ReportWire

Tag: Surveillance

  • Trump Loyalists Kill Vote on US Wiretap Program

    Trump Loyalists Kill Vote on US Wiretap Program

    [ad_1]

    For the third time since December, House Speaker Mike Johnson has failed to wrangle support for reauthorizing a critical US surveillance program, raising questions about the future of a law that compels certain businesses to wiretap foreigners on the government’s behalf.

    Johnson lost 19 Republicans on Tuesday in a procedural vote that traditionally falls along party lines. Republicans control the House of Representatives but only by a razor-thin margin. The failed vote comes just hours after former US president Donald Trump ordered Republicans to “Kill FISA” in a 2 am post on Truth Social, referring to the Foreign Intelligence Surveillance Act, under which the program is authorized.

    The Section 702 surveillance program, which targets foreigners overseas while sweeping up a large amount of US communications as well, is set to sunset on April 19. The program was extended by four months in late December following Johnson’s first failed attempt to hold a vote.

    Congressional sources tell WIRED they have no idea what the next steps will be.

    The program itself will carry on into the next year, regardless of whether Johnson manages to muster up another vote in the next week. Congress does not directly authorize the surveillance. Instead, it allows the US intelligence services to seek “certifications” from a secret surveillance court on a yearly basis.

    The Justice Department applied for new certifications in February. Last week, it announced they’d been approved by the court. The government’s power to issue new directives under the program without Congress’s approval, however, remains in question.

    The certifications, which are required only due to the “incidental” collection of US calls, generally permit the program’s use in cases involving terrorism, cybercrime, and weapons proliferation. US intelligence officials have also touted the program as crucial in combating the flood of fentanyl-related substances entering the US from overseas.

    The program remains controversial due to a laundry list of abuses committed primarily at the Federal Bureau of Investigation, which maintains a database that holds a portion of the raw data collected under 702.

    Although the government says it only “targets” foreigners, it has acknowledged collecting a large amount of US communications in the process. (The actual amount, it says, is impossible to calculate.) Nevertheless, it claims that once those communications are in the government’s possession, it is constitutional for federal agents to review those wiretaps without a warrant.

    An unlikely coalition of progressives and conservative lawmakers formed last year in a push to end these warrantless searches, many of the Republicans involved vocal critics of the FBI following its misuse of FISA to target a Trump campaign staffer in 2016. (The 702 program, which is only one part of FISA, was not implicated in that particular controversy.)

    Privacy experts have criticized proposed changes to the Section 702 program championed by members of the House Intelligence Committee, as well as Johnson, who had previously voted in favor of a warrant requirement despite now opposing it.

    “It seems Congressional leadership needs to be reminded that these privacy protections are overwhelmingly popular,” says Sean Vitka, policy director at Demand Progress, a civil liberties–focused nonprofit. “Surveillance reformers remain willing and able to do that.”

    A group of attorneys—among the few to ever present arguments before the Foreign Intelligence Surveillance Court—said in a statement on Tuesday that an amendment offered up by the Intel committee risked dramatically increasing the number of US businesses forced to cooperate with the program.

    Declassified filings released by the FISA court last year revealed that the FBI had misused the 702 program more than 278,000 times, including, as reported by The Washington Post, against “crime victims, January 6 riot suspects, people arrested at protests after the policing killing of George Floyd in 2020 and—in one case—19,000 donors to a congressional candidate.”

    James Czerniawaski, a senior policy analyst at Americans for Prosperity, a Washington, DC, think tank pushing for changes to Section 702, says that despite recognizing its value, it remained a “troubled program” in need of “significant and meaningful reforms.”

    “The outcome of today was completely avoidable,” he says, “but it requires the Intelligence Community and its allies to recognize that its days of unaccountable and unconditional spying on Americans are over.”

    [ad_2]

    Dell Cameron

    Source link

  • The NSA Warns That US Adversaries Free to Mine Private Data May Have an AI Edge

    The NSA Warns That US Adversaries Free to Mine Private Data May Have an AI Edge

    [ad_1]

    Electrical engineer Gilbert Herrera was appointed research director of the US National Security Agency in late 2021, just as an AI revolution was brewing inside the US tech industry.

