Geigner's Effect: CDPR Breach Worse Than Originally Reported, Because Of Course

from the this-is-the-way,-unfortunately dept

There has been a theorem proposed on these pages, originally by Mike himself, for a long time that goes something like this: when a data breach is first reported in the news, the severity of the breach is always, always, always underreported and there will eventually be an admission that the breach was much worse. Despite this not having been my original idea, I nonetheless slapped my name on it and called it The Geigner Effect. If that sort of name-slapping is good enough for former US Presidents, it's damned well good enough for me.

Anyway, an example of this is Ninteno's 2020 breach, where user data for the Nintendo Network was stolen, with the number of reported accounts effected magically doubling from 140k to 300k after a few months. It's also happened with Equifax, TJX, and even our own federal government. Perhaps most infamously, it also occurred when Yahoo acknowledged there was an email breach of a few hundred thousand accounts in 2013 that grew and grew over subsequent reports until, eventually in 2017, Yahoo acknowledged that literally every account had been affected.

In February, game studio CD Projekt Red acknowledged a breach of their corporate network. That breach was mostly for corporate assets, including source code for several games along with data from CDPR's "accounting, administration, legal, HR, investor relations, and more". Held for ransom, there was no mention in the ransom note one way or the other if user data was effected. CDPR for its part indicated it would not be giving into any monetary demands by the nefarious actors, but indicated it was working with law enforcement authorities to investigate the incident.

“We will not give into the demands nor negotiate with the actor, being aware that this may eventually lead to the release of compromised data,” the company writes. CD Projekt Red writes that it does not believe the breach contains personal data from players.

“We have already approached the relevant authorities, including law enforcement and the President of the Personal Data Protection Office, as well as IT forensic specialists, and we will closely cooperate with them in order to fully investigate the incident,” the company writes.

And, well, that's been it since February. For the lay observer, this looked like CDPR's systems and data had been restored from backup and that whatever work the authorities had done must have had a good effect, as no more information was released. For all the world, it appeared as though there was no real fallout from any of this.

Until this past Thursday, "coincidentally" the same day that E3 kicked off, when CDPR came out and admitted that the fallout from the breach both very much happened and is still going on.

As the entire gaming world laser-focused on Geoff Keighley’s sartorially questionable sneakers during the Summer Game Fest Kickoff Live! event, Cyberpunk 2077 studio CD Projekt Red released a statement regarding a February cyberattack against the company. Turns out, that data breach could not be contained.

“Today, we have learned new information regarding the breach, and now have reason to believe that internal data obtained during the attack is currently being circulated on the internet. [...] We are not able to confirm the exact contents of the data in question, though we believe it may include current/former employee and contractor details in addition to data related to our games,” CDPR wrote in a tweet published at 2:39 p.m. ET, smack in the middle of today’s hotly anticipated showcase of video gaming advertisements.

This is the gaming industry equivalent of the old axiom: if you have to break news you really want to bury, break it at 5p on a Friday. In this case, CDPR was obviously attempting to limit the exposure of this news by announcing it just as the entire gaming world was focused on the start of E3. Why?

Well, perhaps it has something to do with just how vague CDPR is still being about what it lost in this data breach.

Today’s statement doesn’t say whether or not players of CDPR’s games were affected. Representatives for CDPR did not immediately respond to Kotaku’s request for comment.

That silence is not a good sign. Either CDPR doesn't know if user data was included in the breach, or it does know and doesn't want to say. That would indicate that the answer to the question of whether CDPR's customers' data is out there in the wild is somewhere on a spectrum of "yes" and "maybe".

And if the Geigner Effect holds true, one could expect a follow up post to this one on exactly that topic.

Filed Under: breach, breach reporting, geigner's effect, under-reporting
Companies: cd projekt red

Study Shows Disney, Netflix Continue To Dominate Traditional TV In Customer Satisfaction

from the give-them-what-they-want dept

There's just something about terrible customer service, high prices, and sketchy product that consumers oddly don't like. American consumers' dislike of traditional cable TV providers was once again made clear this week in a new study by the American Consumer Satisfaction Index, which tracks US consumer approval of companies on a 100 point scale. As has long been the case, the full report shows most traditional cable TV, satellite, or IPTV providers languishing somewhere in the mid 60s -- scores that are bested by a long line of industries and government agencies (including the IRS).

