UK Wing Of TikTok Swears It Isn't Helping The Chinese Government Oppress Uighur Muslims

from the but-would-you-swear-on-this-stack-of-little-red-books? dept

China doesn't have a problem with censorship. By that, I mean the Chinese government sees no problem with its ever-expanding censorship of speech it doesn't like. While China appears to have embraced capitalism, it hasn't embraced the democratic accoutrements that normally accompany a move towards a more free society.

The government doesn't like to be criticized, so it has engaged in several efforts to censor speech by people arguing for less censorship and a better government. These efforts have been greeted with some creative responses by citizens, but the government flips the internet kill switch on and off as needed, denying citizens access to something most people around the world consider to be as essential as tap water.

As if that weren't enough to keep speech in line, American companies and… um… sportsball concerns have cooperated with censorship efforts to appease the Chinese government with the end goal of accessing China's billion-strong user base.

The crackdown on speech is far more pronounced in one region of the country, where the government has targeted certain citizens -- more than one million Uighur Muslims -- with ever-increasing censorship, along with the killings and disappearings China has historically deployed against those on its expansive persona non grata lists.

A number of US companies have helped the Chinese government oppress Uighur Muslims. Unsurprisingly, a Chinese company is doing the same thing. TikTok, the social media upstart that has irrationally angered the Trump administration, has admitted its contribution to the government's persecution of its least favored citizens. This includes efforts made by TikTok's moderation teams located in other countries where one would (very hopefully) assume the Chinese government's demands are free to be ignored. Unfortunately, this doesn't appear to be the case.

At a UK parliamentary committee hearing on Wednesday, Elizabeth Kanter, TikTok's UK director of public policy, was asked by Conservative MP Nusrat Ghani whether the app had quashed content about the Uighur crisis in Xinjiang, where at least 1 million Uighur Muslims and other minorities have been detained in so-called "reeducation camps."

According to TikTok's UK director, it's policy of China-appeasing censorship in other nations is no longer a thing. But the explanation isn't very convincing.

"At that time we took a decision [...] to not allow conflict on the platform, and so there was some incidents where content was not allowed on the platform, specifically with regard to the Uighur situation," she said.

Supposedly, things are better now. All you have to do is trust TikTok's UK rep and your own eyes, I guess.

"If you look at the platform now and search for the term 'Uighur' on the TikTok app, you can find plenty of content about the Uighurs. There's plenty of content that's critical of China."

Sounds good. Or, at least, better. But requests for more detail by the UK government were greeted with vague reassurances that the new, more permissive policy has been in place "for at least over a year," but that as recently as "a couple of years ago," the UK wing of TikTok was still acting as an extension of the Chinese government.

ByteDance, the Chinese company that owns TikTok, has attempted to distance itself from the Chinese government and its censorship for a few years now. It operates a completely different social media service in China, putting a firewall between users located elsewhere and the Great Firewall the Chinese government has erected. But its home base is problematic. It's impossible to please both the Chinese government and its non-Chinese users who expect their content to be exempt from China's censorship efforts. The end result is, far too often, something that errs on the side of the Chinese government's demands.

TikTok isn't the security threat the Trump administration has frequently imagined it to be. (Well, it's no more of a threat to users and their personal info than several American companies…) But it is still a problem for users located outside of China, who expect their interactions to be unmolested by laws they're not obligated to follow.

Filed Under: censorship, china, content moderation, free speech, oppression, uighur, uk
Companies: bytedance, tiktok

Five Eyes Countries Band Together To Complain About Facebook And End-To-End Encryption

from the breaking-Messenger-will-leave-criminals-with-only-dozens-of-secure-options dept

The world's law enforcement agencies are back at it, advocating for the demise of end-to-end encryption. The last time they all got together like this, they were complaining to Facebook for thinking about adding encryption to its Messenger service.

