Rupert Murdoch Spreads False Claim Biden FCC Nom Wants To 'Censor Conservatives.' NewsMax & OAN Immediately Prove Him Wrong.

from the gibberish-and-nonsense dept

We'd already noted how telecom and media giants are hard at work trying to scuttle the nomination of consumer advocate Gigi Sohn to the FCC. Sohn is broadly popular on both sides of the aisle in telecom and media circles, so companies like AT&T and News Corporation are working overtime to come up with talking points politicians can use to oppose her nomination. This week, that included prodding Lindsey Graham to frame Sohn (who has decades of telecom policy experience) as an unqualified radical extremist looking to censor conservatives:

Anybody who knows or has worked with Sohn (which is pretty much everyone in telecom policy circles, including myself) knows this is gibberish. Graham's rant was timed with the release of this clumsy missive by the Wall Street Journal editorial board that tries to claim Sohn wants to "censor conservatives." Their evidence of this? She supported holding Sinclair Broadcasting accountable after it lied to regulators to try and get its merger with Tribune Broadcasting approved:

"After Tribune Broadcasting abandoned its merger with the conservative-leaning Sinclair Broadcast Group in 2018, she declared, "Today is a good day for every American who believes that diversity of voices in the media is better for our democracy" and urged the FCC to "look at whether Sinclair is qualified to be a broadcast licensee at all."

The Journal oddly forgets to mention this important context, but Sinclair didn't just "abandon" that merger. It was blocked by the Trump FCC and then fined for using shell companies, relatives, and other shady side deals to try and pretend the Tribune merger wouldn't violate bipartisan media ownership rules. Sinclair's efforts were so legally dubious, even Trump FCC boss Ajit Pai was forced to oppose the deal. Sohn's big crime? Agreeing with Pai. This somehow gets twisted into Sohn "supporting Conservative censorship"; fairly reflective of the Journal's integrity and the quality of policy discourse in 2021.

One ironic bit that ruins AT&T's and News Corporation's lobbying efforts here: right-wing disinformation mills Newsmax and OAN (who both opposed the threat the Sinclair merger posed to smaller right wing disinformation mills) released statements in support of Sohn's nomination. Their primary justification? That she... supports conservative voices. From Newsmax commentator Bradley Blakeman:

"I know Gigi. I have worked with Gigi. And I have seen her fight for people's right to express themselves, even when she disagrees with them."

AT&T, News Corp., and Comcast very much don't want a consumer advocate at the FCC. They very much want to retain all the favors they nabbed during the Trump era, whether that is the death of net neutrality and broadband privacy rules, or the elimination of many media consolidation rules and neutered FCC consumer protection authority. Their problem is Sohn is both qualified and popular across the aisle, which is forcing them to dig a little too deeply into the nonsense bin to try and justify opposition to the nomination.

Filed Under: fcc, gigi sohn, lindsey graham, regulations, rupert murdoch

Daily Deal: Shells Personal Cloud Computer

from the good-deals-on-cool-stuff dept

With Shells you can unlock the full performance and experience of a desktop computer on any device; an old Chromebook, your TV, tablet, and more. Launch any virtual desktop in less than five minutes! Powered by the cloud, you can download, store, access, and edit your files on any device. Start a project on your phone during your bus journey home, and finish up right where you left off on your TV in the comfort of your living room. With Shells, your computer is with you anywhere, anytime. A one year subscription on the Basic plan (40 GB storage, 2 GB memory) is on sale for $65, on the Plus plan (80 GB storage, 4 GB memory) for $95, or on the Pro plan (160 GB storage, 8 GB memory) for $195. Use the code SAVE15NOV for an additional 15% off.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

The Curious Case Of Billionaire Brian Sheth, An Anonymous Tweeter, Copyright Law, Twitter, And Some Company That Barely Seems To Exist

from the wtf-is-going-on-here? dept

Techdirt regular John Roddy highlighted a truly bizarre fight happening in a California court that may or may not involve billionaire Brian Sheth. Sheth was a cofounder of the high-flying Vista Equity Partners, and left it a year ago in a high profile exit, after the firm's other cofounder, Robert Smith, entered into a non-prosecution agreement with the DOJ and agreed to pay $139 million and "abandon" $182 million in deductions, related to charges of tax fraud. In the Forbes link above, Sheth claims he sought to have Smith leave Vista following this revelation, but "Smith prevailed" and so Sheth left. Nothing in that article makes Sheth look particularly bad.

