ReportWire

Tag: Breaches

  • US Border Patrol Is Spying on Millions of American Drivers

    [ad_1]

    Eight years after a researcher warned WhatsApp that it was possible to extract user phone numbers en masse from the Meta-owned app, another team of researchers found that they could still do exactly that using a similar technique. The issue stems from WhatsApp’s discovery feature, which allows someone to enter a person’s phone number to see if they’re on the app. By doing this billions of times—which WhatsApp did not prevent—researchers from the University of Vienna uncovered what they’re calling “the most extensive exposure of phone numbers” ever.

    Vaping is a major problem in US high schools. But is the solution to spy on students in the bathroom? An investigation by The 74, copublished with WIRED, found that schools around the country are turning to vape detectors in an effort to crack down on nicotine and cannabis consumption on school grounds. Some of the vape detectors go far beyond detecting vapor by including microphones that are surprisingly accurate and revealing. While few defend addiction and drug use, even non-vapers say the added surveillance and the punishments that result go too far.

    Don’t look now, but that old networking equipment your company hasn’t thought about in years may jump out and bite you. Tech giant Cisco this week launched a new initiative, warning companies that AI tools are making it increasingly simple for attackers to find vulnerabilities in outdated and unpatched networking infrastructure. The message: Upgrade or else.

    If you’ve ever attended a conference, you probably worried about getting sick in the cesspools that are a conference center. But one hacker conference in New Zealand, Kawaiicon, invented a novel way to keep attendees a little bit safer. By tracking the CO2 levels in each conference room, Kawaiicon’s organizers were able to create a real-time air-quality monitoring system, which would tell people which rooms were safe and which seemed … gross. The project brings new meaning to antivirus monitoring.

    And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    The US Border Patrol is operating a predictive-intelligence program that monitors millions of American drivers far beyond the border, according to a detailed investigation by the Associated Press. A network of covert license-plate readers—often hidden inside traffic cones, barrels, and roadside equipment—feeds data into an algorithm that flags “suspicious” routes, quick turnarounds, and travel to and from border regions. Local police are then alerted, resulting in traffic stops for minor infractions like window-tint violations, air fresheners, or marginal speeding. AP reviewed police records showing that drivers were questioned, searched, and sometimes arrested despite no contraband being found.

    Internal group chats obtained through public-records requests show Border Patrol agents and Texas deputies sharing hotel records, rental car status, home addresses, and social media details of US citizens in real time while coordinating what officers call “whisper stops” to obscure federal involvement. The AP identified plate-reader sites more than 120 miles from the Mexican border in the Phoenix area, as well as locations in metropolitan Detroit and near the Michigan-Indiana line that capture traffic headed toward Chicago and Gary. Border Patrol also taps DEA plate-reader networks and has, at various times, accessed systems run by Rekor, Vigilant Solutions, and Flock Safety.

    CBP says the program is governed by “stringent” policies and constitutional safeguards, but legal experts told AP that its scale raises new Fourth Amendment concerns. A UC Law San Francisco official said the system amounts to a “dragnet” tracking Americans’ movements, associations, and daily routines.

    Microsoft claims to have mitigated the largest distributed denial-of-service (DDoS) attack ever recorded in a cloud environment—a 15.72 Tbps, 3.64-billion-pps barrage launched on October 24 against a single Azure endpoint in Australia. Microsoft says The attack “originated from the Aisuru botnet,” a Turbo-Mirai–class IoT network of compromised home routers, cameras, and other consumer devices. More than 500,000 IP addresses are said to have participated, generating a massive DDoS attack with little spoofing. Microsoft says its global Azure DDoS Protection network absorbed the traffic without service disruption. Microsoft described the attack as the “the largest DDoS ever observed in the cloud,” emphasizing the single endpoint; however, Cloudflare also recently reported a 22.2 Tbps flood, naming it the largest DDoS attack ever seen.

    Researchers note that Aisuru has recently launched multiple attacks exceeding 20 Tbps and is expanding its capabilities to include credential stuffing, AI-driven scraping, and HTTPS floods via residential proxies.

