Tone Deaf Facebook To Cripple VR Headsets Unless You Link It To Your Facebook Account

(Mis)Uses of Technology

from the what's-the-opposite-of-advertising dept

Back in 2014 when Facebook bought Oculus, there were the usual pre-merger promises that nothing would really change, or that Facebook wouldn’t erode everything folks liked about the independent kickstarted product. Oculus founder Palmer Luckey, who has since moved on to selling border surveillance tech to the Trump administration, made oodles of promises to that effect before taking his money and running toward the sunset. Among those promises was the promise users would never be forced to use a Facebook login account just to use your VR headset and its games, and that the company wouldn’t track your behavior for advertising.

Like every major merger, those promises didn’t mean much. This week, Facebook and Oculus announced that users will soon be forced to — use a Facebook account if they want to be able to keep using Oculus hardware, so the company can track its users for advertising purposes. The official Oculus announcement tries to pretend that this is some innate gift to the end user, instead of just an obvious way for Facebook to expand its behavioral advertising empire:

“Giving people a single way to log into Oculus?using their Facebook account and password? will make it easier to find, connect, and play with friends in VR. We know that social VR has so much more to offer, and this change will make it possible to integrate many of the features people know and love on Facebook.”

And while users won’t be forced to fully use Facebook to login until 2023, those that don’t want Facebook tracking their every online waking movement will be out of luck. Meaning that you may not be able to use your pricey hardware — or the software you’ve been accumulating — unless you agree to join the Facebook universe:

“After January 1, 2023, we will end support for Oculus accounts. If you choose not to merge your accounts at that time, you can continue using your device, but full functionality will require a Facebook account. We will take steps to allow you to keep using content you have purchased, though we expect some games and apps may no longer work. This could be because they include features that require a Facebook account or because a developer has chosen to no longer support the app or game you purchased. All future unreleased Oculus devices will require a Facebook account, even if you already have an Oculus account.”

The changes will also impact the functionality of Oculus Quest’s “Link,” which lets users connect the standalone VR headset to a PC to expand its functionality. It also begs the question: what happens if you get banned by Facebook due to its incoherent and inconsistent moderation strategies? You suddenly can’t use your VR headset because Facebook’s algorithms stupidly ban you for posting photos of yourself breastfeeding?

This being Facebook, there’s not a mention of any ability to prevent Facebook from being able to track the entirety of your behavior while using a VR headset. Given all the justified criticism of Facebook, the consumer response (especially among those that liked Oculus but have tried to avoid Facebook) is about what you’d expect over at forums like the Oculus subreddit:

The whole thing is very tone deaf, and very… Facebook. Facebook’s need to track and monetize Oculus user behavior bulldozed over any concerns the company may have had about interoperability, or any valid concerns that this could simply drive customers to more open competitors. It’s yet another example of users buying a product and features they believe they own, only to have functionality eroded or the terms of use dramatically modified down the road. It’s also yet another example of how, more often than not, the promises made ahead of major U.S. mergers mean absolutely nothing.

Filed Under: accounts, facebook account, logins, oculus, vr, vr headsets
Companies: facebook, oculus

Google Warns Australians That The Government's Plan To Tax Google To Give Money To Newspapers Will Harm Search & YouTube

(Mis)Uses of Technology

from the a-bad-deal dept

Earlier this year we noted that the Australian government was setting up a you’re-too-successful tax on Google and Facebook which it planned to hand over to media organizations. We should perhaps call it the “Welfare for Rupert Murdoch” tax, because that’s what it is. Murdoch, of course, owns a huge share of media operations in Australia and has been demanding handouts from Google for years (showing that his claimed belief in the free market was always hogwash).

In response, Google has now released an open letter to Australians pointing out that this plan to tax Google to funnel money to Murdoch will have massive unintended consequences. In particular, Google argues, under the law, Google would be required to give an unfair advantage to big media companies:

You?ve always relied on Google Search and YouTube to show you what?s most relevant and helpful to you. We could no longer guarantee that under this law. The law would force us to give an unfair advantage to one group of businesses – news media businesses – over everyone else who has a website, YouTube channel or small business. News media businesses alone would be given information that would help them artificially inflate their ranking over everyone else, even when someone else provides a better result. We?ve always treated all website owners fairly when it comes to information we share about ranking. The proposed changes are not fair and they mean that Google Search results and YouTube will be worse for you.