However... an anonymous Twitter user @CallMeMoneyBags has been tweeting criticism of lots of folks involved in the private equity space, including Brian Sheth. A year ago, just about the same time that Sheth left Vista, MoneyBags tweeted a bunch of tweets referring to Sheth, and including snapshots of women who were sometimes scantily clad. The text of the tweets wasn't particularly bad. One of them just says "Brian Sheth is the King of Private Equity" with some hashtags:

Some of the tweets could be read obliquely to suggest infidelity:

You'll notice that the screenshots of those tweets show the media disabled over a copyright claim, and that's the next stage of this mystery. An entity called "Bayside Advisory LLC," which barely seems to exist, sent Twitter a copyright infringement notice for the images in those tweets, and then immediately filed a DMCA 512(h) subpoena to Twitter demanding that it identify the person behind @CallMeMoneyBags.

Twitter, properly moved to quash the subpoena, noting that this was all highly sketchy, and that the standard to force the disclosure of an anonymous poster is quite high, and it was not met here. Twitter rightfully noted that it was also somewhat perplexed by who the hell Bayside Advisory LLC was, and whether it had any connection to Sheth:

None of the Tweets mention Bayside.... Twitter’s counsel has attempted to learn the connection between Bayside and Sheth or the images at issue but has been unsuccessful.... Bayside does not appear to be registered to conduct business in California, and public searches of Bayside reveal only an Ohio real estate holdings company with no apparent connection to Sheth and no specialization in creating or acquiring copyrights of candid photographs.

There's been a fair bit of back and forth, but to summarize, Twitter argues (correctly) that the 1st Amendment protects anonymity. "Bayside" (whoever that is) argues back (misleadingly) that copyright infringement is not protected by the 1st Amendment. Twitter argues (correctly) that fair use is not infringement, and Bayside argues that it's not fair use. Twitter then argues again that (1) it is fair use, and (2) even if it's not fair use, Bayside doesn't meet the very high bar to expose an anonymous social media user.

Throughout all of this Bayside keeps insisting that it has no connection to Sheth at all and is merely a concerned copyright holder trying to police infringement. This seems exceedingly difficult to believe. However, the company filed a disclosure insisting that there were no other parties of interest in this case, and says that Twitter is wrong in implying that Sheth or someone connected to him are trying to expose MoneyBags:

Twitter falsely claims that Bayside is attempting to unmask a Twitter user (“MoneyBags”) for commenting on a newsworthy billionaire, thereby chilling MoneyBags’ First Amendment speech. (Dkt. 13 at 5). Bayside is not. As was clear in its opposition to the motion to quash (Dkt. 9), Bayside seeks the identity of a copyright infringer pursuant to the DMCA. The First Amendment does not afford protection for copyright infringement, nor are copyright infringer identities protected from disclosure by the First Amendment. Harper & Row Publishers, Inc. v. Nation Enters., 471 U.S. 539, 556 (1985); Arista Records, LLC v. Doe 3, 604 F.3d 110, 118 (2d Cir. 2010). Bayside has never requested MoneyBags’ tweets be removed. The commentary in those tweets remained after Bayside’s DMCA notice, and their textual comment is of no concern to Bayside. What is of great concern to Bayside is the unauthorized use of several of its copyrighted Photographs simply as an illustrative aid to those tweets, which does not constitute fair use.

Elsewhere, Bayside is even more emphatic that it has nothing to do with Sheth:

“the photos are exclusively and solely owned and controlled by our client Bayside Advisory LLC, the photos are registered with the United States Copyright Office reflecting that Bayside is the sole owner, Mr. Sheth never had any ownership or control interest in the photos and that Mr. Sheth does not own or control any interest in Bayside.”

