South Korean Gov't Gave Millions Of Facial Photos Collected At Airports To Private Companies

from the PLEASE-DO-NOT-FEED-THE-ALGORITHMS dept

Facial recognition systems are becoming an expected feature in airports. Often installed under the assumption that collecting the biometric data of millions of non-terrorist travelers will prevent more terrorism, the systems are just becoming another bullet point on the list of travel inconveniences.

Rolled out by government agencies with minimal or no public input and deployed well ahead of privacy impact assessments, airports around the world are letting people know they can fly anywhere as long as they give up a bit of their freedom.

What's not expected is that the millions of images gathered by hundreds of cameras will just be handed over to private tech companies by the government that collected them. That's what happened in South Korea, where facial images (mostly of foreign nationals) were bundled up and given to private parties without ever informing travelers this had happened (or, indeed, would be happening).

The South Korean government handed over roughly 170 million photographs showing the faces of South Korean and foreign nationals to the private sector without their consent, ostensibly for the development of an artificial intelligence (AI) system to be used for screening people entering and leaving the country, it has been learned.

The agency carelessly handing out millions of facial images to private tech companies was the country's Ministry of Justice. Ironically enough, South Korean privacy activists (as well as some of the millions contained in the database) say this action is exactly the opposite of "justice."

While the use of facial recognition technology has become common for governments across the world, advocates in South Korea are calling the practice a “human rights disaster” that is relatively unprecedented.  

“It’s unheard-of for state organizations—whose duty it is to manage and control facial recognition technology—to hand over biometric information collected for public purposes to a private-sector company for the development of technology,” six civic groups said during a press conference last week.

The project -- one with millions of unaware participants -- began in 2019. The MOJ is in the process of obtaining better facial recognition tech to arm its hundreds of airport cameras with. To accomplish this, it apparently decided the private sector should take everything cameras had collected so far and use those images to train facial recognition AI.

The public was never informed of this by the Ministry of Justice. It took another government employee to deliver the shocking news. National Assembly member Park Joo-min requested information from the Ministry about its "Artificial Intelligence and Tracking System Construction" project and received this bombshell in return.

Maybe the government felt this was okay because most of the images were of non-citizens. This is from South Korean news agency Hankyoreh, which broke the story:

Of the facial data transferred from the MOJ for use by private companies last year as part of this project, around 120 million images were of foreign nationals.

Companies used 100 million of these for “AI learning” and another 20 million for “algorithm testing.” The MOJ possessed over 200 million photographs showing the faces of approximately 90 million foreign nationals as of 2018, meaning that over half of them were used for learning.

With two-thirds of the freebie images being of foreigners, perhaps the South Korean government thought it would lower its incoming litigation footprint. But that still leaves nearly 58 million images of its own citizens. And there's nothing preventing foreign citizens from suing the South Korean government, even though this action can sometimes be considerably more expensive than suing locally.

Lawsuits are coming, though, according to Motherboard.

Shortly after the discovery, civil liberty groups announced plans to represent both foreign and domestic victims in a lawsuit.

The legal basis for the collection isn't being challenged. It's the distribution of the collected images, which no travelers expressly agreed to. Precedent isn't on the government's side.

“Internationally, it is difficult to find any precedent of actual immigration data from domestic and international travelers being provided to companies and used for AI development without any notification or consent,” said Chang Yeo-Kyung, executive director of the Institute for Digital Rights.

It's pretty sad when democratic governments decide the people belong to the government, rather than the other way around. But as the march towards always-on surveillance continues in travel hubs and major cities, using members of the public as guinea pigs for AI development is probably going to become just as routine as the numerous, formerly-novel, impositions placed on travelers shortly after the 9/11 attacks.

Filed Under: biometrics, facial recognition, privacy, south korea, surveillance

Hikvision's Director Of Cybersecurity And Privacy Says IoT Devices With Backdoors 'Can't Be Used To Spy On Companies, Individuals Or Nations'

from the O-RLY? dept

Hikvision describes itself as "an IoT solution provider with video as its core competency". It hasn't cropped up much here on Techdirt: it was mentioned earlier this year as one of two surveillance camera manufacturers that had been blacklisted by the US government because they were accused of being "implicated in human rights violations and abuses" in Xinjiang. Although little-known in the West, Hikvision is big: it has "more than 42,000 employees, over 20,000 of which are R&D engineers." Given the many engineers Hikvision employs, the following comment by Fred Streefland, Director of Cybersecurity and Privacy at Hikvision EMEA (Europe, the Middle East and Africa), reported by IPVM, is rather remarkable:

even devices with backdoors can't be used to spy on companies, individuals, or nations. The security features built into devices, networks, and data centres, combined with end-users data-protection responsibilities, make espionage and other misuses of backdoors impossible.

