RISKS-LIST: Risks-Forum Digest Sunday 8 Sep 2024 Volume 34 : Issue 44

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.44>
The current issue can also be found at
<http://www.csl.sri.com/users/risko/risks.txt>

Contents:
Bypassing airport security via SQL injection (Tom Van Vleck
How Navy chiefs conspired to get themselves illegal warship Wi-Fi
(Navy Times)
Chinese Government Hackers Penetrate U.S. ISPs (Joseph Menn)
New Yubikey vulnerability (ArsTechnica)
JPMorgan Plans to Report Customers Who Exploited TikTok ‘Glitch’ to
Authorities (WSJ)
California Passes AI Safety Bill (Bloomberg)
Musk and xAI accused of worsening Memphis smog with unauthorized turbines
(CNBC)
AI Could Engineer a Pandemic, Experts Warn (Time)
The Bands and the Fans Were Fake. The $10 Million Was Real.
(NYTimes)
Kids who use ChatGPT as a study assistant do worse on tests
(Hechinger Report)
Chatbots Are Primed to Warp Reality (The Atlantic)
Automated trading bots scheme results in millions of dollars,
Teslas, Rolexes, and federal wire-fraud convictions (Justice)
Former Tesla Autopilot Head And Ex-OpenAI Researcher Says
'Programming Is Changing So Fast' That He Cannot Think Of Going Back
To Coding Without AI (Benzinga)
Electric toothbrushes and light-up sneakers are setting France on
fire (Politico)
Wake me when the Internet of Things is over (StraitsTimes.com)
Risks of Rogue WiFi on Navy ships (Navy Times)
In feud with Musk, Brazilian justice restricts access to X
(LA Times)
North Korea Aggressively Targeting Crypto Industry with
Well-Disguised Social Engineering Attacks (IC3)
Five-day O2/Telefonica DSL outage in Berlin, Germany (SCTB)
What The CrowdStrike Outage Can Teach Us about Testing and Failure Modes
(Packet Pushers)
Visa required for EU entry starting next year (Edward Hasbrouck)
Russian 'spy whale' found dead off Norway (BBC)
Re:_Moscow's Spies Were Stealing U.S. Tech, Until the FBI Started a Sabotage
Campaign (Amos Shapir)
Foreign Policy: TikTok ban & global data commons (Cliff Kilby)
How Telegram Became Criminals’ Favorite Marketplace (WSJ)
Telegram Founder's Indictment Thrusts Encryption into the Spotlightooo
(NYTimes)
Re: Telegram billionaire co-founder Pavel Durov arrested (John Levine)
Re: Feds sue Georgia Tech for lying bigly about computer security
(Dylan Norhtrup)
Re: Standard security policies and variances (Charles Cazabon)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Fri, 30 Aug 2024 09:13:33 -0400
From: Tom Van Vleck <thvv@multicians.org>
Subject: Bypassing airport security via SQL injection

https://ian.sh/tsa

• Ian Carroll (https://twitter.com/iangcarroll)
• Sam Curry (https://twitter.com/samwcyo)

``KCM is a TSA program that allows pilots and flight attendants to bypass
security screening, even when flying on domestic personal trips. A
similar system also exists for cockpit access, called the Cockpit Access
Security System (CASS).''

ARINC (a subsidiary of Collins Aerospace) operates a site called FlyCASS
which pitches small airlines a web-based interface to CASS. Apparently this system was operated by only one person.

The FlyCASS site was vulnerable to a very simple SQL injection attack. A
test of this allowed the researchers to add names, authorizations, and
photos to the database. The researchers reported the issue to the Department
of Homeland Security and the problem was addressed... see the web page for
the story.

------------------------------

Date: Thu, 5 Sep 2024 08:31:14 -0700
From: Steve Bacher <sebmb1@verizon.net>
Subject: How Navy chiefs conspired to get themselves illegal warship Wi-Fi
(Navy Times)

A scathing Navy investigation reveals how USS Manchester's enlisted leaders endangered their ship with an unauthorized Starlink Wi-Fi setup.