While the report shows that streaming did drop 2.6% to a score of 74 (thanks in part to COVID-era network strain and demand), that's still significantly better that most broadband and cable TV ratings, which remain mired in the 50s and 60s:

Compare that to streaming, which provides consumers with cheaper service, greater flexibility, and better customer service:

The cable industry was already struggling in early 2020, when a record number of cable customers "cut the cord" and flocked to over the air or streaming alternatives. That was before a pandemic came to town. But with live sports less consistent and folks desperate to cut costs as they struggled to pay rent, the trend simply exploded in the second half of last year. The number of folks still paying for traditional cable has now dropped more than 22.8% from pay TV's peak back in 2014. But by the end of 2024, analysts expect that fewer than half of US homes will subscribe to a traditional pay TV service.

One survey predicts that 27 percent of US households are planning to cut cable TV from their budgets this year. That's quite an explosion for a trend that cable and broadcast executives have spent a decade pretending wasn't actually happening (it was), wasn't a big deal (it was), was only something poor losers do (studies repeatedly proved this claim false) or would rebound once Millennials began seriously procreating (that didn't happen).

It's an ongoing lesson for the oodles of cable and broadcast executives who have been wrong about this phenomenon. For giant telecom incumbents their only saving grace is the fact that their monopolies over broadband access in many markets means the bloodshed isn't quite as bad as it otherwise would be, as they can simply extract their pound of flesh via price hikes on your broadband bill.

Filed Under: customer reputation, customer satisfaction, customer service, streaming, tv, video
Companies: comcast, disney, netflix

High School Responds To Student's Prank By Asking Local Law Enforcement To Step In And Investigate

from the now-who's-acting-like-a-child? dept

I see we're still handling things stupidly when it comes to school disciplinary problems. For years now, many schools have been steadily abdicating their responsibilities, allowing in-school law enforcement (commonly called "School Resource Officers") to hand out discipline that school administrators used to handle themselves.

This hasn't worked out well for students. It has turned standard discipline problems into police matters and given students a head start on having their futures ruined for juvenile (in all senses of the word) mistakes.

Recently, a high school in Glastonbury, Connecticut was horrified to find it had been pranked. The Hartford Courant's first pass at the breaking news opened with this:

An inappropriate quote has halted distribution of Glastonbury High School’s 2021 yearbooks and police have been called to investigate, the principal confirmed Monday.

How does an "inappropriate quote" become the subject of a police investigation? The rest of the reporting didn't explain. Neither did school administrators. But they did hint it had something to do with bullying.

A student using a false name submitted the quote printed in the yearbook, which was being distributed, Principal Nancy Bean wrote to students and parents on Friday.

Bean would not describe the quote, but she wrote, “We are saddened and distressed by what happened. Acts of bias, bullying and cruelty are not acceptable at our school. We are committed to ensuring all Glastonbury High School students feel safe and supported.”

While it may have been possible some sort of stalking or harassment was taking place that might have merited a law enforcement response, the principal's explanation that the quote had been "submitted" by a student using a fake name suggested nothing more than a bored student taking the high school for a ride.

Later reporting filled in more details. But it still didn't explain why the school felt compelled to involve the police. Nor did it explain why the police felt compelled to remain involved.

A quote by Adolf Hitler inserted into Glastonbury High School’s 2021 yearbooks has halted distribution of the yearbook and police have been called to investigate.

A student using a false name submitted the quote printed in the yearbook, which was being distributed, Principal Nancy Bean wrote to students and parents on Friday. The quote under a student’s photo was attributed to George Floyd, the Black man killed by police one year ago in Minnesota, a photo of the yearbook entry sent to The Courant Monday afternoon showed.

That it involved George Floyd's name and Adolph Hitler's words still doesn't make it a crime. And, again, the principal said a student "submitted" the quote. Those vetting the yearbook before publication failed to catch it. A prank isn't a crime, no matter how terrible it made administrators feel once they realized they'd been tricked into publishing (and distributing) a Hitler quote.

