This decision follows the recent controversy around Substack platforming and monetizing Nazi writers as well as Substack’s disappointing response to concerned creators about the issue. And with Substack’s growth from simple hosting software into a more robust space for algorithmic content, it matters to us how the company chooses to moderate the content it makes money from. As Casey Newton at the Platformer eloquently put it: “I’m not aware of any major US consumer internet platform that does not explicitly ban praise for Nazi hate speech, much less one that welcomes them to set up shop and start selling subscriptions.” 

Critics of our choice to leave may feel that we don’t support freedom of speech here at hatemail, but nothing could be further from the truth. In 2020, we moved to Substack from MailChimp’s TinyLetter platform over MailChimp’s agressive censorship of queer and sex-positive content. We deeply care about freedom of speech and it’s not lost on us that we are, once again, moving hatemail due to a platform’s content moderation choices. But framing the way Substack is handling their Nazi problem as a laudable adherence to freedom of speech is poor judgment at best. 

Freedom of speech is a value that is often used to encourage the protection of marginalized ideas. To speak truth to power. To safeguard the voices of the disenfranchised. But white supremacy is not an idea that comes from the disenfranchised. It’s an idea that has historically shaped the foundations of the most currently powerful political institutions on planet Earth. White supremacy may be considered an unpopular idea to explicitly support (because our species has seen the inhumanity of its ideological endpoint in political movements such as Nazism) but it certainly is not a marginalized one. 

Thank you for your patience while we try to find the best platform for hatemail…one that doesn't support Nazis. 

Hackers are Exploiting New Ivanti VPN Zero-Days

Hackers are exploiting two zero-day vulnerabilities in a popular VPN product sold by lvanti, a U.S. software company specializing in security and management solutions. Ivanti said that patches won’t be ready until the end of the month. [TechCrunch] [ArsTechnica]

China Says It Cracked Apple AirDrop to Identify Message Sources

The Chinese government-backed research group Beijing Wangshendongjian Judicial Appraisal Institute says it has found a way to extract contact information from the device logs for Apple’s AirDrop feature. AirDrop has become a popular way to share sensitive political information in China and avoid censorship. [Bloomberg] [Bleeping Computer]

Qualcomm Chip Vulnerability Enables Remote Attack by Voice Call

On New Year’s Day, Qualcomm announced a vulnerability impacting Qualcomm chipsets which could facilitate remote code execution access by malicious attackers on targeted devices. Patches for the vulnerability have already been made available. [SC Media]

Dark Visitors: A List of Known AI Agents on the Internet

Check out this list of known AI agents such as autonomous chatbots and data scrapers. The list is regularly updated and individuals can submit AI agents that haven’t already been flagged. [Dark Visitors] 

FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data

Data broker X-Mode Social and its successor company Outlogic Federal will be prohibited from selling or sharing sensitive location data following allegations by the U.S. Federal Trade Commission that the companies were selling people’s location data such as information about visits to places of religious worship, reproductive health clinics, and domestic violence shelters. [Federal Trade Commission] 

The Nature of Bug Bounty Programs is Changing, and Their ‘Auntie’ is Worried

Katie Moussouris, founder and CEO Luta Security who is known for work on ‘bug bounty’ programs, discusses why regulations requiring companies to report vulnerabilities to government agencies before they are patched is a concerning global trend. [The Record]

NIST Request for Public Comment on Artificial Technology Guidance 

The U.S. National Institute of Standards and Technology (NIST) is seeking public comment concerning the safe development and use of AI technology as it builds AI guidance in alignment with the Biden administration’s October 2023 executive order. The deadline for submitting comments is Feb. 2, 2024. [Federal Register] 

Your Washing Machine Could be Sending 3.7 GB of Data a Day

A Twitter thread about a LG washing machine taking up 3.66 GB of data a day on an owner’s router sparks a conversation on the possible causes and a broader discussion on the dangers of connected device hacking. [Tom’s Hardware]

Corporate Spy Tech and Inequality: 2023 Year in Review

From 23andMe stolen user information to automakers’ data stockpiles, the Electronic Frontier Foundation’s year in review on their work concerning corporate Spy Tech is a doozy. [Electronic Frontier Foundation]

The exhibition currently running at Amant provokes thoughts about borders, castes, and the structures of society that are as forceful as they are invisible. The exhibition is titled I did not tell you what I saw, but only what I dreamt and contains pieces created by the artist from 2008 to 2023, with most of them being produced in the past five years. Pieces make use of rocks taken from disputed territory; cannabis smuggled across a border finds new purpose as an ink on paper; a speaker hanging from the ceiling at one point appears to chase visitors around the room with recorded voice counting off numbers in a banal, authoritative manner.

Gupta’s manifestation of grim and violent themes is frankly playful. While some may claim that the discourse of today’s dark realities require nuance, it may be actually be levity that is lacking. The ability to disperse and consume information with a light, gentle, and caring touch could be all the difference between finding an ally in someone or finding one at odds.

Shilpa Gupta’s I did not tell you what I saw, but only what I dreamt runs at Amant in Brooklyn until April 2024.

Threat by Shilpa Gupta as it appeared at Faurschou’s gallery in Greenpoint, Brooklyn in 2022. Source: Faurschou

For, in your tongue, I cannot fit as exhibited at Amant’s running exhibition of Gupta’s work. Source: Amant

TikTok’s Data Collection Being Scrutinized by Australia's Privacy Watchdog

The Office of the Australian Information Commissioner (OAIC), the country’s privacy watchdog, launched an inquiry into TikTok’s personal data collection methods and consent protocols. [The Guardian]

Cars Have Become Computers On Wheels – And Police Have Easy Access to Data

Law enforcement is increasingly turning to car data to solve crimes. The practice sheds light on how much data is already stored in cars, the growth of computers being incorporated into them, and the legal gray areas surrounding the issue. [The Record]

An Indigenous Perspective on Generative AI

Justin Hendrix sits down with Michael Running Wolf from McGill University to talk about exploitation, data sovereignty, and ownership from an Indigenous lens. [Tech Policy Press]

Google Wrote a ‘Robot Constitution to Make Sure Its New AI Droids Won’t Kill Us

Google’s DeepMind robotics team has introduced a new training data system with a “Robot Constitution” inspired by Isaac Asimov in order to prioritize human safety during tasks. [The Verge]

California Senator Files Bill Prohibiting Agencies from Working with Unethical Tech Companies

Sen. Steve Padilla had introduced Senate Bills 892 and 893, which prohibits the California government from contracting AI services from companies that don’t meet “established standards.” [The Verge]

Inauthentic Accounts Pose as Taiwanese Users to Spread Political Memes and Videos Ahead of 2024 Election

This report released by Graphika describes a coordinated effort to manipulate online conversation ahead of Taiwan’s January 2024 presidential election. [Graphika]

Avert Your Eyes, Avoid Responsibility and Just Blame TikTok

Zeynep Tufekci argues that politicians will have to develop policy ideas beyond social media platform accountability if they really want to mitigate the influence that online disinformation has on young voters. [The New York Times]

Law Firm That Handles Data Breaches Was Hit by Data Breach

International law firm Orrick, Herrington & Sutcliffe recently reported that sensitive data of more than 637,000 individuals was stolen by hackers in March 2023. [TechCrunch]

A Mexican Cartel Set Up Its Own Shitty Internet And Forced Everyone To Use It

The residents of Cenobio Moreno and San Juan de los Plátanos, in Michoacán, made monthly internet payments to the drug cartel Los Viagras for access to a poor quality network. [LUIS]

Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations

This report lays out a taxonomy of concepts and definitions in the field of adversarial machine learning (AML) to build future standards for security assessments and to develop a common industry language. [NIST]

Meet ‘Link History,’ Facebook’s New Way to Track the Websites You Visit

Facebook is pushing a new data setting on users called “Link History,” which collects information on all of the links you click while in its mobile app and uses the data to fuel targeted ads. [Gizmodo]

New Spin on a Revolving Door: Pentagon Officials Turned Venture Capitalists

Defense officials are  moving away from traditional revolving door weapons makers like Lockheed Martin and instead are increasingly joining venture capital firms bankrolling defense technology startups. [The New York Times]

Huawei Teardown Shows 5nm Chip Made in Taiwan, Not China

A teardown of Huawei Technologies Co.’s latest notebook revea;s that the laptop runs on a chip made by Taiwan Semiconductor Manufacturing Co., contradicting speculation that Huawei’s mainland Chinese chip maker had achieved a major technical advance. [Bloomberg]

Palestinian groups accuse Meta of unfairly moderating speech amid Israel-Hamas conflict

Several Palestinian advocacy groups are calling on Meta to address long-standing content moderation issues they allege have unfairly restricted them. [The Hill]

Introducing the AI Alliance

Meta forms an “AI Alliance” with several universities and companies as it pushes open source and community approaches. [Meta]

a16z Funded AI Platform Generated Images That “Could Be Categorized as Child Pornography,” Leaked Documents Show

OctoML, the engine that powers a16z funded Civitai, thought the images could qualify as “child pornography,” but ultimately decided to keep working with the company anyway, internal Slack chats and other material shows. [404Media]

AI influencers are getting filthy rich... let's build one

AI influencers are making real money selling content on websites like OnlyFans.This video shows how easy (and scary) it can be. [Fireship on YouTube]

Apps That Use AI to Undress Women in Photos Soaring in Use

Apps and websites that use artificial intelligence to undress women in photos are soaring in popularity, according to researchers. [Bloomberg]

'Nudify' apps that use AI to undress women in photos are soaring in popularity, prompting worries about non-consensual porn

TikTok has blocked the keyword “undress,” a popular search term associated with the services. [Fortune]

Hackers stole ancestry data of 6.9 million users, 23andMe finally confirmed

Majority of impacted users are now being notified, 23andMe confirmed. [Ars Technica]

Clandestine online operations now require sign-off by senior officials

The military’s information operations are getting ‘new levels of oversight,’ the Pentagon tells us. [Washington Post]

China’s Hackers Are Expanding Their Strategic Objectives

China-based hackers are accessing U.S. infrastructure and developing methods to disrupt it in the event of conflict. [Lawfare]

A Decade of Have I Been Pwned

“A decade ago to the day, I published a tweet launching what would surely become yet another pet project that scratched an itch, was kinda useful to a few people but other than that, would shortly fade away into the same obscurity as all the other ones I'd launched over” [Troy Hunt’s blog]

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

UEFIs booting Windows and Linux devices can be hacked by malicious logo images. [Ars Technica]

Inside Job: How a Hacker Helped Cocaine Traffickers Infiltrate Europe’s Biggest Ports - OCCRP

OCCRP exposes the work of a Dutch hacker, who was hired by drug traffickers to penetrate port IT networks. [OCCRP]

Former US ambassador arrested in Florida, accused of serving as an agent of Cuba, AP source says

A former American diplomat who served as U.S. ambassador to Bolivia has been arrested in a long-running FBI counterintelligence investigation [AP]

Another journalist goes missing in China

Veteran Hong Kong journalist Minnie Chan, who covers Chinese defense & diplomacy for the South China Morning Post, vanished while on assignment in Beijing. Friends suspect the government is holding her. [Will Ripley on Twitter]

Russia’s largest hacking conference: Biggest hits from Positive Hack Days 2023

Russia’s largest hacking conference, Positive Hack Days, recently took place in Moscow from Friday, May 19 to Saturday, May 20. The event was held at Gorky Park, a large park and cultural complex in Moscow, and split into an area freely open to the public and a village area. [Margin Research]

Russian information operation uses US celebrity Cameos to attack Zelensky

Kremlin propagandists tricked a half dozen celebrities into recording videos urging Ukraine's president to seek treatment for substance abuse. [Cyberscoop] [Microsoft]

Oxford’s 2023 Word of the Year Is … ‘Rizz’

https://www.nytimes.com/2023/12/03/arts/rizz-oxford-word-year.html

Sorry, Swifties. The Gen Z slang term — derived from “charisma” — went viral this year after the actor Tom Holland claimed to have none.