Even more to the point, in a cynical demand for “transparency” the law would actually create privacy problems for Australians by forcing Google to cough up info on its users to Australian media businesses:

You trust us with your data and our job is to keep it safe. Under this law, Google has to tell news media businesses ?how they can gain access? to data about your use of our products. There?s no way of knowing if any data handed over would be protected, or how it might be used by news media businesses.

Australia’s “competition watchdog” who was tasked with creating this legislation in the first place claimed that the letter was “misinformation.”

?Google will not be required to charge Australians for the use of its free services such as Google Search and YouTube, unless it chooses to do so.?

The ACCC also reiterated that Google will ?not be required to share any additional user data with Australian news business unless it chooses to do so?, as is outlined in the code.

?The draft code will allow Australian news businesses to negotiate for fair payment for their journalists? work that is included on Google services,? the watchdog added.

Of course, if you look at the details of the draft code, it’s actually the ACCC that is spreading misinformation here, and Google’s concerns seem entirely substantiated. First, it’s notable that the ACCC flat out says that the law is designed specifically just to impact Facebook and Google, though other companies could be added if bureaucrats in Austalia decided those companies got too big. This is astounding in its own way. In the US Congress isn’t supposed to create laws that explicitly are designed to deal with a single company, but Australia has no apparent problem with that. Similarly, this kind of law would violate the 1st Amendment. That’s because it’s set up to benefit news organizations — but only news organizations that the Australian government deems to “adhere to appropriate professional editorial standards.” In other words, if the government doesn’t like you, you might not qualify.

But the details in the draft also very much support Google’s publicly stated concerns. It would require Google (and Facebook) to give these specially privileged news organizations all sorts of information (some of it quite crazy):

• give news media businesses at least 28 days? notice of:
  • algorithm changes likely to materially affect referral traffic to news;
  • algorithm changes designed to affect ranking of news behind paywalls; and
  • substantial changes to display and presentation of news, and advertising directly associated with news, on digital platform services;
• give news media businesses clear information about the nature and availability of user data collected through users? interactions with news on their services;
• publish proposals to appropriately recognise original news on their services;
• provide flexible user comment moderation tools for news media businesses; and
• allow news media businesses to prevent their news being included on any individual digital platform service

First off, the idea that Google would need to alert media orgs to any algorithmic change is crazy. At the very least, it gives those organizations the ability to game the system. As Google said, it gives an unfair advantage.

Second, giving news businesses “clear information about the nature and availability of user data” is an issue. While the draft proposal tries to suggest that this doesn’t violate privacy because it’s not giving the news orgs the actual underlying user data, just (effectively) the metadata of what is collected, that’s not at all accurate either. As we’ve discussed in the past regarding government surveillance, the metadata about the data can be just as, if not more, valuable.

I know it’s trendy to hate on Google, but this proposal in Australia is downright insane. It truly is welfare for Rupert Murdoch because he’s jealous of the success of Google and Facebook, and that’s just nuts.

Filed Under: algorithms, australia, data, google tax, journalism, news, news aggregation, news industry, rupert murdoch, search
Companies: google

Shitbirds Of A Feather Flock Together: ICE Signs $274,000 Contract With Clearview

(Mis)Uses of Technology

from the voted-Most-Hateable-for-two-years-running! dept

ICE continues to not care what anyone thinks of it. Its tactics over the past few years have turned it into one of the federal government’s most infamous monsters, thanks to its separation of families, caging of children, unfettered surveillance of undocumented immigrants, its fake university sting created to punish students trying to remain in the country legally, its sudden rescinding of COVID-related distance learning guidelines solely for the purpose of punishing students trying to remain in the country legally… well, you get the picture.

Perhaps it’s fitting ICE is buying tech from a company that appears unconcerned that most of the public hates it. Clearview — the facial recognition software that matches uploaded facial images with billions of images scraped from the open web — is one of the latest additions to ICE’s surveillance tech arsenal.

Immigration and Customs Enforcement (ICE) signed a contract with facial recognition company Clearview AI this week for “mission support,” government contracting records show (as first spotted by the tech accountability nonprofit Tech Inquiry). The purchase order for $224,000 describes “clearview licenses” and lists “ICE mission support dallas” as the contracting office.