Since the original reporting, a few more details have come to light. And there's still nothing that suggests a criminal act has occurred. It only suggests the school needs better editors and/or a more tightly-controlled submission system.

In an email to the school community, Glastonbury High School’s principal and the district’s superintendent said the quote — which appeared under a student’s photo — was submitted by a different student using a false name. They said they also uncovered an offensive quote glorifying war and an entry, which referenced the “Boston Bomber.” The district’s priority is supporting the students, who were victimized by this act.

Fast forward to a couple of days past the point of the original reporting and a new narrative is being developed, possibly to justify the involvement of law enforcement.

A letter released by the Glastonbury school superintendent said the student gained access to a computer system and submitted a quote from Adolf Hitler, but falsely attributed the message to George Floyd.

"Gained access." That's incredibly vague. If a student had hacked a secure system or accessed administrative systems they had no authority to access, it might be a crime. But only "might." And only if prosecutors are willing to abuse badly-written laws to convert a prank into criminal charges.

The Glastonbury Police were a little more direct in the statement given to Newsweek:

"Although we find the quote to be disturbing, our criminal investigation is not focused on the content of the quote itself, but instead we are focused on investigating the unauthorized access of a computer system through which students submitted their quotes to be published in the yearbook."

This still doesn't explain anything. The official statement from the school superintendent makes no mention of unauthorized access. It also notes the student has already been punished by the school for this prank. All the letter says is the student used a fake name to submit fake quotes. That's not illegal, no matter how embarrassed school officials feel. And this never would have been the end result if schools hadn't become increasingly comfortable outsourcing their disciplinary problems.

Filed Under: cfaa, connecticut, glastonbury, hacking, kids, police, pranks, school resource officers, schools, students, unauthorized access

Chinese Government Now Using National Security Law To Censor Art Being Displayed In Hong Kong

from the less-freedom-for-all;-tiny-Chinese-flags-for-others dept

Hong Kong's new "national security" law -- thrust on it by the Chinese government that's supposed to stay out of Hong Kong's governmental business until 2047 -- continues to increase the amount of censorship in the supposedly still-independent region.

Once the Chinese government began interfering, Hong Kong residents revolted. This only encouraged the Chinese government to apply a heavier hand. The new law allows prosecutors to seek life sentences for anti-government protesting. It also hands police the power to censor the internet and compel assistance to decrypt communications.

To further ensure its desires go unchallenged, the Chinese government adopted a resolution that forced four pro-democracy legislators out of office in Hong Kong. This led to another dozen sympathetic lawmakers resigning from their positions in protest. Unfortunately, this means there are even fewer Hong Kong politicians willing to stand up to the Chinese government's impositions.

The national security law has already enabled the punishment of dissent, censored the internet, silenced pro-democracy press, and ousted pro-democracy legislators. Now it's coming for culture, seeking to limit Hong Kong residents to government-approved creative works.

The updated rules announced Friday require Hong Kong censors considering a film for distribution to look out not only for violent, sexual and vulgar content, but also for how the film portrays acts “which may amount to an offense endangering national security.”

Anything that is “objectively and reasonably capable of being perceived as endorsing, supporting, promoting, glorifying, encouraging or inciting” such acts is potential grounds for deeming a film unfit for exhibition, the rules now say.

This gives China-approved censors the freedom to forbid anything they perceive as being anti-China. And it's not just limited to content. The rules also allow films to be censored if the perceived "effect" of viewers of the work might cross the multiple lines the Chinese government says now threaten the security of the nation.

The new rules have already had their intended impact on theaters and filmmakers, including those participating in an annual Hong Kong film festival.

A local cinema was pressured into scrapping the screening of a documentary on the fierce clashes between police and radical protesters occupying the Hong Kong Polytechnic University at the height of the social unrest, while the M+ Museum in the city’s cultural hub came under similar pressure not to show exhibits deemed to be anti-China art.

In a separate development on Friday, organisers of the Fresh Wave International Short Film Festival, which nurtures local young film talent, cancelled its screenings for Far From Home, saying the Office for Film, Newspaper and Article Administration had failed to issue either a certificate of approval or notice of refusal to approve in time.