    The US Securities and Exchange Commission has dropped its remaining claims against SolarWinds and its CISO, Tim Brown, ending a long-running case over the company’s 2020 supply-chain hack, in which Russian SVR operatives allegedly compromised SolarWinds’ Orion software and triggered widespread breaches across government and industry. The agency’s lawsuit—filed in 2023 and centered on alleged fraud and internal-control failures—had already been mostly dismantled by a federal judge in 2024. SolarWinds called the full dismissal a vindication of its argument that its disclosures and conduct were appropriate and said it hopes the outcome eases concerns among CISOs about the case’s potential chilling effect.

    Law enforcement records show that the FBI accessed messages from a private Signal group used by New York immigration court-watch activists—a network that coordinates volunteers monitoring public hearings at three federal immigration courts. According to a two-page FBI/NYPD “joint situational information report” dated August 28, 2025, agents quoted chat messages, labeled the nonviolent court watchers as “anarchist violent extremist actors,” and circulated the assessment nationwide. The report did not explain how the FBI penetrated an encrypted Signal group, but it claimed the information came from a “sensitive source with excellent access.”

    The documents, first reported by the Guardian, were original obtained by the government-transparency group Property of the People. They describe activists discussing how to enter courtrooms, film officers, and gather identifying details of federal personnel, but provide no evidence to support the FBI’s allegation that a member previously advocated violence. A separate set of records—also obtained by the group—shows the bureau framed ordinary observation of public immigration hearings as a potential threat, even as Immigration and Customs Enforcement has escalated courthouse arrests and set what advocates call “deportation traps.” Civil liberties experts told the paper that the surveillance mirrors earlier FBI campaigns targeting lawful dissent and risks chilling protected political activity.

    [ad_2]

    Dell Cameron, Andrew Couts

    Source link

  • Exposed United Nations Database Left Sensitive Information Accessible Online

    Exposed United Nations Database Left Sensitive Information Accessible Online

    [ad_1]

    A database containing sensitive, sometimes personal information from the United Nations Trust Fund to End Violence Against Women was openly accessible on the internet, revealing more than 115,000 files related to organizations that partner with or receive funding from UN Women. The documents range from staffing information and contracts to letters and even detailed financial audits about organizations working with vulnerable communities around the world, including under repressive regimes.

    Security researcher Jeremiah Fowler discovered the database, which was not password protected or otherwise access controlled, and disclosed the finding to the UN, which secured the database. Such incidents are not uncommon, and many researchers regularly find and disclose examples of exposures to help organizations correct data management mistakes. But Fowler emphasizes that this ubiquity is exactly why it is important to continue to raise awareness about the threat of such misconfigurations. The UN Women database is a prime example of a small error that could create additional risk for women, children, and LGBTQ people living in hostile situations worldwide.

    “They’re doing great work and helping real people on the ground, but the cybersecurity aspect is still critical,” Fowler tells WIRED. “I’ve found lots of data before, including from all sorts of government agencies, but these organizations are helping people who are at risk just for being who they are, where they are.”

    A spokesperson for UN Women tells WIRED in a statement that the organization appreciates collaboration from cybersecurity researchers and combines any outside findings with its own telemetry and monitoring.

    “As per our incident response procedure, containment measures were rapidly put in place and investigative actions are being taken,” the spokesperson said of the database Fowler discovered. “We are in the process of assessing how to communicate with the potential affected persons so that they are aware and alert as well as incorporating the lessons learned to prevent similar incidents in the future.”

    The data could expose people in multiple ways. At the organizational level, some of the financial audits include bank account information, but more broadly, the disclosures provide granular detail on where each organization gets its funding and how it budgets. The information also includes breakdowns of operating costs, and details about employees that could be used to map the interconnections between civil society groups in a country or region. Such information is also ripe for abuse in scams since the UN is such a trusted organization, and the exposed data would provide details on internal operations and potentially serve as templates for malicious actors to create legitimate-looking communications that purport to come from the UN.

