aggregator

Senate Passes Cybersecurity Bill To Decrease Grid Digitization, Move Toward Manual Control

Slashdot - Your Rights Online - Wt, 2019-07-02 04:03
On June 27, the U.S. Senate passed a bipartisan cybersecurity bill that will study ways to replace automated systems with low-tech redundancies to protect the country's electric grid from hackers. Called The Securing Energy Infrastructure Act (SEIA), the bill establishes a two-year pilot program identifying new security vulnerabilities and researching and testing solutions, including "analog and nondigital control systems." The U.S Department of Energy would be required to report back to Congress on its findings. Utility Drive reports: The increase in distributed energy resources can serve load more efficiently, but also offers potential attackers more potential entry points. "Our connectivity is a strength that, if left unprotected, can be exploited as a weakness," Sen. Angus King, I-Maine, who sponsored the bill with Sen. Jim Risch, R-Idaho, said in a statement. Sens. Susan Collins, R-Maine, Martin Heinrich, D-N.M., and Mike Crapo, R-Idaho cosponsored the bill. The House measure is being introduced by Reps. Dutch Ruppersberger, D-Md., and John Carter, R-Texas.

Read more of this story at Slashdot.

India Widens Antitrust Probe Into Google's Android Dominance

Slashdot - Your Rights Online - Pn, 2019-07-01 09:34
An anonymous reader quotes Reuters: Google appears to have misused its dominant position in India and reduced the ability of device manufacturers to opt for alternate versions of its Android mobile operating system, Indian officials found before ordering a wider probe in an antitrust case. A 14-page order from the Competition Commission of India (CCI), reviewed by Reuters this week, found Google's restrictions on manufacturers seemed to amount to imposition of "unfair conditions" under India's competition law.... The Indian case is similar to one Google faced in Europe, where regulators imposed a $5 billion fine on the company for forcing manufacturers to pre-install its apps on Android devices. Google has appealed against the verdict. By making pre-installation of Google's proprietary apps conditional, Google "reduced the ability and incentive of device manufacturers to develop and sell devices operated on alternate versions of Android", the CCI said in the order. "It amounts to prima facie leveraging of Google's dominance".

Read more of this story at Slashdot.

Former Equifax CIO Sentenced to 4 Months in Prison for Insider Training

Slashdot - Your Rights Online - N, 2019-06-30 22:34
An anonymous reader quotes CNET: A former Equifax executive who sold his stock in the consumer credit reporting firm before it announced a massive data breach has been sentenced to four months in federal prison for insider trading. Jun Ying, former chief information officer for the company's US Information Solutions, was also ordered to pay about $117,000 in restitution and a $55,000 fine, the US Attorney's Office said Thursday... Ying sold all his shares in Equifax, making more than $950,000. Ying's insider trading happened 10 days before Equifax publicly announced its breach. Ying, 44, is the second Equifax employee convicted of insider trading related to the data breach. Sudhakar Reddy Bonthu, a former Equifax software development manager, pleaded guilty in 2018 to using the insider information to make more than $75,000 on the stock market. Bonthu was ordered to serve eight months home confinement, pay a $50,000 fine and forfeit the proceeds from the stock sale. In announcing the sentence, U.S. Attorney Byung J. Pak said that Ying had "thought of his own financial gain before the millions of people exposed in this data breach even knew they were victims."

Read more of this story at Slashdot.

Wikipedia Co-Founder Calls For a Social Media Strike July 4-5

Slashdot - Your Rights Online - N, 2019-06-30 19:34
Wikpedia co-founder Larry Sanger is also Slashdot reader #936,381. He has an announcement: "Humanity has been contemptuously used by vast digital empires," says my new Declaration of Digital Independence, which you can sign. So I'm calling a massive social media strike for July 4-5 to raise awareness of the possibility of decentralizing social media, which is wildly popular whenever proposed. Read the FAQ use the resources to learn and spread the word far and wide. Look for lots of news about this soon. And get ready! Maybe we can make a long-held geek dream finally come true.

Read more of this story at Slashdot.