And so it continues. China isn't going to wait until 2047 to take control of Hong Kong. It wants subservience now. The pro-democracy protests that have rocked Hong Kong for the past few years will continue. But it looks as though China's national security mandates will ultimately turn Hong Kong into a directly controlled subsidiary of the Chinese government a couple of decades ahead of schedule.

Filed Under: censorship, china, culture, free speech, hong kong, national security

Hypocrisy: Rupert Murdoch Has Always Hated Antitrust; But Now He Wants It Used Against Internet Companies Who Out Innovated Him

from the the-cronyiest-of-capitalists dept

It's no secret that Rupert Murdoch is an extreme hypocrite. He spent decades railing against any kind of regulatory powers to hold back companies, but as soon as his own attempts to build an internet empire flopped dramatically, he's come around to being a major booster of regulatory crackdowns. Just only against the companies who out-innovated him. For years now he's been demanding that governments force the internet companies to pay him money -- a move that has been successful in his home country of Australia.

The latest is that Murdoch, who built his business empire by buying up competitors and doing everything possible to avoid antitrust authorities, is now a major force behind supporting antitrust efforts -- so long as they're aimed at the internet companies. When the Democrats released their 5 antitrust proposals last week, each one (perhaps somewhat surprisingly) had a Republican co-sponsor. That appears to have been thanks to Murdoch:

Fox Corp. and News Corp. lobbyists have been urging GOP members to support the bills this week, according to people familiar with the efforts, with two sources saying there could be as many as 3 to 4 GOP co-sponsors on each bill. Talks are ongoing....

Say what you want about Rupert Murdoch, but the idea that he's a free marketer and against regulations is nonsense. That was only true when the regulations involved his companies. Now that he's failed to innovate, he's spent the last decade demanding that governments punish the companies who actually competed better than he did. He's the cronyist of the crony capitalists.

Filed Under: antitrust, competition, congress, innovation, rupert murdoch
Companies: news corp.

Daily Deal: The 2021 CompTIA Master Training Bundle

from the good-deals-on-cool-stuff dept

The 2021 CompTIA Master Training Bundle has 11 CompTIA exam prep courses. The courses cover Cloud Essentials, PenTest+, Core 1and 2, Linux, Cybersecurity, and more. It's on sale for $50.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

Buried Apple Privacy Scandal Undermines Its Attacks On Right To Repair Legislation

from the do-as-we-say,-not-as-we-do dept

Apple has never looked kindly upon users actually repairing their own devices. The company's ham-fisted efforts to shut down, sue, or otherwise imperil third-party repair shops are legendary. As are the company's efforts to force recycling shops to shred Apple products (so they can't be refurbished and re-used). As is Apple's often comical attacks on essential right to repair legislation, which usually involves the company insisting that allowing broader independent and consumer repair of their devices would be a security and privacy nightmare.

Yeah, about that. Apple last week was revealed to have paid a multi-million dollar settlement to an Oregon woman after iPhone repair technicians uploaded explicit images and videos to the internet from a phone that she sent in for repair. In this case, the culprits were employed by one of Apple's "authorized" repair contractors, Pegatron Technology Service in California. These authorized techs then uploaded the woman's private conversations and photos to the internet, making it look as if she had done it:

"The videos were uploaded to appear as though the woman herself had shared them on purpose, according to the documents, causing the woman “severe emotional distress”. The woman was made aware of the incident when friends saw the videos and images on Facebook. The woman sued Apple and eventually settled with the company for a multi-million dollar sum. But Apple was never directly named in the lawsuit in an effort to keep the matter confidential."

The revelation comes on the heels of a previous instance where an Apple store employee did something very similar. The latest screw up, subsequent payoff, and attempt to bury the settlement rather undermines Apple's longstanding argument that its own repair process is somehow superior to independent repair shops, and that by making it easier to repair consumer devices, consumers face all manner of alleged privacy and security harm (even if a recent bipartisan FTC report found that wasn't actually true).

The inconsistency was quickly seized upon by right to repair advocates, who note that Apple has lobbied intensely against the right to repair legislation that has been proposed in more than half of states in 2021 alone. Usually using what right to repair advocates describe as the "benevolent monopoly" argument

"Paul Roberts, a Right to Repair advocate and founder of SecuRepairs.org, calls this argument the “benevolent monopoly” argument. Yes, we have taken your choices away from you, the reasoning goes, but we did it to protect you from making the wrong choice or being tricked. Science fiction author and activist Cory Doctorow describes Apple’s model as “digital feudalism,” with the company acting as “warlord,” forcing citizens to stay within its walls and to abide by its rules."