Sharif Kouddous on Twitter

“If I must die” — this is the poem Refaat has pinned at the top of his profile. The Israeli military killed him today in Gaza. [Sharif Kouddous on Twitter]

Building end-to-end security for Messenger

Meta publishes new whitepapers on a new end-to-end encryption scheme intended for Messenger apps. [Meta]

Your 2023 WebMD Wrapped

A satirical look into what your WebMD data might have said about you this year. [McSweeneys]

Adversarial Fashion

Clothing and tutorials for confounding and triggering computer vision-based surveillance systems with fashion and accessories. [Adversarial Fashion]

At New York Fashion Week, being offline is the ultimate luxury

If you’re following New York Fashion Week through TikTok, you’re witnessing an alternative reality.  [Washington Post]

Palantir Among First Tech Firms to Promise White House They Won't Use AI for Evil

Adobe, Nvidia, Salesforce, Stability, and others also claim they will steward ‘trustworthy’ AI, if you can ever trust the companies themselves. [Gizmodo]

“This Is a Disaster:” Game Developers Scramble to Deal With Unity’s New Fees

The enshittification of the popular game engine got much worse today, with some developers saying they are already looking at open source alternatives. [404media]

Revealed: Israeli cyber firms developed an 'insane' new spyware tool. No defense exists

A Haaretz investigation reveals that Israeli cyber companies developed technology that exploits the advertising system at the heart of the online economy to monitor civilians, hack into their phones and computers, and spy on them. This terrifying capability, against which no defense currently exists, has already been sold to a nondemocratic country. [Haaretz] [non-paywalled archive]

Pegasus Infection of Galina Timchenko, exiled Russian Journalist and Publisher 

In an investigative collaboration with Access Now, the Citizen Lab has analyzed forensic artifacts from the iPhone of award-winning exiled Russian investigative journalist Galina Timchenko and found with high confidence that on or around February 10th, 2023 it was infected with NSO Group’s Pegasus spyware. [CitizenLab]

Caesars Entertainment Paid Millions in Ransom in Recent Attack

Caesars Entertainment Inc. paid tens of millions of dollars to hackers who broke into the company’s systems in recent weeks and threatened to release the company’s data, according to two people familiar with the matter. [Bloomberg]

Tracking the Worlds Dumbest Cyber Mercenaries - Cooper Quintin

“In this talk we will discuss the story of Dark Caracal, the mistakes they have made, and how they have managed to remain effective despite quite possibly being the dumbest APT to ever exist.” [DEFCON on YouTube]

‘It’s slavery for modern times’: how children of 12 toil in Colorado’s fields

Some states are pushing to relax child labour laws but even in the farms of San Luis valley, where most are Hispanic/Latino, youngsters can work an unlimited number of hours. [Guardian]

Amazon Illegally Silenced Drone Staff, Labor Board Alleges

US Labor Board prosecutors accused Amazon.com Inc. of imposing illegal secrecy rules on its staff, which could ultimately force the company to change its confidentiality rules. [Bloomberg]

Revealed: The Country that Secretly Wiretapped the World for the FBI

For years the FBI ran its own encrypted phone company to intercept messages from thousands of people around the globe. One country was critical to that operation, whose identity was unknown to the public. [404Media]

Telegram & Discord Security Best Practices

Greetings! In this note I'll give you some simple tips and you'll sleep better at night when using Telegram & Discord for life & work in crypto! [OfficerCIA on Mirror]

Stripe Forbids Sex Work, But Profits From Non-Consensual Porn

Stripe is processing payments for sites that produce nonconsensual AI porn while denying service to actual sex workers and people in the adult entertainment industry. [404Media]

Site for Generating Non-Consensual AI Porn Restricts Content Following 404 Media Investigation

“Time to try a new hobby,” one Mage user said in response to the new restrictions. [404Media]

Private Until Presumed Guilty - Allison Young, Diane Akerman

“In this talk, we will show you examples of information that can easily be extracted from many phones to surveil personal reproductive decisions. We will also show you how the government obtains your not-so-private thoughts using forensic extraction and reporting tools, with a focus on health and lifestyle apps. [DEFCON on YouTube]

Ashton Kutcher Resigns From Nonprofit Over Danny Masterson Letter

Kutcher resigned from the board of Thorn, the organization he co-founded to combat child sexual abuse, after backlash against his support of a more lenient sentence for Masterson, who was convicted of rape. [NYTimes]

Hate Parties: Sharing Links on Fringe Platforms Drives Antisemitic Comments on YouTube

Hate parties occur when links shared to fringe platforms lead users to YouTube comment sections to revel in hate, challenging content moderation strategies. [ADL]

India demands action after Seattle police officer laughs at death of student

‘India has reacted strongly to shocking bodycam footage of a Seattle police officer laughing over the death of a 23-year-old Indian student and demanded the US take action on the matter. [The Independent]

BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild

Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We refer to the exploit chain as BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim. [CitizenLab] [Apple]

Keeping Pegasus on The Wing: The Legitimization of Cyber Espionage

“We show that these legitimation axes are designed to simultaneously ensure the company's survivability and to sustain surveillance realism – the perception of surveillance as the only viable option. This article contributes to the emerging literature on cyber surveillance firms and to the burgeoning research on the legitimation of surveillance by shedding light on the discursive infrastructures behind contemporary cyber espionage.” [Taylor Francis]

When AI systems are used, they are usually used for surveillance

The President of the messaging app Signal, Meredith Whittaker, warns about the application of Artificial Intelligence. It’s important not to give big corporations linked to governments a free pass. [Schweizer Monat]

Mobile App Stores Begin Enforcing China's New Oversight Move On Apps

Mobile app stores in China run by Tencent Holdings, Xiaomi, and others have started to bar app publishers from launching new apps if they do not make all the disclosures required by authorities, documents seen by Reuters showed. [Reuters]

Google Chrome pushes browser history-based ad targeting

The risks will vary, based on where you are. [The Register]

If You’ve Got a New Car, It’s a Data Privacy Nightmare

Bad news: your car is a spy. Every major car brand failed a recent privacy and security test from Mozilla. You’re probably driving around in a "privacy nightmare" that may collect information as sensitive as your race, health status, and sexual activity. [Gizmodo]

Google Search, Whatsapp, and TikTok on list of 22 services targeted by EU’s tough new DMA

They now have six months to comply with the rules. [The Verge]

The Absence of Data Privacy Law is a National Security Threat

Informational technology companies’ involvement in aiding and abetting foreign intelligence activities in alleged human rights violations must continue to face scrutiny. [National Interest]

Gov monitors Global Entry travelers daily, even if they aren't traveling

"Trusted traveler"? Don't kid yourself. If you traveled this year, the Feds are spying on you. [Newsweek]

NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild 

Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices.The exploit chain, which Citizen Lab has dubbed “BLASTPASS,” was capable of compromising iPhones running the latest version of iOS (16.6). [CitizenLab] [Meysam on Twitter]

Members of Trickbot and Conti hacking groups indicted and sanctioned by the US

Authorities have sanctioned 11 alleged members of the cybercriminal groups, while the US Justice Department unsealed three federal indictments against nine people accused of being members.

[Indictment on DocumentCloud] [Sanctions announcement from Treasury Department]

AI-Based Honeypot Dubbed “sheLM” by Researchers

A new AI-based honeypot – a network with a component designed to lure and study cyber-attack techniques – has caught the attention of researchers at Czech Technical University and UNCuyo. [Cyber Security News]

Results of Major Technical Investigations for Storm-0558

After disclosing an intrusion last month from a Chinese-nexus threat actor, Microsoft has published their technical investigation and findings for transparency. [Microsoft Blog] [Microsoft Blog]

Microsoft Says China is Using AI to Influence U.S. Voters

On Thursday, Microsoft researchers reported that a network of fake, Chinese-controlled social media accounts appear to be seeking to influence U.S. voters with artificial intelligence. The Chinese embassy in Washington denied the accusation. [Reuters]

Malicious Chinese Code in Korean Gear is Just the Tip of the Iceberg

South Korea suspects China’s been tinkering with government computer hardware. [Bloomberg] [Bloomberg]

In-vehicle wireless devices are endangering emergency first responders

Gateways are supposed to make cops safer. Many leak their locations in real time. [ArsTechnica]

Breaking Down the Door to Emergency Services through Cellular IoT Gateways

If configured incorrectly, cellular IoT gateways can give attackers access to critical infrastructure, threatening human life in ways only Hollywood has conceived. [F5]

New Musk biography offers fresh details about the billionaire's Ukraine dilemma

Elon Musk secretly ordered his engineers to turn off his company’s Starlink satellite communications network near the Crimean coast last year to disrupt a Ukrainian sneak attack on the Russian naval fleet, according to an excerpt adapted from Walter Isaacson’s new biography of the eccentric billionaire titled “Elon Musk.” [CNN]

In Ukraine, a U.S. Arms Dealer Is Making a Fortune and Testing Limits

Billions are pouring into a clubby, secretive arms market. With Pentagon cash and unusually close Ukrainian military ties, Marc Morales has few peers. [NYTimes]

After Prigozhin’s Death, a High-Stakes Scramble for His Empire

A shadowy fight is playing out on three continents for control of Yevgeny Prigozhin’s sprawling interests as head of the Wagner mercenary group. The biggest prize: his lucrative operations in Africa. [NYTimes]

Dozens of ‘Cop City’ Activists Are Indicted on Racketeering Charges

Opponents of a police training facility in Atlanta say they are engaged in legitimate acts of protest. Prosecutors accuse them of taking part in a sprawling criminal enterprise. [NYTimes]

Metamorphosis of a fake account

The weird and wacky journey from cryptocurrency-shilling spambot to propaganda-pushing persona. [Norteno Conspirador]

The Current Campaign of Fake AI Bots Trying to Install Malware

Fake ads are flooding Facebook & Co. offering downloads of the latest AI tools. Instead of smart helpers, you'll only get malware. [We Live Security]

What is a "good" Linux Kernel bug?

I found my first Linux kernel vulnerability in 2006, but it wasn't a particularly good one. At the time I was just copying everything that my colleague Ilja van Sprundel was doing, and that was good enough to find something. If you watch Ilja's video from CCC, Unusual Bugs (2006) [Isoceles Blog]

FBI and Global Partners Disrupt Notorious Botnet Software Qakbot

Last week the FBI, along with international law enforcement partners, successfully tricked thousands of computers into uninstalling a botnet software that officials say has caused hundreds of millions of dollars in damage worldwide. [TechCrunch]

Teens Hacked Boston Subway Cards to Get Infinite Free Rides—and This Time, Nobody Got Sued

In 2008, Boston’s transit authority sued to stop MIT hackers from presenting at the Defcon hacker conference on how to get free subway rides. Today, four teens picked up where they left off. [Wired]

A Brazilian phone spyware was hacked and victims’ devices 'deleted' from server

The Portuguese-language spyware app has been used to compromise over 76,000 devices to date, the leaked data shows. [TechCrunch]

Cyber security experts lament west’s failure to learn lessons from Ukraine

US and its allies struggle to copy Kyiv’s collaborative efforts, say delegates at world’s biggest cyber security conference [Financial Times]

Conti Inc.: Understanding the Internal Discussions of a large Ransomware-as-a-Service Operator with Machine Learning

Ransomware-as-a-service (RaaS) is increasing the scale and complexity of ransomware attacks. Understanding the internal operations behind RaaS has been a challenge due to the illegality of such activities. The recent chat leak of the Conti RaaS operator, one of the most infamous ransomware operators on the international scene, offers a key opportunity to better understand the inner workings of such organizations. [arxiv]

Predict And Prevent DDOS Attacks Using Machine Learning and Statistical Algorithms

This study uses several machine learning and statistical models to detect DDoS attacks from traces of traffic flow and suggests a method to prevent DDOS attacks. For this purpose, we used logistic regression, CNN, XGBoost, naive Bayes, AdaBoostClassifier, KNN, and random forest ML algorithms. [arxiv]

UK and allies support Ukraine calling out Russia's GRU for new malware campaign

Malware, dubbed Infamous Chisel, enables unauthorised access to compromised Android devices. [United Kingdom press release]

ACLU Files Complaint Against MasterCard Anti-Online Sex Work Policy

The ACLU has submitted a Federal Trade Commission complaint against MasterCard over a new policy that discriminates against online adult content sellers. [ACLU]

Police Have Only Arrested Black People In All Known Cases of False Accusation Due to Facial Recognition Technology

All six publicly known reports of false arrests due to facial recognition technology have been made by Black people. Civil liberties groups, tech experts, and activists continue to warn that the use of facial recognition technology in law enforcement will only increase racial inequities in policing. [BusinessInsider]

IBM Returns to Facial Recognition Market After Promising to Leave It

IBM has signed a $69.8 Million contract to provide facial recognition technology just three years after promising to abandon the technology due to ethical concerns. [The Verge] 

Japanese Government To Use ChatGPT Tech In Administrative Tasks

Microsoft will supply Japan's government with the technology underpinning its ChatGPT generative AI for use in clerical work and analysis. [NikkeiAsia]

I Tracked an NYC Subway Rider's Movements with an MTA ‘Feature’

“Obviously this is a great fit for abusers,” an expert on domestic violence and cybersecurity said. [404media]

New York police will use drones to monitor backyard parties this weekend, spurring privacy concerns

Those attending outdoor parties or barbecues in New York City this weekend may find an uninvited guest looming over their festivities: a police drone. [AP]

Maker of ‘smart’ chastity cage left users’ emails, passwords, and locations exposed

A hacker said they breached the maker of internet-connected chastity cages to warn about security flaws that are exposing users' data. [TechCrunch]

Project Shows How Much It Costs To Build An AI Disinformation Machine

A developer used widely available AI tools to generate anti-Russian tweets and articles.The project is intended to highlight how cheap and easy it has become to create propaganda at scale. [Wired]

Meta’s ‘Biggest Single Takedown’ Removes Chinese Influence Campaign

The campaign began at least four years ago and spanned thousands of accounts on Facebook, Instagram, TikTok, X, Substack and Chinese websites, Meta said. [NYTimes]

China’s Misinformation Fuels Anger Over Fukushima Water Release

By exaggerating the risks from Japan’s discharge of treated wastewater, Beijing hopes to cast Japan and its allies as conspirators in malfeasance, analysts say. [NYTimes]

Slowly but surely we have been digesting all that we consumed during the week of August 6th to 12th when BSides Las Vegas, BlackHat USA, DEF CON (#DC31), The Diana Initiative, and more take over Las Vegas, NV. All of the goons might already have those sketchy flash drives full of the recorded talks, but we’ve been getting by off the vapors of what gets posted to different channels. (FYI: You can find an index of channels that host talks at conferences like these at hackroost.net)

DEF CON 31 - Infinite Money Glitch - Hacking Transit Cards - Bertocchi, Campbell, Gibson

As the Wired article details… Teens Hacked Boston Subway Cards to Get Infinite Free Rides—and This Time, Nobody Got Sued. In 2008, Boston’s transit authority sued to stop MIT hackers from presenting at the DEF CON hacker conference on how to get free subway rides. Today, four teens picked up where they left off. This is their talk at #DC31. [Youtube]

DEF CON 31 Recon Village - Sally - Nosy Cops Exposing the Hidden Potential of Police Radio