For what it's worth, it does appear that Bayside Advisory LLC, using a US Postal Service postal box based in Menlo Park, California, did in fact file a copyright registration for six photos after MoneyBags posted the tweets. The registration claims that two of the photos (registered as a "group") were "published" in 2017 and the four others (also registered together as a group) were "published" in July of 2020. In those registrations, Bayside names Brenda Diaz as the photographer of all six photos. Notably, Bayside insists that protecting copyright is part of what it does:

Contrary to Twitter’s baseless conjecture, Bayside is a communications and strategic advisory firm that, among other things, advises and partners with creators, artists, and entrepreneurs to protect, promote, and champion creative expression. Bayside owns a catalog of photographs (the Photographs are only a small part of the catalog) to exploit for those purposes. What Twitter is attempting to do with its motion to quash is diminish the rights of copyright holders by forcing them to navigate the court system and fight diligently, and at great cost and expense, to get basic information about those who infringe their copyrights.

That would be a hell of a lot more compelling if... the two registrations at issue here weren't the only two registrations for published works that Bayside Advisory has. Earlier this summer (many, many months later) Bayside Advisory did register two more groups of unpublished photographs, but the idea that these photos are "only a small part of its catalog" is, at the very least, not clearly seen in its copyright registration practices.

Now, many months later, the judge has finally issued an order... which only punts the matter for the time being. Basically, the judge says it doesn't have enough info about @CallMeMoneyBags' use of the photos to determine whether or not they are protected by fair use, because MoneyBags is not a party here and hasn't filed anything on his (or her) behalf. So the court says that it has to hear from MoneyBags in order to get the full record and make a fair use determination, and whether or not MoneyBags' anonymity should also be protected:

To the extent the court must reach the issue of whether @CallMeMoneyBags’s use of the photos constitutes fair use, it lacks a well-developed record on which to base any ruling. ... In this case, Twitter states that “[i]t appears the anonymous Twitter user here posted those candid photographs for the purpose of criticizing or satirizing Sheth.” Mot. to Quash 12. Twitter speculates. The purpose and meaning of the tweets is not clear. They include hashtag references which are not obvious. Evidence regarding the user’s purpose and intended meaning is likely available only from the individual(s) who posted the tweets. ... The facts relevant to the first factor may also impact the third, which examines “the amount and substantiality of the portion used in relation to the copyrighted work as a whole.”... As the Supreme Court has explained, when examining the third factor, “the enquiry will harken back to the first of the statutory factors” because “the extent of permissible copying varies with the purpose and character of the use.”

Additionally, to the extent the court determines it is necessary and appropriate to “balance ‘the magnitude of the harms that would be caused to the competing interest by a ruling in favor of [Bayside] and by a ruling in favor of [Twitter and the user of the @CallMeMoneyBags account],’” the court lacks sufficient information to do so.... As noted, Twitter contends that unmasking @CallMeMoneyBags “may invite social ostracism, expose them to harassment, or prevent future employment opportunities,” but this too is speculative.

Accordingly, the court shall give the user(s) of the @CallMeMoneyBags account an opportunity to provide information supporting the foregoing inquiries, including evidence regarding any claim of fair use of the photos and the harms that could result if the court rules in favor of Bayside on the motions to quash and to compel. Twitter shall immediately serve a copy of this order along with the complete briefing on Twitter’s motion to quash and Bayside’s motion to compel on the email address associated with the @CallMeMoneyBags account, and file a declaration attesting to the same by November 10, 2021. By no later than December 10, 2021, the user(s) of the @CallMeMoneyBags account may specially appear and file evidence regarding fair use and/or the harms that may result if the court denies the motion to quash and grants the motion to compel. The user(s) may appear anonymously for the purpose of submitting such evidence. The court will take the matter under submission after December 10, 2021.

Twitter has since told the court that it has sent this ruling to @CallMeMoneyBags, and one hopes that MoneyBags can find himself (or herself) a decent lawyer who understands both fair use and anonymity...