Because Facebook does so well reporting child porn to the proper authorities, the proper authorities have gathered to decry its decision to encrypt this service, claiming it would result in a lot of unobserved child porn being passed between users. With Facebook unable to eavesdrop on messages, the images and videos can be shared unnoticed.

And, again, the international law enforcement community is asking for weaker encryption… and namechecking Facebook as the cause of and potential solution to all the world's child porn problems. The new "international statement" opens up with a united declaration that everyone loves encryption, before getting to the long list of "buts."

We, the undersigned, support strong encryption, which plays a crucial role in protecting personal data, privacy, intellectual property, trade secrets and cyber security. It also serves a vital purpose in repressive states to protect journalists, human rights defenders and other vulnerable people, as stated in the 2017 resolution of the UN Human Rights Council. Encryption is an existential anchor of trust in the digital world and we do not support counter-productive and dangerous approaches that would materially weaken or limit security systems.

Of course, that last sentence is a lie. At best, it's completely disingenuous. Almost immediately following this assertion that the undersigned have no intention or pursuing counterproductive/dangerous approaches, the Five Eyes crew (along with India and Japan) lists the counterproductive/dangerous ways they'd like encryption to be broken.

Particular implementations of encryption technology, however, pose significant challenges to public safety, including to highly vulnerable members of our societies like sexually exploited children. We urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content. We call on technology companies to work with governments to take the following steps, focused on reasonable, technically feasible solutions:

• Embed the safety of the public in system designs, thereby enabling companies to act against illegal content and activity effectively with no reduction to safety, and facilitating the investigation and prosecution of offences and safeguarding the vulnerable;

• Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight; and

• Engage in consultation with governments and other stakeholders to facilitate legal access in a way that is substantive and genuinely influences design decisions.

I'm not sure what sort of "strong encryption" can handle all of these weak spots being introduced without turning into something easily misused, but these government reps are pretty sure people at these companies will come up with something. These governments have convinced themselves they're "stakeholders" in private conversations between citizens that are facilitated by services like Facebook's Messenger.

And that's what this is about. The statement cites Facebook's success in handling child porn while trying to use that against it.

In 2018, Facebook Messenger was responsible for nearly 12 million of the 18.4 million worldwide reports of CSAM [child sexual abuse material to the US National Center for Missing and Exploited Children (NCMEC)]. These reports risk disappearing if end-to-end encryption is implemented by default, since current tools used to detect CSAM [child sexual abuse material] do not work in end-to-end encrypted environments.”

If this is true, then there's nothing else that can be done. Weakened encryption that allows Facebook to intercept users' messages does nothing for the millions of Facebook users who've never trafficked in illegal content. The company can either give users security and privacy, or it can give these governments what they want. There's no middle ground that's going to accommodate both groups.

And this push against Facebook is working. These statements were converted into news articles claiming Facebook is "responsible" for 94% of all reported child porn. But that wording suggests Facebook is the problem, rather than its users. Facebook made 94% of the reports, showing once again it's been doing what it can to combat the problem.

Its decision to offer encryption to Messenger users isn't being made lightly. It's aware of the downside. But it's also aware of the threat posed to its users by a number of malicious entities, which include authoritarian governments and state-sponsored hackers. If it wants to protect its millions of innocent users, it has to offer the same shelter to criminals using the service. That's how it goes. The middle ground governments think the private sector should nerd towards simply doesn't exist.

Filed Under: australia, backdoors, canada, encryption, five eyes, india, japan, new zealand, security, uk, us
Companies: facebook

16K COVID-19 Cases Go Missing In UK Due To Government's Use Of Excel CSVs For Tracking

from the excel? dept

Yes, yes, you're sick of hearing about COVID-19. Me too. But the dominant force of 2020 continues to provide news, often times with a technology focus. This mismanaged pandemic has already given us an explosion of esports, students gaming remote learning systems, and enough dystopia to make George Orwell vomit in his grave.