At DC31’s Recon Village, Sally, Who Makes Yachts shares multiple demos and stories from over three years of 24/7 coverage in the Atlanta metro area that illuminate how real-world applications of this data and these techniques can help uncover corruption and keep people safe when public safety officials overstep their bounds. [Youtube]

The World’s Last Internet Cafes

For a quarter century, internet cafes connected the world. Now they’re vanishing into history. [Rest of World]

Why Nothing on Your Phone Is Safe From Ads

Tech companies are just hoping you’ll put up with it. [New York Magazine]

The Internet Is Turning Into a Data Black Box. An ‘Inspectability API’ Could Crack It Open

Unlike web browsers, mobile apps increasingly make it difficult or impossible to see what companies are really doing with your data. The answer? An inspectability API. [Wired]

Hell freezes over as Apple supports right-to-repair bill

As California legislation nears finish line, Apple suddenly switches sides. [ArsTechnica]

The Scourge of Commercial Spyware—and How to Stop It

Enforceable regulation of commercial spyware requires human rights, transparency, oversight & accountability, & exclusion of private industry. [Lawfare]

Following Elon Musk’s lead, Big Tech is surrendering to disinformation

Social media companies are receding from their role as watchdogs against conspiracy theories ahead of the 2024 presidential election. [Washington Post]

Rachel Thomas on Twitter

Friends with no previous interest in AI ethics have been asking me about it recently, so I want to share several underlying concepts about AI & power that are important to understand. [Twitter]

The Secret Weapon Hackers Can Use to Dox Nearly Anyone in America for $15

Most Americans have very little choice but to provide their personal information to credit bureaus. Hackers have found a way into that data supply chain, and are advertising access in group chats used by violent criminals who rob, assault, and shoot targets. [404media]

Ukraine hacks thousands of Russian security cameras to broadcast anti-Russian message

Ukraine has hacked thousands of Russian security cameras which have speakers and used those speakers to play a sarcastic message about how “great” Russia is. Some of the Russians looked pretty confused by what was happening. [Twitter]

pwn.college

pwn.college is an education platform for students (and other interested parties) to learn about, and practice, core cybersecurity concepts in a hands-on fashion. In martial arts terms, it is designed to take a “white belt” in cybersecurity to becoming a “blue belt”, able to approach (simple) CTFs and wargames. The philosophy of pwn.college is “practice makes perfect”. [pwn college]

April C Wright on Twitter

if you or someone you know struggle with online harassment or threats, i urge you to watch / share my recent #OPSEC talk i got a meaningful message today from someone who tldr is sending these tips for anti- #stalking to their friend i’m open for QA! [Twitter]

Inside the AI Porn Marketplace Where Everything and Everyone Is for Sale

Generative AI tools have empowered amateurs and entrepreneurs to build mind-boggling amounts of non-consensual porn. [404media]

Google and Microsoft Are Supercharging AI Deepfake Porn

To stay up and running, deepfake creators rely on products and services from Google, Apple, Amazon, CloudFlare and Microsoft. [Bloomberg]

Elon Musk’s Shadow Rule

How the U.S. government came to rely on the tech billionaire—and is now struggling to rein him in. [New Yorker] [Bloomberg]

Huawei Is Building a Secret Network for Chips, Trade Group Warns

The leading association of global chip companies is warning that Huawei Technologies Co. is building a collection of secret semiconductor-fabrication facilities across China, a shadow manufacturing network that would let the blacklisted company skirt US sanctions and further the nation’s technology ambitions. [Bloomberg]

China’s blueprint for an alternative world order

Beijing is using its economic muscle to rally developing countries and reduce the west’s influence over the UN [Financial Times]

In Wuhan, doctors knew the truth. They were told to keep quiet.

China's leaders covered up the pandemic at first — as described by doctors and other health-care professionals on the front lines. [Washington Post]

Newly declassified US intel claims Russia is laundering propaganda through unwitting Westerners

Russian intelligence is operating a systematic program to launder pro-Kremlin propaganda through private relationships between Russian operatives and unwitting US and western targets, according to newly declassified US intelligence. [CNN]

Know Your Adversary: Unmasking the Attacker and Decoding Threat Actor Patterns

Building a robust understanding of threat actors' patterns is critical to proactive defense strategies and preventing risk holistically. [Flashpoint]

Man Who Shot Store Owner for Flying Pride Flag Was a Far-Right Conspiracist

He posted anti-gay and antisemitic conspiracy theories, and followed and reposted Jordan Peterson and Matt Walsh. [Vice]

Jacksonville Dollar General shooter targeted Black people, sheriff says

Three people are dead after a racially-motivated shooting in Jacksonville, Florida. It happened at a Dollar General. police say the shooter left three different manifestos detailing his hate toward Black people. Reports say the gunman barricaded himself inside the store and killed three victims before turning one of his guns on himself. [CNN]

Naomi Wu and the Silence That Speaks Volumes

When China's prodigious tech influencer, Naomi Wu, found herself silenced, it wasn't just the machinery of a surveillance state at play. [Hacking But Legal]

Saudi Arabia: Mass Killings of Migrants at Yemen Border

Saudi border guards have used explosive weapons to kill 100s Ethiopian migrants trying to cross the Yemen-Saudi border, in a widespread & systematic pattern of attacks. Systematic abuses of Ethiopians may amount to crimes against humanity. [Human Rights Watch]

Moira Donegan on Twitter

Federal courts are pulling on the thread of Dobbs to unravel sex discrimination as a cognizable legal harm. Protection from discrimination on the basis of sex—a category that protects women, gay people, and trans people—is on increasingly shaky legal footing. [Twitter]

SpaceX Working with Cloudflare to Speed Up Starlink Service

Space Exploration Technologies, Elon Musk’s rocket company, is working with Cloudflare to boost the performance of SpaceX’s satellite internet service Starlink, according to a person with direct knowledge of the project. [The Information]

Investors Can Jam With Toast Point of Sale

The restaurant payments and software provider is adding a lot of new locations and has upsell potential. [Wall Street Journal]

Big-Ass-Data-Broker-Opt-Out-List

Big list of data brokers that everyone should send opt-out notices to. [@yaelwrites on GitHub]

Cleaning Up ChatGPT Takes Heavy Toll on Human Workers

Contractors in Kenya say they were traumatized by the effort to screen out descriptions of violence and sexual abuse during the run-up to OpenAI’s hit chatbot. [Wall Street Journal]

America Already Has an AI Underclass

Search engines, ChatGPT, and other AI tools wouldn’t function without an army of contractors. Now those workers say they’re underpaid and mistreated. [The Atlantic]

Does Sam Altman Know What He’s Creating?

The OpenAI CEO’s ambitious, ingenious, terrifying quest to create a new form of intelligence. [The Atlantic]

Big Tech's Takeover and Destruction of Open Protocols and Networks

Some great thoughts on Big Tech’s alleged appreciation for open technology: “All this means that corporations inherently cannot be trusted on open, federated networks. If they are allowed on, they will eventually destroy them.” [Cheapskates Guide]

The tricky truth about how generative AI uses your data

AI systems train on your data. What can you do about it? [Vox]

Doomsday to utopia: Meet AI’s rival factions

Inside Silicon Valley’s insular AI sector, a small group of strange but influential subcultures have clashed in recent months. [Washington Post]

How to Prepare for the Deluge of Generative AI on Social Media

A project studying algorithmic amplification and distortion, and exploring ways to minimize harmful amplifying or distorting effects. [Knight Center at Columbia]

The Online Christian Counterinsurgency Against Sex Workers

Special Operations vet Jeff Tiegs runs Skull Games, where evangelical Christians use internet surveillance to locate and bust sex workers. [The Intercept]

In age of AI, women battle rise of deepfake porn

Photo apps digitally undressing women and manipulated images fuel sextortion rackets. A boom in deepfake porn using people's images without consent is outpacing efforts to regulate the technology [Yahoo/AFP]

Stanford researchers find Mastodon has a massive child abuse material problem

Researchers found CSAM within five minutes of searching Mastodon. [The Verge]

Twitter under fire for reinstating account that posted child sex abuse

Twitter reinstated the account after some of its more than 500,000 followers complained that the account had been suspended for its political messaging. [Washington Post]

Code Kept Secret for Years Reveals Its Flaw—a Backdoor

A secret encryption cipher baked into radio systems used by critical infrastructure workers, police, and others around the world is finally seeing sunlight. Researchers say it isn’t pretty. [Wired]

Decoy Dog: Unveiling a Sophisticated DNS-Based Malware Toolkit

The Decoy Dog malware toolkit is a DNS-based command and control system. Learn about its origins, advanced features, and the response from threat actors. [Infoblox]

The Ups and Downs of 0-days: A Year in Review of 0-days Exploited In-the-Wild in 2022

Google’s annual report of exploits of 0-day vulnerabilities being observed in the wild. [Google]

Analysis of the whitewashing of human rights violations in Xinjiang, China

An investigation into the information operators, narratives, and media shielding the many atrocities in Xinjiang from coming to light. [OSINT Team Blog]

Our Oppenheimer Moment: The Creation of A.I. Weapons

A weird, oozing opinion piece in the New York Times from Palantir CEO Alex Karp. Per Meredith Whittaker on Twitter: “Note the author/Palantir have been promoting transforming tech cos into defense contractors for years, since at least 2018. Well before this new surge of generative AI hype. The urgency and serious-men tone remains constant, only the pretexts (and grandiosity) change.” [New York Times]

Hikvision Uyghur Recognition, NVIDIA-Powered, Sold To PRC China Authorities

Hikvision promised that this had stopped, but a new PRC government document IPVM obtained shows the truth of the human rights abusing software. [IPVM]

Elon Musk’s Unmatched Power in the Stars

The tech billionaire has become the dominant power in satellite internet technology. The ways he is wielding that influence are raising global alarms. [New York Times]

Their Families Said They Needed Treatment. Mississippi Officials Threw Them in Jail Without Charges

In Mississippi, serious mental illness or substance abuse can land you in jail, even if you aren’t charged with a crime. The state is a stark outlier in jailing so many people for so long, but many officials say they don’t have another option. [ProPublica]

Spyhide stalkerware is spying on tens of thousands of phones

The Android spyware app, developed in Iran and hosted in Germany, has compromised about 60,000 Android devices since 2016. [TechCrunch]

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

It's just a "proposal," but it's also being prototyped inside Chrome right now. [ArsTechnica]

California hotel workers strike back over 'union busting' app

A US trade union has filed a labor complaint against Instawork, a staffing app it says is designed to penalize workers who strike [Context]

They put food on our tables but live in the shadows. This man is fighting to be seen

Jose Martinez has picked America's food for decades. With all that experience on different farms, he saw workers lacking labor protections. Now he works to give farmworkers more rights. [NPR]

AI in Hollywood Has Gone From Contract Sticking Point to Existential Crisis

As the strikes grind on, actors and writers are worried about technology encroaching on their jobs. [Bloomberg]

Israel Lawmakers Pass Controversial Law to Limit Judges’ Power

Israel’s parliament approved a bill that will reduce judges’ ability to overrule government decisions and appointments. [Bloomberg]

Hong Kongers line up for hours at Shenzhen bank branches to withdraw their money

Long waits come amid concerns about the Chinese economy and liquidity of banking system. [Radio Free Asia]

Florida Has Approved PragerU ‘Curriculum’ for the Classroom

It’s the latest shakeup to Florida’s public education curriculum, which has taken a sharp conservative turn under Gov. Ron DeSantis’ leadership. [The Daily Beast]

Winnipeg: A daughter's quest to find her mother's remains

Police believe the remains of four indigenous women murdered by a serial killer were dumped in a landfill. [BBC]

Musk’s X Corp sues Israel’s Bright Data for scraping data

X Corp., formerly known as Twitter, alleges that the Israel-based web data collection firm scrapes and sells content and user data pulled from the social media platform. [Times of Israel]

Researcher Meredith Whittaker says AI’s biggest risk isn’t ‘consciousness’—it’s the corporations that control them

The former Googler and current Signal president Meredith Whittaker on why she thinks Geoffrey Hinton’s alarmism is a distraction from more pressing threats. [Fast Company]

‘I didn’t see him show up’: Ex-Googlers blast ‘AI godfather’ Geoffrey Hinton’s silence on fired AI experts

Former Google colleagues say machine learning pioneer Geoffrey Hinton failed to support them when they warned that AI could harm marginalized people. [Fast Company]

Cynthia Rudin Builds AI That Humans Can Understand

Cynthia Rudin wants machine learning models, responsible for increasingly important decisions, to show their work. [Quanta]

Google "We Have No Moat, And Neither Does OpenAI"

Leaked Internal Google Document Claims Open Source AI Will Outcompete Google and OpenAI. [SemiAnalysis]

Scientists Use GPT AI to Passively Read People's Thoughts in Breakthrough

An AI model similar to ChatGPT was combined with fMRI readings to non-invasively decode continuous language from subjects, a new study reports. [Vice]

Google Promised to Defund Climate Lies, but the Ads Keep Coming

Google said in 2021 that it would stop running ads alongside videos and other content that denied the existence and causes of climate change. [New York Times]

IBM to Pause Hiring for Jobs That AI Could Do

International Business Machines Corp. Chief Executive Officer Arvind Krishna said the company expects to pause hiring for roles it thinks could be replaced with artificial intelligence in the coming years. [Bloomberg]

Public Money, Public Code

A campaign for releasing publicly financed software as Free Software. [Public Money, Public Code]

Will a Chatbot Write the Next ‘Succession’?