And, of course, there's a lot that's perplexing here. The most obvious candidate for wanting to identify MoneyBags would be Sheth, but Bayside is emphatic (in its court filings) that it's not Sheth, but it's not at all clear who is actually behind Bayside or what Bayside actually does. But if it's not Sheth, then who would be so insistent on finding out who is behind the account, and spending what appears to be significant amount on a lawyer who used to run legal affairs for Universal Music Publishing Group? That's not how most people react to random snapshots being placed on Twitter. It's possible that it's somehow connected to the photographer, Diaz, but, if so, why did she hand over just those six images to Bayside to register and fight this fight? It's all... very perplexing.

Either way, kudos to Twitter for (1) fighting for the right to post anonymously, to criticize people while doing so, and (2) fighting for fair use.

Filed Under: 512(h), anonymity, brenda diaz, brian sheth, callmemoneybags, copyright, criticism, dmca 512, first amendment, identity, social media, subpoenas
Companies: bayside advisory, twitter

Clearview Officially Kicked Out Of Australia For Violation Country's Privacy Laws

from the going-to-be-missing-most-of-the-Five-Eyes-pretty-soon dept

Clearview -- the facial recognition tech company whose unproven AI runs searches on 10 billion images scraped from the web -- has been booted from another country.

Last July, Clearview pulled out of Canada while under investigation by its government. Eight months later, the investigation concluded, with the Canadian Privacy Commissioner finding Clearview's scraping of web content violated the rights of Canadian citizens by gathering their information without their permission.

The same thing has just happened in Australia. An investigation by the Office of the Australian Information Commissioner (OAIC), in conjunction with the UK's Information Commissioner's Office, has determined Clearview broke the law there as well.

Commissioner [Angelene] Falk found that Clearview AI breached the Australian Privacy Act 1988 by:

• collecting Australians’ sensitive information without consent
• collecting personal information by unfair means
• not taking reasonable steps to notify individuals of the collection of personal information
• not taking reasonable steps to ensure that personal information it disclosed was accurate, having regard to the purpose of disclosure
• not taking reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles.

The determination orders Clearview AI to cease collecting facial images and biometric templates from individuals in Australia, and to destroy existing images and templates collected from Australia.

We'll see if that order has any effect. It's unclear whether Clearview has any mechanism in place to determine where content originated from and/or what content contained in its 10-billion image database belongs to Australian citizens. Hopefully it does have something to aid in compliance with orders like these. Because it would be extremely irresponsible -- especially following a similar ejection six months ago -- to continue to scrape the web in contravention of two governments' orders to cease collection and destroy locally-sourced content.

The Information Commissioner says Clearview's collection methods are "unreasonably intrusive and unfair." They also put millions of people at risk for identity fraud if the database were ever to be compromised. In addition, the database undoubtedly contains millions of pictures of minors and other at-risk groups, like victims of crimes -- both of which are given additional privacy protections under Australian law.

The report also notes that Clearview's brief run in Australia had the opportunity to create more than theoretical harm. Australian law enforcement agencies -- including the federal police -- performed test runs of Clearview's software over a period of five months (October 2019 - March 2020). The Australian Federal Police is currently being investigated for its use of Clearview's tech to determine whether its test runs complied with privacy laws.

Clearview's rebuttal to this report claims two things: it pulled access from Australian law enforcement following the initiation of this investigation and that, as an American company, it does not have to comply with Australia's laws.

The Information Commissioner disagrees:

However, Commissioner Falk said she was satisfied Clearview AI was required to comply with Australian privacy law and that the information it handled was personal information covered by the Privacy Act.

“Clearview AI’s activities in Australia involve the automated and repetitious collection of sensitive biometric information from Australians on a large scale, for profit. These transactions are fundamental to their commercial enterprise,” she said.

“The company’s patent application also demonstrates the capability of the technology to be used for other purposes such as dating, retail, dispensing social benefits, and granting or denying access to a facility, venue or device.

“This case reinforces the need to strengthen protections through the current review of the Privacy Act, including restricting or prohibiting practices such as data scraping personal information from online platforms."