That its new partner is being sued in multiple states (including a suit filed by the Vermont Attorney General) doesn’t appear to concern ICE, which is itself often on the receiving end of lawsuits. Clearview may be making good on its promise to pull out of the private market and sell only to government agencies, but that just means it will be only governments using unproven AI and scraped images to pursue investigations and arrest people.

Clearview’s statement to The Verge about its contract with ICE makes it appear this is all about the children:

“Clearview AI’s agreement is with Homeland Security Investigations (HSI), which uses our technology for their Child Exploitation Unit and ongoing criminal investigations,” Clearview AI CEO Hoan Ton-That said in an emailed statement to The Verge. “Clearview AI has enabled HSI to rescue children across the country from sexual abuse and exploitation.”

Clearview leans on the children here, but the statement says a couple of other interesting things I’m sure Ton-That would rather slide by unnoticed. First: “and ongoing criminal investigations.” ICE considers every undocumented immigrant to be a criminal, which means the agency is going to use this software to track down people in the US for committing the civil violation of staying in the country without the proper paperwork. ICE has not been able to find enough dangerous immigrants to make the administration’s public statements about rampaging hordes of bad hombres come true, so it has decided to go after everyone, including students here on visas.

Second, Clearview claims it has “enabled” HSI to “rescue children across the country.” I’d say we’d just have to take its word on this but we certainly don’t have to take its word on this because it’s said things like this in the past only for the named law enforcement agency to contradict Clearview’s claims when asked for comment. That may be what Clearview hopes its partnership with ICE/HSI will do, but it’s difficult to believe the recently signed contract has already produced results or that ICE/HSI are really using this mostly to fight child sexual exploitation rather than just uploading photos of brown people and hoping for hits.

Either way, we can safely conclude both partners here suck. ICE is bad and keeps getting worse, and Clearview isn’t ever going to improve and is presumably still scraping sites for “content” it can sell to its customers.

Filed Under: dhs, facial recognition, for the children, hsi, ics, surveillance
Companies: clearview, clearview ai

Just As The Postal Service Is Being Dismantled To Prevent The Handling Of Mail In Ballots, It Tries To Patent Blockchain Voting By Mail

(Mis)Uses of Technology

from the i...-uh...-what? dept

We are living in truly dystopian times. As you may have heard, this week there have been a bunch of stories regarding the somewhat systematic dismantling of US Postal Service operations in what appears to be a coordinated effort by this administration to foil the process of sending and collecting mail-in ballots. But, apparently, rather than ensuring its own ability to handle mail-in ballots for this election, the US Postal service is trying to… patent blockchain-based voting?

As you almost certainly know, President Trump has been — without any factual basis at all — decrying mail-in ballots, despite the fact that they have been proven safe and effective. As we’re in the middle of a pandemic — made significantly worse by this administration’s own incompetence — whose main mode of transmission is gathering indoors, the need for more mail-in ballots is obvious to anyone who cares about a functioning democracy. Instead, the President has apparently focused on making it impossible. While that seemed like a conspiracy theory to many, he admitted he was holding up funding for exactly that reason:

“They want three and a half billion dollars for something that’ll turn out to be fraudulent, that’s election money basically. They want three and a half billion dollars for the mail-in votes. Universal mail-in ballots. They want $25 billion, billion, for the Post Office. Now they need that money in order to make the Post Office work so it can take all of these millions and millions of ballots,” Trump said, repeating his false claims that mail-in voting would be “fraudulent.”

“But if they don’t get those two items that means you can’t have universal mail-in voting because you they’re not equipped to have it,” Trump added.

Except, again, there is no evidence to support the claims of mail-in ballot fraud. Indeed, Trump and the first lady themselves have requested mail-in ballots in Florida (where he does not reside) and when questioned as to why it was okay for their to be mail-in ballots there, has said it works in Florida because there’s a Republican governor.

So Florida has got a great Republican governor, and it had a great Republican governor. Ron DeSantis, Rick Scott, two great governors. And over a long period of time, they?ve been able to get the absentee ballots done extremely professionally. Florida is different from other states.

He’s also supported mail-in ballots among his supporters in North Carolina. Of course, it’s notable that North Carolina is basically the one place where there was some evidence of mail-ballot fraud… conducted by Republican operatives.