As labor contract negotiations heat up in Hollywood, unions representing writers and actors seek limits on artificial intelligence. [New York Times]

FBI seizes 9 crypto exchanges used to launder ransomware payments

The FBI and Ukrainian police have seized nine cryptocurrency exchange websites that facilitated money laundering for scammers and cybercriminals, including ransomware actors. [Bleeping Computer]

288 dark web vendors arrested in major marketplace seizure | Europol

This operation, codenamed SpecTor, was composed of a series of separate complementary actions in Austria, France, Germany, the Netherlands, Poland, Brazil, the United Kingdom, the United States, and Switzerland. [EuroPol]

Apple, Google partner on an industry specification to address unwanted tracking

Today Apple and Google jointly submitted a proposed industry specification to help address the misuse of Bluetooth location-tracking devices. [Apple]

On-by-default Edge feature seems to be sending all the URLs you visit to Bing

It seems to be a bug introduced in Edge version 112, released earlier in April. [ArsTechnica]

TikTok Tracked Users Who Watched Gay Content, Prompting Employee Complaints

The company logged categories of content and users on the app in effort to boost engagement. [Wall Street Journal]

Anti-Trans Doctor Group Leaks 10,000 Confidential Files

A Google Drive left public on the American College of Pediatricians’ website exposed detailed financial records, sensitive member details, and more. [Wired]

Four Proud Boys Convicted of Sedition in Key Jan. 6 Case

The verdict was a blow against the far-right group and another milestone in the Justice Department’s prosecution of the pro-Trump rioters who stormed the Capitol. [New York Times]

Discreetly, Berlin Confronts Russian Spies Hiding in Plain Sight

For years, Germany seemed to tolerate even flagrant Russian operations on its soil. But a new Cold War-like chill has now made the snooping difficult to ignore. [New York Times]

America’s Spies Are Losing Their Edge

New technologies and a lack of patriotism in Silicon Valley are leveling the playing field for Russia and China. [Bloomberg]

Apple is a Chinese company

The world’s most valuable company makes great products, but it may turn out that the biggest driver of its share price has been the close relationship CEO Tim Cook has cultivated with China. [Financial Times] [Non paywall version on Archive]

Ukraine downs Russian hypersonic missile with US Patriot

Ukraine’s air force claims to have downed a Russian hypersonic missile over Kyiv using newly acquired American Patriot defense systems, the first known time the country has been able to intercept one of Moscow’s most modern missiles. [AP]

A Brutal Sex Trade Built for American Soldiers

It’s a long-buried part of South Korean history: women compelled by force, trickery or desperation into prostitution, with the complicity of their own leaders. [New York Times]

AI Chatbots Have BeenUsed to Create Dozens of News Content Farms

A new report documents 49 new websites populated by AI tools like ChatGPT and posing as news outlets. [Bloomberg]

Outrage simmers in New York after the killing of Jordan Neely on a subway train

The attack on Monday has been called a semi-sanctioned vigilante response to homelessness and the mental health crisis. [The Guardian]

China Takes the Yuan Global in Bid to Repel a Weaponized Dollar

A string of new deals promote the Chinese currency as geopolitical risk spills into international finance. [Bloomberg]

Bricking Incident - Orqa Blog

Ransomware was programmed to ‘explode’ in a way to cause maximum crisis: it was timed so it activates on a spring Saturday, during a long weekend, when most of you should be flying, and most of our engineering team should be enjoying their well-deserved days off. Supposedly, this would put the Company in the panic mode, and give the perpetrator a sufficient leverage to extort his ransom. [Orqa]

Jeffrey Epstein Documents, Part 2: Dinners With Lawrence Summers and Movie Screenings With Woody Allen

Schedules and emails show deeper relationships between the disgraced financier and a range of prominent people, including the former Treasury Secretary and the filmmaker. [Wall Street Journal]

War, Weapons and Conspiracy Theories: Inside Airman Teixeira’s Online World

A review of more than 9,500 messages obtained by The New York Times offers important clues about the mind-set of a young airman implicated in a vast leak of government secrets. [New York Times]

Google engineer jumps to death in NYC, second worker suicide in months

A senior software engineer at Google jumped to his death from the search giant’s headquarters in Chelsea late Thursday, according to authorities and police sources. [NYPost]

Justice Department’s Civil Rights Division Joins Officials from CFPB, EEOC and FTC Pledging to Confront Bias and Discrimination in Artificial Intelligence

The Justice Department’s Civil Rights Division and officials from the Consumer Financial Protection Bureau (CFPB), the Equal Employment Opportunity Commission (EEOC) and the Federal Trade Commission (FTC) jointly pledged today to uphold America’s commitment to the core principles of fairness, equality and justice as emerging automated systems, including those sometimes marketed as “artificial intelligence” or “AI,” become increasingly common in our daily lives – impacting civil rights, fair competition, consumer protection and equal opportunity. [DoJ]

UK set to legislate to create new regulator to tackle Big Tech

Draft bill expected within days that will put CMA’s digital markets unit on a statutory footing. [Financial Times] [Non paywall archive]

Stability AI launches StableLM, an open source ChatGPT alternative

StableLM's 3B and 7B models are available now on GitHub under CC 4.0 license. [Ars Technica]

A Cambridge Analytica-style scandal for AI is coming

Can you imagine a car company putting a new vehicle on the market without built-in safety features? [MIT Technology Review]

Republicans respond to Biden reelection announcement with AI-generated attack ad

Republicans deepfake their Biden response. [The Verge]

The Dark Forest and the Cozy Web

An illustrated diagram exposing the inner layers of the dark and cozy web. [Maggie Appleton]

Tesla Again Paints A Very Misleading Story With Their Crash Data

Tesla's crash data seem amazing, but the reality is very different and many have been misled by the numbers. In actuality, there's no strong case that Teslas are much safer with Autopilot on. [Forbes]

BlueSky Reply-Based Social Graph

Analyze Bluseky users with this neat social network graph. [Jaz on Bluesky]

Missing Links: A comparison of search censorship in China - The Citizen Lab

We discovered over 60,000 unique censorship rules used to partially or totally censor search results across eight China-accessible search platforms analyzed. These findings call into question the ability of non-Chinese technology companies to better resist censorship demands than their Chinese counterparts. [Citizen Lab]

Wagner mercenary admits ‘tossing grenades’ at injured Ukrainian PoWs 

Former convict tells of torturing troops and says he does ‘not regret a single thing’. [The Guardian]

The Mystery of a Former CIA Legend Going ‘Foreign Agent’ for Ukraine

Bob Baer, a former CIA agent whose memoir inspired an award-winning movie starring George Clooney, registered as a foreign agent for Ukraine in March. Then things got weird. [The Daily Beast]

Buildup resumed at suspected Chinese military site in UAE, leak says

The activity has disturbed some U.S. officials, who worry a longstanding U.S. ally is growing too close to Beijing. [Washington Post]

Digital Security Tips to Prevent the Cops From Ruining Your Trip Abroad

Traveling with a phone and laptop? Here are digital security tips to keep your devices and your data safe from the cops. [The Intercept]

Mandiant: Teenagers among 'most prevalent threat actors'

Plus they are cliquey as all hell. [The Register]

Many Public Salesforce Sites are Leaking Private Data

A shocking number of organizations -- including banks and healthcare providers -- are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. [Krebs on Security]

Montana Governor Signs Law Banning Transgender Care for Minors

Gov. Greg Gianforte had been urged by his son, who is nonbinary, to reject the bill. A transgender lawmaker was barred from the House floor after the debate. [NYTimes]

Fox News Parts Ways With Tucker Carlson

Mr. Carlson has been one of the network’s top-rated hosts for many years. [NYTimes] [Axios]

Clarence Thomas’s Billionaire Friend Did Have Business Before the Supreme Court

Justice Clarence Thomas said he was advised he didn’t have to disclose private jet flights and luxury vacations paid for by billionaire Harlan Crow because, although a close friend, Crow “did not have business before the court.” [Bloomberg]

‘There are no people here’: S.F.’s $2.2 billion transit center remains an empty cavern

San Francisco's empty $2.2 billion Salesforce transit center is a microcosm of the city's fading downtown, which is having the slowest recovery among U.S. cities. [SF Chronicle]

Fox Fired ‘Uncontrollable’ Host Tucker Carlson, Who Badmouthed Bosses

Fox News, in announcing Monday that it’s parted ways with Tucker Carlson, is losing a host who brought in millions of viewers but proved too much to handle even for corporate chiefs Rupert and Lachlan Murdoch. [Bloomberg]

Magic publishers sent Pinkerton agents to a YouTuber’s house to retrieve leaked cards

March of the Machine: The Aftermath isn’t due out in stores until May. [Polygon]

Law firm head bought Gorsuch-owned property

The Supreme Court justice did not report the identity of the purchaser, whose firm has had numerous cases before the court. [Politco]

BAT to Pay $635 Million in DOJ Deal for North Korea Activities

Cigarette maker British American Tobacco plc agreed to pay $635.2 million to US authorities to resolve investigations into sanctions violations for selling products in North Korea and misleading banks about the source of those sales. [Bloomberg]

Disney sues Florida Gov. Ron DeSantis, alleges political effort to hurt its business

Walt Disney Co. sued Florida Gov. Ron DeSantis on Wednesday, alleging the Republican governor has waged a "relentless campaign to weaponize government power" over the company. [CNBC]

Fed Seeks Broad Changes to Bank Rules in Aftermath of SVB Failure

The Federal Reserve’s bank-supervision chief called for an extensive reevaluation of how the institution oversees US financial firms following the failure of Silicon Valley Bank, which he blamed on the company’s weak risk management and supervisory foot-dragging by the Fed. [Bloomberg]

Requiem for the Newsroom

Nobody’s going to make a movie about reporters at home with their cursors. [NYTimes]

Epstein’s Private Calendar Reveals Prominent Names, Including CIA Chief, Goldman’s Top Lawyer

Schedules and emails detail meetings in the years after he was a convicted sex offender; visitors cite his wealth and connections. [WSJ]

President Joe Biden issues executive order against spyware

Last week, the White House issued an executive order prohibiting commercial spyware. [White House] Additionally, the governments of Australia, Canada, Costa Rica, Denmark, France, New Zealand, Norway, Sweden, Switzerland, the United Kingdom, and the United States issued a joint statement on their efforts to counter the proliferation of commercial spyware. [White House]

At least 50 U.S. government personnel targeted with phone spyware overseas

The revelation comes as the White House bans federal agencies from using spyware that poses national security and human rights risks. [Washington Post]

Spyware vendors use 0-days and n-days against popular platforms

Google’s Threat Analysis Group (TAG) tracks more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government backed actors. [Google]

New industry principles to curb cyber mercenaries

The Cybersecurity Tech Accord, with support from other industry players, released a new set of principles to guide the technology industry to help curb the dangerous and rapidly growing market of “cyber mercenaries.” [Cybersecurity Tech Accord]

Amnesty International uncovers new hacking campaign linked to mercenary spyware company

The attack targeted Android operating system. As a result of the discovery, Google were able to release security updates protecting billions of Android, Chrome and Linux users from the exploit. [Amnesty International]

North Korean group uses cybercrime to fund espionage operations

APT43 is a prolific threat actor operating on behalf of the North Korean regime. [Mandiant]

A Q&A with the hacktivists rocking Latin America: Guacamaya

Recorded Future News spoke to hacktivist collective Guacamaya to better understand what it hopes to accomplish and the role they see for themselves going forward. [The Record]

Android app from China executed 0-day exploit on millions of devices

Fast-growing e-commerce app Pinduoduo had an EvilParcel stow-away. [ArsTechnica]

Secret trove offers rare look into Russian cyberwar ambitions

More than 5,000 pages of documents from a Moscow-based contractor offer a glimpse into planning and training that would allow Russia’s intelligence agencies and hacking groups to find vulnerabilities, coordinate attacks and control online activity. [Washington Post]

Attackers have better things to do than corrupt your builds

This posts clarifies the clucking and clamoring over attackers exploiting vulns or corrupting build pipelines (spoiler alert: it isn’t worth their time and effort to). [Kelly Shortridge]

Pro-Russian hackers target elected U.S. officials supporting Ukraine

Group tracked since 2021 exploits unpatched Zimbra servers to hack email accounts. [ArsTechnica]

Ukraine war shows difficulty of large-scale cyberattacks, NSA director says

Gen. Paul Nakasone, in an interview, says U.S. rivals are trying to penetrate America’s networks, data and weapons systems. [Wall Street Journal]

Twitter says parts of its source code were leaked online

The leak adds to the challenges facing the Elon Musk-owned company, which is trying to unmask the person responsible and any other people who downloaded the code. [New York Times]

The case to pause giant AI experiments

Future of Life Institute has released an open letter arguing for all AI labs to immediately pause the training of AI systems more powerful than GPT-4 for the duration of at least six months. [Future of Life Institute]

What we still don’t know about how AI is trained

GPT-4 is a powerful, seismic technology that has the capacity both to enhance our lives and diminish them. [New Yorker]

The prospect of an AI winter

Arguments that AI that systems (1) are too unreliable and too inscrutable, (2) won’t get that much better (mostly due to hardware limitations) and/or (3) won’t be that profitable. [Erich Grunewald]

Apple illegally fired five labor activists, union says

The workers, who were disciplined and fired for attendance-related issues, believe they were let go because of their union organizing. [Washington Post]

The open letter on AI doesn't go far enough

One of the earliest researchers to analyze the prospect of powerful Artificial Intelligence warns of a bleak scenario. [Time]

OpenAI faces complaint to FTC that seeks investigation and suspension of ChatGPT releases

The Center for AI and Digital Policy accuses OpenAI of violating a part of the FTC Act that prohibits unfair and deceptive business practices. [CNBC]

A conversation on AI trust and safety

From an event held by Aspen Institute. [Benjamin Wittes]

Search has its Goliath. Could Richard Socher be its David?