Two countries have banned Clearview entirely and they won't be the last to do so. Back in the United States, where Clearview can't use the "local laws don't apply to us" excuse, the company is being sued in two states for the same reason: violating privacy laws. It has no friends in the facial recognition field and its use of web scraping to compile a database of billions of images hasn't made it any allies anywhere else in the tech field.

Sooner or later, Clearview's going to be stuck with selling to authoritarians and oligarchs who give zero fucks about the privacy of their constituents and are always looking for new tools to track down and punish their critics. Given its non-response to nearly two years of negative press, it appears Clearview is willing to wade into this cesspool to ensure it remains profitable.

Filed Under: australia, facial recognition, privacy
Companies: clearview

Denuvo Games Once Again Broken For Paying Customers Thanks To DRM Mishap

from the whoopsie dept

It's been a while since we've mentioned Denuvo, the once-vaunted anti-piracy video game DRM that subsequently became an industry punchline. Once touted as "uncrackable", Denuvo went from there to becoming indeed crackable, then crackable shortly after release of games, to then being crackable the same day, to then being cracked in some cases hours after a game's release. As a result, plenty of publishers have taken to patching Denuvo out of their games, while Denuvo did a mini-pivot to create anti-cheat software for online games. While all that was going on, plenty of paying customers of games protected by Denuvo complained about various issues: authentication issues intermittently preventing the customer from playing the game they bought, performance issues that are linked back to how Denuvo runs and behaves, or Denuvo simply breaking games.

In other words, Denuvo is a case study in real world DRM: no real protection from piracy, but plenty of headaches for paying customers. If that sounds like a recipe for disaster, well, yeah. But, it's an ongoing disaster, it appears. A whole bunch of PC video games suddenly became unplayable this past week, such as Marvel's Guardians of the Galaxy.

The problem seemed to appear after players updated the game, leading some to believe that code may have broken the game. However, as more and more complaints came in, another potential problem was identified. It was so simple as to be almost unthinkable but so devastating that it rendered games completely useless.

Once the same reports of games failing to load came in about several other titles, Twitter lit up about the topic. From there, the internet did its sleuthing thing and the one commonality uncovered was Denuvo DRM software. One Twitter denizen poked around and appears to have figured it out: someone at Denuvo forgot to renew a domain.

“@PlanetZooGame @shadowofwargame your DRM provider has let their domain name lapse, and it’s killed your game startup… along with multiple other games I imagine,” he wrote.

Buckland identified the domain ‘codefusion.technology’ as the culprit and offered a screenshot of its WHOIS records, which clearly shows that the domain expired on September 24, 2021, and had not been renewed. Following the failure to renew, the domain then went into a grace period but when that expired too, it appears to have been removed from DNS records. This meant that the domain would not resolve to an IP address, effectively breaking the system.

Now, that domain has now been renewed, so the problem for those gamers and games is fixed. But that cannot be the end of the story. For starters, TorrentFreak reached out to its regular contacts at Denuvo to get their take on all of this, but got undeliverable bounceback messages. Why that would occur is not currently known, but it's all just messy. In addition, the lack of communication or accountability from Denuvo or its parent company, Irdeto, is infuriating.

In the meantime, someone has now renewed the codefusion.technology domain, which appears to have solved players’ problems. It’s now set to expire on September 24, 2022, meaning just a single year was added to the bank. Hopefully next year doesn’t bring similar problems.

And by problems we apparently mean paying customers unable to play the games for which they paid, all because someone on Denuvo's side couldn't be bothered to keep its own domain up and running.

And that's the story of DRM. Again, anyone who pirated these games is not having a single problem. Only those that forked over cash to play are impacted. How that isn't the end of DRM adoption by the gaming companies is completely beyond me.

Filed Under: drm, video games
Companies: denuvo

Apple Faces Yet More 'Right To Repair' Backlash Over iPhone 13 Screen

from the do-not-pass-go,-do-not-collect-$200 dept

Apple has never looked too kindly upon users actually repairing their own devices. The company's ham-fisted efforts to shut down, sue, or otherwise imperil third-party repair shops are legendary. As are the company's efforts to force recycling shops to shred Apple products (so they can't be refurbished and re-used), and Apple's often comical attacks on "right to repair" legislation, a push that only sprung up after companies like Apple, Microsoft, Sony, John Deere, and others created a grass-roots counter-movement via their attempts to monopolize repair.