Key paragraphs:

Unauthorized Wi-Fi systems
<https://www.militarytimes.com/news/your-military/2023/09/12/elon-musk-blocking-starlink-to-stop-ukraine-attack-troubling-for-dod/>like
the one Marrero set up are a massive no-no for a deployed Navy ship, and
Marrero’s crime occurred as the ship was deploying to the West Pacific,
where such security concerns become even more paramount among heightened
tensions with the Chinese.

“The installation and usage of Starlink, without the approval of higher
headquarters, poses a serious risk to mission, operational security, and
information security,” the investigation states.

https://www.navytimes.com/news/your-navy/2024/09/03/how-navy-chiefs-conspired-to-get-themselves-illegal-warship-wi-fi/

The article also says:

Marrero’s “egregious misconduct” with the illegal Wi-Fi “cannot be
understated,” the investigating officer wrote

[Of course it can be understated!
OTOH, it probably cannot be overstated, and/or should not be
understated.]

------------------------------

Date: Fri, 30 Aug 2024 11:23:01 -0400 (EDT)
From: ACM TechNews <technews-editor@acm.org>
Subject: Chinese Government Hackers Penetrate U.S. ISPs
(Joseph Menn)

Joseph Menn, *The Washington Post, 27 Aug, via ACM TechNews

U.S. Internet service providers (ISPs) have been breached by Chinese government-backed hackers, say researchers, with the goal of gathering intelligence on users. Government and military personnel working undercover
and groups of strategic interest to China are thought to be the primary targets. Lumen Technologies researchers said three U.S. ISPs were hacked
this summer via a previously unknown zero-day flaw in a Versa Networks
program used for managing wide-area networks.

------------------------------

Date: Tue, 3 Sep 2024 16:04:16 -0400
From: Cliff Kilby <cliffjkilby@gmail.com>
Subject: New Yubikey vulnerability (ArsTechnica)

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/2/

FWIW, this changes nothing.
FIDO is still better than
TOTP is still better than
Either SMS or Email verification.

To effect a clone, the fob must be out of your possession for an extended period of time (Source denotes 10 hours but calls that short) and the
attacker needs a full lab and external data to do anything with it.

Do monthly inventories of all assets (including backup fobs), and have a
lost device process (which should include fobs).
Authentication attempts should be throttled, captcha'ed, and have auto disable/lock enforced.
I would add the specifics that any account that is flagged as "break-glass" should be monitored and alarmed for any authentication attempt, successful
or not.

If attempting to use it doesn't set off every alarm in the building, or it
can be used if every alarm isn't already going off, it cannot be a
break-glass account.

Still, shame on yubico for not validating constant time encryption on all
their products. I understand the Infineon cryptographic library comes with
a "trust us, bro" NDA, which may have hampered testing.

I guess that means that obscurity still means insecurity.

[I've had THREE yubikeys lately. The second was part of an SRI-wide, but
it could not be installed. PGN]

------------------------------

Date: Sat, 7 Sep 2024 22:23:05 -0400
From: Monty Solomon <monty@roscom.com>
Subject: JPMorgan Plans to Report Customers Who Exploited TikTok ‘Glitch’ to
Authorities (WSJ)

Thousands of people withdrew money after depositing bad checks

https://www.wsj.com/finance/banking/jpmorgan-plans-to-report-customers-who-exploited-tiktok-glitch-to-authorities-cb5f5cef

------------------------------

Date: Fri, 30 Aug 2024 11:23:01 -0400 (EDT)
From: ACM TechNews <technews-editor@acm.org>
Subject: California Passes AI Safety Bill (Bloomberg)

Shirin Ghaffary, *Bloomberg*, 29 Aug 2024, via ACM TechNews

California's legislature approved an AI safety bill opposed by many
tech companies. The measure moved to Governor Gavin Newsom's desk
after passing the state Assembly Wednesday, with the Senate granting
final approval Thursday. SB 1047 mandates that companies developing AI
models take "reasonable care" to ensure that their technologies don't
cause "severe harm," such as mass casualties or property damage above
$500 million.