    The NSA, sometimes jokingly said to stand for No Such Agency, has long hired top math and computer science talent. Its technical leaders have been early and avid users of advanced computing and AI. And yet when Herrera spoke with me by phone about the implications of the latest AI boom from NSA headquarters in Fort Meade, Maryland, it seemed that, like many others, the agency has been stunned by the recent success of the large language models behind ChatGPT and other hit AI products. The conversation has been lightly edited for clarity and length.

    Gilbert HerreraCourtesy of National Security Agency

    How big of a surprise was the ChatGPT moment to the NSA?

    Oh, I thought your first question was going to be “what did the NSA learn from the Ark of the Covenant?” That’s been a recurring one since about 1939. I’d love to tell you, but I can’t.

    What I think everybody learned from the ChatGPT moment is that if you throw enough data and enough computing resources at AI, these emergent properties appear.

    The NSA really views artificial intelligence as at the frontier of a long history of using automation to perform our missions with computing. AI has long been viewed as ways that we could operate smarter and faster and at scale. And so we’ve been involved in research leading to this moment for well over 20 years.

    Large language models have been around long before generative pretrained (GPT) models. But this “ChatGPT moment”—once you could ask it to write a joke, or once you can engage in a conversation—that really differentiates it from other work that we and others have done.

    The NSA and its counterparts among US allies have occasionally developed important technologies before anyone else but kept it a secret, like public key cryptography in the 1970s. Did the same thing perhaps happen with large language models?

    At the NSA we couldn’t have created these big transformer models, because we could not use the data. We cannot use US citizen’s data. Another thing is the budget. I listened to a podcast where someone shared a Microsoft earnings call, and they said they were spending $10 billion a quarter on platform costs. [The total US intelligence budget in 2023 was $100 billion.]

    It really has to be people that have enough money for capital investment that is tens of billions and [who] have access to the kind of data that can produce these emergent properties. And so it really is the hyperscalers [largest cloud companies] and potentially governments that don’t care about personal privacy, don’t have to follow personal privacy laws, and don’t have an issue with stealing data. And I’ll leave it to your imagination as to who that may be.

    Doesn’t that put the NSA—and the United States—at a disadvantage in intelligence gathering and processing?

    II’ll push back a little bit: It doesn’t put us at a big disadvantage. We kind of need to work around it, and I’ll come to that.

    It’s not a huge disadvantage for our responsibility, which is dealing with nation-state targets. If you look at other applications, it may make it more difficult for some of our colleagues that deal with domestic intelligence. But the intelligence community is going to need to find a path to using commercial language models and respecting privacy and personal liberties. [The NSA is prohibited from collecting domestic intelligence, although multiple whistleblowers have warned that it does scoop up US data.]

    [ad_2]

    Will Knight

    Source link

  • Sinking US Wiretap Program Offered One Last Lifeboat

    Sinking US Wiretap Program Offered One Last Lifeboat

    [ad_1]

    A bill introduced by senators Dick Durbin and Mike Lee to reauthorize the Section 702 surveillance program is the fifth introduced in the US Congress this winter. The authority is threatening to expire in a month, disrupting a global wiretapping program said to inform a third of articles in the President’s Daily Briefing—a morning “tour d’horizon” of US spies’ top concerns.

    But the stakes aren’t exactly so clear. With or without Congress, the Biden administration is seeking court approval to extend the 702 program into 2025. From the moment US representative Mike Johnson assumed the House speakership, he’s been unable to orchestrate a vote on the program. Outgunned most recently by Mike Turner, the chairman of the House Intelligence Committee, Johnson was forced to kill a vote after a month of negotiations.

    This, even though Congress can essentially agree on one thing if nothing else: that the 702 program is vital to the national defense and that it can’t be allowed to expire. Johnson has, once again, vowed to hold a vote on the matter, this time after Easter. And historically, this is where things have begun to fall apart.

    The biggest hurdle to reauthorizing the program is a dispute between lawmakers over whether the government should get search warrants before looking up Americans using 702, a massive wiretap database full of millions of email, voice, and text conversations intercepted by spies.