    [ad_2]

    Lily Hay Newman

    Source link

  • Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages

    Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages

    [ad_1]

    A group calling itself “NullBulge” published a 1.1-TB trove of data late last week that it claims is a dump of Disney’s internal Slack archive. The data allegedly includes every message and file from nearly 10,000 channels, including unreleased projects, code, images, login credentials, and links to internal websites and APIs.

    The hackers claim they got access to the data from a Disney insider and named the alleged collaborator. A person with that name who lists Disney as their current employer did not return WIRED’s request for comment. Whether the hackers actually had inside help remains unconfirmed; they could also have plausibly used info-stealing malware to compromise an employee’s account. Disney did not confirm the breach or return multiple requests for comment about the legitimacy of the stolen data. A Disney spokesperson told the Wall Street Journal that the company “is investigating this matter.”

    The data, which appears to have been first published on Thursday, was posted on BreachForums and later taken down, but it is still live on mirror sites.

    Roei Sherman, field CTO at Mitiga Security, says he isn’t surprised that a giant like Disney could have a breach of this scale and significance. “Companies are getting breached all the time, especially data theft from the cloud and software-as-a-service platforms,” he says. “It is just easier for attackers and holds bigger rewards.”

    Sherman, who reviewed the data in the leak, added that “all of it looks legit—a lot of URLs, conversations of employees, some credentials, and other content.”

    The NullBulge site says that it is a “hacktivist group protecting artists’ rights and ensuring fair compensation for their work.” The group claims it hacks only targets that violate one of three “sins.” First: “We do not condone any form of promoting crypto currencies or crypto related products/services.” Second: “We believe AI-generated artwork harms the creative industry and should be discouraged.” And third: “Any theft from Patreons, other supportive artist platforms, or artists in general.”

    The group’s “wall of knowledge,” where it lists its data dumps, summarizes the philosophy: “What better way to punish someone than getting them in trouble eh?” Previously, the group targeted the Indian content creator Chief Shifter with a “first shaming.” Then in May, NullBulge posted a “second punch” and teased the Disney breach. “Here is one I never thought I would get this quickly … Disney. Yes, that Disney,” NullBuldge wrote, suggesting that the group may be a single person. “The attack has only just started, but we have some good shit. To show we are serious, here is 2 files from inside.”

    In addition to the alleged Slack data, NullBulge posted what appears to be detailed information about the individual whom they claim provided the insider access and data. The leak includes medical records and other personally identifying information, plus the alleged contents of the alleged Disney employee’s 1Password password manager. NullBulge claims to have doxxed the individual in retaliation for cutting off communication and access, although whether the employee actually collaborated with the group in the first place remains unconfirmed.

    Security researchers have long warned about corporate Slack accounts as a treasure trove for attackers if compromised. The popular team communication platform is owned by Salesforce and is used by an array of prominent organizations, including IBM, Capital One, Uber, and Disney rival Paramount.

    “Disney will probably be targeted a lot more now by opportunistic threat actors,” Sherman warns.

    [ad_2]

    Lily Hay Newman

    Source link

  • The Sweeping Danger of the AT&T Phone Records Breach

    The Sweeping Danger of the AT&T Phone Records Breach

    [ad_1]

    From targeted wiretaps to bulk surveillance dragnets, phone companies have been at the center of privacy concerns for decades—and their time in the limelight isn’t over yet. On Friday, telecom giant AT&T announced that it recently suffered a data breach impacting call and text messaging records of “nearly all” its customers. The company is in the process of notifying about 110 million people that they were affected.

    AT&T said in a US Securities and Exchange Commission filing that it learned about the data breach on April 19. Attackers exfiltrated data between April 14 and April 25. The company said in its SEC submission that the US Justice Department authorized delayed disclosure of the breach on May 9 and again on June 5, pending investigation. AT&T added that it is “working with law enforcement in its efforts to arrest those involved in the incident.” So far, “at least one person has been apprehended.”

    “Yeah, this is really bad,” says Jake Williams, vice president of research and development at the cybersecurity consultancy Hunter Strategy. “What the threat actors stole here are essentially call data records. These are a gold mine in intelligence analysis because they allow someone to understand networks—who is talking to whom and when. And threat actors have data from previous compromises to map phone numbers to identities. But even without identifying data for a phone number, closed networks—where numbers only communicate with others in the same network—are almost always interesting.”