But the choice of who should repair devices consumers, John Deere tractor owners, or hospitals own shouldn't be left up to the manufacturer. Especially if that manufacturer is attempting to monopolize repair in a way that's not only harmful to customers, but the planet itself.

Filed Under: authorized repair, privacy, revenge porn, right to repair
Companies: apple

Two States Pass Laws Limiting Law Enforcement Access To Private DNA Services

from the catching-up-with-the-cops-who-have-already-caught-up-with-the-tech dept

One of the more recent opportunities for law enforcement in the Third Party Doctrine space has been DNA databases. A number of companies offer on-demand DNA testing, allowing users to check themselves for potential markers that could indicate susceptibility to diseases or just to figure out where they fit in in the world by linking them to distant relatives they may not be aware of.

Since users are sharing this potentially-sensitive info with DNA companies and other users, law enforcement illogically thought they wouldn't mind sharing it with cops. At least one company believed this as well, informally deputizing its user base as involuntary providers of DNA evidence.

A whole lot of Wild Westing ensued. Some investigators used subpoenas, believing it was third party data that carried no expectation of privacy. Others used warrants, but used them to access the entire contents of third party DNA databases. Cops even created fake accounts to upload DNA samples to find matches in cases that had gone cold.

This mostly-voluntary patchwork of legal paperwork/legal theories is now being codified into something coherent and subject to at least some judicial oversight. As the New York Times reports, two states have recently passed laws governing the use of private companies' DNA databases by law enforcement.

Beginning on Oct. 1, investigators working on Maryland cases will need a judge’s signoff before using the method, in which a “profile” of thousands of DNA markers from a crime scene is uploaded to genealogy websites to find relatives of the culprit. The new law, sponsored by Democratic lawmakers, also dictates that the technique be used only for serious crimes, such as murder and sexual assault. And it states that investigators may only use websites with strict policies around user consent.

Montana’s new law, sponsored by a Republican, is narrower, requiring that government investigators obtain a search warrant before using a consumer DNA database, unless the consumer has waived the right to privacy.

The Maryland law is obviously the stronger of the two. It would steer investigators away from more law enforcement-receptive sites like FamilyTreeDNA, which opts users into sharing information with law enforcement by default. It would also prevent investigators from creating fake accounts to perform DNA searches, unless specifically approved by a judge.

It also mandates destruction of information obtained from DNA databases at the conclusion of investigations. And, perhaps most importantly, it forces investigators to utilize the government-owned DNA database (Codis) before approaching private third parties.

The Montana law is better than nothing, but it still needs more work. While it does erect a warrant provision, it allows that to be waived if the "consumer" consents to the search. Given that most databases attempt to link people by DNA, consent given by one person has the potential to subject lots of other people to searches they never agreed to.

But these are both positive steps. Just another 48 states to go. The relentless advance of technology often has cops claiming they're being left behind, outpaced by criminal early adopters. But the opposite is more often true. Law enforcement moves quickly to take advantage of new tech, rushing out ahead of court precedent and legislation to exploit tech advances legislators could never have anticipated. And when the loopholes begin closing, law enforcement will switch back to complaining about the "loss" of its lawless spaces. For now, two states are better protected than the rest of the nation. Hopefully, more legislatures will recognize this is an issue they can no longer ignore.

Filed Under: dna, dna databases, maryland, montana, third party doctrine

Funniest/Most Insightful Comments Of The Week At Techdirt

from the speak-softly dept

This week, our first place winner on the insightful side is an anonymous response to Denuvo's claim that its DRM has no performance impact on users' machines whatsoever:

It takes up 500MB, which will use drive I/O when it loads. That's a performance impact. It uses CPU cycles when it runs. That's a performance impact.

If they wanted to argue that there was a negligible, unnoticeable performance impact, that's one thing. But to deny any impact at all? That's a flat-out lie.