    The Durbin-Lee bill contains tweaks designed, its authors say, to meet the Biden administration halfway. While all the legislation up to this point has wrestled over the title of “reform bill,” Durbin’s has set its sights on an idea far more defensible: The Security and Freedom Enhancement (SAFE) Act, he says, is a “bill of compromise.”

    Unlike other reform bills, the SAFE Act would not require the FBI to obtain a warrant to find out if the 702 database contains an American’s communications. Only if the search produces results would investigators need a warrant, and only if they wanted to read what the messages say.

    Without going to court, investigators could learn whether the communications they’re after exist, whether the person they’re looking at communicated with any foreigners under US surveillance, and when exactly those conversations took place. As it’s generally trivial for law enforcement to obtain these kinds of records anyway, this is a compromise that doesn’t serve up a major loss for lawmakers on the side of reform.

    The tweak will add to the difficulty the FBI is having convincing lawmakers that warrants will hinder investigations or destroy the program altogether. “This narrow warrant requirement is carefully crafted to ensure that it is feasible to implement,” Durbin says, “and sufficiently flexible to accommodate legitimate security needs.”

    “There is little doubt that Section 702 is a valuable national security tool,” adds Durbin, but the program sweeps up “massive amounts of Americans’ communications.”

    “Even after implementing compliance measures, the FBI still conducted more than 200,000 warrantless searches of Americans’ communications in just one year—more than 500 warrantless searches per day,” he says.

    [ad_2]

    Dell Cameron

    Source link

  • The ‘Emergency Powers’ Risk of a Second Trump Presidency

    The ‘Emergency Powers’ Risk of a Second Trump Presidency

    [ad_1]

    Donald Trump appears to dream of being an American authoritarian should he return to office. The former US president, who on Tuesday secured enough delegates to win the 2024 Republican nomination, plans to deport millions of undocumented immigrants and house scores of them in large camps. He wants to invoke the Insurrection Act to deploy the military in cities across the nation to quell civil unrest. He wants to prosecute his political opponents. There’s an organized and well-funded effort to replace career civil servants in the federal government with Trump loyalists who will do his bidding and help him consolidate power.

    What’s also concerning to legal experts, though, are the special powers that would be available to him that have been available to all recent presidents but have not typically been used. Should Trump decide to go full authoritarian, he could utilize what are called “emergency powers” to shut down the internet in certain areas, censor the internet, freeze people’s bank accounts, restrict transportation, and more.

    Utilizing laws like the National Emergencies Act, the Communications Act of 1934, and the International Emergency Economic Powers Act (IEEPA), he would be able to wield power in ways this country has never seen. Furthermore, America’s vast surveillance state, which has regularly been abused, could theoretically be abused even further to surveil his perceived political enemies.

    “There really aren’t emergency powers relating to surveillance, and that’s because the non-emergency powers are so powerful and give such broad authority to the executive branch. They just don’t need emergency powers for that purpose,” says Elizabeth Goitein, senior director of the Brennan Center for Justice’s Liberty & National Security Program at the New York University School of Law.

    Goitein says she worries most about what a president could do with the emergency powers available to them, though, when she considers whether a president might decide to behave like an authoritarian. She says the laws surrounding these powers offer few opportunities for another branch of government to stop a president from doing as they please.

    “Emergency powers are meant to give presidents extraordinary authorities for use in extraordinary circumstances. Because they provide these very potent authorities, it is critical that they have checks and balances built into them and safeguards against abuse,” Goitein says. “The problem with our current emergency powers system—and that system comprises a lot of different laws—is that it really lacks those checks and balances.”

    Under the National Emergencies Act, for example, the president simply has to declare a national emergency of some kind to activate powers that are contained in more than 130 different provisions of law. What constitutes an actual emergency is not defined by these laws, so Trump could come up with any number of reasons for declaring one, and he couldn’t easily be stopped from abusing this power.

    “There’s a provision of the Communications Act of 1934 that allows the president to shut down or take over communications facilities in a national emergency. There is a provision that allows the president to exert pretty much unspecified controls over domestic transportation, which could be read extremely broadly,” Goitein says. “There’s IEEPA, which allows the president to freeze the assets of and block financial transactions with anyone, including an American, if the president finds it necessary to address an unusual or extraordinary threat that is emanating at least partly from overseas.”