[One problem with this is that Human Safety is an emergent property of the
entire system -- hardware, software, networks, and apps -- and not a
property that can be evaluated in the AI alone. If the AI cannot satisfy
its own properties, that is a bad thing. However, even if it can do so,
the rest of the system may still do harm. Ergo, the AI itself may not be
user-friendly and safe unless everything else is also. PGN]

------------------------------

Date: Fri, 30 Aug 2024 10:51:12 -0400
From: Chad Dougherty <crd@acm.org>
Subject: Musk and xAI accused of worsening Memphis smog with
unauthorized turbines (CNBC)

https://www.cnbc.com/2024/08/28/musk-xai-accused-of-worsening-memphis-smog-with-unauthorized-turbines.html

------------------------------

Date: Fri, 30 Aug 2024 11:23:01 -0400 (EDT)
From: ACM TechNews <technews-editor@acm.org>
Subject: AI Could Engineer a Pandemic, Experts Warn (Time)

Tharin Pillay and Harry Booth, *Time*, 27 Aug 2024, via ACM TechNews

A policy paper from public health and legal professionals at Stanford School
of Medicine, Fordham University, and the Johns Hopkins Center for Health Security calls for mandatory oversight and guardrails for advanced
biological AI models. The authors wrote they believe governments should collaborate with machine learning, infectious disease, and ethics experts to develop tests to determine whether biological AI models could pose "pandemic-level risks."

------------------------------

Date: Thu, 5 Sep 2024 08:22:45 -0700
From: Jim Geisman <jgeissman@socal.rr.com>
Subject: The Bands and the Fans Were Fake. The $10 Million Was Real.
(NYTimes)

Federal prosecutors charged a North Carolina musician with gaming the system
to win royalties from streaming services including Spotify, Apple Music and Amazon Music.

A North Carolina man used artificial intelligence to create hundreds of thousands of fake songs by fake bands, then put them on streaming services where they were enjoyed by an audience of fake listeners, prosecutors said.

Penny by penny, he collected a very real $10 million, they said when they charged him with fraud.

The man, Michael Smith, 52, was accused in a federal indictment unsealed on Wednesday of stealing royalty payments from digital streaming platforms for seven years. Mr. Smith, a flesh-and-blood musician, produced A.I.-generated music and played it billions of times using bots he had programmed,
according to the indictment.

The supposed artists had names like "Callous Post," "Calorie Screams" and "Calvinistic Dust" and produced tunes like "Zygotic Washstands," "Zymotechnical" and "Zygophyllum" that were top performers on Amazon Music, Apple Music and Spotify, according to the charges.

"Smith stole millions in royalties that should have been paid to musicians, songwriters, and other rights holders whose songs were legitimately
streamed," Damian Williams, the U.S. attorney for the Southern District of
New York, said in a statement on Wednesday.

https://www.nytimes.com/2024/09/05/nyregion/nc-man-charged-ai-fake-music.html

[Also noted by Steve Bacher. Matthew Kruk spotted
https://www.bbc.com/news/articles/cly3ld9wy3eo
PGN]

------------------------------

Date: Sat, 7 Sep 2024 06:34:47 -0700
From: Steve Bacher <sebmb1@verizon.net>
Subject: Kids who use ChatGPT as a study assistant do worse on tests
(Hechinger Report)

An experiment in a Turkish high school shows that using ChatGPT in math can “substantially inhibit learning.” Even a fine-tuned version of ChatGPT designed to mimic a tutor doesn’t necessarily help.

https://hechingerreport.org/kids-chatgpt-worse-on-tests/

------------------------------

Date: Mon, 2 Sep 2024 06:46:25 -0700
From: Steve Bacher <sebmb1@verizon.net>
Subject: Chatbots Are Primed to Warp Reality (The Atlantic)

A growing body of research shows how AI can subtly mislead users -- and even implant false memories.

https://www.theatlantic.com/technology/archive/2024/08/chatbots-false-memories/679660/

------------------------------

Date: Sat, 7 Sep 2024 12:47:25 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Automated trading bots scheme results in millions of dollars,
Teslas, Rolexes, and federal wire-fraud convictions (Justice)

ALEXANDRIA, VA. –- A Great Falls man pled guilty on July 23 to wire
fraud and a Florida man was sentenced yesterday for his role in the
wire fraud conspiracy.