But to really get your anger bubbles gurgling, you need turn only to the myriad of ways far too many governments have taken a moment that requires real leadership and forethought, and pissed it all down their legs. America appears to be trying to lead the charge in this, with our shining city on the hill mostly being illuminated by headlights of cars carrying sick passengers looking to get tested for this disease. Still, we're not alone when it comes to sheer asshatery. The UK recently managed to lose thousands of COVID-19 cases... because it was tracking them in Excel CSVs.

The issue was caused by the way the agency brought together logs produced by commercial firms paid to analyse swab tests of the public, to discover who has the virus. They filed their results in the form of text-based lists - known as CSV files - without issue.

PHE had set up an automatic process to pull this data together into Excel templates so that it could then be uploaded to a central system and made available to the NHS Test and Trace team, as well as other government computer dashboards.

Public Health England (PHE) decided to put all of this information into a file using the XLS format. XLS was first introduced in 1987 and was replaced by the XLSX format over a decade ago. Putting aside the use of Excel to monitor positive COVID-19 cases in a major industrialized nation for just a moment, just the use of an antiquated format managed to lose PHE over sixteen thousand positive cases.

How? Well, XLS has restrictions as to how many rows of data it can record.

As a consequence, each template could handle only about 65,000 rows of data rather than the one million-plus rows that Excel is actually capable of. And since each test result created several rows of data, in practice it meant that each template was limited to about 1,400 cases.

When that total was reached, further cases were simply left off.

Which means the people that had COVID-19 weren't tracked for contact tracing. The government and its people didn't have a complete picture as to either the total case count for the disease, nor its positivity rate. In other words, the agency in charge of national health failed to keep the nation informed as to its risk exposure because it didn't know how to properly use a common office application that it repurposed to record COVID-19 data.

Labour's shadow health secretary Jonathan Ashworth said lives had still been put at risk because the contact-tracing process had been delayed.

"Thousands of people [were] blissfully unaware they've been exposed to Covid, potentially spreading this deadly virus at a time when hospital admissions are increasing," he told the House of Commons. "This isn't just a shambles. It's so much worse."

The UK's Health Secretary told the House of Commons that PHE had decided to replace the use of Excel, or what he called a "legacy system", two months ago. But apparently PHE hadn't gotten around to it yet.

And still hasn't, actually. In fact, PHE's plan to temporarily fix all of this is... more Excel!

To handle the problem, PHE is now breaking down the test result data into smaller batches to create a larger number of Excel templates. That should ensure none hit their cap.

But insiders acknowledge that the current clunky system needs to be replaced by something more advanced that excludes Excel, as soon as possible.

When you hear complaints that governments are not taking this pandemic seriously, this is what they mean.

Filed Under: covid-19, excel, public health england, uk

UK Tribunal To Decide Whether Gov't Agencies Can Continue To Pretend There's A Residency Requirement For FOI Requests

from the because-there-isn't dept

The UK's Freedom of Information law is pretty straightforward when it comes to residency requirements. There aren't any.

Anyone can make a freedom of information request – they do not have to be UK citizens, or resident in the UK. Freedom of information requests can also be made by organisations, for example a newspaper, a campaign group, or a company.

And yet, some UK government agencies have decided to read a residency requirement into a law that doesn't contain one. As Owen Bowcott reports for The Guardian, these seemingly illegal non-responses to requests are about to be tested in court.

A combined hearing involving the Home Office, Metropolitan police, the Information Commissioner’s Office (ICO) and 13 separate cases is to be held at an information tribunal in London.

At issue is whether applicants overseas are entitled to a response when submitting freedom of information requests to UK government departments and agencies.

Nothing in the UK's Freedom of Information law appears to institute a residency requirement for FOI requesters. Nor does it hint at territorial limitations that could allow agencies to withhold documents from certain requesters. But the agencies handling these 13 cases seem to feel there is a residency requirement and they appear to be applying this novel interpretation to screw with requesters they'd rather not respond to.