At the same time, however, beyond just blocking funding for the USPS, other efforts have been made to harm the ability to handle mail-in ballots. The Postmaster General, Louis DeJoy, who was only just appointed in May, fired a bunch of top USPS execs in a “Friday Night Massacre” a week ago. And this week, it seems like there’s been a new story every hour or so. All over the country, the USPS started removing and dismantling expensive postal sorting machines for now clear reason.

There have also been reports in places like Montana and Oregon that the familiar blue postal boxes were being removed for unclear reasons.

To drive all of this home, the USPS has directly warned 46 states (and Washington DC) that it may have delays in handling mail-in ballots.

But have no fear (or, really, have lots and lots of fear), because in the midst of all of this, a USPS patent application for blockchain-based mail-in ballots has been released. Applied for back in February, but just now revealed, the patent application first noticed by Jamie Love is for:

A voting system that can use the security of blockchain and the mail to provide a reliable voting system. A registered voter receives a computer readable code in the mail and confirms identity and confirms correct ballot information in an election. The system separates voter identification and votes to ensure vote anonymity, and stores votes on a distributed ledger in a blockchain.

Of course, as we’ve highlighted in the past, while some people keep pushing for blockchain-based voting it solves none of the problems of actual online voting, and leverages none of the benefits of the blockchain. Indeed, basically every blockchain-based voting system to date has been a dumpster fire of security concerns and, given everything else discussed above, you can bet the same would be true for any USPS-based blockchain voting system.

Even so, the timing of this release of this patent, in the midst of everything else going on with the USPS and efforts to suppress mail-in ballots (well, at least from those who don’t support the President) is the kind of coincidental timing that even the worst Hollywood writers would reject as just too on the nose. Alas…

Filed Under: blockchain, democracy, donald trump, e-voting, elections, louis dejoy, mail in ballots, patents, usps, voting

Las Vegas Police Are Running Lots Of Low Quality Images Through Their Facial Recognition System

(Mis)Uses of Technology

from the that's-going-to-end-badly dept

Even when facial recognition software works well, it still performs pretty poorly. When algorithms aren’t generating false positives, they’re acting on the biases programmed into them, making it far more likely for minorities to be misidentified by the software.

The better the image quality, the better the search results. The use of a low-quality image pulled from a store security camera resulted in the arrest of the wrong person in Detroit, Michigan. The use of another image with the same software — one that didn’t show the distinctive arm tattoos of the non-perp hauled in by Detroit police — resulted in another bogus arrest by the same department.

In both cases, the department swore the facial recognition software was only part of the equation. The software used by Michigan law enforcement warns investigators search results should not be used as sole probable cause for someone’s arrest, but the additional steps taken by investigators (which were minimal) still didn’t prevent the arrests from happening.

That’s the same claim made by Las Vegas law enforcement: facial recognition search results are merely leads, rather than probable cause. As is the case everywhere law enforcement uses this tech, low-quality input images are common. Investigating crimes means utilizing security camera footage, which utilizes cameras far less powerful than the multi-megapixel cameras found on everyone’s phones. The Las Vegas Metro Police Department relied on low-quality images for many of its facial recognition searches, documents obtained by Motherboard show.

In 2019, the LVMPD conducted 924 facial recognition searches using the system it purchased from Vigilant Solutions, according to data obtained by Motherboard through a public records request. Vigilant Solutions—which also leases its massive license plate reader database to federal agencies—was bought last year by Motorola Solutions for $445 million.

Of those searches, 471 were done using images the department deemed “suitable,” and they resulted in matches with at least one “likely positive candidate” 67% of the time. But 451 searches, nearly half, were run on “non-suitable” probe images. Those searches returned likely positive matches—which could mean anywhere from one to 20 or more mugshots, all with varying confidence scores assigned by the system—only 18% of the time.

Fortunately, low-quality images seemingly rarely return anything investigators can use. (Although that 18% is still 82 “likely positive matches…”) If the system did, we’d be seeing far more bogus arrests than we’ve seen to this point. Of course, prosecutors and police aren’t letting suspects know facial recognition software contributed to their arrests, so courtroom challenges have been pretty much nonexistent.