    [ad_2]

    Thor Benson

    Source link

  • 5 Years After San Francisco Banned Face Recognition, Voters Ask for More Surveillance

    5 Years After San Francisco Banned Face Recognition, Voters Ask for More Surveillance

    [ad_1]

    San Francisco made history in 2019 when its Board of Supervisors voted to ban city agencies including the police department from using face recognition. About two dozen other US cities have since followed suit. But on Tuesday San Francisco voters appeared to turn against the idea of restricting police technology, backing a ballot proposition that will make it easier for city police to deploy drones and other surveillance tools.

    Proposition E passed with 60 percent of the vote and was backed by San Francisco Mayor London Breed. It gives the San Francisco Police Department new freedom to install public security cameras and deploy drones without oversight from the city’s Police Commission or Board of Supervisors. It also loosens a requirement that SFPD get clearance from the Board of Supervisors before adopting new surveillance technology, allowing approval to be sought any time within the first year.

    Matt Cagle, a senior staff attorney with ACLU of Northern California, says those changes leave the existing ban on face recognition in place but loosen other important protections. “We’re concerned that Proposition E will result in people in San Francisco being subject to unproven and dangerous technology,” he says. “This is a cynical attempt by powerful interests to exploit fears about crime and shift more power to the police.”

    Mayor Breed and other backers have positioned it as an answer to concern about crime in San Francisco. Crime figures have broadly declined but fentanyl has recently driven an increase in overdose deaths and commercial downtown neighborhoods are still struggling with pandemic-driven office and retail vacancies. The proposition was also supported by groups associated with the tech industry, including campaign group GrowSF, which did not respond to a request for comment.

    “By supporting the work of our police officers, expanding our use of technology and getting officers out from behind their desks and onto our streets, we will continue in our mission to make San Francisco a safer city,” Mayor Breed said in a statement on the proposition passing. She noted that 2023 saw the lowest crime rates in a decade in the city—except for a pandemic blip in 2020—with rates of property crime and violent crime continuing to decline further in 2024.

    Proposition E also gives police more freedom to pursue suspects in car chases and reduces paperwork obligations, including when officers resort to use of force.

    Caitlin Seeley George, managing director and campaign director for Fight for the Future, a nonprofit that has long campaigned against the use of face recognition, calls the proposition “a blow to the hard-fought reforms that San Francisco has championed in recent years to rein in surveillance.”

    “By expanding police use of surveillance technology, while simultaneously reducing oversight and transparency, it undermines peoples’ rights and will create scenarios where people are at greater risk of harm,” George says.

    Although Cagle of ACLU shares her concerns that San Francisco citizens will be less safe, he says the city should retain its reputation for having catalyzed a US-wide pushback against surveillance. San Francisco’s 2019 face recognition ban was followed by around two dozen other cities, many of which also added new oversight mechanisms for police surveillance.

    [ad_2]

    Lauren Goode, Tom Simonite

    Source link

  • The UK’s GPS Tagging of Migrants Has Been Ruled Illegal

    The UK’s GPS Tagging of Migrants Has Been Ruled Illegal

    [ad_1]

    The way the UK government has been tagging migrants with GPS trackers is illegal, the country’s privacy regulator ruled on Friday, in a rebuke to officials who have been experimenting with migrant-surveillance tech in both the UK and the US.

    As part of an 18-month pilot that concluded in December, the UK interior ministry, known as the Home Office, forced up to 600 people who arrived in the country without permission to wear ankle tags that continuously tracked their locations. However, that pilot broke UK data protection law because it did not properly assess the privacy intrusion of GPS tracking or give migrants clear information about the data that was being collected, the UK’s Information Commissioner’s Office (ICO) said today. The ruling means the Home Office has 28 days to update its policies around GPS tracking.

    Friday’s decision also means the ICO could fine the Home Office up to £17.5 million ($22 million) or 4 percent of its turnover—whichever is higher—if it resumes tagging people who arrive on the UK south coast in small boats from Europe. In 2023, over 29,000 people arrived using this often perilous route. Earlier this week, French rescue services said one person had died and two were missing after attempting to cross the English Channel, the stretch of water that separates England and France.