Streefland expanded on why data protection laws make espionage "impossible":

the end-users who buy these cameras are responsible for the data/video footage they generate. In other words, they're the data custodians who process the data and control the video footage, which is legally required to be kept private. Secret access to video footage on these devices is impossible without the consent of the end-user.

An interesting theory, but not one that security guru Bruce Schneier has much time for. IPVM asked him to comment on Streefland's statements:

I would say that only someone who doesn't understand cybersecurity at all would say something like that. But he's a CSO [Chief Security Officer], so he's probably deliberately saying something that stupid in order to sell you something.

That's a polite way to put it. As many stories on Techdirt attest, IoT products in general, and video cameras in particular, have huge security problems, often caused by backdoors, that have led to all kinds of spying at every level.

It seems that someone at Hikvision has realized just how ludicrous Streefland's comments were. The original source for the IPVM story is an interview with Streefland published by Benchmark Magazine. That interview is taken almost verbatim from a post on Hikvision's own blog, called "Debunking myths in the security industry." By an amazing coincidence, both the original interview and the blog post now lead to "404 not found" messages. Happily, the Internet Archive's indispensable Wayback Machine still has copies of both the interview and the blog post, where Streefland's words of wisdom quoted above can be found, along with some other choice thoughts on security.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: backdoors, cybersecurity, fred streefland, iot, privacy, surveillance
Companies: hikvision

NSO Pegasus Malware Deployed To Spy On Palestinian Human Rights Activists

from the now-who-would-want-to-do-a-thing-like-that? dept

Another day, another revelation about the abuse of NSO malware by its customers. The latest report shows NSO Group's powerful Pegasus malware was used to target Palestinian human rights activists. Citizen Lab is again on the case, providing the forensic examination of the detected malware and coming to this conclusion:

In October 2021, the human rights non-governmental organization (NGO) Front Line Defenders (FLD) began collecting data on the suspected hacking of the devices of several Palestinians working for civil society organizations based in the West Bank. FLD shared the data they collected with the Citizen Lab and Amnesty International’s Security Lab for separate independent peer review of their initial findings. FLD’s analysis indicated that six devices belonging to six Palestinian human rights defenders were hacked with Pegasus, a spyware developed by the cyber-surveillance company NSO Group. Both the Citizen Lab and Amnesty International’s Security Lab independently confirmed these findings.

Given the targets of the hacking, one would suspect the Israeli government was involved in this targeting of Palestinian activists. Citizen Lab and Amnesty International have made no allegations as to the source of these attacks, but there are some details that suggest Israel's government is involved.

One of those details comes from the Citizen Lab report:

Of interest is the fact that four hacked phones exclusively used SIMs issued by Israeli telecoms companies with Israeli (+972) phone numbers. NSO Group has said that exported versions of Pegasus cannot be used to hack Israeli phone numbers.

If exportation is key to this restriction on targeting Israeli phones numbers, deploying it from home presumably bypasses this protection.

Adding to the perception that the Israeli government might be behind these hacks is the timeline of the attacks and the publication of these findings. The attacks were apparently carried out in July 2020. The three entities investigating the hackings published their findings November 8, 2021. Shortly before these publications, the Israeli government declared the organizations these targets worked for as "terrorist organizations."

Israel on Friday effectively outlawed six prominent Palestinian human rights groups by declaring them terrorist organizations, a major escalation of its decades-long crackdown on political activism in the occupied territories.

The declaration appeared to pave the way for Israel to raid their offices, seize assets, arrest staff and criminalize any public expressions of support for the groups. Most of the targeted organizations document alleged human rights violations by Israel as well as the Palestinian Authority, both of which routinely detain Palestinian activists.

That happened on October 22. On November 6, the dossier that supposedly justified the designation was leaked. And it didn't appear to have much in it to support Israel's unilateral declaration that these rights groups were actually terrorist groups.

A confidential Israeli dossier detailing alleged links between Palestinian human rights groups and an internationally designated terrorist organization contains little concrete evidence and failed to convince European countries to stop funding the groups.

The 74-page document appears to have been prepared by Israel’s Shin Bet internal security service and shared with European governments in May. The Associated Press obtained the document from the online +972 Magazine, which was the first to report on it, along with the Hebrew-language Local Call.

Here's why this matters: it turns the targets from activists to terrorists, which gives the Israeli government permission (albeit in arrears) to engage in malicious hacking of devices. Protections and rights tend to evaporate pretty quickly once a government -- any government -- decides you're a terrorist. Given the lack of solid intel in the dossier, this almost looks like the laundering of previously illegal surveillance activities. It also gives the government permission to do more of the same in the future.