And if the construction of the iPhone 13 is anything to go by, Apple has learned absolutely nothing in the last five years of heated debate, legal wrangling, and bipartisan anger. According to iFixit, the iPhone 13 is harder to repair than ever. The screen technically can no longer be replaced at all without the use of a microscope and special software. If you try to do it yourself, it disables the iPhone's Face ID identification technology. That's something that's been confirmed by both iFixit and numerous independent repair shops:

iFixit isn't impressed:

"This is a dark day for fixers, both DIY and professional. One of the most common phone repairs that could once be done with hand tools now requires a microscope. This means you won’t be able to fix your iPhone screen yourself without sacrificing major functionality. It also has huge implications for the professional repair industry, for which Apple is the dominant brand to service. Small shops could be shuttered, forced to choose between spending thousands on new equipment or losing a major source of income."

After complaints bubbled up, Apple told The Verge it would eventually release a software update that doesn't require you transfer the microcontroller to keep Face ID working after a screen swap. Though that update isn't here yet, there's no guarantee it won't come without caveats, the screen is still very difficult to repair, and making the decision in the first place (after several years of very public right to repair backlash) speaks volumes. It's also still part of an overall trend at Apple to monopolize repair.

If an independent repair shop wants to survive, they now have to join (assuming they're even allowed) Apple's problematic independent repair program. Otherwise, independent repair shops lose a ton of revenue every time these policy choices are made (which from Apple's perspective is the whole point). Apple will routinely claim they're only concerned about consumer privacy and security, but it's possible to be pro-privacy and security and pro-environment, pro-consumer, and pro-independent repair simultaneously.

Historically, the more companies like Apple, Sony, or John Deere attempt to monopolize repair, the bigger the bipartisan coalition of annoyed consumers grows. That increases the risk of state or federal legislation blocking their efforts, a bit of mathematics they'll eventually be forced to take to heart.

Filed Under: face id, independent repair, iphone, iphone 13, right to repair, screen
Companies: apple

Missouri Admits It Fucked Up In Exposing Teacher Data, Offers Apology To Teachers -- But Not To Journalists It Falsely Accused Of Hacking

from the be-better-missouri dept

As you'll recall, last month, journalists for the St. Louis Post-Dispatch revealed that the state's Department of Elementary and Secondary Education (DESE) website was exposing teacher and administrator social security numbers in the HTML source code. This came years after state auditors had highlighted that DESE was already collecting information it should not have been collecting. Bizarrely, DESE and Missouri governor Mike Parson, rather than thanking these journalists for helping to protect the teachers, accused them of being hackers and promising to prosecute them. After people mocked him, he doubled down on the claim and a PAC closely connected to Parson put out a bizarre add playing up the evil "hacking" by the "fake news" media, along with ridiculous talk about "decoding the HTML source code."

Except that, now, DESE has (much more quietly, and with much less bombast) apologized for the data breach and offered credit and identity theft monitoring to teachers:

The Department of Elementary and Secondary Education (DESE), in conjunction with Missouri's Office of Administration Information Technology Services Division (OA-ITSD), will begin to send letters in the coming days to certificated educators across the state whose personally identifiable information (PII) may have been compromised during a recent data vulnerability incident.

Note the changing description here. What they were previously calling a "hack" is now, more accurately, called a "data vulnerability incident." Though, a more accurate description would be that DESE exposed private data of teachers and administrators. Taking responsibility for that would mean being a bit more upfront about that. DESE messed up. Own it.

The state is unaware of any misuse of individual information or if information was accessed inappropriately outside of an isolated incident. However, out of an abundance of caution and in the unlikely event that this information was inappropriately accessed outside this single incident, the State of Missouri is offering 12 months of credit and identity theft monitoring resources through IDX to the approximately 620,000 past and present certificated educators whose PII was contained in the DESE certification database.