Sting Finds Ransomware Data Recovery Firms Are Just Paying The Ransom

Slashdot - Your Rights Online - N, 2019-06-30 09:34
"ProPublica recently reported that two U.S. firms, which professed to use their own data recovery methods to help ransomware victims regain access to infected files, instead paid the hackers. Now there's new evidence that a U.K. firm takes a similar approach." An anonymous reader quotes their report: Fabian Wosar, a cyber security researcher, told ProPublica this month that, in a sting operation he conducted in April, Scotland-based Red Mosquito Data Recovery said it was "running tests" to unlock files while actually negotiating a ransom payment. Wosar, the head of research at anti-virus provider Emsisoft, said he posed as both hacker and victim so he could review the company's communications to both sides. Red Mosquito Data Recovery "made no effort to not pay the ransom" and instead went "straight to the ransomware author literally within minutes," Wosar said. "Behavior like this is what keeps ransomware running." Since 2016, more than 4,000 ransomware attacks have taken place daily, or about 1.5 million per year, according to statistics posted by the U.S. Department of Homeland Security. Law enforcement has failed to stem ransomware's spread, and culprits are rarely caught... But clients who don't want to give in to extortion are susceptible to firms that claim to have their own methods of decrypting files. Often, victims are willing to pay more than the ransom amount to regain access to their files if they believe the money is going to a data recovery firm rather than a hacker, Wosar said. Red Mosquito charged their client four times the actual ransom amount, according to the report -- though after ProPublica followed up, the company "did not respond to emailed questions, and hung up when we called the number listed on its website." The company then also "removed the statement from its website that it provides an alternative to paying hackers. It also changed 'honest, free advice' to 'simple free advice,' and the 'hundreds' of ransomware cases it has handled to 'many.'"

Read more of this story at Slashdot.

Microsoft Claims Unauthorized Repairing of Its Devices Would Be a Security Risk

Slashdot - Your Rights Online - So, 2019-06-29 21:41
In comments submitted to America's Federal Trade Commission, Microsoft says repairing its devices could jeopardize protections from the Trusted Platform Module (TPM) security chip. "Don't believe them," argues a group of information security professionals who support the right to repair. Slashdot reader chicksdaddy quotes their report: The statement was submitted ahead of Nixing the Fix, an FTC workshop on repair restrictions that is scheduled for mid-July... "The unauthorized repair and replacement of device components can result in the disabling of key hardware security features or can impede the update of firmware that is important to device security or system integrity," Microsoft wrote... "If the TPM or other hardware or software protections were compromised by a malicious or unqualified repair vendor, those security protections would be rendered ineffective and consumers' data and control of the device would be at risk. Moreover, a security breach of one device can potentially compromise the security of a platform or other devices connected to the network...." As we know: Firms like Microsoft, Lexmark, LG, Samsung and others use arguments like this all the time and then not too subtly imply that their authorized repair professionals are more trustworthy and honest than independent competitors. But that's just hot air. They have no data to back up those assertions and there's no way that their repair technicians are more trustworthy than owners, themselves... There's nothing inherent in repair or the things called for in right to repair laws like providing diagnostic software, diagnostic codes, schematics and replacement parts that puts the integrity of the TPM or the trust model it anchors at risk. Nor does the TPM require that the devices it secures remain pristine: using the same hardware and software configuration as when they were sold by the OEM. After all, TPMs are in Dell computers. Dell makes diagnostic software and diagnostic codes and schematics available for their hardware and I haven't heard Microsoft or anybody else suggest that a TPM on a repairable Dell laptop is any less secure than the TPM on an unrepairable Microsoft Surface.

Read more of this story at Slashdot.

Trump Relaxes US Ban On Selling To Huawei In Surprise G20 Concession

Slashdot - Your Rights Online - So, 2019-06-29 19:34
hackingbear tipped us off to a breaking news story. CNN reports: US President Donald Trump has appeared to soften his tone on Chinese communications giant Huawei, suggesting that he would allow the company to once again purchase U.S. technology. Speaking at a press conference in Osaka, Saturday, Trump said that the U.S. sells a "tremendous amount of product" to Huawei. "That's okay, we will keep selling that product," said Trump. "The (U.S.) companies were not exactly happy that they couldn't sell." Forbes points out "While it's not a lifting of the blanket ban, it will significantly benefit the Chinese manufacturer." ZDNet reports: This news just broke with comments made by Trump, including "U.S. companies can sell their equipment to Huawei. We're talking about equipment where there's no great national security problem with it." The details of this statement are still pending, but it is likely that 5G infrastructure equipment may still not be part of this access deal while the smartphone segment may be where we see open access. One Daily Beast contributor argues the action "appears to be a surrender to publicly issued Chinese demands." But TechCrunch writes that "any mutual trust has been broken and things are unlikely to be the same again."

Read more of this story at Slashdot.

Theranos Founder Elizabeth Holmes To Stand Trial In 2020

Slashdot - Your Rights Online - So, 2019-06-29 15:00
An anonymous reader quotes a report from TechCrunch: Elizabeth Holmes, the founder of the now-defunct biotech unicorn Theranos, will face trial in federal court next summer with penalties of up to 20 years in prison and millions of dollars in fines. Jury selection will begin July 28, 2020, according to U.S. District Judge Edward J. Davila, who announced the trial will commence in August 2020 in a San Jose federal court Friday morning. Holmes and former Theranos president Ramesh "Sunny" Balwani were indicted by a grand jury last June with 11 criminal charges in total. Two of those charges were conspiracy to commit wire fraud (against investors, and against doctors and patients). The remaining nine are actual wire fraud, with amounts ranging from the cost of a lab test to $100 million. Bloomberg says Holmes' legal team plans to argue that The Wall Street Journal's John Carreyrou "had an undue influence on federal regulators," and "went beyond reporting the Theranos story." "The jury should be aware that an outside actor, eager to break a story, and portray the story as a work of investigative journalism, was exerting influence on the regulatory process in a way that appears to have warped the agencies' focus on the company and possibly biased the agencies' findings against it," her attorneys wrote, per Bloomberg. "The agencies' interactions with Carreyrou thus go to the heart of the government's case."

Read more of this story at Slashdot.

Law Enforcement Use of Face Recognition Systems Threatens Civil Liberties, Disproportionately Affects People of Color: EFF Report

Electronic Frontier Foundation - Cz, 2018-02-15 17:45

San Francisco, California—Face recognition—fast becoming law enforcement’s surveillance tool of choice—is being implemented with little oversight or privacy protections, leading to faulty systems that will disproportionately impact people of color and may implicate innocent people for crimes they didn’t commit, says an Electronic Frontier Foundation (EFF) report released today.

Face recognition is rapidly creeping into modern life, and face recognition systems will one day be capable of capturing the faces of people, often without their knowledge, walking down the street, entering stores, standing in line at the airport, attending sporting events, driving their cars, and utilizing public spaces. Researchers at the Georgetown Law School estimated that one in every two American adults—117 million people—are already in law enforcement face recognition systems.

This kind of surveillance will have a chilling effect on Americans’ willingness to exercise their rights to speak out and be politically engaged, the report says. Law enforcement has already used face recognition at political protests, and may soon use face recognition with body-worn cameras, to identify people in the dark, and to project what someone might look like from a police sketch or even a small sample of DNA.

Face recognition employs computer algorithms to pick out details about a person’s face from a photo or video to form a template. As the report explains, police use face recognition to identify unknown suspects by comparing their photos to images stored in databases and to scan public spaces to try to find specific pre-identified targets.

But no face recognition system is 100 percent accurate, and false positives—when a person’s face is incorrectly matched to a template image—are common. Research shows that face recognition misidentifies African Americans and ethnic minorities, young people, and women at higher rates than whites, older people, and men, respectively. And because of well-documented racially biased police practices, all criminal databases—including mugshot databases—include a disproportionate number of African-Americans, Latinos, and immigrants.

For both reasons, inaccuracies in face recognition systems will disproportionately affect people of color.

“The FBI, which has access to at least 400 million images and is the central source for facial recognition identification for federal, state, and local law enforcement agencies, has failed to address the problem of false positives and inaccurate results,” said EFF Senior Staff Attorney Jennifer Lynch, author of the report. “It has conducted few tests to ensure accuracy and has done nothing to ensure its external partners—federal and state agencies—are not using face recognition in ways that allow innocent people to be identified as criminal suspects.”

Lawmakers, regulators, and policy makers should take steps now to limit face recognition collection and subject it to independent oversight, the report says. Legislation is needed to place meaningful checks on government use of face recognition, including rules limiting retention and sharing, requiring notification when face prints are collected, ensuring robust security procedures to prevent data breaches, and establishing legal processes governing when law enforcement may collect face images from the public without their knowledge, the report concludes.

“People should not have to worry that they may be falsely accused of a crime because an algorithm mistakenly matched their photo to a suspect. They shouldn’t have to worry that their data will end up in the hands of identity thieves because face recognition databases were breached. They shouldn’t have to fear that their every move will be tracked if face recognition is linked to the networks of surveillance cameras that blanket many cities,” said Lynch. “Without meaningful legal protections, this is where we may be headed.”

For the report:

Online version: https://www.eff.org/wp/law-enforcement-use-face-recognition

PDF version: https://www.eff.org/files/2018/02/15/face-off-report-1b.pdf

One pager on facial recognition: https://www.eff.org/document/facial-recognition-one-pager

Contact: Jennifer Lynch

Catalog of Missing Devices Illustrates Gadgets that Could and Should Exist

Electronic Frontier Foundation - Pt, 2018-02-02 01:43

San Francisco - The Electronic Frontier Foundation (EFF) has launched its “Catalog of Missing Devices”—a project that illustrates the gadgets that could and should exist, if not for bad copyright laws that prevent innovators from creating the cool new tools that could enrich our lives.

“The law that is supposed to restrict copying has instead been misused to crack down on competition, strangling a future’s worth of gadgets in their cradles,” said EFF Special Advisor Cory Doctorow. “But it’s hard to notice what isn’t there. We’re aiming to fix that with this Catalog of Missing Devices. It’s a collection of tools, services, and products that could have been, and should have been, but never were.”

The damage comes from Section 1201 of the Digital Millennium Copyright Act (DMCA 1201), which covers digital rights management software (DRM). DRM was designed to block software counterfeiting and other illegal copying, and Section 1201 bans DRM circumvention. However, businesses quickly learned that by employing DRM they could thwart honest competitors from creating inter-operative tools.

Right now, that means you could be breaking the law just by doing something as simple as repairing your car on your own, without the vehicle-maker’s pricey tool. Other examples include rightsholders forcing you to buy additional copies of movies you want to watch on your phone—instead of allowing you to rip the DVD you already own and are entitled to watch—or manufacturers blocking your printer from using anything but their official ink cartridges.

But that’s just the beginning of what consumers are missing. The Catalog of Missing Devices imagines things like music software that tailors your listening to what you are reading on your audiobook, or a gadget that lets parents reprogram talking toys to replace canned, meaningless messaging.

“Computers aren’t just on our desktops or in our pockets—they are everywhere, and so is the software that runs them,” said EFF Legal Director Corynne McSherry. “We need to fix the laws that choke off competition and innovation with no corresponding benefit.”

The Catalog of Missing Devices is part of EFF’s Apollo 1201 project, dedicated to eradicating all DRM from the world. A key step is eliminating laws like DMCA 1201, as well as the international versions of this legislation that the U.S. has convinced its trading partners to adopt.

For the Catalog of Missing Devices:
https://www.eff.org/missing-devices

Contact: Cory DoctorowCorynne McSherry

EFF and ACLU Ask Court to Allow Legal Challenge to Proceed Against Warrantless Searches of Travelers’ Smartphones, Laptops

Electronic Frontier Foundation - Pt, 2018-01-26 23:38

Boston, Massachusetts—The Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU) urged a federal judge today to reject the Department of Homeland Security’s attempt to dismiss an important lawsuit challenging DHS’s policy of searching and confiscating, without suspicion or warrant, travelers’ electronic devices at U.S. borders.

EFF and ACLU represent 11 travelers—10 U.S. citizens and one lawful permanent resident—whose smartphones and laptops were searched without warrants at the U.S. border in a groundbreaking lawsuit filed in September. The case, Alasaad v. Nielsen, asks the court to rule that the government must have a warrant based on probable cause before conducting searches of electronic devices, which contain highly detailed personal information about people’s lives. The case also argues that the government must have probable cause to confiscate a traveler’s device.