According to court documents, Rick Tariq Rahim, 56, defrauded customers who wanted to invest using Rahim’s automated trading bots, some of which traded forex, and by “copying” Rahim’s supposed trading activities that he posted
to Discord. He marketed his products under BotsforWealth,
TradeAutomation.com, ProChartSignals.com, OptionCopier.com, CopyAndWin.com, SnipeAlgo.com, and QQQtrade.com. Rahim charged customers a subscription fee
for access to Rahim’s bots, software, and copying his supposed trades. Rahim also offered a “lifetime membership” to which customers received access to Rahim’s private Discord channel, some of his products, as well as his “in-office” trading days. Additionally, Rahim personally traded stocks for at least two individuals, claiming claiming that "We'll hit home runs and
make $500k+ per day very very often." Instead, Rahim lost over $300,000 of
his clients’ funds in eight months.

Rahim induced customers to subscribe to his products by using video-centric, internet-based social media tools, including TikTok, YouTube, and
Discord. He posted false information to his websites and to his social media accounts claiming to “beat the stock market every day” and promising extreme
profit margins.

Rahim also sought to induce customers by claiming he was extremely
wealthy, boasting about trading millions of dollars and posting about
his large home, pool, and luxury cars, including his Lamborghini.
Despite claiming to regularly beat the market, however, he exaggerated
his personal trading success, in part by not posting trades in which
he lost money. In fact, Rahim realized over $500,000 in losses from
February 2021 through December 2022. He did not invest millions in the
market during this time period as he had claimed. As part of his
fraud scheme, Rahim also created at least 20 Discord user profiles to
post emojis, likes, and symbols showing agreement and excitement
regarding Rahim’s posts. Rahim earned at least $1,397,000 in
subscription fees during the course of his schemes. After accepting
the guilty plea, the court ordered that Rahim not give any financial
investment advice to anyone for a fee.

https://www.justice.gov/usao-edva/pr/automated-trading-bots-scheme-results-mill ions-dollars-teslas-rolexes-and-federal-wirez

------------------------------

Date: Sun, 25 Aug 2024 08:07:11 -0700
From: "Jim" <jgeissman@socal.rr.com>
Subject: Former Tesla Autopilot Head And Ex-OpenAI Researcher Says
'Programming Is Changing So Fast' That He Cannot Think Of Going Back
To Coding Without AI (Benzinga)

Having AI to help coding reminds me of how long ago composers like Haydn = might write out the main parts, but give only hints about the =
accompaniment, which is left to the copyist to fill in.

------------------------------

Date: Sun, 1 Sep 2024 08:06:12 -0700
From: Steve Bacher <sebmb1@verizon.net>
Subject: Electric toothbrushes and light-up sneakers are setting France on
fire (Politico)

Waste treatment plants have seen an uptick in fires caused by lithium-ion batteries in household goods.

CATUS, France — Every day at the Syded waste treatment plant in the Lot region of southwestern France, the company collects, sorts and treats up to
80 metric**tons of household and business waste.

And every day, its 266 employees have to look out for an electric
toothbrush, a single-use vape or a broken toy that could set the whole place
on fire.

“Had you called me 4 or 5 years ago I would have said [fires occur] ‘from time to time’ but now the risk of fire defines my day-to-day,” said Hervé Coulaud, environment director at the Syded plant.

The problem, it turns out, is batteries — specifically, lithium-ion batteries. As the technology has advanced and the batteries have become
smaller and more efficient, they've shown up in ever more household goods,
from musical birthday cards to diapers that beep when they're too wet.

But if these tiny power sources aren't removed and disposed of separately
when an item is thrown away, they end up in mainstream waste plants and get crushed.

And that's the moment they can ignite and send the whole place up in flames.

[...]

https://www.politico.eu/article/electric-toothbrush-light-up-sneakers-france-ho usehold-waste-fires-studies-product/

------------------------------

Date: Thu, 05 Sep 2024 06:26:52 +0000
From: Richard Marlon Stein <rmstein@protonmail.com>
Subject: Wake me when the Internet of Things is over
(StraitsTimes.com)

https://www.straitstimes.com/opinion/wake-me-when-the-internet-of-things-is-ove r

[Reprinted from https://www.bloomberg.com/opinion/articles/2024-09-04/internet- of-things-is-falling-flat-with-consumers]

"Makers of smart washing machines and refrigerators should admit defeat and let
dumb things remain dumb."

Wiser words were never written on IoT. Time to disconnect that IoT-enabled Roti
maker.