So, what's notable here is that with all the claims of "hacks" being thrown around, DESE and the Governor kept insisting that just 3 individuals, whose info the reporters checked on, were exposed, and refused to admit that it actually impacted a very large number of teachers and administrators. Now, buried in the middle of this notice, we find out that the records of 620,000 teachers and administrators were exposed, including past employees. Wow.

And, also, there's at least some kind of apology, even if it's a bit of a mealy-mouthed one:

“Educators have enough on their plates right now and I want to apologize to them for this incident and the additional inconvenience it may cause them,” said Commissioner of Education Margie Vandeven. “It is unacceptable. The security of the data we collect is of the utmost importance to our agency. Rest assured that we are working closely with OA-ITSD to resolve this situation.”

Notice, however, that the apology is only to the teachers and administrators and not to the journalists DESE and the Governor falsely accused of hacking. Perhaps that's because -- as the Kansas City Star reports -- the journalists are still being investigated for possible prosecution:

That investigation is still ongoing, according to patrol Capt. John Hotz. Those interviewed so far have included Shaji Khan, a University of Missouri - St. Louis cybersecurity expert whom the Post-Dispatch consulted to verify the data flaw. Cole County Prosecutor Locke Thompson will ultimately make a decision on whether to bring charges.

Hell, in the description of what happened, DESE ignores that it previously accused the reporters of hacking, refuses to even call them reporters (refering to them as "an individual") and then still plays up that the data needed to be "decoded."

As previously announced by OA, on October 12, 2021, DESE was made aware that the PII of at least three Missouri educators was potentially compromised. The information was located within the educator certification data available on DESE’s website. An individual told DESE that they, through a multi-step process, accessed the certification records of at least three educators, took the encoded source data from that webpage, decoded that data, and then viewed the social security number (SSN) of those specific educators. Educators’ PII was only accessible on an individual basis within this search tool, and there was no option to decode SSNs for all educators in the system all at once.

Again, if you click on the "previously announced" link, it takes you right to the announcement that calls the reporter "a hacker" and accuses them of "taking records."

Notably, Governor Mike Parson, who was so eager to call the journalists hackers and call for their prosecution has not (as of me writing this) said anything directly on Twitter about all this -- other than a bizarre tweet this morning about how "great teachers are crucial to our workforce development goals." Of course, one way to get great teachers is not to expose their data, and then try to cover it up or to blame the responsible and ethical disclosure practices of journalists who actually helped to protect those teachers.

Filed Under: credit monitoring, data breach, data vulnerability, dese, hacking, journalism, mike parson, missouri, st. louis, teachers

Seven Years After Discovering Rogue Stingray Devices In DC, The Federal Gov't Still Doesn't Have Any Idea What To Do About It

from the tfw-when-you-love-surveillance-way-more-than-countersurveillance dept

Seven years ago, wardriving security researchers discovered rogue cell tower simulators being operated near sensitive locations in Washington, DC, presumably by foreign governments.

The company used their ultrasecure CryptoPhone 500 to search for the interceptors, which can compromise phones through baseband hardware and are believed to have a range of roughly 1 mile. ESD America‘s phones allegedly detected telltale signs of call interception in the vicinity of the White House, the Russian Embassy, the Supreme Court, the Department of Commerce, and the Russell Senate Office Building, among other landmark buildings.

Three years later, Senator Ron Wyden sent a letter to DHS Undersecretary Christopher Krebs, asking him to look into this report. The DHS was told to find out where these were located, who was running them, whether the DHS was already aware of this problem, and what, if anything, the DHS planned to do about it.

The answer -- arriving four months later -- was "not much." The DHS agreed the possible use of Stingray-type devices by foreign operatives was indeed the sort of thing it should be concerned about (what with it being in the business of securing the homeland), but didn't appear to believe it should do much about it itself. It said it had detected several devices during a 90-day operation using ESD America equipment, but had no staffing or funding to do anything more than confirm what ESD America had discovered four years earlier.