One set of requests deals with the UK's government's involvement with attempts to extradite Julian Assange for prosecution.

One of the blocked cases is an appeal by the Italian journalist Stefania Maurizi, who works for daily newspaper Il Fatto Quotidiano and writes about WikiLeaks.

She has been pursuing information about how the Crown Prosecution Service dealt with its Swedish counterpart during initial attempts to extradite Assange to Sweden.

So, it appears that at least one of the 13 cases is about documents being withheld because the agency doesn't want to release them, not because there's a genuine question about whether the agency is obligated to respond to non-UK residents. Meanwhile, the government says it's going to continue following the law… by not following the law in these 13 cases -- at least until the tribunal says otherwise.

Filed Under: freedom of information, residency, uk

BrewDog's 'Elvis Juice' Now An Approved Trademark In The UK, But Not the EU

from the ain't-nothin'-but-a-brewdog dept

You will hopefully recall that a few years back we discussed a trademark dispute between BrewDog, a UK-based brewery, and the Elvis Presley estate. At issue was BrewDog's grapefruit IPA dubbed "Elvis Juice" and the trademark application BrewDog had filed for it. Somehow, on first review, the UK IPO managed to side with the Presley estate, despite the fact that Elvis is a common first name, that the trade dress for the brew had nothing to do with Elvis Presley, and that this was all occurring in a country where Elvis Presley might not even be the most famous singing Elvis on the market. Fortunately, BrewDog appealed and won, so Elvis Juice is a registered trademark in the UK.

But not the European Union. Side note: did you guys know that the UK stupidly got out of the EU? Crazy! Anywho, BrewDog also had an application to trademark Elvis Juice in the EU. The Elvis Presley estate also opposed that trademark. And, this time, the Presley estate won.

The craft brewing company, based in Ellon, had won the right to register the brand as a trademark in the UK in 2018. However, they have been denied exclusive rights to the name in Europe – potentially threatening sales on the continent.

Unlike its UK counterpart, the EU bought the Presley estate's line that throughout Europe people buying an IPA called Elvis Juice would somehow think it was associated with a crooner from the American 50s as opposed to, say, Elvis Costello. Or the two Elvises that legally changed their name to Elvis that also own BrewDog. How that makes any sense, or how anyone is making this connection in, for instance, Spain is beyond me.

In the case documents, the EU Intellectual Property Office ruled: “It is clear that the applicant’s submission based on the peaceful coexistence of the marks cannot succeed. No evidence actually demonstrating such peaceful existence on the pertinent market has been shown. In short…there exists a likelihood of confusion… A likelihood of confusion for only part of the relevant public of the European Union is sufficient to reject the contested application.”

I mean, if this were two years ago, when the UK IPO decision came down, the UK would have been part of that pertinent market. And that should have been all that was needed to side with BrewDog. This, somehow, went the other way.

And, as a result, it's an open question as to whether BrewDog will keep its Elvis Juice branding as a whole, given the EU decision. Meanwhile, the EU IPO also ordered the brewery to pay the Presley estate costs.

Filed Under: elvis juice, elvis presley, eu, trademark, uk
Companies: brewdog

UK Says South Wales Police's Facial Recognition Program Is Unlawful

from the too-many-faces,-too-few-legal-protections dept

The South Wales Police has been deploying a pretty awful facial recognition program for a few years now. Back in 2018, documents obtained by Wired showed its test deployment at multiple events attended by thousands was mostly a mistake. The system did ring up 173 hits, but it also delivered nearly 2,300 false positives. In other words, it was wrong about 92% of the time.

Civil liberties activist Ed Bridges sued the South Wales Police after his image was captured by its camera system, which is capable of capturing up to 50 faces per second. Bridges lost at the lower level. His case was rejected by the UK High Court, which ruled capturing 50 faces per second was "necessary and proportionate" to achieve its law enforcement ends.