The plaintiffs in the case include a military veteran, journalists, students, an artist, a NASA engineer, and a business owner. The government seeks dismissal, saying the plaintiffs don’t have the right to bring the lawsuit and the Fourth Amendment doesn’t apply to border searches. Both claims are wrong, the EFF and ACLU explain in a brief filed today in federal court in Boston.

First, the plaintiffs have “standing” to seek a court order to end unconstitutional border device searches because they face a substantial risk of having their devices searched again. This means they are the right parties to bring this case and should be able to proceed to the merits. Four plaintiffs already have had their devices searched multiple times.

Immigration and Customs Enforcement (ICE) policy allows border agents to search and confiscate anyone’s smartphone for any reason or for no reason at all. Customs and Border Protection (CBP) policy allows border device searches without a warrant or probable cause, and usually without even reasonable suspicion. Last year, CBP conducted more than 30,000 border device searches, more than triple the number just two years earlier.

“Our clients are travelers from all walks of life. The government policies that invaded their privacy in the past are enforced every day at airports and border crossings around the country,” said EFF Staff Attorney Sophia Cope. “Because the plaintiffs face being searched in the future, they have the right to proceed with said Cope.

Second, the plaintiffs argue that the Fourth Amendment requires border officers to get a warrant before searching a traveler’s electronic device. This follows from the Supreme Court’s 2014 decision in Riley v. California requiring that police officers get a warrant before searching an arrestee’s cell phone. The court explained that cell phones contain the “privacies of life”—a uniquely large and varied amount of highly sensitive information, including emails, photos, and medical records. This is equally true for international travelers, the vast majority of whom are not suspected of any crime. Warrantless border device searches also violate the First Amendment, because they chill freedom of speech and association by allowing the government to view people’s contacts, communications, and reading material.

“Searches of electronic devices at the border are increasing rapidly, causing greater numbers of people to have their constitutional rights violated,” said ACLU attorney Esha Bhandari. “Device searches can give border officers unfettered access to vast amounts of private information about our lives, and they are unconstitutional absent a warrant.”

Below is a full list of the plaintiffs along with links to their individual stories, which are also collected here:

  • Ghassan and Nadia Alasaad are a married couple who live in Massachusetts, where he is a limousine driver and she is a nursing student.
  • Suhaib Allababidi, who lives in Texas, owns and operates a business that sells security technology, including to federal government clients.
  • Sidd Bikkannavar is an optical engineer for NASA’s Jet Propulsion Laboratory in California.
  • Diane Maye is a college professor and former captain in the U. S. Air Force living in Florida.
  • Zainab Merchant, from Florida, is a writer and a graduate student in international security and journalism at Harvard.

For the brief:
https://www.eff.org/document/alasaad-v-nielsen-opposition-motion-dismiss

For more EFF information on this case:
https://www.eff.org/cases/alasaad-v-duke 

For more ACLU information on this case:
https://www.aclu.org/news/aclu-eff-sue-over-warrantless-phone-and-laptop-searches-us-border

For more on privacy at the border:
https://www.eff.org/wp/digital-privacy-us-border-2017

Contact: Sophia CopeAdam SchwartzJosh Bell

EFF Asks Ninth Circuit Appeals Court To Strengthen Privacy Protections Of Smart Phones At The Border

Electronic Frontier Foundation - So, 2018-01-20 01:20

San Diego, California—The Electronic Frontier Foundation (EFF) urged the U.S. Ninth Circuit Court of Appeals to further limit the government’s ability to conduct highly intrusive searches of electronic devices at the border by requiring federal agents to obtain a warrant if they want to access the contents of travelers’ phones.

“The Ninth Circuit four years ago issued an important ruling requiring officials to show they have reasonable suspicion of criminal activity to forensically search digital devices. While that was an improvement over the government’s prior practice of conducting suspicionless searches, the court didn’t go far enough,” said EFF Staff Attorney Sophia Cope. “We are now asking the Ninth Circuit to bar warrantless device searches at the border.”

“Our electronic devices contain texts, emails, photos, contact lists, work documents, and other communications that reveal intimate details of our private lives. Our privacy interests in this material is tremendous. Requiring a warrant is a critical step in making sure our Fourth Amendment protections survive into the digital age,” said Cope.

The Ninth Circuit is being asked to throw out evidence obtained through a warrantless forensic search of the defendant’s cell phone at the U.S.-Mexico border in southern California. The case, U.S. v. Cano, is a drug prosecution and the first before the Ninth Circuit since the U.S. Supreme Court ruled that because devices hold “the privacies of life,” police need a warrant to search the phones of people who are arrested.

In an amicus brief filed today in U.S. v. Cano, EFF urged the court to recognize that people traveling through our international borders deserve the same privacy protections that the Supreme Court has extended to arrestees. The Ninth Circuit’s rulings apply to states in the west and southwest, several of whom share borders with Mexico and Canada,

Warrantless border searches of luggage have been allowed under an exception to the Fourth Amendment for routine immigration and customs enforcement. But since digital devices provide so much more highly personal, private information than what is traditionally carried in a suitcase, agents should be required to show a judge that they have probable cause to believe that the device contains evidence of a violation of the immigration or customs laws, EFF said in the brief.

Digital device searches at the border have more than tripled since the inauguration of President Trump. This increase, along with the increasing number of people who carry these devices while traveling, has highlighted the need for stronger privacy rights while crossing the U.S. border. Last year, EFF and ACLU filed a lawsuit in Boston against the federal government on behalf of 11 travelers whose smartphones and other electronic devices were searched without a warrant at the U.S. border.

“Digital devices differ wildly from luggage and other physical items a person carries across the border,” said EFF Senior Staff Attorney Adam Schwartz. “Now is the time to apply the full force of constitutional privacy protections to digital devices.”

For the brief:
https://www.eff.org/document/eff-amicus-brief-us-v-cano

For more on privacy at the border:
https://www.eff.org/wp/digital-privacy-us-border-2017

Contact: Sophia CopeAdam Schwartz

EFF to Court: Linking Is Not Copyright Infringement

Electronic Frontier Foundation - Cz, 2018-01-18 19:58

Los Angeles, California—Playboy Entertainment's lawsuit accusing acclaimed website Boing Boing of copyright infringement—for doing nothing more than reporting on a historical collection of Playboy centerfolds—is groundless and should be thrown out, the Electronic Frontier Foundation (EFF) told a federal court today.

As EFF and co-counsel Durie Tangri LLP explain in a request to dismiss the lawsuit filed on behalf of Boing Boing owner Happy Mutants LLC, Playboy’s copyright claim seeks to punish Boing Boing for commenting on and linking to an archive of Playboy “playmate” centerfold images that a third party posted. The blog contained links to an imgur.com page and YouTube video—neither of which were created by Boing Boing. But courts have long recognized that simply linking to content on the web isn’t unlawful.

“Boing Boing didn’t upload, publish, host, or store any images that Playboy owns, didn’t control the images, and didn’t contribute to the infringement of any Playboy copyrights,” said EFF Legal Director Corynne McSherry. “It’s frankly mystifying that an entertainment company that has often fought to defend free speech rights  is trying to punish Boing Boing for doing what has made it a leading online source of news and commentary: unique and groundbreaking reporting on art, science, and popular culture.”

“Boing Boing’s reporting and commenting on the Playboy photos is protected by copyright’s fair use doctrine,” said EFF Senior Staff Attorney Daniel Nazer. “We’re asking the court to dismiss this deeply flawed lawsuit. Journalists, scientists, researchers, and everyday people on the web have the right to link to material, even copyrighted material, without having to worry about getting sued.”

For the brief:
https://www.eff.org/document/playboy-v-happy-mutants-eff-mtd

For more on fair use:
https://www.eff.org/issues/intellectual-property

Contact: Corynne McSherryDaniel Nazer

EFF and Lookout Uncover New Malware Espionage Campaign Infecting Thousands Around the World

Electronic Frontier Foundation - Cz, 2018-01-18 18:15

San Francisco – The Electronic Frontier Foundation (EFF) and mobile security company Lookout have uncovered a new malware espionage campaign infecting thousands of people in more than 20 countries. Hundreds of gigabytes of data has been stolen, primarily through mobile devices compromised by fake secure messaging clients.

The trojanized apps, including Signal and WhatsApp, function like the legitimate apps and send and receive messages normally. However, the fake apps also allow the attackers to take photos, retrieve location information, capture audio, and more.

The threat, called Dark Caracal by EFF and Lookout researchers, may be a nation-state actor and appears to employ shared infrastructure which has been linked to other nation-state actors. In a new report, EFF and Lookout trace Dark Caracal to a building belonging to the Lebanese General Security Directorate in Beirut.

“People in the U.S., Canada, Germany, Lebanon, and France have been hit by Dark Caracal. Targets include military personnel, activists, journalists, and lawyers, and the types of stolen data range from call records and audio recordings to documents and photos,” said EFF Director of Cybersecurity Eva Galperin. “This is a very large, global campaign, focused on mobile devices. Mobile is the future of spying, because phones are full of so much data about a person’s day-to-day life.”

“Dark Caracal is part of a trend we’ve seen mounting over the past year whereby traditional APT actors are moving toward using mobile as a primary target platform,” said Mike Murray, Vice President of Security Intelligence at Lookout. “The Android threat we identified, as used by Dark Caracal, is one of the first globally active mobile APTs we have spoken publicly about.”

Dark Caracal has been operating since at least 2012. However, one reason it has been hard to track is the diversity of seemingly unrelated espionage campaigns originating from the same domain names. The researchers believe that Dark Caracal is only one of a number of different global attackers using this infrastructure. Over the years, Dark Caracal’s work has been repeatedly misattributed to other cybercrime groups. In fact, EFF’s Operation Manul report from 2016 misidentified espionage from these servers as coming from the Indian security company Appin.

“One of the interesting things about this ongoing attack is that it doesn’t require a sophisticated or expensive exploit. Instead, all Dark Caracal needed was application permissions that users themselves granted when they downloaded the apps, not realizing that they contained malware,” said EFF Staff Technologist Cooper Quintin. “This research shows it’s not difficult to create a strategy allowing people and governments to spy on targets around the world.”

For the full report:
https://www.lookout.com/info/ds-dark-caracal-ty

For more on Dark Caracal:
https://blog.lookout.com/dark-caracal-mobile-APT

For more on how to avoid downloading malware:
https://ssd.eff.org/en/module/how-avoid-phishing-attacks

Contact: Eva GalperinCooper Quintin

EFF Asks Copyright Office to Improve Exemptions to the Digital Millennium Copyright Act

Electronic Frontier Foundation - Wt, 2017-12-19 00:57

Washington, D.C.—The Electronic Frontier Foundation (EFF) asked the Librarian of Congress today to limit the legal barriers people face when they want to repair and modify software-enabled products, so that they—not manufacturers— control the appliances, computers, toys, vehicles, and other products they own.

In comments filed in Washington D.C. today, EFF continued its years-long fight to enable owners and creators to repair, modify, and enhance products, or use snippets of films or songs, free of onerous threats that doing so somehow infringes companies' copyrights. Software-enabled devices and Internet-connected products and appliances are ubiquitous in modern life, and people aren't infringing anyone's copyright when, for example, they choose to permanently disable the embedded, on-all-the-time camera or microphone in their kids' toys, or send their car to their favorite mechanic, rather than high-priced dealerships, to be repaired.

“It’s absurd that a law intended to protect copyrighted works is misused instead to prevent people from taking apart or modifying the things they own, inhibit scientists and researches from investigating safety features or security enhancements, and block artists and educators from using snippets of film in noncommercial ways," said EFF Legal Director Corynne McSherry. "The exemption process is one highly flawed way of alleviating that burden."

“We rely on the devices in our lives to learn and communicate, to keep us safe and get things done,” said EFF Staff Attorney Kit Walsh. “These devices should work for us and embody our preferences, not the commercial desires of their manufacturers. We, the users of these devices, should be able to decide how they affect our  lives and how we can improve and adapt them. That’s how we ensure that technology enhances our freedoms rather than undermining them.”

This year EFF petitioned the Librarian to exempt from Section 1201 of the Digital Millennium Copyright Act (DMCA) all modifications and repairs of software-enabled devices that don’t infringe copyrights. It’s also seeking exemptions that will allow people to tinker with smart speakers and digital home assistants such as Amazon Echo and Google Home. EFF is also seeking one clear, easier-to-use exemption for video excerpts that would allow educators, libraries, documentary filmmakers, remix artists, and others to use video snippets without fear of legal repercussions by copyright owners. The Librarian implements the exemption recommendations of the Copyright Office.

“Our approach is simple: we are seeking to expand the types of activities that should be exempt from Section 1201 of the DMCA to encompass repairs, modifications, enhancements, and innovations that don’t infringe copyright,” said EFF Senior Staff Attorney Mitch Stoltz. “We shouldn’t have to seek exemptions for things copyright law already allows. Instead, there should be a general rule that allows people to circumvent digital locks to do any non-infringing activity.”

For EFF’s comments:
https://www.eff.org/document/eff-1201-exemption-comments-2017-computer-program-repairs
https://www.eff.org/document/eff-1201-exemption-comments-2017-jailbreaking-0
https://www.eff.org/document/eff-1201-exemption-comments-2017-video-0
https://www.eff.org/document/huang-1201-exemption-comments-2017
https://www.eff.org/document/green-1201-exemption-comments-2017

For more on the Section 1201 exemption process:
https://www.eff.org/cases/2018-dmca-rulemaking

For more on the unintended consequences of Section 1201 of the DMCA:
https://www.eff.org/issues/dmca
https://www.eff.org/issues/dmca-rulemaking

 

Contact: Corynne McSherryKit WalshMitch Stoltz

EFF Demands Information About Secretive Government Tattoo Recognition Technology

Electronic Frontier Foundation - Cz, 2017-11-30 20:05

Washington, D.C. - The Electronic Frontier Foundation (EFF) filed suit against the Department of Justice, the Department of Commerce, and the Department of Homeland Security today, demanding records about the agencies’ work on the federal Tattoo Recognition Technology program.

This secretive program involves a coalition of government, academia, and private industry working to develop a series of algorithms that would rapidly detect tattoos, identify people via their tattoos, and match people with others who have similar body art—as well as flagging tattoos believed to be connected to religious and ethnic symbols. This type of surveillance raises profound religious, speech, and privacy concerns. Moreover, the limited information that EFF has been able to obtain about the program has already revealed a range of potentially unethical behavior, including conducting research on prisoners without approval, adequate oversight, or safeguards.

EFF filed a series of Freedom of Information Act (FOIA) requests for more information about the Tattoo Recognition Technology program, which is a National Institute of Standards and Technology (NIST) project sponsored by the FBI, beginning in January of 2016. Although the agencies released some records, they withheld others, and heavily redacted some of the documents they released. As a result, EFF is going to court today against DHS, DOJ, and NIST's parent agency, the Commerce Department, to make sure this important information is released to the public.

“These new automated tattoo recognition tools raise serious constitutional concerns,” said EFF Stanton Fellow Camille Fischer. “Tattoos have served as an expression of the self for thousands of years, and can represent our innermost thoughts, closely held beliefs, and significant moments. If law enforcement is creating a detailed database of tattoos, we have to make sure that everyone’s rights to freedom of expression are protected.”

One big danger of this surveillance is that it can create First Amendment freedom of association concerns when people are matched with others who have similar tattoos—sometimes incorrectly. For example, someone who wears a Star of David tattoo could be confused with a member of a Chicago street gang whose members also wear six-pointed-star tattoos. Recently, an immigrant was fast-tracked for deportation because immigration officials claimed he had a gang tattoo. The immigrant argued that the tattoo signified his place of birth.

“Federal researchers say they want to ‘crack the code’ of tattoos and speech, creating a powerful program that will encourage police to make assumptions about tattoo-wearers,” said EFF Staff Attorney Aaron Mackey. “But the reality is that body art is much more complex than that. The government must disclose more about this program so we can ensure that it doesn’t violate our rights.”

For the full lawsuit:
https://www.eff.org/document/tattoo-complaint

For more on tattoo recognition technology:
https://www.eff.org/deeplinks/2016/06/tattoo-recognition-research-threatens-free-speech-and-privacy
https://www.eff.org/deeplinks/2016/05/5-ways-law-enforcement-will-use-tattoo-recognition-technology

Contact: Camille FischerAaron MackeyDave Maass