No one's made any accusations (other than noting NSO customers love targeting opposition leaders and activists), but the defensive statements have been delivered anyway. At best, this is some really lazy deflection by the Israeli government and more of the same "hey, we just sell the stuff" excuses from NSO Group.

The Israeli prime minister’s office and the Defense Ministry denied that Pegasus had been used to hack the Palestinians’ phones. An NSO spokeswoman said that the company would not say who used the software and that it did not have access to information about whom the program was used against.

Well, the Citizen Lab report says otherwise. And this non-denial doesn't say the government didn't hack the phones. All it says is that these two government reps are on record denying something that can't actually be denied while refusing to confirm anything about the activists' targeting by the Israeli government.

This all looks pretty shady. And it's unlikely to persuade the US government to drop NSO from its export regulation blacklist, despite NSO's protestations that its largely-unregulated sales to human rights violators contributes to the overall security and well-being of the entire planet.

And there's this postscript, which suggests NSO is now so toxic even one of its principals wants nothing more to do with it. (Google Translated from the original Hebrew.)

Itzik Benvenisti leaves NSO less than two weeks after being appointed CEO. In August, Benvenisti was appointed co-president of the company.

Calcalist has learned that Benvenisti informed the chairman of the NSO board of directors, Asher Levy, on Tuesday that in light of the special circumstances created in the company, he decided that he would not be able to enter the position of CEO.

The "special circumstances?" Apparently it's the ongoing PR nightmare NSO is battling along with its blacklisting by the US government. According to the Calcalist article, Benvenisti said it was not possible to carry out his plans for the company while being blacklisted. One presumes Benvenisti is well aware that remaining with the company would make his name just as toxic as NSO's since there's no reason to believe this is the last negative press the company will generate.

Filed Under: activists, human rights, israel, malware, palestinian, spyware, surveillance

Mexican Businessman Arrested For Using NSO Spyware To Target A Journalist

from the NSO's-long,-international-SEO-nightmare-continues dept

No news is the only good news for Israeli tech company NSO Group. The problem is it's impossible to generate no news when you can't go more than a few days without generating more bad news.

Since the leak of data showing its customers were targeting journalists, activists, religious leaders, and other government officials with powerful malware capable of intercepting cellphone communications, the headlines NSO has racked up range from bad to worse to nightmarish.

Multiple countries are now following up on investigations performed by entities like CitizenLab, performing investigations of their own to determine whether they've been breached by NSO's malware or if government customers have violated rights. The United States has effectively blacklisted the company, forbidding US government agencies from buying its products and US exploit developers from selling to NSO.

One country was host to a large percentage of the numbers on the leaked list of potential NSO Group malware targets: Mexico. 15,000 of the 50,000 phone numbers on the list were located in that country. Perhaps unsurprisingly, Mexico is home to the first arrest related to abuse of NSO spyware.

Mexican prosecutors said Monday they have arrested a businessman on charges he used the Pegasus spyware to spy on a journalist.

[...]

A federal official not authorized to be quoted by name said the suspect is Juan Carlos García Rivera, who has been linked to the company Proyectos y Diseños VME and Grupo KBH. He was detained on Nov. 1.

Mexico buys a lot of spyware from NSO. The AP report says the Mexican government spent $61 million on Pegasus licenses (NSO's most popular -- and most powerful -- phone exploit) from 2006 to 2018. That quote was given to the Associated Press in July. It has since been updated.

Last week, the government’s top anti-money laundering investigator said officials from the two previous administrations had spent about $300 million in government money to purchase spyware. But that figure may reflect all spyware and surveillance purchases, or may include yet-unidentified contracts.

Supposedly the Mexican government has kicked the spyware habit. Current president Andrés Manuel López Obrador was elected in 2018 and promised never to use exploits like these. It remains to be seen if that promise has been broken or will be broken in the future. According to the head of the government's Financial Intelligence Unit -- which monitors government financial transactions for evidence of corruption -- "no transactions" related to the purchase of spyware have been detected.

That's reassuring but not nearly as reassuring as a statement from a non-government entity would be, given the Mexican government's long, mostly unsuccessful, battle with internal corruption.

NSO has, of course, responded with another nonsensical non-denial of the facts at hand:

As stated in the past, NSO’s technologies are only sold to vetted and approved government entities, and cannot be operated by private companies or individuals. We regret to see that, over and over again, the company’s name is mentioned in the media in events that has nothing to do with NSO, directly or indirectly.

This certainly looks like the software was "operated" by a private individual. Maybe that first and pretty damn clear impression will change when more facts are in. Just because NSO forbids the use by private individuals doesn't mean private individuals with access to malware are somehow incapable of deploying it. And, just to be pedantic because NSO insists on pedantry, when issuing defensive statements, this report very definitely has something to do with NSO indirectly. Being angry about the endless stream of bad news doesn't make NSO right and everyone else wrong about it's at least tacit involvement with misuse of its products by its customers.