Although most of the information in the documents is redacted — making it difficult to verify LVMPD claims about the software’s contribution to arrests and prosecutions — enough details remained to provide a suspect facing murder charges with information the LVMPD had never turned over to him or admitted to in court.

Clark Patrick, the Las Vegas attorney representing [Alexander] Buzz, told Motherboard that neither the LVMPD nor the Clark County District Attorney’s office ever informed him that investigators identified Buzz as a suspect using, at least in part, facial recognition technology. The Clark County District Attorney’s office did not respond to an interview request or written questions.

Had this information been given to Buzz and his attorney at the beginning of the trial, he likely would not have waived his right to a preliminary evidentiary hearing. If this had taken place — along with knowledge of a private company’s contribution to the investigation — prosecutors may have had to produce information about the tech and the surveillance footage it pulled images from.

The documents don’t appear to show a reliance on low-quality images to make arrests, but they do show investigators will run nearly any image through the software to see if it generates some hits. The precautions taken after this matter most. If investigators are only considering matches to be leads, it will head off most false arrests. But if investigators take shortcuts — as appears to have happened in Detroit — the outcome is disastrous for those falsely arrested. A person’s rights and freedoms shouldn’t be at the mercy of software that performs poorly even when given good images to work with. The use of this software is never going to go away completely, but agencies can mitigate the damage by refusing to treat matches as probable cause.

Filed Under: facial recognition, las vegas, law enforcement, police

The Silver Lining Of Internet Regulation: A Regulatory Impact Assessment

(Mis)Uses of Technology

from the will-this-regulation-harm-the-internet? dept

To design better regulation for the Internet, it is important to understand two things: the first one is that today’s Internet, despite how much it has evolved, still continues to depend on its original architecture; and, the second relates to how preserving this design is important for drafting regulation that is fit for purpose. On top of this, the Internet invites a certain way of networking ? let’s call it the Internet way of networking. There are many types of networking out there, but the Internet way ensures interoperability and global reach, operates on building blocks that are agile, while its decentralized management and general purpose further ensure its resilience and flexibility. Rationalizing this, however, can be daunting because the Internet is multifaceted, which makes its regulation complicated. The entire regulatory process involves the reconciliation of a complex mix of technology and social rules that can be incompatible and, in some cases, irreconcilable. Policy makers, therefore, are frequently required to make tough choices, which often manage to strike the desired balance, while, other times, they lead to a series of unintended consequences.

Europe’s General Data Protection Regulation (GDPR) is a good example. The purpose of the regulation was simple: fix privacy by providing a framework that would allow users to understand how their data is being used, while forcing businesses to alter the way they treat the data of their customers. The GDPR was set to create much-needed standards for privacy in the Internet and, despite continuous enforcement and compliance challenges, this has majorly been achieved. But, when it comes to the effect it has had on the Internet, the GDPR has posed some challenges. Almost two months after going into effect, it was reported that more than 1000 websites were affected, becoming unavailable to European users. And, even now, two years after, fragmentation continues to be an issue.

So, what is there to do? How can policy makers strike a balance between addressing social harms online and policies that do not harm the Internet?

A starting point is to perform a regulatory impact assessment for the Internet. It a tested method of policy analysis, intended to assist policy makers in the design, implementation and monitoring of improvements to the regulatory system; it provides the methodology for producing high quality regulation, which can, in turn, allow for sustainable development, market growth and constant innovation. A regulatory impact assessment constitutes a tool that ensures regulation is proportional (appropriate to the size of the problem it seeks to address), targeted (focused and without causing any unintended consequences), predictable (it creates legal certainty), accountable (in terms of actions and outcomes) and, transparent (on how decisions are made).

This type of thinking can work to the advantage of the Internet. The Internet is an intricate system of interconnected networks that operates according to certain rules. It consists of a set of fundamental properties that contribute to its flexible and agile character, while ensuring its continuous relevance and constant ability to support emerging technologies; it is self-perpetuating in the sense that it systematically evolves while its foundation remains intact. Understanding and preserving the idiosyncrasy of the Internet should be key in understanding how best to approach regulation.

In general, determining the context, scope and breadth of Internet regulation is important to determine whether regulation is needed and the impact it may have. Asking questions that under normal circumstances policy makers contemplate when seeking to make informed choices is the first step. These include: Does the proposed new rule solve the problem and achieve the desired outcome? Does it balance problem reduction with other concerns, such as costs? Does it result in a fair distribution of the costs and benefits across segments of society? Is it legitimate, credible and, trustworthy? But, there should be an additional question: Does the regulation create any consequences for the Internet?