Richard Socher, 38-year-old co-founder and CEO of search engine You.com, talks about the AI-powered search app. [The Information]

Twitter open sources their recommendation algorithm

Twitter aims to offer users greater transparency into the process through which the platform selects and organizes content for display on their timelines. [Shaped]

Afraid of AI? The startups selling it want you to be

ChatGPT and other new AI services benefit from a science fiction-infused marketing frenzy unlike anything in recent memory. There's more to fear here than killer robots. [LA Times]

Loudmouth DJI drones tell everyone where you are

Back when commercial quadcopters started appearing in the news on the regular, public safety was a talking point. How, for example, do we keep them away from airports? [Hackaday]

NYPD is refusing to comply with NYC's new surveillance tech laws

NYPD filed vague reports about surveillance tech and rejected recommendations on how to better comply with the law, according to a report. [Daily Dot]

The dirty secrets of a smear campaign

Rumors destroyed Hazim Nada’s company. Then hackers handed him terabytes of files exposing a covert campaign against him—and the culprit wasn’t a rival but an entire country. [New Yorker]

Some thoughts on the current state of AI from a disinformation research perspective

What I am concerned about in the present and near future regarding technologies like ChatGPT and Stable Diffusion. [Conspirator0]

Anti-Taiwan influence operation shows shift in tactics

Inauthentic assets amplified content to more than 1,300 Facebook groups, with the apparent goal of dividing Taiwanese society and undermining its democracy. [DFR Lab]

A 4chan anti-trans hoax about "Trans Day of Vengeance" spread from Twitter to various right-wing figures, including Tucker Carlson

Carlson reiterated the hoax for his audience as evidence that trans people are becoming “more aggressive.” [Media Matters]

How a major toy company kept 4chan online

Documents obtained by WIRED confirm that Good Smile, which licenses toy production for Disney, was an investor in the controversial image board. [Wired]

What’s more provocative than sincerity?

Ryder Ripps built a career as a digital art troll, and now he’s calling out his former boss Kanye West and Bored Ape Yacht Club for bigotry. Is his crusade real? [New York Times]

$335,000 pay for ‘AI whisperer’ jobs appears in red-hot market

The fast-growing apps have created a seller’s market for anyone —even liberal arts grads — capable of manipulating its output. [Bloomberg]

Jack Ma’s retreat undercuts China’s pitch to private business

Even as leaders voiced “unwavering support” for the private sector, one of the country’s best-known entrepreneurs chose to spend months overseas. [Bloomberg]

Five arrested in migration center fire that left 39 dead in Mexico

The authorities said arrest warrants had been obtained for three government migration officials, two private security workers and a migrant accused of starting the blaze. [New York Times]

ChatGPT chatbot banned in Italy

The country's data-protection regulator has serious privacy concerns over the technology. [BBC]

Wall Street Journal reporter arrested in Russia on spying charges

Russian authorities have detained an American reporter for the Wall Street Journal and accused him of spying. [CNN]

This week’s issue of hatemail must begin with our deepest appreciation of Kelly Lum (also known as aloria). Kelly passed away this last week, leaving the cybersecurity community and New York City hacker scene in fond memory of her humor, her leadership, and undeniable style. She was 41. [Techcrunch] [DarkReading]

Effective Altruism Is Pushing a Dangerous Brand of ‘AI Safety’

This philosophy—supported by tech figures like Sam Bankman-Fried—fuels the AI research agenda, creating a harmful system in the name of saving humanity. [Wired]

Chatbots, deepfakes, and voice clones: AI deception for sale

You may have heard of simulation theory, the notion that nothing is real and we’re all part of a giant computer program. [FTC]

The secret history of Elon Musk, Sam Altman, and OpenAI | Semafor

In 2018, Musk wanted to take charge of OpenAI to beat Google but others opposed the move, putting Altman at the helm. [Semaphor]

Twitter Says Parts of Its Source Code Were Leaked Online

The leak adds to the challenges facing the Elon Musk-owned company, which is trying to unmask the person responsible and any other people who downloaded the code. [New York Times]

Free data-center heat is allegedly saving a struggling public pool $24K a year

A public pool in the UK is expected to save £20,000 and cut carbon emissions by 25.8 tons annually by warming a 25 m and children's pool with waste heat from a data center from startup Deep Green. [ArsTechnica]

A Cult That Worships Superintelligent AI Is Looking For Big Tech Donors

Amidst the hype over ChatGPT, artists are forming religious movements to worship our future machine overlords—and change them for the better. [Vice]

2022 Zero-Day Exploitation Continues at an Elevated Pace

In this post Mandiant shares insights from their analysis of 2022 zero-day exploitation. [Manditant]

Meta Manager Was Hacked With Spyware and Wiretapped in Greece

Artemis Seaford, a dual U.S.-Greek national, was targeted with a cyberespionage tool while also under a wiretap by the Greek spy agency in a case that shows the spread of illicit snooping in Europe. [New York Times]

Google Suspends Chinese E-Commerce App Pinduoduo Over Malware

Google says it has suspended the app for the Chinese e-commerce giant Pinduoduo after malware was found in versions of the app. [Krebs on Security]

Export Control is Not a Magic Bullet for Cyber Mercenaries

The U.S. and the EU need to do more to limit the damage to their intelligence and law enforcement capabilities caused by cyber mercenaries. [Lawfare]

The Cold War With China Is Changing Everything

Both sides are spending lots of money on technological elites. [New York Times]

The FBI raided a notable journalist's home. Rolling Stone didn't tell readers why

The FBI had raided the home of a renowned journalist at the top of his game months earlier, and he had disappeared from public view. [NPR]

OnlyFans model known for her long tongue sues ex $6.3B for alleged revenge porn

Mikayla Saravia is suing Nicholas Hunter for $6.3 billion for allegedly taking control of her social media accounts and sharing explicit content without her consent. [NY Post]

Rep. Jim Jordan Issues Sweeping Information Requests to Universities Researching Disinformation

In the letters, Jordan asserted that the schools may have contributed to the Biden administration’s “censorship regime by advising on so-called misinformation.” [ProPublica]

U.S. Tells China's ByteDance to Sell TikTok or Face a Ban

The Committee on Foreign Investment in the U.S. demanded that TikTok's Chinese owners divest their stakes in the company. TikTok pushed back. [Gizmodo] [Reuters]

TikTok Sale Likely to Be Rejected by China

The Chinese government is likely to oppose any attempt by the Biden administration to force TikTok’s Chinese shareholders to sell their stakes in the hugely popular app, said China-based lawyers and investors, setting the stage for a protracted standoff between Beijing and Washington. [The Information]

Justice Dept. Investigating TikTok’s Owner Over Possible Spying on Journalists

The inquiry appears to be tied to an admission by the app’s owner, ByteDance, that employees had inappropriately obtained Americans’ data. The company said it had fired the workers involved. [New York Times]

PDF Download: Australian Parliament Report on TikTok

The Australian Parliament just published the most comprehensive exploration yet of the CCP’s ties to TikTok. The 113-page doc details the CCP’s controls and its surveillance and propaganda aims, which contradict TikTok’s public statements. [Australian Parliament]

Why Does the Global Spyware Industry Continue to Thrive? Trends, Explanations, and Responses

The global spyware and digital forensics industry continues to grow despite public backlash following an array of surveillance scandals, many linked to NSO Group’s Pegasus program. This paper explores the resilience of the commercial spyware market and offers ideas about how to limit the spread of invasive cyber surveillance tools. It highlights several factors driving the industry, including elevated demand for intrusion technology from government clients and private customers, as well as inconsistent political will from democratic governments to crack down on these technologies. [Carnegie Endowment]

Global Inventory of Commercial Spyware & Digital Forensics

Global inventory of commercial spyware & digital forensics technology procured by governments. Focuses on three overarching questions: Which governments show evidence of procuring and using commercial spyware? Which commercial firms are selling targeted surveillance technology and what are their countries of origin? What types of activities are government agencies using the technology for? [Mendeley]

Mexico to investigate alleged human rights abuses by military after spying claims

Move follows reports alleging that the army used Pegasus spyware software to hack the phone of a prominent rights activist. [The Guardian]

Zuckerberg Was Warned on Social Media Addiction, Filing Says

Employees at Meta Platforms Inc. and ByteDance Inc. were aware of the harmful effects of their platforms on young children and teenagers but disregarded the information or in some cases sought to undermine it, according to claims in a court filing. [Bloomberg]

Microsoft lays off entire AI ethics team while going all out on ChatGPT

This month saw the surprise dissolution of Microsoft’s entire Ethics & Society team—the latest casualty in the company’s ongoing layoffs affecting 10,000 employees, or roughly 5 percent of its entire global workforce. Once a 30-member department, the Ethics & Society team had been reduced to just seven people in October 2022 following an internal reorganization. [Popular Science] [The Verge]

How AI could write our laws

ChatGPT and other AIs could supercharge the influence of lobbyists—but only if we let them. [MIT Technology Review]

GitHub on Twitter: ”Looking to improve your accessibility skills?”

Here are some simple steps that all developers can take to automatically increase accessibility. [GitHub on Twitter]

2.3% of workers have pasted confidential company data into ChatGPT

The average company leaks confidential material to ChatGPT hundreds of times per week. ChatGPT is incorporating that material into its publicly available knowledge base and sharing it. [Cyberhaven]

Why leading researchers fear AI will wreak even more havoc than social media

Artificial intelligence could warp the economy and supercharge everything from financial scams to government surveillance, according to tech experts. [Business Insider]

Battle for Libraries

Don’t let libraries die. As the future goes digital, major publishers are suing to cut off libraries’ defense of digital books from censorship. It’s time to fight back. [Battle for Libraries]

Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems

In this paper, we seek to align overlapping, AI-adjacent communities on a consistent and comprehensive assurance terminology crucial for the safe deployment of AI-based systems. We then propose a novel end-to-end AI risk framework that integrates the concept of an Operational Design Domains (ODD). We believe that by defining a more concrete operational envelope, developers and auditors can better assess potential risks and required safety mitigations for AI-based systems. [Heidy Khlaaf / Trail of Bits]

Dark Web ‘BreachForums’ Operator Charged With Computer Crime

Federal agents have arrested a Peekskill, New York, man they say ran the notorious dark web data-breach site “BreachForums” under the name “Pompompurin.” [Bloomberg]

Two U.S. Men Charged in 2022 Hacking of DEA Portal

Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. [Krebs on Security]

This Is the New Leader of Russia's Infamous Sandworm Hacking Unit

Evgenii Serebriakov now runs the most aggressive hacking team of Russia's GRU military intelligence agency. Thanks to a botched 2018 operation, he's already well-known to Western intelligence. [Wired]

Uncovering a Wave of Global Espionage

SentinelLabs uncover a previously unknown set of espionage campaigns conducted by Winter Vivern advanced persistent threat (APT) group. [Winter Vivern / SentinelOne]

The Paradox of Digital Infections: Unraveling the Philosophical Implications of Computer Viruses

In the realm of computer science, computer viruses are perhaps the most feared and misunderstood entities. They infiltrate systems, steal information, and wreak havoc on the digital world. Simultaneously, philosophy seeks to understand the world, uncovering truth and wisdom to navigate the complexity of human experience. At first glance, it might seem that these two disciplines have little in common. However, a closer examination reveals that computer viruses and philosophy share a deep connection, as they both challenge our understanding of ethics, autonomy, and the nature of existence. [16-bit Wisdom]

Reporting On Sexual Violence In Conflict

Reporting on sexual violence in places divided by conflict? And concerned about making things worse for your interviewees? Here is some practical advice you will want to read. [Covering CRSV]

Best Practices for Journalists Covering Conflict-Related Sexual Violence

At a recent GIJN webinar, journalist and experts discussed best practices for investigating sexual violence in conflict zones. [GIJN]

Latest ABS data shows 22% of women have been exposed to sexual violence

About 42% of men reported experiencing physical violence since the age of 15, report finds. [The Guardian]

In Bulgaria, Russian Trolls Are Winning the Information War

Pro-Russia groups are gaming Facebook’s review process, and moderators are stuck in the middle. [Wired]

Pro-Moscow voices tried to steer Ohio train disaster debate

Soon after a train derailed and spilled toxic chemicals in Ohio last month, anonymous pro-Russian accounts started spreading misleading claims and anti-American propaganda about it on Twitter, using Elon Musk's new verification system to expand their reach while creating the illusion of credibility. [AP]

How a Montenegrin Gang Used Open-Source Intelligence to Kill - OCCRP

Hitmen working for a criminal group active in Montenegro and Serbia used open-source intelligence techniques, poring over apartment listing sites, satellite images, and tourist photos posted online. [OCCRP]

Dr. Jen Golbeck on Twitter

In my monitoring-the-MAGAs project, I'm keeping an eye on their plans ahead of Trump's arrest on Tuesday . So far, they are disorganized, ranting, conspiratorial, and not planning a thing. I'll keep this thread updated with anything interesting that I spot. [@jengolback on Twitter]

China exerts control over internet cable projects in South China Sea

Beijing imposes strict permit requirements for access to underwater data infrastructure over spying fears. [Financial Times] [Non paywall copy on Archive]

Activist killed in ‘Cop City’ protest had hands in the air when shot, family say

Manuel Paez Terán’s family release results of independent autopsy after protester fatally shot by Georgia law enforcement. [The Guardian]

This week we feature Telegram, the popular messaging and social media app. Since its inception, the company has had a lax approach to content moderation, allowing hate groups like the TERRORGRAM network to thrive on the platform. Telegram has its own internet AS infrastructure, found at AS62041 and powered by the GlobalNet internet backbone.