Fortunately, Bridges has prevailed at the next level. The Court of Appeal has ruled in favor of Bridges and against the SWP's mini-panopticon.

The decision [PDF] opens with a discussion of the automated facial recognition technology (AFR) used by the SWP, which runs on software developed by NEC called "NeoFace Watch." Watchlists are compiled and faces that pass SWP's many cameras are captured and compared to this list. On the list are criminal suspects, those wanted on warrants (or who have escaped from custody), missing persons, persons of interest for "intelligence purposes," vulnerable persons, and whatever this thing is: "individuals whose presence at a particular event causes particular concern."

Here's how it works:

The CCTV camera records footage for the duration of any AFR Locate deployment. AFR Locate is capable of scanning 50 faces per second (although that does not necessarily mean 50 different people). Beyond those technical limitations, there is no limit on the number of persons who may have their facial biometrics captured during any given deployment. It is SWP’s intention during each deployment to allow AFR Locate to process as many individuals as possible. It is clear that the numbers of persons processed are very large. Over the 50 deployments that were undertaken in 2017 and 2018, around 500,000 faces may have been scanned. The overwhelming majority of persons whose biometrics are captured and processed by SWP using AFR Locate are not suspected of any wrongdoing and are not otherwise of interest to the police.

People in the area where the cameras operate are notified via placards and handouts by police officers. Obviously, there's no way of notifying everyone in the area their face might be captured and run against a watchlist that is only limited by tech, rather than desire. (It currently maxes out at 2,000 individuals.)

Is this all lawful? Well, some of it is, but most of it isn't. The court appears to believe the deployment is outpacing what the law actually allows. There's not much in the law that specifically allows for this deployment and use.

The fundamental deficiencies, as we see it, in the legal framework currently in place relate to two areas of concern. The first is what was called the “who question” at the hearing before us. The second is the “where question”. In relation to both of those questions too much discretion is currently left to individual police officers. It is not clear who can be placed on the watchlist nor is it clear that there are any criteria for determining where AFR can be deployed.

The court says it's troubling there's no specific internal guidance either, which allows officers to determine where cameras are placed. They rarely seem to be placed in areas where suspects are most likely to be present. Most often, they appear to be deployed where officers feel they might be able to capture the largest number of faces.

The court also says the system violates UK privacy rights as defined in Article 8. It appears the South Wales Police made no effort to mitigate this rights violation. Its data protection impact assessment made only the slightest reference to these rights before deciding it was probably ok because the ends of catching criminals justifies pretty much any means the SWP chooses to deploy.

First, the DPIA contained no assessment of the impact of the deployment of AFR on the protection of the personal data of members of the public who might be affected by the measures. Secondly, it contained no assessment of the risks to their rights and freedoms, so that, for example, there was little or no engagement with the fact that SWP’s use of AFR involved the collection of data on a blanket and indiscriminate basis, and it placed too little weight on the interference posed by the initial collection itself and the plainly ambitious scale of the collection, particularly bearing in mind that it involved the sensitive processing of biometric data. Thirdly, the assessment did not adequately address the risk that a false positive would result in innocent members of the public having their biometric data retained for longer periods and place them at risk of being subjected to more intrusive interventions by police. Fourthly, the assessment of the right to privacy under Article 8 of the Convention, privacy risks, and possible mitigation of those risks, was negligible at best, being more concerned with the technical operation of AFR.

The court then points out the system used by the SWP may be prone to bias. Or it may not be. There's no way to know because the company that made the software refused to discuss it in court.

The fact remains, however, that SWP have never sought to satisfy themselves, either directly or by way of independent verification, that the software program in this case does not have an unacceptable bias on grounds of race or sex. There is evidence, in particular from Dr Jain, that programs for AFR can sometimes have such a bias. Dr Jain cannot comment on this particular software but that is because, for reasons of commercial confidentiality, the manufacturer is not prepared to divulge the details so that it could be tested. That may be understandable but, in our view, it does not enable a public authority to discharge its own, non-delegable, duty under section 149.