    Critics of the GPS tags welcomed the decision. “Blanket 24/7 GPS surveillance of asylum seekers arriving in the UK runs diametrically opposed to data protection and privacy rights,” says Jonah Mendelsohn, a lawyer at Privacy International, a digital rights group that has campaigned against the tag. “The UK government’s gung-ho, Wild West approach in deploying deeply intrusive technology has through today’s decision collided with a rules-based system that we all have recourse to, regardless of our immigration status.” The Home Office did not respond to WIRED’s request for comment.

    “Having access to a person’s 24/7 movements is highly intrusive, as it is likely to reveal a lot of information about them, including the potential to infer sensitive information such as their religion, sexuality, or health status,” said John Edwards, the UK information commissioner, in a statement. “Lack of clarity on how this information will be used can also inadvertently inhibit people’s movements and freedom to take part in day-to-day activities.”

    The ICO did not rule that the Home Office had to delete migrants’ GPS data already stored in its systems. The regulator also left open the possibility that there may be a legal way to monitor migrants electronically, but not without data protections in place.

    In UK courts, at least two cases revolving around GPS tags are awaiting judgment. In one, a 25-year-old former asylum seeker from Sudan, who was tagged by the Home Office as part of the pilot scheme after arriving in the UK via a small boat in May 2022, is challenging the regime for its disproportionate interference with his right to family and private life. Wearing the tag brought up painful memories of being bound and tortured during his journey to the UK, according to his lawyers at London firm Duncan Lewis, adding that his tag has since been removed.

    Another case revolves around car mechanic Mark Nelson, who told WIRED that his experience wearing a GPS tag had been dehumanizing. “Our firm represents numerous individuals like Mark who are being electronically monitored,” says Katie Schwarzmann, a human rights lawyer at Wilsons Solicitors, who is representing Nelson. “In virtually all cases the Home Office has failed to provide evidence they have considered less-intrusive methods or explain why this draconian regime is necessary for immigration control.”

    The UK is not the only country that is using GPS tracking devices as an alternative to immigration detention centers. Last year, the US Immigration and Customs Enforcement agency also announced it would start tracking migrants using GPS ankle tags and specially designed smartwatches.

    [ad_2]

    Morgan Meaker

    Source link

  • A Vending Machine Error Revealed Secret Face Recognition Tech

    A Vending Machine Error Revealed Secret Face Recognition Tech

    [ad_1]

    Canada-based University of Waterloo is racing to remove M&M-branded smart vending machines from campus after outraged students discovered the machines were covertly collecting face recognition data without their consent.

    The scandal started when a student using the alias SquidKid47 posted an image on Reddit showing a campus vending machine error message, “Invenda.Vending.FacialRecognitionApp.exe,” displayed after the machine failed to launch a face recognition application that nobody expected to be part of the process of using a vending machine.

    “Hey, so why do the stupid M&M machines have facial recognition?” SquidKid47 pondered.

    The Reddit post sparked an investigation from a fourth-year student named River Stanley, who was writing for a university publication called MathNEWS.

    Stanley sounded the alarm after consulting Invenda sales brochures that promised “the machines are capable of sending estimated ages and genders” of every person who used the machines—without ever requesting consent.

    This frustrated Stanley, who discovered that Canada’s privacy commissioner had years ago investigated a shopping mall operator called Cadillac Fairview after discovering some of the malls’ informational kiosks were secretly “using facial recognition software on unsuspecting patrons.”

    Only because of that official investigation did Canadians learn that “over 5 million nonconsenting Canadians” were scanned into Cadillac Fairview’s database, Stanley reported. Where Cadillac Fairview was ultimately forced to delete the entire database, Stanley wrote that consequences for collecting similarly sensitive face recognition data without consent for Invenda clients like Mars remain unclear.

    Stanley’s report ended with a call for students to demand that the university “bar facial recognition vending machines from campus.”

    A University of Waterloo spokesperson, Rebecca Elming, eventually responded, confirming to CTV News that the school had asked to disable the vending machine software until the machines could be removed.