In second place, it's Samuel Abram with a note on our post about the "map of the internet" visualization:

Of course, the credit should be given to Randall Munroe who–in his sublime XKCD webcomic–created the idea of web sites' traffic as literal land masses.

I'm glad someone else took the mantle from him.

For editor's choice on the insightful side, we've got a pair of comments about Ohio's bizarre lawsuit against Google. First, it's ladyattis with a summary:

It's all about control

Seriously, my subject line says it all. They're not about their principles or their ideology, it's all about control. If they can't "trust the market" to protect their peculiar set of values then they'll burn the whole thing down out of spite. It borders on abusive behavior that you see in some dysfunctional relationships (particularly from the abuser in the relationship). I don't think legal analyses will help here, I think these folks need a shrink to work over their neuroses.

Next, it's sorrykb picking up on a comparison we made in the post, noting how it would be nonsense to claim encouraging people to eat more vegetables means you want to put everyone on an all-plant diet all the time:

Of course it’s nonsense. It’s also exactly what the GOP did earlier this year.

Nonsense is their brand.

Over on the funny side, our first place winner is Bobvious with an update to a classic quote:

"it is difficult for an influencer to understand something when their raison d'etre depends upon not understanding it" - Upton Sinclair (Millennial Edition)

In second place, it's Yakko Warner responding to the copyright lawsuit against Roblox with an old and fairly timeless lyric:

"It doesn't matter if you're a grandma or a seven-year-old girl,
They'll treat you like the evil hard-bitten criminal scum you are."

--Weird Al Yankovic, Don't Download This Song

For editor's choice on the funny side, we start out with one more comment from that post, in which an anonymous commenter made another reference to an even earlier era of anti-piracy:

Still waiting for home taping to kill music already.

Finally, it's That One Guy, who reacted to a study suggesting misinformation takedowns can lead more people to believe false stories by hatching a plan:

Only one thing to do...

Time to make a series of videos pointing out how vaccines absolutely work and are a great way to cut down on avoidable death and suffering, eating healthy is a good thing along with exercise and you should always strive to verify what someone's telling you and maintain a healthy sense of skepticism. After this I'll find some way to get the videos taken down(slipping in a few seconds of copyrighted music or video should do the trick nicely) and I'll then use the fact that the videos were removed as evidence that what's in them is true.

That's all for this week, folks!

This Week In Techdirt History: June 6th - 12th

from the and-then-and-then-and-then dept

Five Years Ago

This week in 2016, there were lots of stories about questionable actions by the FBI, and amidst all that, the agency turned down our FOIA request to find out how much money they spent getting into Syed Farook's iPhone. A worrying appeals court ruling chipped away at privacy while Senator Jeff Sessions was seeking to blast a giant hole in the Fourth Amendment. We learned more about the NSA's handling of Ed Snowden's concerns prior to his leak, and took a look at how despite all the supposed damage, the agency was doing great. This was also the week that Gawker filed for bankruptcy.

Ten Years Ago

This week in 2011, the RIAA was arguing that changing copyright terms is unconstitutional, though only if they get shorter, while the Supreme Court agreed to hear the Golan case examining the opposite. YouTube added Creative Commons licensing options for videos while Russia's president proposed baking similar options right into copyright law. ICE declared victory in its domain seizure campaign while Homeland Security appeared to be stalling on related FOIA requests. Meanwhile, the ridiculous prosecution of whistleblower Thomas Drake was falling apart and by the end of the week, Drake took a plea bargain deal.

Fifteen Years Ago

This week in 2006, long before ICE's domain seizures, we wondered why the US government was getting involved in takedowns of foreign music sites. We also took a look at the negative impact of the DMCA on innovation, and the way that the music industry's efforts to shut down sites often served as free advertising via the Streisand Effect — and the same was true with the movie industry, as was soon demonstrated by the MPAA going after Isohunt. Meanwhile, the copyright industries were trying to sneak through a huge and insane change to the law around "incidental copies". Blizzard relented on its attempts to block third-party World Of Warcraft game guides, the story of how Canada's "Captain Copyright" propaganda mascot might himself be a copy continued to develop, and we were surprised when some British politicians appeared to have reasonable views on copyright.

Filed Under: history, look back