Actively seeking answers to these questions is vital because regulation is generally risky, and risks arise from acting as well as from not acting. To appreciate this, imagine if the choices made in the early days of the Internet dictated a high regulatory regime in the deployment of advanced telecommunications and information technologies. The Internet would, most certainly, not be able to evolve the way it has and, equally the quality of regulation would suffer.

In this context, the scope of regulation is important. The fundamental problem with much of the current Internet regulation is that it seeks to fix social problems by interfering with the underlying technology of the Internet. Across a wide range of policymaking, we know that solely technical fixes rarely fix social problems. It is important that governments do not regulate aspects of the Internet that could be seen as compromising network interoperability, to solve societal problems. This is a “category error” or, more elaborately, a misunderstanding of the technical design and boundaries of the Internet. Such a misunderstanding tends to confuse the salient similarities and differences between the problem and where this problem occurs; it not only fails to tackle the root of the problem but causes damage to the networks we all rely on. Take, for instance, data localization rules, which seek to force data to remain within certain geographical boundaries. Various countries, most recently India, are trying to forcibly localize data, and risk impeding the openness and accessibility of the global Internet. Data will not be able to flow uninterrupted on the basis of network efficiency; rather, special arrangements will need to be put in place in order for that data to stay within the confines of a jurisdiction. The result will be increased barriers to entry, to the detriment of users, businesses and governments seeking to access the Internet. Ultimately, forced data localization makes the Internet less resilient, less global, more costly, and less valuable.

This is where a regulatory risk impact analysis can come in handy. Generally, what the introduction of a risk impact analysis does is that it shows how policy makers can make informed choices about how some of the regulatory claims can or cannot possibly be true. This would require a shift in the behavior of policy makers from solely focusing on process to a more performance-oriented and result-based approach.

This sounds more difficult than it actually is. Jurisdictions around the world are accustomed to performing regulatory impact assessments which has successfully been integrated in many governments’ policy making process for more than 35 years. So, why can’t it be part of Internet regulation?

Dr. Konstantinos Komaitis is the Senior Director, Policy Strategy and Development at the Internet Society.

Filed Under: do no harm, impact assessment, internet regulation

Scientists Forced To Change Names Of Human Genes Because Of Microsoft's Failure To Patch Excel

(Mis)Uses of Technology

from the code-is-law dept

Six years ago, Techdirt wrote about a curious issue with Microsoft’s Excel. A default date conversion feature was altering the names of genes, because they looked like dates. For example, the tumor suppressor gene DEC1 (Deleted in Esophageal Cancer 1) was being converted to “1-DEC”. Hardly a widespread problem, you might think. Not so: research in 2016 found that nearly 20% of 3500 papers taken from leading genomic journals contained gene lists that had been corrupted by Excel’s re-interpretation of names as dates. Although there don’t seem to be any instances where this led to serious errors, there is a natural concern that it could distort research results. The good news is this problem has now been fixed. The rather surprising news is that it wasn’t Microsoft that fixed it, even though Excel was at fault. As an article in The Verge reports:

Help has arrived, though, in the form of the scientific body in charge of standardizing the names of genes, the HUGO Gene Nomenclature Committee, or HGNC. This week, the HGNC published new guidelines for gene naming, including for “symbols that affect data handling and retrieval.” From now on, they say, human genes and the proteins they expressed will be named with one eye on Excel’s auto-formatting. That means the symbol MARCH1 has now become MARCHF1, while SEPT1 has become SEPTIN1, and so on. A record of old symbols and names will be stored by HGNC to avoid confusion in the future.

So far, 27 genes have been re-named in this way. Modifying gene names in itself is not unheard of. The Verge article notes that, in the past, names that made sense to experts, but which might alarm or offend lay people, are also changed from time to time:

“We always have to imagine a clinician having to explain to a parent that their child has a mutation in a particular gene,? says [Elspeth Bruford, the coordinator of HGNC]. “For example, HECA [a cancer-related human gene] used to have the gene name ‘headcase homolog (Drosophila),’ named after the equivalent gene in fruit fly, but we changed it to ‘hdc homolog, cell cycle regulator’ to avoid potential offense.”