    Students told CTV News that their confidence in the university’s administration was shaken by the controversy. Some students claimed on Reddit that they attempted to cover the vending machine cameras while waiting for the school to respond, using gum or Post-it notes. One student pondered whether “there are other places this technology could be being used” on campus.

    Elming was not able to confirm the exact timeline for when the machines would be removed, other than telling Ars it would happen “as soon as possible.” Elming declined Ars’ request to clarify if there are other areas of campus collecting face recognition data. She also wouldn’t confirm, for any casual snackers on campus, when, if ever, students could expect the vending machines to be replaced with snack dispensers not equipped with surveillance cameras.

    Invenda Claims Machines Are GDPR-Compliant

    MathNEWS’ investigation tracked down responses from companies responsible for smart vending machines on the University of Waterloo’s campus.

    Adaria Vending Services told MathNEWS that “what’s most important to understand is that the machines do not take or store any photos or images, and an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface—never taking or storing images of customers.”

    According to Adaria and Invenda, students shouldn’t worry about data privacy because the vending machines are “fully compliant” with the world’s toughest data privacy law, the European Union’s General Data Protection Regulation (GDPR).

    “These machines are fully GDPR compliant and are in use in many facilities across North America,” Adaria’s statement said. “At the University of Waterloo, Adaria manages last mile fulfillment services—we handle restocking and logistics for the snack vending machines. Adaria does not collect any data about its users and does not have any access to identify users of these M&M vending machines.”

    [ad_2]

    Ashley Belanger, Ars Technica

    Source link

  • Here Are the Secret Locations of ShotSpotter Gunfire Sensors

    Here Are the Secret Locations of ShotSpotter Gunfire Sensors

    [ad_1]

    Finding shell casings can be extremely difficult. A Los Angeles Police Department officer not authorized to speak to the media tells WIRED they’ve spent “hours” searching for bullet casings. Just because officers don’t find evidence of gunfire, they say, doesn’t mean it didn’t happen.

    While SoundThinking says its alerts are reviewed by its Incident Review Center before being sent to the police, in Pasadena, officers who investigated ShotSpotter alerts reported that the suspected gunfire was sometimes something else entirely: a car backfiring, construction noise, or fireworks, Knock LA reported.

    Chris Baumohl, an EPIC Law Fellow and coauthor of the petition to the DOJ, tells WIRED that our findings confirm what the nonprofit wrote in their petition in September: that ShotSpotter surveillance disproportionately occurs in communities of color. He also alleges that the technology primes police to go into minority communities believing that shots are fired, whether accurate or not. The result, Baumohl argues, is that community members are more likely to be picked up on bench warrants, misdemeanors, and for other reasons unrelated to guns.

    In February, a leaked internal report from the State’s Attorney’s Office in Illinois’ Cook County, where Chicago is located, found that nearly a third of arrests stemming from a ShotSpotter alert had nothing to do with a gun, Baumohl points out. On February 13, Chicago mayor Brandon Johnson, a vocal critic of ShotSpotter, said the city won’t renew its contract with SoundThinking.

    According to SoundThinking’s Chittum, the idea that police show up to ShotSpotter alerts ready to make arrests is speculation based on a few high-profile incidents. Instead, he argues that ShotSpotter provides law enforcement with accurate data to engage the community safely. “It allows police to knock on a door and tell residents, ‘Hey, we got a report of gunfire, we are just checking to see if everyone is OK. Did you hear anything? Did you see anything? If you do, please call us; we care, and we’ll come.’”

    Ultimately, Chittum argues, ShotSpotter is simply a tool. When used correctly it can help police-community relations. “It’s up to the police to decide how they use it,” he says.

    But what happens on the ground often paints a more complicated picture than what Chittum describes. WIRED reviewed body camera footage and police records of a 2022 ShotSpotter arrest in Cincinnati. According to the records, at 8:21 pm on New Year’s Eve, police officers were dispatched to an area where two loud sounds were picked up by SoundThinking sensors. When the officers arrived, they quickly detained a tall man in a blue hoodie and black jacket who was standing near the corner where the technology had indicated gunfire.