Since there is the potential for bias to seep into the software and result in unjustified targeting of races or sexes, the program may violate equality protections set down in the Public Sector Equality Duty (PSED), which requires government agencies to eliminate discriminatory processes and procedures. Since the company has not been forthcoming -- and the SWP doesn't appear to have anything in place to address possible bias -- the AFR program violates the law.

This is a big ruling. London is infested with CCTV cameras and the government has warmly embraced domestic surveillance. If this particular ideation of facial recognition is unlawful, there's a good chance the programs deployed elsewhere are as well. As long as facial recognition systems continue to rack up more false positives than legal wins, innocent UK citizens are at risk.

Filed Under: cctv, ed bridges, facial recognition, neoface watch, privacy, south wales, uk

UK Information Commissioner Says Police Are Grabbing Too Much Data From Phones Owned By Crime Victims

from the losing-the-tech-race,-eh? dept

The UK's Information Commissioner's Office (ICO) has taken a look at what law enforcement officers are hoovering up from citizens' phones and doesn't like what it sees. The relentless march of technology has enabled nearly everyone to walk around with a voluminous, powerful computer in their pocket -- one filled with the details and detritus of everyday living. And that relentless march has propelled citizens and their pocket computers right into the UK's regulatory void.

The ICO's report [PDF] doesn't just deal with the amount of data and communications UK cops can get from suspects' phones. It also deals with the insane amount of data cops are harvesting from devices owned by victims and witnesses of criminal acts. Left unaddressed, the lack of a solid legal framework surrounding mobile phone extractions (MPEs) will continue to lead law enforcement officers to believe they can harvest everything and look for the relevant stuff at their leisure.

Very few people would consent to this sort of intrusive search, but some aren't aware of how extensive these searches are. Those that are aware are less likely to come forward to help further an investigation, even if they're a victim of a crime.

Large volumes of data are likely to include intimate details of the private lives of not only device owners but also third parties (eg their family and friends). In other words, it is not just the privacy of the device owner that is affected, but all individuals that have communicated digitally with that person or whose contact details have been added by the owner. This presents considerable risks to privacy through excessive processing of data held on or accessed through the phone.

Left unexplained, or in cases where it is not necessary or justified, this intrusion into individuals’ privacy presents a risk of undermining confidence in the criminal justice system. People may feel less inclined to assist the police as witnesses or to come forward as a victim, if they are concerned that their and their friends’ and families’ private lives will be open to police scrutiny without proper safeguards…

Privacy is paramount when dealing with those not suspected of committing criminal acts. Standard MPE practice appears to ignore this crucial element, which only heightens distrust of law enforcement agencies. But privacy concerns are being swept aside in favor of efficiency. Why do things the right way when it's so much easier to do them this way?

PI [Privacy International] published a report calling for an urgent review of the use of MPE by the police, (“Digital stop and search: how the UK police can secretly download everything from your mobile phone” 15). It raised questions over the lawful bases for carrying out extractions, the lack of national and local guidance, and the authorisation process. [...] PI were also concerned that the use of MPE kiosks (‘self-service’ devices used by police forces to download and analyse the contents of individuals’ mobile phones) is becoming more common and forming part of ‘business as usual’ for officers, despite a lack of governance, oversight and accountability in their use.

But if law enforcement officers don't get what they want, there's a good chance crime victims won't get what they want. Here's where things get extremely unpleasant. It's not that crime victims feel this way. It's what's actually happening. When investigators aren't given consent to perform MPEs on crime victims' phones, there's a chance law enforcement will just decide to stop pursuing the investigation.

Here's what Big Brother Watch discovered after obtaining records from multiple police forces in England and Wales:

It found officers had asked for the complainant's mobile phone data in 84 sexual assault cases.

And every one of the 14 of those in which the complainant had declined had then been dropped by police.