It is nice to know that we won’t need to worry about serious problems flowing from Excel’s habit of automatically re-naming cell entries. But it’s rather troubling that Microsoft doesn’t seem to have thought the problem worthy of its attention or a fix, despite it being known for at least six years. It shows once again how people are being forced to adapt to the software they use, rather than the other way around. Or, as Lawrence Lessig famously wrote: “code is law“?

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: autoconversion, dates, excel, gene names, genes, spreadsheets
Companies: microsoft

Forget TikTok. Feebly Secured Infrastructure Is Our Real Problem

(Mis)Uses of Technology

from the missing-the-broader-context dept

One of the dumber aspects of press coverage of the TikTok kerfuffle is the lack of broader context. How, exactly, does banning a Chinese-owned teen dancing app solve our security and privacy headaches in a world where apps and services everywhere are collecting most of the same data, if not more? And why the myopic focus on just TikTok when Americans attach millions of totally unsecured Chinese-made “smart” IOT devices to their home and business networks with reckless abandon? If you’re going to freak out about U.S. consumer privacy and internet security — why not focus on actually shoring up overall U.S. consumer privacy and security?

Many press outlets and analysts have innately bought into the idea that banning TikTok somehow seriously thwarts the Chinese government’s spying efforts. In reality, China’s spying capabilities, fueled by an unlimited budget, have no limit of potential other ways to get far more data thanks to United States’ lax privacy and security standards. Case in point, last week in the midst of TikTok hysteria, a report quietly emerged showing that the U.S. satellite communications networks have the security of damp cardboard:

“More than a decade has passed since researchers demonstrated serious privacy and security holes in satellite-based Internet services. The weaknesses allowed attackers to snoop on and sometimes tamper with data received by millions of users thousands of miles away. You might expect that in 2020?as satellite Internet has grown more popular?providers would have fixed those shortcomings, but you?d be wrong.”

The security researcher in question showcased how it wasn’t particularly difficult to hack into these satellite networks to observe all manner of online activity, from airliners receiving unencrypted navigation data in flight, to utility administrators managing wind turbines. Many of these vulnerabilities have been known about for fifteen years yet still haven’t been fixed:

?There are still many satellite Internet services operating today which are vulnerable to their [the previous researchers?] exact attacks and methods?despite these attacks having been public knowledge for more than 15 years at this point,? Pavur told me ahead of Wednesday?s talk. ?We also found that some newer types of satellite broadband had issues with eavesdropping vulnerabilities as well.”

Which is all to say: if you’re going to freak out about TikTok, why not at least spend some of those calories discussing actually trying to fix our broader cybersecurity and privacy problems? Why not create systems that are simply resilient, transparent, and accountable by design?

The U.S. still doesn’t have even a basic privacy law for the internet era, companies routinely face no serious penalty for privacy missteps, our privacy regulators are routinely kneecapped and under-funded, consumer data is routinely left open on the cloud, a new hack is revealed at least once a week, and nobody wants to spend the funds necessary to upgrade older infrastructure because doing so simply isn’t sexy. To ignore this, then become utterly hysterical because the Chinese government might get some teen phone data, seems divorced from the broader context.

Yet most of the biggest pearl clutchers about the dangers of TikTok have been utterly absent from this broader reality.

They were nowhere to be found among efforts to fix a massive SS7 flaw that makes our cellular infrastructure vulnerable. They were dead quiet as folks tried to hold the cellular industry accountable for selling everybody’s location data to any nitwit with a nickel. In fact, most of the folks that have hyperventilated the most about TikTok have repeatedly shot down attempts at internet-era privacy laws and fought against funding to secure U.S. elections. Why, it’s almost as if many of them don’t actually care about U.S. privacy and security, and instead are performatively upset about TikTok for xenophobic, financial, and political reasons.

Seriously concerned about U.S. cybersecurity and privacy issues? Why not work to actually try to fix those problems instead of engaging in histrionics about a teenage dancing app? Because it only takes a few hours of reading about the U.S. cybersecurity and privacy incompetence before you come to realize that TikTok is among the very least of this country’s problems on that front.

Filed Under: china, infrastructure, iot, privacy, surveillance
Companies: tiktok