    According to police records, there were nine officers on the scene that night. Body camera footage shows one of the officers rifling through the man’s pockets as others milled around. Some pointed their flashlights at the ground or in the windows of parked cars. Others chatted, speculating about the potential whereabouts of bullet casings.

    “I’m glad we could come out and help,” a sergeant watching the man being searched tells the officer standing next to him.

    Police never found a bullet casing, gun, or bullet hole. They arrested the man anyway. After running his name through their on-car computer, they discovered he had warrants out for his arrest. He had failed to appear in court for traffic violations.

    Additional data analysis by Matt Casey, data science content lead at Snorkel AI, a firm that helps companies with AI projects and builds custom AI with its data development platform.

    [ad_2]

    Dhruv Mehrotra, Joey Scott

    Source link

  • How to Not Get Scammed Out of $50,000

    How to Not Get Scammed Out of $50,000

    [ad_1]

    Plus: State-backed hackers test out generative AI, the US takes down a major Russian military botnet, and 100 hospitals in Romania go offline amid a major ransomware attack.

    [ad_2]

    Andrew Couts

    Source link

  • Government hackers targeted iPhones owners with zero-days, Google says | TechCrunch

    Government hackers targeted iPhones owners with zero-days, Google says | TechCrunch

    [ad_1]

    Government hackers last year exploited three unknown vulnerabilities in Apple’s iPhone operating system to target victims with spyware developed by a European startup, according to Google.

    On Tuesday, Google’s Threat Analysis Group, the company’s team that investigates nation-backed hacking, published a report analyzing several government campaigns conducted with hacking tools developed by several spyware and exploit sellers, including Barcelona-based startup Variston.

    In one of the campaigns, according to Google, government hackers took advantage of three iPhone “zero-days,” which are vulnerabilities not known to Apple at the time they were exploited. In this case, the hacking tools were developed by Variston, a surveillance and hacking technology startup whose malware has already been analyzed twice by Google in 2022 and 2023.

    Contact Us

    Do you have more information about Variston or Protect Electronic Systems? We’d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email lorenzo@techcrunch.com. You also can contact TechCrunch via SecureDrop.

    Google said it discovered the unknown Variston customer using these zero-days in March 2023 to target iPhones in Indonesia. The hackers delivered an SMS text message containing a malicious link that infected the target’s phone with spyware, and then redirected the victim to a news article by the Indonesian newspaper Pikiran Rakyat. Google did not say who was Variston’s government customer in this case.

    An Apple spokesperson did not comment to TechCrunch, asking whether the company is aware of this hacking campaign found by Google.

    While Variston keeps getting attention from Google, the company has lost multiple employees over the past year, according to former staff who spoke to TechCrunch on the condition of anonymity because they were under a non-disclosure agreement.

    It is not yet known who Variston sold its spyware to. According to Google, Variston collaborates “with several other organizations to develop and deliver spyware.”

    Google says one of the organizations was Protected AE, which is based in the United Arab Emirates. Local business records identify the company as “Protect Electronic Systems,” and say it was founded in 2016 and headquartered in Abu Dhabi. On its official website, Protect bills itself as “a cutting edge cyber security and forensic company.”

    According to Google, Protect “combines spyware it develops with the Heliconia framework and infrastructure, into a full package which is then offered for sale to either a local broker or directly to a government customer,” referring to Variston’s software Heliconia, which Google previously detailed in 2022.

    Variston was founded in 2018 in Barcelona by Ralf Wegener and Ramanan Jayaraman, and shortly after acquired Italian zero-day research company Truel IT, according to Spanish and Italian business records seen by TechCrunch.

    Wegener and Jayaraman did not respond to a request for comment by email. Representatives from Protect also did not respond.

    While there has been a lot of attention in the last few years on Israeli companies like NSO Group, Candiru, and QuaDream, Google’s report shows that European spyware makers are expanding their reach and capabilities.

    Google wrote in its report that its researchers track around 40 spyware makers, which sell exploits and surveillance software to government customers around the world. In the report Google mentions not only Variston, but also the Italian companies Cy4Gate, RCS Lab, and Negg as examples of relatively newer companies that have entered the market. RCS Lab was founded in 1993 and used to be a partner of the now-defunct spyware maker Hacking Team, but didn’t develop spyware on its own until recent years, focusing instead on selling products to conduct traditional phone wiretapping at the telecom providers’ level.