Filed Under: journalism, malware, mexico, spyware, surveillance
Companies: nso group

Transparency Activists Dump 1.8 Terabytes Of Police Helicopter Surveillance Footage

from the you've-let-us-down,-Dr.-Whirlington-Spinblade dept

Let's just get right into this and let Distributed Denial of Secrets (DDoS) harvest some accolades and encouragement to continue to deploy its particular brand of intrusive transparency on historically secretive entities.

The transparency activist group Distributed Denial of Secrets, or DDoSecrets, posted a 1.8-terabyte trove of police helicopter footage to its website on Friday. DDoSecrets cofounder Emma Best says that her group doesn’t know the identity of the source who shared the data and that no affiliation or motivation for leaking the files was given. The source simply said that the two police departments were storing the data in unsecured cloud infrastructure.

The lesson here (one of many) is that if you can't adequately protect your secrets, maybe you don't deserve to have them. And there are plenty of secrets to be had here. It's not that people aren't aware police helicopters are circling overland at all hours of the day. Episodes of COPS and YouTube collections of high-speed chases have made that fact common knowledge.

The DDoS release shows law enforcement agencies aren't just deploying choppers to keep an eye on suspects in motion. They're also using them to engage in extended surveillance of people suspected of nothing, hovering over large gatherings and deploying infrared cameras to peer inside of buildings just for the fuck of it.

Putting your stuff in the cloud means opening up additional attack vectors for those seeking your secrets. That appears to be the root source of this new leak. What a time to be alive!

I mean, sure there's more surveillance than ever. But the reliance on (apparently unreliable) private contractors means government secrets are only a hack away with being shared with everyone on the planet. That's definitely good news for the policed, who often have no say in how they're surveilled and are routinely denied access to information about government surveillance tech.

There's an amazing amount of irony contained in this latest DDoS release. Just a couple of months ago, the Dallas PD was being raked over the coals by pissed off city officials for inexplicably deleting more than 22 terabytes of data. According to the cops, the city IT employee handling the transfer of data from the cloud to Dallas PD servers screwed things up, resulting in the mass deletion. Some of it was recoverable. Most of it wasn't. At best, 7.5 terabytes were permanently lost during the botched transfer.

Good news is in the eye of the beholder. Transparency enthusiasts will obviously love this new set of leaks from Distributed Denial of Secrets. And this new leak may allow the Dallas PD to recover more of the data it thought it had lost forever, as David Lee points out for Courthouse News Service.

Data transparency activists released a massive 600-hour leak of mostly Dallas Police Department helicopter footage, raising more questions about the city’s data security protocols three months after DPD admitted to a 22-terabyte deletion of case data that resulted in the release of criminal defendants awaiting trial.

I hate to laugh at the turntables, but try and spin this, DJ DPDPR. RAISE ALL THE QUESTIONS!

If an entity wants to be entrusted with the power to deploy warrantless surveillance provided it has enough downwash, it should be expected to protect the hundreds of hours of footage it's gathered. And if it can't manage a data transfer with losing at least a third of its 22 TB of data, it should probably allow transparency activists to perform its archival duties for it, considering how much better they are at preserving data and making it easily accessible.

Filed Under: dallas pd, helicopter video, police surveillance, surveillance, transparency
Companies: distributed denial of secrets

Clearview Is So Toxic Even Other Surveillance Tech Purveyors Want Nothing To Do With It

from the bring-back-spitting-in-disgust-old-world-style dept

Outside of Clearview's CEO Hoan Ton-That, it's unclear who truly likes or admires the upstart facial recognition tech company. In the short time since its existence was uncovered, Clearview has managed to turn itself into Pariah-in-Chief of a surveillance industry full of pariahs.

Clearview hasn't endeared itself to the sources for its 10-billion image database, which are (in descending order) (1) any publicly-accessible website/social media platform, and (2) their users. The company has been sued (for violating state privacy laws) in the United States and politely asked to leave by Canada, which found Clearview's nonconsensual harvesting of personal info illegal.

It has subpoenaed activists demanding access to their (protected by the First Amendment) conversations with journalists. It has made claims about law enforcement efficacy that have been directly contradicted by the namechecked police departments. It has invited private companies, billionaire tech investors, police departments in the US, and government agencies around in the world to test drive the software by running searches on friends, family members, and whoever else potential customers might find interesting/useful to compile a (scraped) digital dossier on.

Clearview intends to swallow up all the web it can. Caroline Haskins' report for Business Insider (alt link here) catches Clearview's vice president of federal sales pretty much saying the only way to avoid being added to Clearview's database is to stop being online.