Gigi Sohn withdrew her FCC commissioner nomination

Gigi Sohn is withdrawing her nomination for FCC commissioner, blasting industry opposition and saying in a statement the continued 2-2 deadlock at the FCC will mean higher broadband prices and lax data protection policies. [Brian Fung (@b_fung) on Twitter]

The Decline of Net Neutrality Activism

Net Neutrality is less of a hot-button topic than it was, presumably because of a deadlocked FCC that couldn’t pass anything. [Neel Chauhan’s blog]

Content Moderation & Fraud Detection - Patterns in Industry

Collecting ground truth, data augmentation, cascading heuristics and models, and more. [Eugene Yan’s blog]

Planned Obsolescence

Eliminate the labor involved – a DJ, for example – and you will eventually eliminate the spaces for which those jobs were created. [Dada Durmmer’s blog]

A Guide to Investigating the Datafied State Through Documents

If we want to study power, and the tactics and practices of elites and others who hold it — in other words, if we want to study “up” — perhaps a good place to start is in the archives. [Data & Society]

How Teens Recovered From the ‘TikTok Tics’

A wave of teenagers who developed tics during the pandemic has receded, illustrating the powerful influence of stress on the body and the resilience of adolescents. [New York Times]

Review: "Screen Damage: The Dangers of Digital Media for Children"

A French neuroscientist shows that screens and kids shouldn’t mix. [City Journal]

curl 25 years online celebration

curl turns 25 years old and what better way to celebrate this than to join fellow curl friends, developers and fans online on the exact birthday? [daniel.haxx.se]

Standing firm against threats to private and safe communication

A message from Signal executive Meredith Whitaker on the threat of the United Kingdom’s online safety bill. [Signal]

The Daring Ruse That Exposed China’s Campaign to Steal American Secrets

How the downfall of one intelligence agent revealed the astonishing depth of Chinese industrial espionage. [New York Times]

GranittHQ/data-predator-victims

Granitt is compiling a database of victims of Intellexa's Predator spyware, based on reporting by Citizen Lab, Documento, and others. [Granitt on GitHub]

North Korean hackers target security researchers with a new backdoor

Campaign uses carefully crafted LinkedIn accounts that mimic legit people. [ArsTechnica]

Biden admin’s cloud security problem: ‘It could take down the internet like a stack of dominos’

The Biden administration is embarking on the nation’s first comprehensive plan to regulate the security practices of cloud providers. [Politico]

Tennessee becomes the first state to pass a ban on public drag shows

Tennessee Gov. Bill Lee has signed a bill banning drag shows in public spaces, a measure that will likely force drag shows underground in Tennessee. Other states across the country are proposing similar legislation. [NPR]

the emails - 2600 pages of hate

a collection of emails from 2019-2021 between dozens of anti-trans expert witnesses, US right-wing lawmakers and conservative legal groups. [maia’s blog]

Inside the secret working group that helped push anti-trans laws across the country

Leaked emails give a glimpse of the religious-right networks behind transgender healthcare bans. [Mother Jones]

Twitter just let its privacy- and security-protecting Tor service expire

Just shy of its one-year anniversary. [The Verge]

The FBI Just Admitted It Bought US Location Data

Rather than obtaining a warrant, the bureau purchased sensitive data—a controversial practice that privacy advocates say is deeply problematic. [Wired]

Recognising Sexual and Gender-Based Violence as an Open Source Researcher

Bellingcat examines strategies to approach sexual and gender-based violence content in open source research and investigations. [Bellingcat]

U.S. Special Forces Want to Use Deepfakes for Psy-ops

The U.S. government spent years warning deepfakes could destabilize democratic societies. [The Intercept]

Disinformation Wars: China, Russia Cooperating On Propaganda More Than Ever, Says Report

A report from the German Marshall Fund highlights the growing closeness between Chinese and Russian state actors in the information space that has been accelerated by the war in Ukraine. [Radio Free Europe]

DHS has a program gathering domestic intelligence — and virtually no one knows about it

Collecting information from Americans raises ongoing civil liberties concerns. [Politico]

Let's See What Henry Kissinger Thinks About ChatGPT, Shall We?

The 99-year-old Cold War architect believes ChatGPT and other AI could reshape human consciousness and threaten Democracy itself. [Gizmodo]

ODNI Releases 2023 Annual Threat Assessment of the U.S. Intelligence Community

The annual report is submitted to Congress every year. [ODNI]

When Negotiations Go Wrong: The ISIS Hostages | ENDEVR Documentary

The abductions of John Cantlie and James Foley were the beginning of a hostage taking frenzy which impacted the foreign policy of many countries. [ENDEVR on YouTube]

US government moves to stop potential banking crisis

The U.S. government took extraordinary steps Sunday to stop a potential banking crisis after the historic failure of Silicon Valley Bank, assuring all depositors at the failed institution that they could access all their money quickly, even as another major bank was shut down. [AP]

Saudi Arabia, Iran Restore Relations in Deal Brokered by China

Iran and Saudi Arabia agreed to re-establish diplomatic relations in a deal brokered by China, ending seven years of estrangement and jolting the geopolitics of the Middle East. [Wall Street Journal]

This week’s Who Hosts Hate? is LiquidWeb, an American web hosting provider owned by the private equity group Madison Dearborn Partners. Anti-transgender websites like lgballiance[.]org[.]uk rely on LiquidWeb’s hosting services. LGB Alliance’s most recent IP resolutions on IPInfo: https://ipinfo.io/67.225.255.222

FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising

The Federal Trade Commission has issued a proposed order banning online counseling service BetterHelp, Inc. [FTC]

The Spooky, Loosely Regulated World of Online Therapy

Like many of the businesses offering therapy online, the service promotes itself as a seamless way to access mental health services. [Jezebel]

Data & Society's Jenna Burrell thinks we're worrying about the wrong things about chatbots | Semafor

Jenna Burrell wants us to stop attributing human-like qualities to chatbots and think of them as tools — with strength, weakness and limitations. [Semaphor]

Airbnb Is Banning People Who Are ‘Closely Associated’ With Already-Banned Users

As a safety precaution, the tech company sometimes bans users because the company has discovered that they “are likely to travel” with another person who has already been banned. [VICE]

Dirt: The future of search

TikTok vs. chatbots. [Dirt]

A Native Son of Palo Alto Thinks His Hometown Will Kill Us All

Author Malcolm Harris argues that the economic and technological ills of society can all be traced back to one city in the heart of Silicon Valley. [Wired]

The inside story of how ChatGPT was built from the people who made it

Exclusive conversations that take us behind the scenes of a cultural phenomenon. [MIT Technology Review]

Top Kickboxers Advertised Encrypted Phones Used by Organized Crime

Dutch police hacked and shutdown Exclu, a phone network used by alleged criminals. A promotional video shows professional fighters promoting the phones. [VICE]

Keep your AI claims in check

The FTC warns tech companies not to overstate their use of AI to consumers. [FTC]

Data Brokers and the Sale of Americans’ Mental Health Data

This report finds that the industry appears to lack a set of best practices for handling individuals’ mental health data, particularly in the areas of privacy and buyer vetting. It finds that there are data brokers which advertise and are willing and able to sell data concerning Americans’ highly sensitive mental health information. [Duke University]

The Camera Shy Hoodie — Mac Pierce

A DIY wearable for avoiding recognition on IR security cameras. [Mac Pierce]

DensePose from WiFi

“Using wifi signals to detect human movement/behavior. Imaging like a radar. No need to install a camera in the building to see what's going on inside.” – @lukolejnik [DensePose paper by CMU researchers]

Secret Service and ICE break the law with fake phone towers

Investigations 'at risk' from sloppy surveillance uncovered by audit probe. [The Register]

BitTorrent Seedbox Provider Handed Criminal Conviction Over Users' Piracy * TorrentFreak

A man who rented out servers configured for BitTorrent file-sharing use has been handed a three-month suspended sentence in Denmark. [TorrentFreak]

Artemis vulnerability scanner is now open source

Artemis is a tool developed by the CERT Polska team and initiated by the KN Cyber science club of Warsaw University of Technology. The tool is built to find website misconfigurations and vulnerabilities on a large scale. [CERT PL]

Apple’s iPhone Passcode Problem: Thieves Can Ruin Your Entire Digital Life in Minutes | WSJ

iPhone thieves across the country are locking people out of their Apple and iCloud accounts and gaining access to Apple Pay and bank apps, draining them of thousands of dollars—sometimes before victims even know what happened. [WSJ on YouTube]

Conservative News Corp. empire says hackers were inside its network for 2 years

News Corp. disclosed the breach last year. Now, company says it lasted 23 months. [ArsTechnica]

Russian State Hackers Use Britney Spears Instagram Posts to Control Malware

A cyber-espionage group known as Turla — believed to be the cyber-arm of Russian intelligence — has been playing around with a backdoor trojan disguised as a Firefox extension that uses comments on Britney Spears Instagram photos to store the location of its command and control (C&C) server. [BleepingComputer]

Hackers Breach U.S. Marshals System With Sensitive Personal Data

The compromised computer system includes information on both investigative targets and agency employees. [NYTimes]

Gamers are fixing a video game ‘taken over’ by hackers

Hackers are targeting Activision's first person shooter Black Ops III exploiting significant vulnerabilities. These two gamers are fighting back. [TechCrunch]

Barricaded Siblings Turn to TikTok While Defying Court Order to Return to Father They Say Abused Them

A judge concluded the children were victims of “parental alienation,” which continues to influence family courts despite being rejected by mainstream scientific groups, and authorized police to use “reasonable force” to remove them from their mother. [ProPublica]

Take It Down

This service is one step you can take to help remove online nude, partially nude, or sexually explicit photos and videos taken before you were 18. Developed by NCMEC, it has some serious backing from tech companies like Meta. [NCMEC]

Stop Non-Consensual Intimate Image Abuse | StopNCII.org

StopNCII.org is operated by the Revenge Porn Helpline which is part of SWGfL, a charity that believes that all should benefit from technology, free from harm. [StopNCII]

Event: The Rights of Sex Workers in the Digital Age

March 9, 2023. Panelists Sinnamon Love (BIPOC-AIC), N'Jaila Rhee (NJRUA), Nosipho Vidima, and Beyonce Karungi. Discussion will showcase sex worker leadership from across the globe to discuss digital technologies, online spaces and rights questions pertaining to access for women. [EventBrite]

Networks of pro-Kremlin Telegram channels spread disinformation at a global scale

Three networks comprising fifty-six channels targeted Telegram users in twenty countries and ten languages. [DFRLab]

This week’s Who Hosts Hate? is LeaseWeb Netherlands B.V. LeaseWeb is a Dutch cloud services provider with datacenters located Europe, Asia, and North America. White nationalist sites like ironmarch[.]org rely on LeaseWeb’s hosting services; Iron March’s most recent IP resolutions on IPInfo: https://ipinfo.io/82.192.82.226, https://ipinfo.io/37.48.65.143.

This week marks the return of hatemail in its weekly newsletter format, after a year away. The hatemail newsletter is a collection of articles shared and discussed by members of cabal, a hacker collective fighting tech-enabled abuse. We typically follow a rollup format of articles, with some additional sections for interesting job postings and events. Sometimes (like this time) we take a moment to discuss a meta topic, or do some research exclusive to this newsletter. We also include a section at the end of the publication called “Who Hosts Hate?” which discloses network infrastructure utilized by hate sites.

If it’s your first time reading hatemail, welcome. And for the returning subscribers, welcome back! We hope you find some articles and topics that got past your radar.

SCOTUS “confused” after hearing arguments for weakening Section 230 immunity

During the first hearing on a major Section 230 case, SCOTUS sways Google’s way and says eroding Section 230 could crash the digital economy. [ArsTechnica]

Digital Power Report from the Transnational Institute

The think tank Transnational Institute’s 11th flagship State of Power report exposes the actors, the strategies and the implications of this digital power grab, and shares ideas on how movements might bring technology back under popular control. [TNI]

Justice Department Says Google Destroyed Evidence Related to Antitrust Lawsuit

The department alleges Google had a past practice of setting employee chats to auto-delete. [Wall Street Journal]

See No Evil: Loopholes in Google’s Data Safety Labels Keep Companies in the Clear and Consumers in the Dark

Mozilla’s latest research tested Google’s new data transparency system, its Play Store’s Data Safety Form, to see how well it helped people understand what personal information an app collects and shares. In 2021 alone, Google Play’s mobile apps generated $48 billion U.S. dollars in worldwide gross revenue. [Mozilla]

Signal CEO: We “1,000% won’t participate” in UK law to weaken encryption

The UK's Safety Online Bill would require Signal to police user messages. [ArsTechnica]

The Myth of Artificial Intelligence

This review of Henry Kissingers’s latest book ‘The Age of AI’ claims that the AI being promoted here advances a larger political and corporate agenda. [Prospect]

Suicides Spur Suits on Amazon Sales of Legal-But-Lethal Compound

Two court cases seek to hold Amazon accountable for chemicals sold on their site used for at-home suicide. [Bloomberg]

Revealed: the hacking and disinformation team meddling in elections

A company led by Tal Hanan boasts vast army of bots exposed by undercover reporters and leaked emails. [The Guardian]

Planting Undetectable Backdoors in Machine Learning Models

This research discusses how malicious users can plant undetectable backdoors into machine learning models, allowing them to manipulate the classification of any input with only a slight perturbation, without being detected. [IEEE]

Trove of L.A. Students’ Mental Health Records Posted to Dark Web After Cyber Hack

Los Angeles Unified School District was breached by the Vice Society ransomware group, who proceeded to leak students’ mental health records. After the article’s publication, LAUSD acknowledged the breach, stating “approximately 2,000” student psychological evaluations” were stolen and published. [The 74 Million]

Even hackers are reportedly getting laid off by organized crime groups

Cybercrime apparently doesn't pay what it used to, as cybersecurity tools and US investigators thwart some ransomware groups, according to the WSJ. [Business Insider]

View of Russia's Role in the Far-Right Truck Convoy

This paper attempts to answer some of those questions by providing a brief but targeted analysis of Russian involvement in the convoy through the lenses of overt state media coverage, state-affiliated proxy websites, and overlap between Russian propaganda and convoy content on social media. [The Journal of Intelligence, Conflict, and Warfare]

Conspiracy Theorists Are Coming for the 15-Minute City

A movement to promote neighborhoods with amenities within walking distance has enraged far-right activists, climate deniers, and extremists. [Wired]

China Cease-Fire Proposal for Ukraine Falls Flat With US, Allies

China called for a cease-fire between Russia and Ukraine in a position paper on ending the war that offered some reprieve to Moscow but was quickly dismissed by Kyiv’s allies as the conflict enters its second year. [Bloomberg]

Tourism in 'New Russia'

Traveling around modern Russia including Luhansk in Donbass. [Britannica Politica]

Anatomy of an online outrage mob

When right-wing influencer Libs Of TikTok tags educators, school districts and medical facilities on Twitter, her fans spam their accounts with harassment. [conspirator0 on Substack]

About 90% of drivers searched or arrested by the NYPD in 2022 were Black or Latino

New data shows almost as many NYPD car stops last year as there were pedestrian stops at the height of the stop-and-frisk era. [Gothamist]

Barricaded Siblings Turn to TikTok While Defying Court Order to Return to Father They Say Abused Them

A judge concluded the children were victims of “parental alienation,” which continues to influence family courts despite being rejected by mainstream scientific groups, and authorized police to use “reasonable force” to remove them from their mother. [ProPublica]

JPMorgan Clamps Down on Staff’s Use of AI-Powered ChatGPT

JPMorgan Chase & Co. has curbed its staff’s use of the ChatGPT chatbot, according to a person familiar with the matter. [Bloomberg]

Company hired same child twice to clean slaughterhouses, internal document shows

An internal company report shows Blackstone-owned Packers Sanitation Services Inc. disciplined an employee who hired the same “known minor” twice under two different identities.[NBC News]

He's Defended Cardi B and Migos. His Next Client Is Donald Trump

The #BillionDollarLawyerDrew Findling will defend the former president if he’s indicted. [Bloomerg]

4-day workweek trial: Shorter hours, happier employees

A trial of a four-day workweek in Britain, billed as the world's largest, has found that an overwhelming majority of the 61 companies that participated from June to December will keep going with the shorter hours and that most employees were less stressed and had better work-life balance. [AP News]

Amazon hiring Senior Antenna Engineer in Redmond, WA [LinkedIn]

Apple hiring SoC Design Verification Engineer in Seattle, WA [LinkedIn]

Draper hiring Junior Offensive Cyber Security Researcher in Cambridge, MA [LinkedIn]

MIT Lincoln Lab hiring Cyber Operations Researcher in Lexington, MA [MIT]

Starbucks hiring senior machine learning engineer in Seattle, WA [LinkedIn]

Today’s network provider is 1776 Solutions, LLC. The company operates AS397702, network infrastructure which includes the hate site KiwiFarms. Previously known as “Final Solutions,” the company is owned by Joshua Moon and is domiciled in Wyoming. The CIDR for this subnet is 103.114.191[.]0/24.

1. Project Owl - Open Source Intelligence Discord Server

You may be familiar with Discord as a casual chat platform for online communities. For Project Owl, they leverage Discord as a major hub of intelligence collected from tens of thousands of members around the world, with various different region expertise. Their coverage on the conflict in Ukraine has been spectacular, well-moderated, and is categorized between confirmed and speculative news as it breaks. 

Project Owl on Discord Project Owl on Twitter

2. LiveUAMap - Live map of breaking news
This is the go-to map for many online analysts keeping track of breaking news in Ukraine. The map is updated as soon as events and news can be confirmed.

LiveUAMap.com

3. Flightradar24 - Global, real time aircraft tracking

We and many other online open-source analysts have been using Flightradar to get an overview of flights within European and Russian airspace as the conflict continues. We noticed trends as they happened, such as flights being diverted as soon as the offensive began. There are also features that let you check out what others are watching (top tracked planes).

Flightradar24.com

4. Sentinel2: Access satellite imagery from European Space Agency

The European Space Agency offers a wealth of satellite imagery taken by their Sentinel2 satellite in orbit. Their catalog features frequent optical and radar satellite images, and open source intelligence analysts have methods  to verify reports of clashes by looking for changes. The image resolution is lower than commercial counterparts like Maxar, PlanetLabs, and Capella.

Sentinel2 on the ESA website.

5. Bellingcat OSINT map

Bellingcat’s coverage of the conflict is representative of their best-in-class open source intelligence techniques. Bellingcat has particular experience in the identification of munitions, weapons, and vehicles, and these are well-annotated throughout their coverage.

Live Ukraine map on Bellingcat.

News Roundup

TECH ETHICS, PRIVACY, AND HACKS

• [The Guardian] An anonymous whistleblower leaked account details linked to Credit Suisse, one of the world’s largest private banks. The leak revealed that some of Credit Suisse’s clients are individuals known to be involved in serious crimes such as drug trafficking and money laundering. 

• [The Verge] Over the weekend, U.S.-based graphics chipmaking company Nvidia confirmed to multiple news outlets that it is investigating an “incident” after reports emerged of a massive cyberattack on its internal systems. 

• [Forbes] Check out this profile on PenLink, a small Nebraska company that asissts many local, state, and federal law enforcement entities with surveillance. 

SECURITY TRENDS AND ANALYSIS

• [arsTechnica] Efforts by Australia’s government competition regulator to have Google and Facebook pay news outlets for featuring news content paid off this weekend when the government won a stand off against the two tech giants.

• [U.S Department of Justice] The U.S. Department of Justice released a statement last week announcing that three men pleaded guilty in their involvement in a white supremacist plot to attack U.S. power grids. 

• [Southern Poverty Law Center] Earlier this month, the Souther Poverty Law Center reported that about one in five applicants to the white supremacist group Patriot Front associated with holding, or formerly holding, some sort of military status. 

ON OUR RADAR

• [Harvard Business Review] Moral injury is a trauma response to witnessing or participating in workplace behaviors contradictory to one’s moral beliefs in high-stakes situations - and employers can take steps to keep their employees from experiencing it. 

• [The Verge] The U.S. Copyright Office recently rejected a request to allow an AI copyright a work of art, effectively dismissing copyright law to directly apply to AI the way it applies to humans (...for now). 

• [The New York Times] Fresh off the announcement that he is stepping down from the Facebook board to pursue an operational role in the next election cycle, the NYT covers Peter Thiel as he embarks to become a “kingmaker” in national conservative races.

Jobs & Other Opportunities

Mid-Senior Security Engineer - [Bugcrowd]

“We require a motivated team member who is willing to push their own boundaries and step out of their comfort zone.You will be challenged on a regular basis, especially because you are the last line of defense for one of the largest crowdsourced security platforms! The Mid-Level / Senior Security Engineer will provide mentoring to multiple junior security engineers and will work closely with other team members on a daily basis.” 

Sr. Technical Project Manager, AI@Unity - [Unity]

“We are looking for a Technical Project Manager to play a critical role in building synthetic data to help our clients across diverse industries develop innovative computer vision applications.”

Design Intern - [Ideas United]

“We focus on producing authentic, story-driven content to create for a better future [...] Are you a student looking to build real-world graphic design experience in a creative studio setting? We are looking for an intern with diverse ideas, a sharp eye and lots of questions.

Security Engineering Intern - [Tinder]

“As a Security Intern at Tinder, you will help us secure our terabytes of data! In this position, you’ll be building and securing our platform and helping future Tinder users make better matches, engage more effectively, and generally make the world a better place.”

Remote Tech Job List by @ruby_rafaelina [Twitter]

@ruby_rafaelina has compiled an amazing list of remote tech jobs with transparent salaries. Check out this list of rules to submit job openings to the growing collection!

Events

We Robot 2022 - University of Washington School of Law

Sept. 14 - 16

We Robot is an interdisciplinary conference that focuses on legal and policy topics relating to robots. You can still submit papers [here] and learn more about the conference [here].

Summercon - Littlefield, Brooklyn, NY

July 8 - 9

Summercon 2022 is officially happening, with options for in-person and virtual! Get ahead of the rush with reservations here. Call for papers to come.

TECH ETHICS, PRIVACY, AND HACKS

• [Electronic Frontier Foundation] The U.S. Central Intelligence Agency has been collecting private data of U.S. residents without any oversight, according to a  declassified report released earlier this month. 

• [Reuters] Last week, the U.S. Justice Department announced the massive seizure of $3.6 billion in stolen bitcoin related to a 2016 hack. 

• [CNBC] On Thursday, Apple announced changes to the software used in AirTag, the company’s tracker product that had been linked to suspected crimes such as car theft. 

• [VICE] Roblox, a gaming platform worth $68 billion and played by half of all children in America, has developed into an ecosystem for hackers and fraud.

• [Dark Reading] Russian aggression against Ukraine continues as state-linked hacking groups attack Ukranian targets.

• [WSJ] NewsCorp, the parent company of the Wall Street Journal and Fox News, disclosed that it was a victim of a months-long hack likely perpetrated by Chinese state intelligence.

SECURITY TRENDS AND ANALYSIS

• [Friday Things] Stacy Lee Kong (@stacyleekong) writes about the growing white “wellness-to-White-Supremacy” pipeline and the link of these spaces to the influencer industry.

• [NBC News] Facebook recently removed U.S. trucker and convoy groups that were run by overseas actors, drawing a connection to these specific groups and anti-vaccine conspiracy content. 

• [New York Times] Sasha Maslov reports on the culture of entrepreneurship, particularly among tech industries, in Ukraine while fears of a Russian invasion continue to grow. 

• [Maya Kaczorowski] A blog post on zero trust frameworks, their rise in popularity, and where it needs to go.

• [Wired] Wired publishes an inside look into the Trickbot ransomware gang.

ON OUR RADAR

• [Vanity Fair] Last week, a bipartisan U.S. Congressional bill was passed to end forced arbitration laws that have historically prevented survivors of sexual misconduct in the workplace from taking their cases to court. 

• [ABC] In a historic day for Australian sex workers, the Victoria parliament repeals an invasive law on sex work.

• [The Seattle Times] Recently released documents reveal that during Seattle’s racial justice uprising in 2020, legislation was drafted by then-Mayor Jenny Durkan’s administration to hand over the Police’s East Precinct building to a Black Lives Matter organization. 

• [The Consilience Project] Check out this read from the Consilience Project on the online weaponization of verified facts by presenting them in misleading narratives. 

• [Vanta] A report from Vanta: “The State of Startup Security”.

Jobs & Other Opportunities

TechOps Lead - [Ocrolus]

“An experienced IT/TechOps support professional with strong organizational, time management, documentation, and project management skills. The ideal candidate has meaningful “customer” (internal or external) support experience, project management experience, and experience working with (ideally spinning up) IT support tools and processes” 

Various Level Pentest Positions - [Humana]

“Successful candidates would be appsec pentesters with 1-2 years experience for the level 2 roles or 3-5 years for the seniors. For the coordinator role, strong technical and soft skills in the realm of scoping, scheduling, and vulnerability management would be key.”

Freelance Content Writer - [Gemini]

“As a Freelance Content Writer, you will help create content that educates readers about the cryptocurrency ecosystem for our educational portal.”

Events

SANS - New2Cyber Summit 2022 March 23rd - March 24th

From the SANS institute, a conference dedicated to folks transferring in or looking to gain new skills in cybersecurity in a broad way. There’s some really great people involved with running this conference, and hopefully it opens up new doors for a bunch of people! Free and virtual, EST timezone.

Registration is [here].

Kernelcon - Omaha, NE’s Hacking Conference

April 1st - April 2nd

Kernelcon is Omaha’s cybersecurity conference and education event. Their mission is to bring an annual world-class event grounded in the Omaha-area, and maintain a “by the community, for the community” feel.

Registration is [here].

This month, activist group Unicorn Riot published a massive leak of chat logs from the white nationalist group Patriot Front. LaBac members have spent the past week analyzing the leak for better understanding of the inner workings of one of the more popular white nationalist groups in the US. Below are some of our findings.

Manifesto

For those unfamiliar with PatriotFront, you might start with their manifesto in their own words. This specific video of PatriotFront members reading their manifesto is currently going around on the internet, as members at one point remove their masks, and exclaim their support of Nazi ideology.

Extracting geolocation from PatriotFront media

A common open source intelligence technique when dealing with image media is to determine whether there is any attached EXIF data in the image metadata that may reveal the geolocation of where the picture was taken.

Some of PatriotFront’s most impactful operations are its “activism,” as it is referred to in the chat, involving the plastering of white nationalist propaganda in public places.

Where possible, LaBac members extracted the available EXIF data from media in the “activism” channel, where geolocation coordinates could then be placed on a map.

Secret codes in PatriotFront messages

Around the time that PatriotFront members discovered the leak, they referenced a formula and a “Python script” to decipher messages. 

This formula makes use of the identifier given to users within RocketChat, the chat platform, as well as other identifying artifacts for a message. 

The purpose of the formula seems to be to identify someone who might take a screenshot of a message by creating an identifier that can be mapped to a PatriotFront ID that members of the group are assigned internally.

The result of the formula is the logged-in user's PatriotFront ID.