The report calls for a long list of improvements and reforms, with an eye on safeguarding the privacy of crime victims and witnesses. ICO says all extractions should be logged and audited routinely. Investigators should be made aware that it's almost impossible to comply with data privacy laws when performing MPEs due to the amount of data/communications present on the average phone -- much of which "belongs" to other people who have communicated with the victim/witness.

It won't be enough to establish guidelines under the current legal framework. ICO says new laws must be put in place to make it explicit what can and can't be obtained with phone searches and when they can be lawfully carried out. This law would also need to set time constraints on examinations of extracted data, as well as the length of time it can be stored once obtained.

For now, the UK's legal framework is more limited than law enforcement's powers. The ICO's report aims to change that. Unfortunately, this will move at the speed of bureaucracy while tech continues to move at the speed of innovation. It's impossible to play catch-up at this speed. I say it's time to hit law enforcement with some broadly-written legislation -- you know, the sort of stuff the normals are forced to deal with all the time. Maybe that will slow the roll of data extraction until the government as a whole has time to address all the nuances.

Filed Under: data, ico, phones, police, privacy, uk

UK City Leaves Nearly Nine Million License Plate/Location Data Records Exposed On The Open Web

from the city-hopes-to-one-day-achieve-minimum-competence dept

Government officials always remind us that the price of order and lawfulness requires us, as a society, to give up some of our privacy and liberty. It shouldn't be that way, but it almost always is.

For UK motorists, the exchange rate for orderly motorway traffic is millions of their travel records left exposed on the open internet.

In a blunder described as "astonishing and worrying," Sheffield City Council's automatic number-plate recognition (ANPR) system exposed to the internet 8.6 million records of road journeys made by thousands of people, The Register can reveal.

The ANPR camera system's internal management dashboard could be accessed by simply entering its IP address into a web browser. No login details or authentication of any sort was needed to view and search the live system – which logs where and when vehicles, identified by their number plates, travel through Sheffield's road network.

Oh my no. This isn't acceptable. Sure, the Surveillance Camera Commissioner (yes, that's a thing in the UK) called it "astonishing and worrying," but even those terms fail to capture the horrendousness of this blunder. If it seems like a lot of records to leave unsecured on the open web, it is. It could allow anyone to retrace the travels of thousands of drivers with minimal effort.

It takes a while to amass nearly nine million license plate photos, but not nearly as long as one might expect. As The Register points out, the system's 100 cameras collect thousands of photos every day. On February 24, the cameras collected 21,000 photos. The only thing slowing the system down is the coronavirus. Stay at home orders dropped the record collection down to a more manageable 13,000 records on April 13.

The massive system went live in 2018, accompanied by documents that do not contain the word "privacy" anywhere in their 164-pages of bureaucratese. Apparently, no one bothered to perform any sort of penetration test that might have discovered this wide-open door before security researchers did. The best summation of this clusterfuck comes from the person who discovered the unsecured license plate portal.

The Register learned of the unprotected dashboard from infosec expert and author Chris Kubecka, working with freelance writer Gerard Janssen, who stumbled across it using search engine Censys.io. She said: "Was the public ever told the system would be in place and that the risks were reasonable? Was there an opportunity for public discourse – or, like in Hitchhiker's Guide to the Galaxy, were the plans in a planning office at an impossible or undisclosed location?"

The Sheffield City Council's response to the news is less than comforting. While properly calling the breach unacceptable, the city (and the local assistant chief constable) claims (without offering any evidence) that no one was "harmed" or "suffered any detrimental effects" from the exposed database. I beg to differ. It quite clearly harmed the trust drivers may have had in their local government and didn't do any favors for the traffic camera system provider either. Overseeing a system whose pervasiveness is only surpassed by its insecurity seems pretty detrimental to the "there's always a tradeoff" posturing governments use when subjecting constituents to even more omnipresent surveillance.

Filed Under: leak, license plate, location data, privacy, sheffield, uk