    The incident is significant not only because of its sheer scale and reach but because AT&T says it is the latest in a staggering spate of data thefts that resulted from attackers compromising organizations’ Snowflake cloud accounts. Snowflake is a data warehousing platform, and attackers collected its customers’ account credentials in recent months to steal hundreds of millions of records from about 165 Snowflake clients, including Ticketmaster, Santander bank, and LendingTree’s QuoteWizard.

    The AT&T data is from both landline and cellular accounts and spans May 1, 2022, to October 31, 2022. A smaller, undisclosed number of people also had records from January 2, 2023, stolen in the breach. The company said on Friday that the data trove “does not contain the content of calls or texts” and does not include the date and time of communications. But attackers did make off with phone numbers and a massive amount of so-called “metadata” about calls and texts, including who contacted whom, call durations, and tallies of a customer’s total calls and texts. The trove also includes some cell site identification numbers—essentially cell tower data that can be used to approximate a cellphone’s location when it made or received a call or text.

    The data includes some records of people who are customers of phone carriers—known as “mobile virtual network operators”—that contract with AT&T to use the larger company’s networks and infrastructure for their service. And, crucially, the stolen trove exposes people who have no relationship with AT&T when they communicated with an AT&T customer during the relevant time spans.

    [ad_2]

    Lily Hay Newman

    Source link

  • The Ticketmaster Data Breach May Be Just the Beginning

    The Ticketmaster Data Breach May Be Just the Beginning

    [ad_1]

    One of the biggest hacks of the year may have started to unfold. Late on Friday, embattled events business Live Nation, which owns Ticketmaster, confirmed it suffered a data breach after criminal hackers claimed to be selling half a billion customer records online. Banking firm Santander also confirmed it had suffered a data breach impacting millions of customers and staff after its data was advertised by the same group of hackers.

    While the specific circumstances of the breaches—including exactly what information was stolen and how it was accessed—remain unclear, the incidents may be linked to attacks against company accounts with cloud hosting provider Snowflake. The US-based cloud firm has thousands of customers, including Adobe, Canva, and Mastercard, which can store and analyze vast amounts of data in its systems.

    Security experts say that as more details become clear about hackers’ attempts to access and take data from Snowflake’s systems, it is possible that other companies will reveal they had data stolen. At present, though, the developing situation is messy and complicated.

    “Snowflake recently observed and is investigating an increase in cyber threat activity targeting some of our customers’ accounts,” Brad Jones, Snowflake’s chief information security officer wrote in a blog post acknowledging the cybersecurity incident on Friday. Snowflake has found a “limited number” of customer accounts that have been targeted by hackers who obtained their login credentials to the company’s systems, Jones wrote. Snowflake also found one former staff member’s “demo” account that had been accessed.

    However, Snowflake doesn’t “believe” it was the source of any leaked customer credentials, the post says. “We have no evidence suggesting this activity was caused by any vulnerability, misconfiguration, or breach of Snowflake’s product,” Jones writes in the blog post.

    While the number of Snowflake accounts accessed and what data may have been taken have not been released, government officials are warning about the impact of the attack. Australia’s Cyber Security Center issued a “high” alert on Saturday saying it is “aware of successful compromises of several companies utilizing Snowflake environments” and companies using Snowflake should reset their account credentials, turn on multi-factor authentication, and review user activity.

    “It looks like Snowflake has had some rather egregiously bad security compromise,” security researcher Troy Hunt, who runs data breach notification website Have I Been Pwned, tells WIRED. “It being a provider to many other different parties, it has sort of bubbled up to different data breaches in different locations.”

    Details of the data breaches started to emerge on May 27. A newly registered account on cybercrime forum Exploit posted an advertisement where they claimed to be selling 1.3 TB of Ticketmaster data, including more than 560 million people’s information. The hacker claimed to have names, addresses, email addresses, phone numbers, some credit card details, ticket sales, order details, and more. They asked for $500,000 for the database.

    One day later, the established hacking group ShinyHunters—which first emerged in 2020 with a data-stealing rampage, before selling 70 million AT&T records in 2021—posted the exact same Ticketmaster ad on rival marketplace BreachForums. At the time, Ticketmaster and its parent company Live Nation had not confirmed any data theft and it was unclear if either post selling the data was legitimate.

    [ad_2]

    Matt Burgess

    Source link

  • Sanctions aren’t working: How the West enables Russia’s war on Ukraine

    Sanctions aren’t working: How the West enables Russia’s war on Ukraine

    [ad_1]

    Press play to listen to this article

    Voiced by artificial intelligence.

    BERLIN — At its summit this week, the European Union is threatening to name and shame more than a dozen Chinese companies that, it claims, are supplying critical technology to equip Russia’s war machine.

    But what about the Western companies that make dual-use and other advanced gear that is subject to sanctions and yet, according to an analysis of wreckage found on the Ukrainian battlefield, is used in Russian Kalibr missiles, Orlan drones and Ka-52 “Alligator” helicopters?

    Radio silence.

    So here’s a trivia question for you: Which company is the leading maker of the so-called “high-priority battlefield items” trafficked to Russia that the Western coalition wants to interdict?

    If you said Intel, then go to the top of the class: According to the sanctions team at the Kyiv School of Economics, the U.S. semiconductor giant again leads the pack this year. It’s followed by Huawei of China. Then come Analog Devices, AMD, Texas Instruments and IBM — all of which are American.

    Russian imports of microelectronics, wireless and satellite navigation systems and other critical parts subject to sanctions have recovered to near pre-war levels with a monthly run rate of $900 million in the first nine months of this year, according to a forthcoming report from the Kyiv School’s analytical center, the KSE Institute.

    All of this indicates that, while Western sanctions imposed over Russia’s full-scale invasion on February 24, 2022, had a temporary impact, Moscow and its helpers have largely succeeded in reconfiguring supply chains — with the help of China, Hong Kong and countries in Russia’s backyard like Kazakhstan and NATO member Turkey.

    That in turn begs the question as to whether, as the EU strives to deliver a 12th package of sanctions against Russia in time for a leaders’ summit on Thursday, the bloc is serving up yet another case study for the definition of insanity often attributed to Albert Einstein: doing the same thing over and over again and expecting a different result.

    For Elina Ribakova, director of the international program at the KSE Institute, the Western private sector must also be held to account. It should, she argues, be required to track its products along the entire value chain to their final destination — just as banks were forced to tighten anti-money laundering controls and customer checks after the 2008 crash.

    “We have a policy in a void. We have put it on paper but we don’t have any infrastructure for the private sector to comply — or for us to check,” Ribakova told POLITICO. “We need to have the private sector enforce and implement this.”

    Intel, responding to a request for comment, said it had suspended all shipments to Russia and Belarus, its ally, and that it was compliant with sanctions and export controls against both countries issued by the U.S. and its allies.

    “While we do not always know nor can we control what products our customers create or the applications end-users may develop, Intel does not support or tolerate our products being used to violate human rights,” the company said in a statement. “Where we become aware of a concern that Intel products are being used by a business partner in connection with abuses of human rights, we will restrict or cease business with the third party until and unless we have high confidence that Intel’s products are not being used to violate human rights.”

    Anecdotal evidence

    The KSE Institute’s findings bear out, in a systematic way, the anecdotal findings of POLITICO’s own reporting this year: In our investigations, we showed how U.S.-made sniper ammunition finds its way into Russian rifles, and how China has positioned itself as Russia’s go-to supplier of nonlethal, but militarily useful, equipment

    As for Europe, while its companies may not feature among the top makers of critical technology sold to Russia, its industrial businesses are facing growing scrutiny over the supply of machinery and spare parts — often via third countries like Kazakhstan that have seen suspicious surges in imports.

    It’s here, also, that Europe has fallen down.

    In imposing sanctions, it’s a case of “all for one” — the bloc has jointly agreed on and implemented measures affecting everything from energy to banking.

    But enforcement is a matter for individual member countries. Some are on board with the program. Others, like Hungarian Prime Minister Viktor Orbán, overtly sympathize with Russia. And others, still, are conflicted — as when it emerged that the husband of hawkish Estonian premier Kaja Kallas owned a stake in a freight firm that still did business in Russia.

    Then there are countries like neutral Austria, with historical ties to the Soviet military-industrial complex that have left politicians and law enforcement with a huge blind spot.

    That’s important because, as independent researcher Kamil Galeev put it to POLITICO, Russia today still upholds an organizing principle dating back to the early Soviet era that civilian industry should “be able to switch 100 percent to military production should the need arise.”

    Justice delayed

    Despite evidence of widespread breaches, only a handful of sanctions cases are being pursued by European law enforcement. Among them, German prosecutors have secured the arrest of a businessman suspected of supplying precision lathes to two Russian companies that make sniper rifles.

    But the wheels of justice turn slowly: The arrest in August of Ulli S. — prosecutors, following German tradition, have not published his full name — relates to the initial imposition of Western sanctions over Russia’s occupation of Crimea and eastern Ukraine in 2014.

    The press had already cracked the case by the time the suspect appeared in court, naming DMG Mori — a Japanese-German joint venture — as the supplier. One customer was Kalashnikov, maker of the famed AK-47 rifle. The other was Promtekhnologia, which has been sanctioned by the U.S. and featured in POLITICO’s sniper bullets investigation. Promtekhnologia makes the Orsis sniper rifle promoted by action movie actor Steven Seagal — now a Russian citizen — and used by President Vladimir Putin’s men in Ukraine.  

    DMG Mori, formerly called Gildemeister, suspended sales to Russia after the full-scale invasion. But, because it has closed down its operations in the country, it says it is no longer able to keep control over its machines made there (although an internal probe did find that they were being used for civilian purposes). The German Federal Prosecutor did not respond to a request for comment.

    The real bad actors 

    It’s not just in stopping imports to Russia that sanctions are falling short of their stated intention.

    Vladimir Putin’s former wife, Lyudmila (left), and her new partner have splashed the cash on luxury property investments in Spain, Switzerland and France a POLITICO investigation found | Yuri Kochetkov/EPA

    Russians with close ties to Putin — and their money — continue to be more than welcome in Europe despite the death and destruction his regime has unleashed. His former wife, Lyudmila, and her new partner have splashed the cash on luxury property investments in Spain, Switzerland and France, as a POLITICO investigation found at the start of the year.

    And when the European Council — the intergovernmental branch of the EU — does sanction Russian business leaders suspected of aiding and abetting the Putin regime, it has often relied on slipshod evidence that makes the decisions easy to challenge in court, POLITICO has also found.

    Nearly 1,600 Western multinationals continue, meanwhile, to do business in Russia. Many that announced they would pull out have struggled to do so, as POLITICO discovered when it investigated Western liquor companies that said they had quit Russia — only to find that their booze was still freely available. And some companies that did stay, like Danone and Carlsberg, have been shaken down by Putin and his cronies — a case of Russian roulette, if ever there was one.

    With the EU apparently lacking the means, or the political will, to do more to economically isolate Russia, the bloc is sending its sanctions envoy, David O’Sullivan, on a mission to apply moral suasion to countries that are, as he diplomatically puts it, “not aligned” on sanctions.

    On the high-priority battlefield technology, Sullivan told POLITICO’s EU Confidential podcast last month that the EU has had “a limited success — but in an area which is absolutely critical to the defense of Ukraine.”

    More broadly, he said: “The sanctions are a sort of slow puncture of the Russian economy. Perhaps not the blowout that some people initially predicted, but … the air is escaping from the tire and sooner or later the vehicle is going to become impossible to drive.”

    To be fair, O’Sullivan isn’t overselling the efficacy of sanctions. And he may ultimately be proven right. 

    But he only will be vindicated if Western governments do a better job of holding their own businesses to account in stemming the flows of technology, equipment and spare parts that sustain Putin and his war of aggression.

    That will come down to whether they have the will to enforce their decisions. And the evidence so far is that they don’t.

    [ad_2]

    Douglas Busvine

    Source link

  • Huawei pushes back on the EU calling it ‘high-risk’

    Huawei pushes back on the EU calling it ‘high-risk’

    [ad_1]

    Chinese technology giant Huawei has had it with European Union officials calling it a “high-risk” supplier.

    The firm, a leading manufacturer of telecoms equipment, filed a complaint with the European Ombudsman office last month after the bloc’s industry chief Thierry Breton described Huawei and its smaller Chinese rival ZTE as “high-risk suppliers” at a press conference on June 15.

    Breton was presenting a report reviewing the EU’s policies on secure 5G, which allow member countries to restrict or prohibit “entities considered high-risk suppliers, notably because they are subject to highly intrusive, third countries laws on national intelligence and data security,” the commissioner said, naming both Huawei and ZTE in his statements.

    Huawei told POLITICO in a statement Friday that the company “strongly opposes and disagrees with the comments made by the European Commission representatives publicly naming and shaming an individual company without legal basis while lacking any justification or due process,” confirming the firm is the one behind the complaint with the EU Ombudsman.

    “We expect the European Commission to address our claims and rectify their comments for the sake of Huawei’s reputation,” the spokesperson added.

    The European Ombudsman found “insufficient grounds to open an inquiry into the comments themselves” but it has asked the Commission to send Huawei a reply to its complaints by November 3, Michal Zuk, a communication officer for the EU watchdog, told POLITICO.

    The Shenzhen-based company has been fighting restrictions on the use of its 5G kit for the past few years. It has fought and lost a court challenge in Sweden against the country’s telecoms regulator and more recently filed a lawsuit with a Lisbon court against a resolution by Portugal’s cybersecurity regulator.

    At the core of Western concerns surrounding Huawei is whether the firm can be instrumentalized, pressured or infiltrated by the Chinese government to gain access to critical data in Western countries.

    The Commission didn’t immediately respond to POLITICO’s request for comment.

    [ad_2]

    Mathieu Pollet

    Source link

  • Has Ukraine’s counteroffensive finally begun?

    Has Ukraine’s counteroffensive finally begun?

    [ad_1]

    The last two days have seen growing signs Ukraine is redoubling its efforts to drive out Vladimir Putin’s forces.

    Russia’s defense ministry said it repelled a major assault in the Donetsk region, claiming in the process to having killed hundreds of Ukrainian soldiers, destroyed 28 tanks and more than a hundred armored vehicles.

    “Having suffered heavy losses the day before, the Kyiv regime reorganised the remnants of the 23rd and 31st mechanised brigades into separate consolidated units, which continued offensive operations,” it said on its Telegram channel.

    Ukraine dismissed Russia’s claims. But hours after his officials said some offensive operations were being mounted, President Volodymyr Zelenskyy in his nightly television address on Monday welcomed advances he says Ukrainian troops have been making, including around the Eastern Ukrainian city of Bakhmut, where fighting has been intense for months. “I am grateful to each soldier, to all our defenders, men and women, who have given us today the news we have been waiting for,” Zelenksyy said.

    But the Ukrainian leader stopped short of announcing that the long-awaited counteroffensive — originally expected in the spring — had been launched. Instead, government officials in Kyiv have been careful to describe the multiple attacks reported along the frontline as “local actions.”

    “We are continuing the defence that began on 24 February 2022. The defensive operation includes everything, including counteroffensive actions. Therefore, in some areas we are moving to offensive actions,” Ukraine’s deputy defense minister, Hanna Maliar, said in a Telegram post. “Fighting of local importance continues,” she added.

    Clearly there has been a significant uptick in operations by the Ukrainians in the past 48 hours. Few military observers dispute that the war is now entering a new phase. So, has the much-anticipated campaign finally started?

    The answer appears to be both yes and no.

    The recent attacks so far appear to represent the prelude to a full-scale action that is yet to begin. There has been no convincing evidence offered so far to suggest that the dozen brigades trained and kitted out by NATO for the counteroffensive have been used in these recent assaults or deployed in force on the battlefield. The 23rd and 31st mechanised brigades the Russian defense ministry mentioned are not part of the new army that’s been training for a full-scale offensive.

    Some of the attacks along five separate lines in south-eastern Donetsk appear to have been exploratory forays, testing Russian reactions and capabilities and looking for gaps. Nonetheless, the Ukrainians claim already to have had some success.

    The Commander of Ukraine’s Ground Forces, Gen. Oleksandr Syrskyi said Tuesday that Russian forces around Bakhmut could not withstand the onslaught of the Ukrainian military and retreated up to 2 kilometers. 

    Serhii Cherevatyi, spokesman for the Eastern Command of the Ukrainian Armed Forces, said on Ukrainian television “despite the enemy’s fierce resistance, our airborne assault and mechanised units managed to advance” between 300 meters and 1 kilometer, “in various parts of the front line.”

    And it isn’t just the Ukrainians saying there have been a series of breaches in Russian defenses. Several ultranationalist Russian military bloggers have been bewailing on social media the advances Ukrainian forces have made around Bakhmut, in northern Donetsk and in the village of Novodonetske.

    They include Igor Girkin, a former Russian intelligence officer and paramilitary commander who played a key role in Russia’s 2014 annexation of Crimea and the war in the Donbas. He said in a social media post that “the enemy managed to cut into our position.” According to Girkin, there’s no doubt that the counteroffensive has finally begun.

    [ad_2]

    Jamie Dettmer

    Source link

  • Meta faces record EU privacy fines

    Meta faces record EU privacy fines

    [ad_1]

    This Christmas is bound to be an expensive one for U.S. tech giant Meta.

    The Big Tech firm looks set to soon face a huge regulatory bill for all three of its social networks, Facebook, WhatsApp and Instagram. Europe’s privacy regulator body, the European Data Protection Board, is expected to issue decisions on Monday that target the three platforms, after which Meta’s lead regulator in Ireland will issue a final decision within a month.

    The detail and possible value of the monetary penalty will remain under wraps until then, but the triplet of fines could add up to over €2 billion, financial statements by Meta indicate — setting a new record for the highest fines under the European Union’s feared General Data Protection Regulation (GDPR) received by a single company in one go.

    According to filings in Ireland, Meta has set aside €3 billion for EU privacy fines in 2022 and 2023. Its platform Instagram already got slapped with a €405 million fine in September for violating kids’ privacy, and Facebook so far has accumulated €282 million in penalties for data breaches as well as a 60 million hit from the French. That leaves well over €2 billion earmarked by the firm for regulatory action.

    That’s a substantial hit for Meta, which announced last month it was laying off 11,000 employees globally amid lower sales and major costs linked to the firm’s pivot to the metaverse.

    Beyond hitting Meta’s pocket, the three fines expected within weeks could also put a bomb under its broader business model. The decisions stem from complaints filed by Austrian activist Max Schrems accusing the company of failing to have proper legal grounds to process millions of Europeans’ data. If the final decisions invalidate Meta’s argument that it’s processing data as part of a contract with users, the company would have to seek another legal basis for its data-fuelled ad targeting model.

    The cases have also revealed deep fissures between Europe’s data watchdogs.

    Ireland’s data protection commission largely backed Meta’s argument that it could claim it needs data to fulfill a “contract” with its users to provide personalized ads, in its draft decision issued a year ago. But that reasoning has long put Ireland in the minority amongst its colleagues. The Norwegian data protection authority said the Irish interpretation would render European data protection law “pointless,” according to a document obtained by POLITICO last year. The Irish regulator was also alone in voting against EU guidelines that banned companies from using the contract legal basis to use data to target ads.

    The three decisions are likely to lay into the Irish regulator’s initial position and, more worryingly for Meta, amp up the pressure for the company to go scrambling for new legal ways to gather and process data on Europeans.

    Meta also still faces an ongoing, high-profile probe into the company’s transfers of Europeans’ data to the U.S.

    Meta declined to comment. It can still appeal the fines coming out of the coming decisions.

    [ad_2]

    Vincent Manancourt

    Source link