[Guesses are it will never be over, even if it never gets smart and
uses trustworthy components. Home owners don't seem to care. PGN]

------------------------------

Date: Wed, 4 Sep 2024 07:17:16 -0400
From: George Neville-Neil <gnn@neville-neil.com>
Subject: Risks of Rogue WiFi on Navy ships (Navy Times)

https://www.navytimes.com/news/your-navy/2024/09/03/how-navy-chiefs-conspired-to-get-themselves-illegal-warship-wi-fi/

[Illegal in the sense it is not sufficiently trustworthy
and not certified? Or because it is Chinese or Russian?
Or all of the above and more? PGN]

------------------------------

Date: Sun, 1 Sep 2024 18:10:17 -0700
From: "Jim" <jgeissman@socal.rr.com>
Subject: In feud with Musk, Brazilian justice restricts access to X
(LA Times)

Internet vs national sovereignty. The judge said Musk showed "total
disrespect for Brazilian sovereignty and, in particular, for the judiciary, setting himself up as a true supranational entity and immune to the laws of each country."

http://enewspaper.latimes.com/infinity/article_share.aspx?guid=c8f44e6b-67e5-4931-974e-f5e1c1fcc546

------------------------------

Date: Sat, 7 Sep 2024 12:45:46 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: North Korea Aggressively Targeting Crypto Industry with
Well-Disguised Social Engineering Attacks (IC3)

The Democratic People's Republic of Korea ("DPRK" aka North Korea) is conducting highly tailored, difficult-to-detect social engineering
campaigns against employees of decentralized finance ("DeFi"),
cryptocurrency, and similar businesses to deploy malware and steal
company cryptocurrency.

North Korean social engineering schemes are complex and elaborate,
often compromising victims with sophisticated technical acumen. Given
the scale and persistence of this malicious activity, even those well
versed in cybersecurity practices can be vulnerable to North Korea's determination to compromise networks connected to cryptocurrency
assets.

North Korean malicious cyber actors conducted research on a variety of
targets connected to cryptocurrency exchange-traded funds (ETFs) over
the last several months. This research included pre-operational
preparations suggesting North Korean actors may attempt malicious
cyber activities against companies associated with cryptocurrency ETFs
or other cryptocurrency-related financial products.

https://www.ic3.gov/Media/Y2024/PSA240903

------------------------------

Date: 30 Aug 2024 13:16:34 +0200
From: risks@sctb.ch
Subject: Five-day O2/Telefonica DSL outage in Berlin, Germany

Monday morning we arose to find ourselves with water, heat, and electricity, but not Internet.

We phoned O2, the provider in question, and in doing so discovered their customer support phone number was also out of action: "this number cannot
be called, please contact customer support immediately!"

We then tried to log in on their website to our account, which turned out
to be 404.

We then tried live chat and was told there was indeed an outage.

Fast-forward to early Friday afternoon (when I now write), and we contacted live chat one more time, prior to changing provider, to see if we could get
an ETA, and were told the outage had been resolved late Friday morning.

Fast-forward to early Friday afternoon (when I now write), and we contacted live chat one more time, prior to changing provider, to see if we could get
an ETA, and were told the outage had been resolved late Friday morning.

Power cycling the modem brought us back on line (which was unexpected - I expected the modem to recover by itself).

We asked what happened. Translated from German;

"A general outage which could be fixed from a distance."

So, there was a five day outage, we were not notified when it occurred, or
when service resumed, there was no ETA for repair, and there has been no explanation of what happened.

I write to RISKS to enquire if anyone here knows anything about what happened?

(I have to say, I wish there were small, local providers we could turn to.
The service here is what you get with large companies; they can't be
different. If you want different, you need to go to a small company.)

------------------------------

Date: Sat, 7 Sep 2024 13:00:25 -0700
From: geoff goodfellow <geoff@iconia.com>
Subject: What The CrowdStrike Outage Can Teach Us about Testing
and Failure Modes (Packet Pushers)

Scratch the surface of the Crowdstrike failure, and you'll find more
than testing and process failures. You'll find lessons about
complexity, unintended consequences, and bringing humility with you
during changes made at scale.

https://packetpushers.net/blog/what-the-crowdstrike-outage-can-teach-us-abo= ut-testing-and-failure-modes/

------------------------------

Date: September 7, 2024 at 0:12:35 JST
From: Edward Hasbrouck <edward@hasbrouck.org>
Subject: Visa required for EU entry starting next year

[via Dave Farber's IP distribution]

What has not been mentionedm in most reports is that the set of=
planned EU restrictions on non-EU (non-Schengen, actually) citizens are all modeled on measures the U.S. has already implemented and encouraged other countries to adopt, as I discuss in a report for the Idenity Project:

Planned new European travel restrictions follow U.S. precedents and pressure

Citizens of the U.S.A and some other most-favored nations have long been
able to travel to many European countries for tourism or business without
visas or pre-arrangements and with minimal border formalities, as long as
they didn't stay too long or seek local residence or employment.

This is scheduled to change with the imposition of new controls on
foreigners -- including U.S. citizens -- visiting Europe starting in November 2024. This is to be followed by a further ratcheting up of control and surveillance of foreign travelers to Europe scheduled for some time in 2025.

Some U.S. citizens are likely to be shocked and humiliated -- as any
traveler anywhere in the world should be, regardless of their citizenship. subjected to fingerprinting and mug shots and additional questioning on
arrival in Europe and, starting next year, a de-facto visa by another name
-- to be that they will have to apply, pay for, and have approved in
advance.

European citizens can and should object to the imposition by their
governments of these new restrictions on foreigners, including foreign
tourists and business visitors and foreign citizens who reside in Europe. Europe could, and should, set a better example of respect for freedom of movement as a human right that shouldn't depend on citizernship.

But U.S. citizens who object to these new European measures should direct
their objections and, more importantly, their agitation for changes in
travel rules to the U.S. government.

These impending new European travel control and surveillance measures are modeled on systems developed, already in use in, and actively promoted to European and other governments around the world by the U.S. government.

By its precedents and international pressure, the U.S. government is making travel more difficult for everyone, including U.S. citizens, everywhere in
the world including in Europe. [...]

More: https://papersplease.org/wp/2024/09/06/planned-new-european-travel-restrictions-follow-us-precedents-and-pressure/

------------------------------

Date: Sun, 1 Sep 2024 22:13:03 -0600
From: Matthew Kruk <mkrukg@gmail.com>
Subject: Russian 'spy whale' found dead off Norway (BBC)

https://www.bbc.com/news/articles/cje2p3z8nlyo

A beluga whale suspected of having been trained as a spy by Russia has been found dead off the Norwegian coast.

The body of the animal -- nicknamed Hvaldimir -- was found floating
off the south-western town of Risavika and taken to the nearest port
for examination.

The whale was first spotted in Norwegian waters five years ago with a GoPro camera attached to a harness that read "Equipment of St Petersburg".

This sparked rumours the mammal could be a spy whale - something experts
say happened in the past. Moscow never responded to the allegations.

[But the whale had a visa from St. Petersburg and the Norwegian
s(t)urgeon might have discovered it was actually smuggling Beluga
caviar into Norway? PGN]

------------------------------

Date: Sat, 31 Aug 2024 11:03:31 +0300
From: Amos Shapir <amos083@gmail.com>
Subject: Re:_Moscow's Spies Were Stealing U.S. Tech, Until
the FBI Started a Sabotage Campaign (Politico, Risks-34.43)

According to legend, Digital Equipment's CVAX microchip had an
inscription etched into the silicon which said, in Russian,
"*CVAX... when you care enough to steal the very best*"

(Source: https://en.wikipedia.org/wiki/VAX)

------------------------------

Date: Sat, 31 Aug 2024 14:46:43 -0400
From: Cliff Kilby <cliffjkilby@gmail.com>
Subject: Foreign Policy: TikTok ban & global data commons

IMHO, the TikTok ban and other similar stunts with X nee Twitter, Telegram, WeChat et al is theatre.

If I may bard for a moment:
Oh noes, the chinas haz our datas!
(please ignore the fact that by law your voter registration, voter participation, and tax records are public)
If we ban the china your datas will be safe!
(except you have no/little legal recourse to deal with a company that has allowed your PII to become public, so any data that leaks is your own fault
for providing it)

I know the EU has GDPR and recourse to punish a company that improperly
handles SPI/PII. The US doesn't even recognise SPI, and dropping a lorry
full of PII in the nearest Aldi carpark is ... not a crime?
But if anyone reports they found a lorry full of PII in the carpark,
they'll get sued.

https://arstechnica.com/security/2024/08/city-of-columbus-sues-man-after-he-dis closes-severity-of-ransomware-attack/

There can be no meaningful global commons of data without a global right to privacy and right to be forgotten.