Another three years have passed and nothing has changed but the list of federal entities that are apparently unable to do anything about these obvious threats to national security. Dell Cameron has the latest on the federal government (in)activity for Gizmodo:

It has been a matter of public record for decades that phones can be tracked and calls and text messages intercepted using a device called a cell site simulator, which exploits long-standing security vulnerabilities in phones by impersonating a legitimate phone company’s cell towers,” Sen. Ron Wyden wrote Thursday in a letter to the director of national intelligence; heads of the FBI and CISA—the agency charged with defending critical systems; and the presumptive next chair of the Federal Communications Commission.

“While the threat posed by this technology has been clear for years,” Wyden wrote, “the U.S. Government has yet to meaningfully address it.”

Among other concerns in the letter, both the Departments of State and Defense have confirmed to Wyden’s office, he said, “that they lack the technical capacity to detect cell site simulators in use near their facilities.”

"For years." That's the problem here. The threat to national security has been at least implied since 2014, when security researchers discovered cell site simulators that didn't appear to be operated by US agencies. That so many were clustered around sensitive areas of Washington DC suggested surveillance by inappropriately curious, if not actually malevolent, foreign agents or operatives.

And the tech itself is no secret either. Not only are Stingray devices widely used by US government agencies, they're also widely used by foreign governments -- many of which have no legal or moral compunction preventing them from using them as more than phone-tracking devices. The devices can also intercept communications and create attack vectors for cellphone-targeting malware. This is the sort of thing that should have been more than shrugged at by federal agencies.

And it doesn't take a government to get this dirty work done. Individuals and members of extremist groups can knock together cell tower simulators on the cheap -- powerful tools that don't rely on a support team of techs or a nondescript host vehicle to engage in tracking, eavesdropping, or hacking.

Researchers in the past have assembled devices for as little as $1,000, and have been able to carry out sophisticated attacks beyond the power of those licensed by state and local agencies. In recent years, international vendors have marketed versions small enough to wear undetected, allowing them to slip into the middle of a protest, for example, without raising alarm.

While it's true the government's offensive options might be limited, as attempts to knock out unknown cell site simulators might result in cell service disruptions in the immediate area, that doesn't mean the government is unable to mount a better defense.

Wyden's letter [PDF] asks who's really in charge out there, if anyone? While there may be no perfect agency to oversee the security of phone networks, one agency needs to step up and assume some responsibility while the details are sorted out. His letter hints that the FCC may be able to assist here.

If it can't oversee the entire process, it could at least institute requirements for cell phone providers that would make phones less susceptible to tracking and interception by these devices. Wyden suggests making it easier for phone users to locate and terminate support for 2G and 3G networks, which are more easily exploited by cell site simulators.

Wyden also suggests something practical that could be implemented quickly and at a minimum of expense: encrypting all voice and text communications by federal employees, which would make interception by Stingray devices mostly worthless.

Finally, Wyden wants to know who's doing anything to protect US government employees and facilities from these attacks, whether they occur in Washington DC, or elsewhere in the world.

These questions need answers. But they also need action. It's been seven years and we've seen very little of either from federal agencies that express their strong concerns about national security when they're playing offence (engaging in broad, intrusive surveillance, violating/ignoring citizens' rights) but seem far less concerned when they're asked to actually, you know, secure the goddamn nation from known threats.

Filed Under: imsi catcher, stingray, washington dc

Daily Deal: StackSkills Unlimited

from the good-deals-on-cool-stuff dept

StackSkills is the premier online learning platform for mastering today's most in-demand skills. Whether you're looking to earn a promotion, make a career change, or pick up a side hustle to make some extra cash, StackSkills delivers engaging online courses featuring the skills that matter most today, both personally and professionally. From blockchain to growth hacking, to iOS development, StackSkills stays ahead of the hottest trends to offer the most relevant courses and up-to-date information. If you're ready to commit to your personal and career growth, you won't want to pass on this incredible all-access pass to the web's top online courses. It's on sale for $59 and if you use the code SAVE15NOV, you'll get an additional 15% off.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal