get parents' consent before collecting personal information of children under 13.

The agency is nearing the conclusion of its investigation and could settle with TikTok in the coming weeks. But there's not a deadline for an agreement, the person said. If the FTC moves forward with a lawsuit instead, it would have to refer the case to the Justice Department, which would have 45 days to decide whether it wants to file a case on the FTC's behalf, make changes or send it back to the agency to pursue on its own.

An anonymous reader quotes a report from TorrentFreak: Brazilian anti-piracy campaign 'Operation 404' has taken down many pirate sites and services over the past five years, but criminal prosecutions have been scarce. This week, anti-piracy group ALIANZA announced a "historic" victory: The operator of pirate IPTV service "Flash IPTV" was sentenced to more than five years in prison, marking the first criminal conviction of this kind in Brazil. [...] The operator of Flash IPTV, who is referred to by the initials A.W.A.P., was found guilty of criminal copyright infringement and sentenced to five years and four months in prison.

Flash IPTV was a relatively large IPTV service with 13,547 active users at its peak. According to local news reports, the service generated $912,000 in revenue over twelve months, before it was taken offline in 2020 as part of the second 'Operation 404' campaign. Speaking with TorrentFreak, ALIANZA says that this is a historic verdict, as it's the first criminal IPTV prosecution linked to 'Operation 404' in Brazil. "We appreciate the commitment of the police and judicial authorities in resolving this important case. The conviction of A.W.A.P. is a milestone that reinforces our commitment to defending the rights of creators and fighting against illegal practices that harm the creative economy," says Victor Roldan, ALIANZA's executive director.

While Operation 404 resulted in many arrests over the years, follow-up prosecutions have been rare in Brazil. Previously, ALIANZA did score a similar victory in Ecuador, where the operator of the pirate IPTV service IPTVlisto.com was sentenced to a year in prison. Last fall, Brazilian authorities conducted the sixth wave of Operation 404 and more are expected to follow in the future. These enforcement initiatives are broadly praised by rightsholders and the recent conviction will only strengthen their support.

A British court has ruled that Julian Assange can't be extradited to the United States on espionage charges unless U.S. authorities guarantee he won't get the death penalty, giving the WikiLeaks founder a partial victory in his long legal battle over the site's publication of classified American documents. From a report: Two High Court judges said they would grant Assange a new appeal unless U.S. authorities give further assurances within three weeks about what will happen to him. The ruling means the legal saga, which has dragged on for more than a decade, will continue -- and Assange will remain inside London's high-security Belmarsh Prison, where he has spent the last five years. Judges Victoria Sharp and Jeremy Johnson said the U.S. must guarantee that Assange, who is Australian, "is afforded the same First Amendment protections as a United States citizen, and that the death penalty is not imposed."

An anonymous reader quotes a report from Ars Technica: On Monday, Florida became the first state to ban kids under 14 from social media without parental permission. It appears likely that the law -- considered one of the most restrictive in the US -- will face significant legal challenges, however, before taking effect on January 1. Under HB 3, apps like Instagram, Snapchat, or TikTok would need to verify the ages of users, then delete any accounts for users under 14 when parental consent is not granted. Companies that "knowingly or recklessly" fail to block underage users risk fines of up to $10,000 in damages to anyone suing on behalf of child users. They could also be liable for up to $50,000 per violation in civil penalties. [...]

DeSantis' statement noted that "in addition to protecting children from the dangers of social media, HB 3 requires pornographic or sexually explicit websites to use age verification to prevent minors from accessing sites that are inappropriate for children." This suggests that Florida could face a legal challenge from adult sites like Pornhub, which have been suing to block states from requiring an ID to access adult content. Most recently, Pornhub blocked access to its platform in Texas, arguing that such laws "impinge on the rights of adults to access protected speech" and fail "strict scrutiny by employing the least effective and yet also most restrictive means of accomplishing Texas's stated purpose of allegedly protecting minors."

According to the Guardian, [Florida House Speaker Paul Renner, who spearheaded the law] expected that social media companies would "sue the second after" HB 3 was signed. So far, no legal challenges have been raised, but Renner seemingly expects that the law's focus on "addictive features such as notification alerts and autoplay videos, rather than on their content" would ensure that the law defeats any constitutional concerns potentially raised by social media companies. "We're going to beat them, and we're never, ever going to stop," Renner vowed.

Court filings unsealed last week allege Meta created an internal effort to spy on Snapchat in a secret initiative called "Project Ghostbusters." Gizmodo: Meta did so through Onavo, a Virtual Private Network (VPN) service the company offered between 2016 and 2019 that, ultimately, wasn't private at all. "Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them," said Mark Zuckerberg in an email to three Facebook executives in 2016, unsealed in Meta's antitrust case on Saturday. "It seems important to figure out a new way to get reliable analytics about them... You should figure out how to do this."

Thus, Project Ghostbusters was born. It's Meta's in-house wiretapping tool to spy on data analytics from Snapchat starting in 2016, later used on YouTube and Amazon. This involved creating "kits" that can be installed on iOS and Android devices, to intercept traffic for certain apps, according to the filings. This was described as a "man-in-the-middle" approach to get data on Facebook's rivals, but users of Onavo were the "men in the middle."

Meta's Onavo unit has a history of using invasive techniques to collect data on Facebook's users. Meta acquired Onavo from an Israeli firm over 10 years ago, promising users private networking, as most VPNs do. However, the service was reportedly used to spy on rival social media apps through tens of millions of people who downloaded Onavo. It gave Facebook valuable intel about competitors, and this week's court filings seem to confirm that. A team of senior executives and roughly 41 lawyers worked on Project Ghostbusters, according to court filings. The group was heavily concerned with whether to continue the program in the face of press scrutiny. Facebook ultimately shut down Onavo in 2019 after Apple booted the VPN from its app store.

Portugal's data regulator has ordered Sam Altman's iris-scanning project Worldcoin to stop collecting biometric data for 90 days, it said on Tuesday, in the latest regulatory blow to a venture that has raised privacy concerns in multiple countries. From a report: Worldcoin encourages people to have their faces scanned by its "orb" devices, in exchange for a digital ID and free cryptocurrency. More than 4.5 million people in 120 countries have signed up, according to Worldcoin's website. Portugal's data regulator, the CNPD, said there was a high risk to citizens' data protection rights, which justified urgent intervention to prevent serious harm. More than 300,000 people in Portugal have provided Worldcoin with their biometric data, the CNPD said.

Telegram is offering a new way to earn a premium subscription free of charge: all you have to do is volunteer your phone number to relay one-time passwords (OTP) to other users. This, in fact, sounds like an awful idea -- particularly for a messaging service based around privacy. From a report: X user @AssembleDebug spotted details about the new program on the English-language version of a popular Russian-language Telegram information channel. Sure enough, there's a section in Telegram's terms of service outlining the new "Peer-to-Peer Login" or P2PL program, which is currently only offered on Android and in certain (unspecified) locations. By opting in to the program, you agree to let Telegram use your phone number to send up to 150 texts with OTPs to other users logging in to their accounts. Every month your number is used to send a minimum number of OTPs, you'll get a gift code for a one-month premium subscription. Boy does this sound like a bad idea, starting with the main issue: your phone number is seen by the recipient every time it's used to send an OTP.

A top executive from the crypto exchange Binance has escaped custody in Nigeria after being arrested for allegedly destabilizing the country's national currency. The Associated Press reports: Nadeem Anjarwalla, the regional manager for Binance in Africa, "fled Nigeria using a smuggled passport," the office of Nigeria's National Security Adviser said in a statement, calling for "whatever information that can assist law enforcement agencies to apprehend the suspect." Anjarwalla, who holds dual British and Kenyan citizenship, had been detained in Nigeria along with another colleague since Feb. 26 when they arrived in the country following a crackdown on the crypto platform. Tigran Gambaryan, the colleague who is an American citizen, remains in captivity.

Nigeria is Africa's largest crypto economy in terms of trade volume with many citizens using crypto to hedge their finances against surging inflation and the declining local currency. Binance stopped all trading with the Nigerian naira currency on its platform in early March after authorities accused it of being used for money laundering and terrorism financing -- without providing evidence publicly. It was not clear how Anjarwalla fled custody. The Abuja-based Premium Times newspaper, which broke the news of his escape, reported that he fled from a guest house in the capital city after guards led him to a nearby mosque for prayers. "The personnel responsible for the custody of the suspect have been arrested, and a thorough investigation is ongoing to unravel the circumstances that led to his escape from lawful detention," Zakari Mijinyawa, spokesman for the office of Nigeria's National Security Adviser said in a statement.

Earlier today, the U.S. and U.K. accused hackers linked to the Chinese state of being behind "malicious" cyber campaigns targeting political figures. The U.K. government also blamed China for a 2021 cyberattack that compromised the personal information of millions of U.K. voters. In response, PBS reports that the U.S. and British government announced sanctions against a company and two people linked to the Chinese government. From the report: Officials said those sanctioned are responsible for a hack that may have gained access to information on tens of millions of U.K. voters held by the Electoral Commission, as well as for cyberespionage targeting lawmakers who have been outspoken about the China threat. The Foreign Office said the hack of the election registers "has not had an impact on electoral processes, has not affected the rights or access to the democratic process of any individual, nor has it affected electoral registration." The Electoral Commission said in August that it identified a breach of its system in October 2022, though it added that "hostile actors" had first been able to access its servers since 2021. At the time, the watchdog said the data included the names and addresses of registered voters. But it said that much of the information was already in the public domain.

In Washington, the Treasury Department said it sanctioned Wuhan Xiaoruizhi Science and Technology Company Ltd., which it calls a Chinese Ministry of State Security front company that has "served as cover for multiple malicious cyberoperations." It named two Chinese nationals, Zhao Guangzong and Ni Gaobin, affiliated with the Wuhan company, for cyberoperations that targeted U.S. critical infrastructure sectors, "directly endangering U.S. national security." Separately, British cybersecurity officials said that Chinese government-affiliated hackers "conducted reconnaissance activity" against British parliamentarians who are critical of Beijing in 2021. They said no parliamentary accounts were successfully compromised.

Three lawmakers, including former Conservative Party leader Iain Duncan Smith, told reporters Monday they have been "subjected to harassment, impersonation and attempted hacking from China for some time." Duncan Smith said in one example, hackers impersonating him used fake email addresses to write to his contacts. The politicians are members of the Inter-Parliamentary Alliance on China, an international pressure group focused on countering Beijing's growing influence and calling out alleged rights abuses by the Chinese government.

A SWAT team in St. Louis County mistakenly raided the home of Brittany Shamily and her family, based on the inaccurate tracking of stolen AirPods by the "FindMy" app. The family is suing for damages stemming from embarrassment, unreasonable use of force, loss of liberty, and other factors. The Riverfront Times reports: Around 6:30 p.m. on May 26, Brittany Shamily was at home with her children, including an infant, when police used a battering ram to bust in her front door. "What the hell is going on?" she screamed, terrified for herself and her family. "I got a three-month-old baby!" Body camera footage from the scene shows Shamily come to the front door, her hands up, her face a mix of fright and utter confusion at the heavily armed folly making its way from her front porch into her foyer. "Oh my god," she says. The SWAT team was looking for guns and other material related to a carjacking that had occurred that morning. Their search didn't turn up any of that -- though it has led to a lawsuit, filed Friday, that may lead to a better public understanding of how county police decide whether to deploy a SWAT team or serve a search warrant in a less menacing manner. Because in this case, the police clearly made the wrong call.

The carjacking that led to the raid happened about 12 hours prior, 16 miles away, in south county. Around 6 a.m., two brothers were leaving the Waffle House on Telegraph Road near Jefferson Barracks when a group of six people pulled up outside the restaurant and carjacked them. Two of the carjackers took off in the brothers' Dodge Charger while the other four fled the scene in their own vehicles. St. Louis County Police were summoned to the scene. As part of their investigation, a friend of the carjacked brothers told police that his AirPods were in the stolen car and that he could track them using the "FindMy" application, a feature that lets users locate one Apple device using another. Police did just that and, according to the lawsuit, the app showed the AirPods to be at Shamily's house.

There was just one problem. "FindMy is not that accurate," says the family's lawyer, Bevis Schock. "I actually went to my house with my co-counsel and played around with it for an hour. It's just not that good." Yet based on the "FindMy" result, an officer signed an application for a search warrant saying he had reason to believe that "firearms, ammunition, holsters" and other "firearm-related material" were inside. That evening, police showed up in full combat gear carrying a battering ram. [...] While the family was detained outside, the SWAT team "ransacked" their house, the lawsuit says. One SWAT team member punched a basketball-sized hole in the drywall. Another broke through a drop ceiling. They turned over drawers and left what had been an orderly house in disarray. After this had gone on for more than half an hour, the AirPods were located -- on the street outside the family's home. Unfortunately, this isn't the first time something like this has happened. In January 2022, SWAT teams in Denver raided an elderly woman's home after the "FindMy" app falsely pinged her home as the location of a stolen iPhone. The woman was recently awarded $3.76 million in compensation and damages.

An anonymous reader quotes a report from NPR: Tennessee made history on Thursday, becoming the first U.S. state to sign off on legislation to protect musicians from unauthorized artificial intelligence impersonation. "Tennessee (sic) is the music capital of the world, & we're leading the nation with historic protections for TN artists & songwriters against emerging AI technology," Gov. Bill Lee announced on social media. The Ensuring Likeness Voice and Image Security Act, or ELVIS Act, is an updated version of the state's old right of publicity law. While the old law protected an artist's name, photograph or likeness, the new legislation includes AI-specific protections. Once the law takes effect on July 1, people will be prohibited from using AI to mimic an artist's voice without permission.

Apple has been hit with a flurry of new consumer lawsuits accusing the iPhone maker of monopolizing the smartphone market, piggybacking on a sweeping antitrust case lodged by the U.S. Justice Department and 15 states last week. From a report: At least three proposed class actions have been filed since Friday in California and New Jersey federal courts by iPhone owners who claim Apple inflated the cost of its products through anticompetitive conduct. The lawsuits, seeking to represent millions of consumers, mirror the Justice Department's claims that Apple violated U.S. antitrust law by suppressing technology for messaging apps, digital wallets and other items that would have increased competition in the market for smartphones.

FrankOVD shares a report: Here's a paragraph from the DOJ's antitrust lawsuit against Apple in full: "In addition to degrading the quality of third-party messaging apps, Apple affirmatively undermines the quality of rival smartphones. For example, if an iPhone user messages a non-iPhone user in Apple Messages -- the default messaging app on an iPhone -- then the text appears to the iPhone user as a green bubble and incorporates limited functionality: the conversation is not encrypted, videos are pixelated and grainy, and users cannot edit messages or see typing indicators.

"This signals to users that rival smartphones are lower quality because the experience of messaging friends and family who do not own iPhones is worse -- even though Apple, not the rival smartphone, is the cause of that degraded user experience. Many non-iPhone users also experience social stigma, exclusion, and blame for 'breaking' chats where other participants own iPhones. This effect is particularly powerful for certain demographics, like teenagers -- where the iPhone's share is 85 percent, according to one survey. This social pressure reinforces switching costs and drives users to continue buying iPhones -- solidifying Apple's smartphone dominance not because Apple has made its smartphone better, but because it has made communicating with other smartphones worse."

"If you've ever jokingly wondered if your search or viewing history is going to 'put you on some kind of list,' your concern may be more than warranted," writes Mashable : In now unsealed court documents reviewed by Forbes, Google was ordered to hand over the names, addresses, telephone numbers, and user activity of Youtube accounts and IP addresses that watched select YouTube videos, part of a larger criminal investigation by federal investigators.

The videos were sent by undercover police to a suspected cryptocurrency launderer... In conversations with the bitcoin trader, investigators sent links to public YouTube tutorials on mapping via drones and augmented reality software, Forbes details. The videos were watched more than 30,000 times, presumably by thousands of users unrelated to the case. YouTube's parent company Google was ordered by federal investigators to quietly hand over all such viewer data for the period of Jan. 1 to Jan. 8, 2023...
"According to documents viewed by Forbes, a court granted the government's request for the information," writes PC Magazine, adding that Google was asked "to not publicize the request." The requests are raising alarms for privacy experts who say the requests are unconstitutional and are "transforming search warrants into digital dragnets" by potentially targeting individuals who are not associated with a crime based simply on what they may have watched online.
That quote came from Albert Fox-Cahn, executive director at the Surveillance Technology Oversight Project, who elaborates in Forbes' article. "No one should fear a knock at the door from police simply because of what the YouTube algorithm serves up. I'm horrified that the courts are allowing this."

Thanks to long-time Slashdot reader schwit1 for sharing the article.

In an interview Saturday, CNN first asked Steve Wozniak about Apple's "walled garden" approach — and whether there's any disconnect between Apple's stated interest in user security and privacy, and its own self-interest?

Wozniak responded, "I think there are things you can say on all sides of it. "I'm kind of glad for the protection that I have for my privacy and for you know not getting hacked as much. Apple does a better job than the others.

And tracking you — tracking you is questionable, but my gosh, look at what we're accusing TikTok of, and then go look at Facebook and Google... That's how they make their business! I mean, Facebook was a great idea. But then they make all their money just by tracking you and advertising.

And Apple doesn't really do that as much. I consider Apple the good guy.
So then CNN directly asked Wozniak's opinion about the proposed ban on TikTok in the U.S. "Well, one, I don't understand it. I don't see why. I mean, I get a lot of entertainment out of TikTok — and I avoid the social web. But I love to watch TikTok, even if it's just for rescuing dog videos and stuff.

And so I'm thinking, well, what are we saying? We're saying 'Oh, you might be tracked by the Chinese'. Well, they learned it from us.

I mean, look, if you have a principle — a person should not be tracked without them knowing it? It's kind of a privacy principle — I was a founder of the EFF. And if you have that principle, you apply it the same to every company, or every country. You don't say, 'Here's one case where we're going to outlaw an app, but we're not going to do it in these other cases.'

So I don't like the hypocrisy. And that's always obviously common from a political realm.

America's Justice Department "is considering whether to allow Julian Assange to plead guilty to a reduced charge of mishandling classified information," reports the Wall Street Journal, citing "people familiar with the matter."

Though Assange faces trial for publishing thousands of confidential U.S. documents in 2010, this development opens up "the possibility of a deal that could eventually result in his release from a British jail," reports the Journal.

Where things stand currently: A U.K. court is currently considering whether to allow a last-ditch appeal by the 52-year-old. After U.S. prosecutors charged him in 2019, U.K. law-enforcement officials apprehended him, and he has been in a London prison ever since... Britain's High Court is expected to decide within weeks whether to grant Assange a further right to appeal his extradition to the U.S. If the court rules against him, the U.S. government will likely have 28 days to come and collect Assange and bring him to face trial.
But... Justice Department officials and Assange's lawyers have had preliminary discussions in recent months about what a plea deal could look like to end the lengthy legal drama, according to people familiar with the matter, a potential softening in a standoff filled with political and legal complexities. The talks come as Assange has spent some five years behind bars. U.S. prosecutors face diminishing odds that he would serve much more time even if he were convicted stateside.