In my layman's understanding of the current state of the legal framework,
you can't stop something as large as a google from direct marketing to you
from illegally harvested data, if that data passed through one US company.
And that one US company only has to say they found it on the internet to (apparently) convert it to legally obtained data. I cite the ongoing LLM training debacle.
https://futurism.com/video-openai-cto-sora-training-data
LLM law of finder's keepers: we don't know where the data came from, but it
was on the internet.

In case my tone belies my beliefs, allow me to unvarnishedly say: All
customers should stop doing business with all companies who are not
beholden to a legal right to privacy at least as robust as GDPR. But,
I cannot be mad at the consumers.

In most cases, they have no choice.

------------------------------

Date: Sat, 7 Sep 2024 22:18:54 -0400
From: Monty Solomon <monty@roscom.com>
Subject: How Telegram Became Criminals’ Favorite Marketplace (WSJ)

[Re: RISKS-34.42 and 34.43 for earlier items. PGN]

Arrest of founder Pavel Durov has drawn fresh attention to how pedophile
rings, identity thieves and drug traffickers use the app as a shop window to sell their wares. https://www.wsj.com/business/telecom/how-telegram-became-criminals-favorite-marketplace-8c824dfb

How Telegram Became a Playground for Criminals, Extremists and Terrorists Drug dealers, scammers and white nationalists openly conduct business and spread toxic speech on the platform, according to a Times analysis of more than 3.2 million Telegram messages.
https://www.nytimes.com/2024/09/07/technology/telegram-crime-terrorism.html

------------------------------

Date: Fri, 30 Aug 2024 11:23:01 -0400 (EDT)
From: ACM TechNews <technews-editor@acm.org>
Subject: Telegram Founder's Indictment Thrusts Encryption into the
Spotlightooo (NYTimes)

Mike Isaac and Sheera Frenkel, *The New York Times*, 30 Aug 2024, via ACM TechNews [See RISKS-34.42 and 43 for earlier items.]

Telegram CEO Pavel Durov's indictment in France for various criminal
offenses includes accusations that the messaging platform had provided cryptology services aimed at ensuring confidentiality without a
license. Encryption has been a long-running point of friction between governments and tech companies, with the latter arguing it is crucial for digital privacy, while the former say it enables illegal activity.
Telegram's encryption does not offer the same transparency as encryption provided on other messaging platforms.

------------------------------

Date: 30 Aug 2024 16:35:15 -0400
From: "John Levine" <johnl@iecc.com>
Subject: Re: Telegram billionaire co-founder Pavel Durov arrested
(Turgut Kalfaoglu, RISKS-34.42)

There has been a dismaying amount of ill-informed pontification about the
Durov case.

A key fact is that Telegram is not, I repeat NOT, an encrypted chat. If you
are talking to one other person it is possible to turn on optional
encryption using a home-brewed scheme of unknown strength. But nearly all of the traffic is group chats and they are not encrypted at all.

The main issue appears to be that when governments ask Telegram for
help dealing with material that is egregiously illegal, such as
terrorism or CSAM, they don't, even though they could. No government
is going to put up with that for long.

More info here:

https://www.emptywheel.net/2024/08/29/the-missing-detail-about-encryption-in-th e-pavel-durov-investigation/

------------------------------

Date: Wed, 4 Sep 2024 08:54:19 -0400
From: Dylan Northrup <northrup@gmail.com>
Subject: Re: Feds sue Georgia Tech for lying bigly about computer
security (RISKS-34.42)

"There is a current trend toward blindly applying high-level
security rules to all computers in an organization, regardless of
their purpose and existing defenses." You mean base-lining?

I'd contend it's not the fact a baseline is being set, but where it's being set.

If the "hired-gun outsider" declares there's not a reason for 'ssh' to be available (because they're applying rules crafted for Windows hosts),
does that make it true?

Security policies should be created in consultation with the
administrators of those systems. All too often, however, they are
unilaterally imposed by outside entities. Security organizations

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)