While this is a good method of finding infiltrators, they failed to implement any other security practices and didn't follow their own guidelines.

PatriotFront stored most of their photos documenting their activism in a central place, though at one point they set the #activism channel to delete older messages with a retention policy. 

Selected charts from our PatriotFront leak analysis

Attendance sheet.

From the leak itself: an attendance sheet for PatriotFront members and their involvement in key meetings and trainings.

Key:

• M: Missed

• A: Attended

• P: Proxy

• AA: Attended with "Activism"

Statewide PatriotFront Membership

Heat graph depicting the volume of PatriotFront members per state.

Most frequent chat sender/recipient pairs between PatriotFront members

Dependency graph depicting the most active PatriotFront members and their most popular recipients.

Special thanks to Emma and their team for their analysis.

News Roundup

TECH ETHICS AND PRIVACY

• [New Yorker] The blockchain business model has made headlines for sensational ploys. But in quieter corners DAOs are forging a promising new ecosystem for digital startups.

• [Politico] The Crisis Text Line’s AI-driven chat service has gathered troves of data from its conversations with people suffering life’s toughest situations. Politico reveals Crisis Text Line shares that data with a for-profit offshoot.

• [The Markup] Life360 Says It Will Stop Selling Precise Location Data. Announcement comes after The Markup identified the family tracking app as one of the largest sources of raw data for the location data industry.

TECH LABOR EVOLVING

• [Economist] Citizen developers are rapidly becoming the vanguard of corporate digitization.

• [Financial Times] Amazon abandons influence campaign designed to attract staff. Paying warehouse workers to tweet positive comments is dropped after poor reach and embarrassing backfires.

• [Vice] “Amazon Paid for a High School Course. Here’s What It Teaches.”

HACKING AND SECURITY INCIDENTS

• [Bloomberg] Hackers Seize $80 Million From Qubit in Latest DeFi Attack.

• [Ars Technica] Microsoft fends off record-breaking 3.47Tbps DDoS attack.

• [Ars Technica] A bug lurking for 12 years gives attackers root on most major Linux distros.

• [Pradeo] Malicious app on Google Play drops banking malware on users’ devices.

• [Crowdstrike] This blog discusses the StellarParticle campaign and the novel tactics and techniques used in supply chain attacks observed by CrowdStrike incident responders.

SECURITY TRENDS AND ANALYSIS

• [New York Times] A Times investigation reveals how Israel reaped diplomatic gains around the world from NSO’s Pegasus spyware — a tool America itself purchased but is now trying to ban.

• [Sentinel One] Hacktivism and State-Sponsored Knock-Offs: Attributing Deceptive Hack-and-Leak Operations.

• [The Verge] In the ’80s, Susan Headley ran with the best of them—phone phreakers, social engineers, and the most notorious computer hackers of the era. Then she disappeared.

COOL STUFF ON OUR RADAR

• [Nex] Friend of cabal and master NSO Pegasus hunter Nex gives a primer on Android forensics.

• [@_alialkhatib on Twitter] “talk to your kids about... uploading precise three-dimensional scans of their bedrooms to the whole wide world.”

• [Space Raccoon] Applying Offensive Reverse Engineering to Facebook Gameroom.

• [@kevinbacker on Twitter] “Even if your model/algorithm/tool generates good predictions, it might not generate trust, credibility, political organization or political will. Those are the most important questions and they are almost always neglected.”

• [@Zerodium on Twitter]  Zerodium ups the bounty for zero-day vulnerabilities in Mozilla Thunderbird and Microsoft Outlook.

Jobs & Other Opportunities

Policy Analyst - Knight First Amendment Institute, Columbia University

The ideal candidate will have an interest in and familiarity with issues at the intersection of free speech and technology, experience in policy analysis and policy strategy and advocacy. [Knight Center]

Senior Product Designer, Plan - GitLab

As a Senior Product Designer at GitLab, you will work 1:1 with a Product Manager and be embedded in our Plan: Project Management team. You'll design features for our highly-visible planning and planning analytics capabilities that empower small, autonomous teams. [GitLab]

Senior Cybersecurity Engineer - Rigetti Quantum Computing

As our 1st Security Engineering hire, you champion the intersection of technology, process, and people to be the conduit for Rigetti in sharing our cutting edge technology with the rest of the world. [Rigetti]

Events

Startup Chica

Saturday, February 26th 2022 from 10:00 AM CST to 5:00 PM CST

The Startup Chica Conference focuses on teaching, inspiring and encouraging young females to enter the business world by becoming leaders and entrepreneurs while fostering their ideas and talents. 

[startupchica.com]

Threat Modeling - Intensive Course

February 28 - March 4th, 8AM-10AM Pacific.

Equivalent to a 2 day in-person course. Participants will deepen knowledge & skills needed to consistently and efficiently utilize threat modeling to identify threats, mitigation techniques, document results, deliver more secure products, and champion threat modeling within organizations.

[Shostack Courses]

Hello hello! Happy MLK Day! We’ve decided to move our publication date to Monday so you can receive your hatemail right at the start of the work week! 

We are also considering moving our newsletter to Revue, Twitter’s alternative to Substack. You can check out what that might look like here. Please do contact us if you have any strong opinions on this.

As always, you can reach out to us at contact@labac.dev for comments, feedback, or questions. Cheers!

— The LaBac Collective

Controversial DMCA Back in the Spotlight

After a wave of Twitch bans including some of Twitch’s top earners on the platform, notably, Hasan Piker (HasanAbi) #13 at $2.8 million and Imane Anys (pokimane) #39 at $1.5 million) as purportedly leaked by Twitch, folks are talking about the Digital Millennium Copyright Act (DMCA). 

Twitch streamers have been struggling with DMCA strikes and bans for a while now, which can also be witnessed on other platforms including YouTube and in stranger places too (tractor hacking and the Right to Repair fights, Ticketmaster suing RMG over ticket scalping via DMCA, Volkswagen stifling legitimate researchers looking into hidden code via DMCA, the 2001 arrest of Russian programmer Dmitry Sklyarov at the DEFCON in Las Vegas via DMCA claims). One might ask, how can a single act be used so widely in many different applications?

DMCA is a commitment passed by Congress in 1998 to comply with two treaties put forth by the World Intellectual Property Organization back in 1996. It’s a hefty piece of legislation that expanded protections for copyright holders and punishment for violations, while also simultaneously limiting the liability of hosting platforms when user content violates copyright law. And these limitations on platform liability are key.

In exchange for reducing company liability when users violate copyright law, lawmakers incentivized hosting companies to aggressively show good faith to DMCA, such as creating comprehensive takedown policies. This understanding was legally tested back in 2010 in a lawsuit between Viacom and YouTube. The decision in that case (YouTube won) actually better-secured liability protections for hosting platforms under the so-called “safe harbor” provisions of DMCA, which groups like the Electronic Frontier Foundation (EFF) have championed to combat the more information-restrictive components of DMCA. 

Truth be told, LaBac reaps the benefits of these DMCA safe harbor provisions all the time. When we help remove sexual content that’s been nonconsensually posted on the internet, we take advantage of these DMCA-incentivized takedown policies around copyright images. And we stay alert to which companies are more compliant with victims’ takedown requests and which companies are more difficult to work with. (The Cyber Civil Rights Initiative’s Without My Consent project is one of our favorite takedown resources, which you can find here). 

To be clear, we aren’t particularly interested in defending DMCA beyond how it benefits us and the people we work to help. After all, DMCA isn’t designed to help victims of nonconsensually posted porn; it’s designed to protect the intellectual property of corporations that largely benefit from strict copyright holding as opposed to individuals, small artistic creators, or content creators (YouTubers, TikTokkers, Twitch streamers, etc.). And we are also well aware of the many other ways that DMCA has been bad for information sharing. But for now, this strategy of co-opting intellectual property law has become an important tool in the fight against cyber sexual harassment… and we’d like to continue using it while we can. 

What we’ve also learned from doing this work is that takedown policies are a reflection of how different companies, such as Twitch, interpret DMCA and what parts of the legislation are important to them. This includes how much energy platforms put into avoiding lawsuits and the stakeholders or relationships they prioritize. So, while it's convenient for hosting sites to point to DMCA when they make unpopular takedown decisions that impact popular creators, the truth is hosting companies like Twitch have more power in how they apply DMCA than they let on (consider how Twitch changed their unique DMCA policy in July 2021). In the end, it largely comes down to what (and who) is important to the company. 

Of course, in an ideal world, our preference is smarter internet legislation. But until the political field changes, a full stop of DMCA — without legislation already in place that functions in a similar way we’ve used DMCA-incentivized takedown policies — could be devastating to victims of nonconsensual porn sharing. But the broadness in which DMCA has been applied is troubling.

After almost 25 years, it might be time to readdress copyright law as it applies to the Internet and reflect on how DMCA has shaped the original issues it targeted such as piracy and copyright infringement. For now, creators' opinions are split on the actions of Twitch streamers as some feel like the actions of recently banned Twitch streamers fall under ‘fair use’. Alternatively, Youtubers and other veterans of content creation such as Let’s Players are left to fear ‘adpocalypse 2.0’, or another large crusade by corporations across platforms of stricter DMCA crackdowns.

TECH ETHICS AND PRIVACY

• [Protocol] Benjamin Pimentel (@benpimentel) argues in this think piece that Web3 evangelists echo Marxism in their pitch of the developing technology.

• [Novara] Anna Cafolla (@AnnaCafolla) breaks down why recent comments made by Molly-Mae Hague are the perfect reflection of Thatcherite ideology within influencer culture. 

• [The Verge] On Friday, several state attorneys released a new antitrust complaint against Google for alleged collusion with Facebook over advertising markets. The complaint includes emails between Mark Zuckerberg and Alphabet Inc. executive Sundar Pichai.

• [Washington Post] Virtual reality equipment opens up new possibilities for surveillance and data collection on our bodies by companies like Meta Inc.

TECH LABOR EVOLVING

• [Bloomberg] ‘Work from anywhere’ policies helped Twitter boost racial diversity in their workforce hires, especially in hiring more Black and Latinx employees.

• [The Verge] On February 4th, workers at an Amazon warehouse in Bessemer, Ala., will get a chance to redo their union election after Amazon was found to have  violated numerous election guidelines. 

• [Vice] Details are emerging about a secretive Google anti-union campaign called Project Vivian that ran between late 2018 and early 2020. 

HACKING AND SECURITY INCIDENTS

• [Microsoft] As tensions between Russia and Ukraine escalate, Microsoft says it has found evidence of a destructive malware attack targeting Ukrainian government networks. Reuters reports that the threat actor behind the attack is Belarusian Intelligence Services, likely acting in support of Russia.

• [NYTimes] Russia says it has shut down the notorious hacker group REvil at the request of U.S. officials, but it’s unclear if the move will ease tensions between the two countries. 

• [The Verge] A developer recently corrupted two popular open-source libraries on GitHub, affecting tons of projects with the libraries in use.

SECURITY TRENDS AND ANALYSIS

• [Chainanalysis] Cryptocurrency crime hit an all-time high in 2021, while cryptocurrency usage is growing incredibly fast with legitimate cryptocurrency usage outpacing crime. 

• [Bleeping Computer] In 2021, the number of Linux malware infections grew 35%, the most common instance being related to DDoS attacks.

• [French Military Academy] This verbose report on Chinese information operations is one of the best public reporting of the Chinese Communist Party’s capabilities in cyberspace, media, and psychological operations.

COOL STUFF ON OUR RADAR

• [Data & Society] Researchers Matt Goerzen and Gabriella Coleman collaborate to chart the movements of the digital underground during the 1990s to reveal what underground technologists or “hackers”, did—technically, linguistically, and culturally—to establish their legitimacy as employable, trustworthy security experts. 

• [@ShujaUH on Twitter] “A farmer in Turkey has fitted his cows with virtual reality goggles to make them think they are outside in summer pastures.”

• [Porchetta] We love it when companies publish transparency reports! In this one, Porchetta Industries (@porchetta_ind) details the past year in their mission to provide funding to Opensource security tooling.

Know your Rights: How the law protects workers’ right to speak out (January 27, 2022 - 4:00 PM to 5:00 PM PST)

The Tech Workers Coalition is hosting a live event to inform tech workers about the legal protections and legal consequences relating to speaking out at work. The event will cover issues about basic legal rights to speak out and organize, how NDAs are (or are not) enforced, how to work with lawyers (for free), what to consider before speaking out, how whistleblower reward programs work, and the various pathways for speaking out, among other issues. RSVP

CanSecWest 2022 & Training (In Person & Online: May 18-20, 2022, Training In-Person & Online: May 14-17, 2022)

CanSecWest, the security conference located in Vancouver, BC, Canada will return with a hybrid option this year. This is the largest hacking-related conference in the Pacific Northwest, and includes the PWN2OWN competition. Registering early saves $800 off ticket prices, and is highly recommended.  Registration

Jobs & Other Opportunities

Role: System Administrator
The Electronic Frontier Foundation (EFF) is seeking applicants for the full-time position of System Administrator to join the Technical Operations team.
Organization: Electronic Frontier Foundation (EFF) (@EFF)
Open Rec: https://www.eff.org/opportunities/jobs/system-administrator [link]

Role: Program Committee Member
SeaGL (Seattle GNU/Linux Conference) is looking for members for the programming committee which handles the CFP and other speaker tasks. If you’ve been a speaker at a conference before and can offer value to the committee, reach out to Nathan Handler (Program Committee Chair).
Organization: SeaGL Conference (@SeaGL)
Tweet:

Share hatemail

LaBac is a hacker collective combatting tech-enabled abuse and serves on the NYC Cyber Sexual Assault Taskforce. Learn more here.