The discussions remain in flux, and talks could fizzle. Any deal would require approval at the highest levels of the Justice Department. Barry Pollack, a lawyer for Assange, said he has been given no indication that the department will take a deal. A Justice Department spokesman declined to comment.

If prosecutors allow Assange to plead to a U.S. charge of mishandling classified documents — something his lawyers have floated as a possibility — it would be a misdemeanor offense. Under such a deal, Assange potentially could enter that plea remotely, without setting foot in the U.S. The time he has spent behind bars in London would count toward any U.S. sentence, and he would likely be free to leave prison shortly after any deal was concluded.
U.S. authorities "gave a package of assurances, including a pledge he could be transferred to his native Australia to serve any sentence," according to the article. The Australian government, which has largely been supportive of Assange, could shorten any sentence once he landed on Australian soil, said Nick Vamos, a partner at London law firm Peters & Peters and a former head of extradition for England and Wales's Crown Prosecution Service. "I honestly think as soon as he arrived in Australia he would be released," he said.

Lindsay Clark reports via The Register: The UK Information Commissioner's Office has received a complaint detailing the mismanagement of personal data at the Nursing and Midwifery Council (NMC), the regulator that oversees worker registration. Employment as a nurse or midwife depends on enrollment with the NMC in the UK. According to whistleblower evidence seen by The Register, the databases on which the personal information is held lack rudimentary technical standards and practices. The NMC said its data was secure with a high level of quality, allowing it to fulfill its regulatory role, although it was on "a journey of improvement." But without basic documentation, or the primary keys or foreign keys common in database management, the Microsoft SQL Server databases -- holding information about 800,000 registered professionals -- are difficult to query and manage, making assurances on governance nearly impossible, the whistleblower told us.

The databases have no version control systems. Important fields for identifying individuals were used inconsistently -- for example, containing junk data, test data, or null data. Although the tech team used workarounds to compensate for the lack of basic technical standards, they were ad hoc and known by only a handful of individuals, creating business continuity risks should they leave the organization, according to the whistleblower. Despite having been warned of the issues of basic technical practice internally, the NMC failed to acknowledge the problems. Only after exhausting other avenues did the whistleblower raise concern externally with the ICO and The Register. The NMC stores sensitive data on behalf of the professionals that it registers, including gender, sexual orientation, gender identity, ethnicity and nationality, disability details, marital status, as well as other personal information.

The whistleblower's complaint claims the NMC falls well short of [the standards required under current UK law for data protection and the EU's General Data Protection Regulation (GDPR)]. The statement alleges that the NMC's "data management and data retrieval practices were completely unacceptable." "There is not even much by way of internal structure of the databases for self-documentation, such as primary keys, foreign keys (with a few honorable exceptions), check constraints and table constraints. Even fields that should not be null are nullable. This is frankly astonishing and not the practice of a mature, professional organization," the statement says. For example, the databases contain a unique ten-digit number (or PRN) to identify individuals registered to the NMC. However, the fields for PRNs sometimes contain individuals' names, start with a letter or other invalid data, or are simply null. The whistleblower's complaint says that the PRN problem, and other database design deficiencies, meant that it was nearly impossible to produce "accurate, correct, business critical reports ... because frankly no one knows where the correct data is to be found." A spokesperson for the NMC said the register was "organized and documented" in the SQL Server database. "For clarity, the register of all our nurses, midwives and nursing practitioners is held within Dynamics 365 which is our system of record. This solution and the data held within it, is secure and well documented. It does not rely on any SQL database. The SQL database referenced by the whistleblower relates to our data warehouse which we are in the process of modernizing as previously shared."