"People are constantly dumping their — it's just a constant," Clearview's Jones said during the roundtable event, referring to the steady stream of people posting their photos online, only for Clearview to scrape them.

The same report shows why Clearview's is so bad at PR. It has a PR team -- one that continually stresses the AI does not provide "matches," but rather "investigative leads." The difference between the terms is the extent of liability. If Clearview only generates leads, it cannot be blamed for false positives. If it says it delivers "matches," it possibly can be sued for wrongful arrests.

But CEO Hoan Ton-That can't stop using the terms interchangeably, which indicates he feels his software generates matches, thus inviting additional culpability.

"No one has done what we do at this scale with this accuracy," he said later in the conference, adding that anyone "is able to solve cases instantaneously if they get matches in the system."

The "accuracy" Ton-That claims no one can match is "98.6% accuracy per one million faces" -- an assertion Clearview's made for a couple of years now. Whether this claim is anywhere near 98.6% accurate remains to be seen. The AI has never been independently tested or audited.

We know how Clearview feels about itself. But how do the competitors in the market feel about it? Caroline Haskins spoke to other surveillance tech purveyors at the Connect:ID industry event and found other providers of facial recognition AI weren't thrilled Clearview was out there giving already-controversial tech an even worse reputation.

Several industry professionals openly expressed not liking or respecting the company. One government contractor said Clearview was "creepy." He told me he'd read about the company's extensive ties to the far right and was alarmed by that.

In one discussion, an attendee called the company "the worst facial-recognition company in the world."

Well, there's one thing surveillance tech purveyors and surveillance tech targets can agree on: Clearview took a bad thing, made it worse, and seems willing to trade paint with the internet at large to maintain its "Images in a facial recognition database [privately-owned]' lead.

While it's normal for competitors to criticize their rivals, the statements made here imply Clearview is bad for the facial recognition tech industry -- something that threatens these competitors' livelihoods. And that's not acceptable, even if the collective marketing of problematic AI to government agencies doesn't appear to bother them a bit.

Filed Under: facial recognition, surveillance
Companies: clearview

License Plate Reader Company Continues Expansion Into Private Neighborhoods With The Help Of Some Useful Cops

from the location-tracking-at-affordable-price-points! dept

The use of automatic license plate readers by law enforcement has steadily increased over the past decade. The theory is a never ending documentation of vehicle movements results in more solved crimes and recovered stolen vehicles. Assertions about law enforcement efficiency have driven other tech acquisitions, ranging from repurposed war gear like Stingray devices to facial recognition software.

But there's another force at work, one driven by private companies and aggressively marketed to private parties. Ring, Amazon's doorbell/camera acquisition, has driven its growth by portraying daily life as inherently unsafe -- a portrayal aided by its partnership with hundreds of law enforcement agencies, who often act as an extension of its marketing department.

Another growth market in the private sector relies on what's normally considered to be law enforcement tech: license plate readers. Flock Safety sells plate readers to gated communities and homeowners associations, promising peace of mind to residents who often have nothing to be worried about. Residents in low crime areas are told crime is headed their way. And people inherently suspicious about anyone they don't immediately recognize were more than happy to inflict surveillance tech on anyone passing through their neighborhoods.

But Flock, like Ring, isn't just for those who've kept up with or surpassed the Joneses. Flock has managed to make inroads into less spectacular neighborhoods, giving residents access to a wealth of plate/location data that is often shared with local law enforcement.

With “safety-as-a-service” packages starting at $2,500 per camera a year, the scanners are part of a growing wave of easy-to-use surveillance systems promoted for their crime-fighting powers in a country where property crime rates are at all-time lows.

Once found mostly in gated communities, the systems have — with help from aggressive marketing efforts — spread to cover practically everywhere anyone chooses to live in the United States. Flock Safety, the industry leader, says its systems have been installed in 1,400 cities across 40 states and now capture data from more than a billion cars and trucks every month.

This is a private company selling products to private individuals with unproven claims about increased safety -- and it all ties into surveillance systems operated by law enforcement.

Piped into a neighborhood’s private Flock database, the photos are made available for the homeowners to search, filter or peruse. Machine-learning software categorizes each vehicle based on two dozen attributes, including its color, make and model; what state its plates came from; and whether it had bumper stickers or a roof rack.

Each “vehicle fingerprint” is pinpointed on a map and tracked by how often it had been spotted in the past month. The plates are also run against law enforcement watch lists for abducted children, stolen cars, missing people and wanted fugitives; if there’s a match, the system alerts the nearest police force with details on how to track it down.

This may sound like a good and responsible use of surveillance tech. But it isn't. The system makes suspects of anyone who passes through a neighborhood while a crime is being committed. And if no one knows exactly when a crime was committed, hours of plate captures expand the list of suspects. When that happens, those running the cameras will be left to their own biases to generate their list of most-likely suspects and that's the information that's going to make its way into the hands of law enforcement.

Flock Safety believes it can solve all kinds of problems, even though decades of policing have yet to generate appreciable progress. Flock's founder, Garrett Langley, says law enforcement isn't capable of solving these problems on its own, pointing to FBI crime stats that show a 17 percent clearance rate for property crimes. He may be right that not enough is being done, but these systems aren't the panacea he claims they are. This statement in particular seems insanely optimistic.

“Are we going to stop homicides? No, but we will drive the clearance rate for homicides to 100 percent so people think twice before they kill someone,” he said. “There are 17,000 cities in America. Until we have them all, we’re not done.”

Good luck. The national clearance rate on homicides hovers around 50 percent. In some cities, it's far lower than the national average. More information is always helpful, but privately owned camera systems only add to the false positive/false negative problem, and private-side bulk collections being turned over to law enforcement is a pretty problematic "solution." Tech like this also tends to nudge people towards vigilantism, something that's been observed with Ring's Neighbors app and Citizen's privately run crime reporting tool.

Then there's the marketing push that now directly involves law enforcement agencies, which tends to put cameras where cops feel they should be put, with the expected results.

When Flock installed 29 cameras in Dayton, Ohio, as part of a months-long trial for the police, residents were surprised and angry to see so many of them recording in the heart of the city’s Latino community — including outside a church where local immigrant families attend Mass and gather with friends.

It's just more of the same, but enabled by private companies that see law enforcement support as an easy way to expand their market base. Flock blamed this incident -- the surveillance of minorities frequently targeted by law enforcement -- on a "gap in communication." The company provided no details on what it told police when it gave them cameras that may have been misinterpreted by law enforcement. The cameras were ultimately removed after the targets of the surveillance complained.

Flock isn't going to give up its expansion plans. And cops really haven't found a camera system they don't like, not even body cameras which have done far more for them than they've done for the public. Like Ring, Flock appears willing to use public servants as PR reps and installation techs. And its expanding user base allows it to become part of a mesh network of surveillance tech that blurs the line between what the government does to us and what we choose to do to each other.

Filed Under: license plate readers, police, private neighborhoods, surveillance
Companies: flock safety

New Investigation Shows A US Journalist Critical Of The Saudi Government Was Hit With NSO Spyware

from the truly-an-unsurprising-development dept

Malware merchant NSO Group's year of embarrassment continues. Leaked data published in July appeared to show NSO malware (namely its phone-hijacking malware Pegasus) had been used to target dissidents, journalists, religious leaders, and prominent politicians.

NSO reacted by first claiming the data showed nothing of the sort or at least was unrelated to its malware and its customers. Then it made contradictory claims, saying it terminated contracts when it discovered abuse of its products and that it had no visibility into its customers' actions. Puzzling.

Then things somehow got worse. Countries accused of using NSO Group malware to target critics and journalists decided to sue critics and journalists. Israel's government opened an investigation into the Israeli company. Another investigation found the government of Bahrain was engaging in exactly the kind of abuse NSO claimed it didn't allow. And, thanks to some pretty ugly divorce proceedings, it came to light that the Dubai's king had used the malware to spy on his ex-wife and her lawyer.

The debacle continues. An investigation by Citizen Lab -- which has uncovered previous misuse of NSO's software -- reveals an American journalist was targeted multiple times by NSO's hacking tools.

New York Times journalist Ben Hubbard was repeatedly targeted with NSO Group’s Pegasus spyware over a three-year period from June 2018 to June 2021. The targeting took place while he was reporting on Saudi Arabia, and writing a book about Saudi Crown Prince Mohammed bin Salman.

The investigators aren't sure who targeted Hubbard, but they do note that complaining to NSO about being targeted in violation of the company's guidelines has zero deterrent effect on future targeting.

The targeting resulted in Pegasus infections in July 2020 and June 2021. Notably, these infections occurred after Hubbard complained to NSO Group that he was targeted by the Saudi-linked KINGDOM Pegasus operator in June 2018.

While it would seem the most likely suspect is the Saudi government (or perhaps the prince himself, given what we now know about individual misuse of NSO spyware), Citizen Lab doesn't have enough information to definitively say who's behind the second round of targeting. And, given government/government officials' willingness to sue journalists over accusations of spying, Citizen Lab is wise to play it safe when it comes to attribution.

The in-depth report is worth reading, detailing how Citizen Lab arrived at these conclusions, as well as noting the similarities between these attacks (which utilized both malicious links and zero-click exploits) and ones observed targeting a Saudi activist earlier this year. And it shows NSO is still months away from being able to put this in the rearview mirror. A change of culture is needed at NSO and it needs to cancel all contracts with countries whose governments whose abuses of human rights and hacking tools have already been the subject of years of reporting.

Filed Under: ben hubbard, malware, pegasus, spyware, surveillance
Companies: citizen lab, nso

Delta Proudly Announces Its Participation In The DHS's Expanded Biometric Collection Program

from the WE-LOVE-YOU-GOVERNMENT-[girlish-screams] dept

Via Travel & Leisure comes this warning -- one the online magazine has decided to portray as exciting news.

Delta Air Lines is expanding its partnership with the Transportation Security Administration with its use of facial recognition technology making getting through airport security even quicker.

The airline is implementing a "digital identity experience" at its hub in Atlanta, offering customers with TSA PreCheck and a Delta SkyMiles number the chance to pass through security and board their flight without having to pull out a boarding pass or their ID.

Ah, the "digital identity experience." That's apparently DeltaSpeak for "biometric collection and facial recognition deployment." That's been the DHS's plan all along. It may have pretended it only wanted to post up at ports of entry (i.e., international airports) but it is going to roll this out to as many airports as possible.

How do we know "digital identity experience" is Delta PR? Because this "article" is largely a regurgitation of Delta's own press release about its increased biometric collection/domestic surveillance efforts.

First unveiled in Detroit security checkpoints in early 2021, Delta’s digital identity experience is an industry first in exclusive partnership with TSA PreCheck. The experience is expanding to Atlanta, offering customers a more efficient way to navigate the airport – without showing a paper boarding pass or a physical government ID. With just one look at a camera, customers who qualify and opt in can easily and efficiently check a bag, pass through the TSA PreCheck security line and board their plane.

You'll notice this "experience" is first being offered to PreCheck participants. This means people who have already registered and paid the government to buy back some of their Constitutional rights are the first to be invited to help expand Custom and Border Protection's biometric database.

Delta is just the "partner." The TSA just mans the front end. The data and subsequent scans belong to the CBP.

Once a customer reaches a camera at the airport, their image is encrypted and sent to U.S. Customs and Border Protection’s (CBP) facial biometric matching service via a secure channel with no accompanying biographic data. CBP then verifies a customer’s identity against government holdings and sends back an indicator to allow the customer to proceed.

There are several things wrong with all of this, starting with Travel & Leisure's cheery stenography of cheery Delta's up-sale of government intrusion. While no one expects a leisure mag to get serious about the implications of expanding biometric collections and facial recognition programs to encompass US citizens traveling domestically, the article could have used less of the Delta's GO TEAM USA jargon and more actual facts: like how facial recognition AI -- all of it -- is fundamentally flawed. Or maybe just point out the unjustified but steady encroachment of surveillance tech into airports serving millions of travelers the government has no reason to suspect are up to no good.

And Travel & Leisure may want to vet its sources. After all, Delta is more than happy to pretend things aren't the way they are as it pitches in to make traveling a worse experience for its customers.

Atlanta’s domestic terminal south security checkpoint is the first in the U.S. that will be converted to computed tomography-automated screening lane (CT-ASL) systems - making the world’s busiest airport even more efficient as travelers connect to destinations around the world.

That's simply not true. Increased efficiency may be the end goal but a recently released report by the DHS Inspector General says CT scanners are actually slowing down the screening process.

TSA deployed CT systems to airport passenger screening checkpoints that did not meet minimum throughput requirements. TSA’s February 2018 Operational Requirements Document identified the need for a CT system capable of screening, on average, 200 items per hour to successfully perform the mission. However, we determined TSA purchased 300 CT systems capable of screening an average of 170 items per hour — 15 percent less than the minimum requirement, and less than the AT X-ray system capability of approximately 354 items per hour.

This is a human centipede. The TSA says some shit. Delta Airlines reposts it with its own happy spin. And, at the tail end of it, consumer-facing sites are swallowing everything and dumping it on to web pages without bothering to question the sources or provide any information that might counterbalance the government's assertions about how more intrusive collections make America a better place to call home.

Filed Under: biometric collection, facial recognition, security theater, surveillance, tsa
Companies: delta

LAPD Sees Your Reform Efforts, Raises You $20 Million In Bullets, Snacks, And Surveillance

from the reading-cards-like-they're-reading-a-room dept

The Los Angeles Police Department is reform-resistant. This isn't the same as reform-proof, but more separates "resistant" from "proof" in this case than the misleading labels promising varying degrees of water resistance placed on watches and cellphones.

The LAPD has endured decades of bad press with barely an uptick in performance or community orientation. The LAPD is best known for beating minorities until riots happen. With a wave of police reform efforts sweeping the nation -- many of them looking to spend less on police violence and more on things that actually help the community -- the LAPD has issued a tone-deaf demand for more money to spend on things residents are complaining about.

The LAPD has filed a massive proposal requesting more than $18 million in budget increases in order to pay for surveillance programs, bullets, and … snacks.

The Stop LAPD Spying Coalition released a letter on Monday blasting the 183-page report. The proposal requests nearly $18.44 million to support many of the things that the community has spent recent years protesting. The letter, which was co-signed by Black Lives Matter Los Angeles and the National Lawyers Guild of Los Angeles, describes the LAPD’s list of demands as a “disgusting insult to hundreds of thousands of people who took the streets last summer."

What else in the LAPD's "more please" proposal? $2 million to spend on social media monitoring, something it's asking for right after it was reported LAPD officers are demanding social media information from people they've accosted or otherwise harassed into a "consensual" conversation. That's in addition to $450,000 in licenses for social media monitoring software to better make use of this new data officers are collecting while out in the proverbial field.

The letter [PDF] from the Stop LAPD Spying Coalition doesn't pull any punches. It compiles a long list of the stupid, counterproductive demands the department is making -- ones not connected in any way to improving relations with the communities they serve.

In true Newspeak, here's the fucking news: the LAPD wants more money to be thrown at its desire to throw bullets at people.

Over $12 million for new trainings in addition to $461,850 in bullets at $17 per round to shoot away at trainings and $492,850 in “overtime funds to address field jail training” for mass arrests

This won't make the LAPD more efficient killers. And it won't make them better guardians of people's rights, starting with the right to protest. What it will do is encourage pulling the trigger until clips run dry and mass processing of people arrested for (the most part) expressing their displeasure with their current police force.

And who wouldn't applaud the blending of police officers and the military like so much corn and gasoline?

$348,130 for a new staff officer whose full-time role will be to permanently coordinate with “military” forces and facilitate their local deployment

And perhaps the most "police" thing of all, the guys are getting kind of hungry:

$100,000 for snacks that “personnel can grab quickly and take with them,” apparently enabled through new “emergency use credit cards”

Love to see "snacks" and "emergency" linked together in a sentence asking for $100,000. It sounds like an insulin request but it's actually about propping up the Frito-Lay Economy.

Once you get past all the "screw your rights and please catch bullets" parts of the LAPD's proposal, you get to the part where the LAPD claims to be saving money by spending money… or something.

Chief Moore’s cover memo raises many questions about the cost of these proposals. As he notes, LAPD previously claimed these same reforms required over $66 million. He writes that this larger figure “counted all costs – even if the resources were currently available” (p. 5) which presumably means LAPD double-counted the cost of resources that it already possessed. But one sentence later, Chief Moore claims the $18.44 million estimate amounts to a $48 million “reduction in cost projection.” It is unclear whether the $18.44 million is in fact a “reduction” or simply accurate accounting. But LAPD’s comfort switching numbers so large without real explanation speaks to how little financial scrutiny they expect from you. Additionally, it is unclear how much of the $18.44 million are yearly versus one-time costs.

Good luck sussing that out, whether you're an activist group or city oversight. The LAPD is used to asking questions, not answering them. A sea change in public receptiveness to cops being assholes doesn't appear to have had any effect on LAPD (and I use this term super-loosely) leadership. Cop business will proceed as usual, recent public antipathy notwithstanding.

So, what else is new? Nothing. But it needs more money. The LAPD says its cool with alleged transparency efforts like body cams, but only if it gets to keep harvesting data from tons of automatic plate readers and its take on stop-and-frisk, which now apparently involves requests for social media info.

And it appears the city did what it could to ensure the LAPD could have its millions without too much interference from the hoi polloi.

The proposals were made public in an 183-page document sent late in the afternoon on Friday, September 24, and the proposals will be voted on the morning of Tuesday, September 28. This is just over one business day to digest and respond to the 183-page proposals, and even that time period is only for people who happen to have received the proposal immediately because they subscribe to this board’s agenda by email. The public’s only opportunity to comment would be if they received that online agenda and then responded either by emails sent before 5 p.m. on Monday, September 27, or by becoming one of the dozen or so individuals who happen to secure a brief public comment slot during this board’s 45-minute public comment period, before the agenda item is even introduced.

Only in the government can you give the finger to your employers (taxpayers) and end up better off during FYWhatever. The LAPD likely knows what the public is asking of it. But it also knows that not caring what they think will at least give it the same budget it had in 2020 and do little to curb its surveillance excesses. At some point, the LAPD's city oversight will have to actually do its job. Until then, it's just signing off on the same law enforcement bullshit that has kept the city in constant turmoil since the Watts riots nearly five decades ago.

Filed Under: budget, lapd, police reform, reform, surveillance