    In its report, Google said it is committed to disrupting hacking campaigns conducted with these companies’ tools because they have been linked to targeted surveillance of journalists, dissidents, and politicians.

    “Commercial surveillance vendors (CSVs) are enabling the proliferation of dangerous hacking tools,” Google wrote in its report. “The harm is not hypothetical. Spyware vendors point to their tools’ legitimate use in law enforcement and counterterrorism. However, spyware deployed against journalists, human rights defenders, dissidents, and opposition party politicians — what Google refers to as ‘high risk users’ — has been well documented.”

    “While the number of users targeted by spyware is small compared to other types of cyber threat activity, the follow-on effects are much broader,” the company wrote. “This type of focused targeting threatens freedom of speech, a free press, and the integrity of elections worldwide.”

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • The two faces of AI | TechCrunch

    The two faces of AI | TechCrunch

    [ad_1]

    We all make mistakes. But sometimes we forget that technology does, too — especially when it comes to AI, which is still in its early days in many respects.

    © 2023 TechCrunch. All rights reserved. For personal use only.

    [ad_2]

    Anna Heim

    Source link

  • Hezbollah fires rockets at Israel in response to killing of Hamas leader

    Hezbollah fires rockets at Israel in response to killing of Hamas leader

    [ad_1]

    Lebanese militant group Hezbollah fired dozens of rockets at Israel on Saturday in retaliation for the targeted killing of a Hamas leader in Beirut this week amid mounting fears of a larger regional war, according to media reports.

    Hezbollah said in a statement Saturday that it targeted an Israeli air surveillance base in northern Israel with 62 missiles as an “initial response” to the suspected Israeli strike on January 2 that killed senior Hamas official Saleh al-Arouri in a Hezbollah stronghold in Beirut. The Israeli military said around 40 rockets were fired from Lebanon at its territory.

    Hasan Nasrallah, the leader of Hezbollah, the Iran-backed Lebanese militant group, said earlier this week that the killing of al-Arouri will “not go unpunished.”

    Israel’s military said it responded to the Hezbollah rocket attacks with a drone strike on “the terrorist cell responsible for the launches toward the area of Metula.”

    The escalation comes as U.S. Secretary of State Antony Blinken has embarked on his fourth diplomatic tour of the Middle East as the Israel-Hamas war reaches its three-month mark and amid growing international criticism of Israel’s strategy. Yemen’s Houthi militants have also increased their attacks on cargo ships and fuel tankers in the Red Sea.

    Blinken met with Turkish President Recep Tayyip Erdogan and Foreign Minister Hakan Fidan on Saturday. U.S. officials said Blinken was seeking Turkish buy-in, or at least consideration, of potential monetary or in-kind contributions to reconstruction efforts and some form of participation in a proposed multi-national force that could operate in or adjacent to the territory, the Associated Press reported.

    Turkey has been harshly critical of Israel and Israeli Prime Minister Benjamin Netanyahu for the prosecution of the war and the impact it has had on Palestinian civilians.

    In addition, officials said, Blinken will stress the importance Washington places on Ankara ratifying Sweden’s membership in NATO, a long-delayed process that the Turks have said they will complete soon. Sweden’s accession to the defense alliance is seen as one critical response to Russia’s invasion of Ukraine.

    EU foreign policy chief Josep Borrell, who was in Lebanon on Saturday, warned that it was imperative to avoid the Israel-Hamas war growing into a regional conflict.

    Hamas launched a surprise attack on Israel on October 7, killing nearly 1,200 people and taking around 250 hostages, some of whom have been released.

    Israel has for the last three months bombed the Hamas-run Gaza Strip, resulting in nearly 23,000 people dying and around 59,000 others being injured, according to the Palestinian enclave’s health authorities.

    In another warning, the United Nations’ humanitarian chief Martin Griffiths said on Friday that Gaza has become “uninhabitable” for its nearly 2.3 million inhabitants and repeated that “a public health disaster is unfolding” in the enclave. 

    [ad_2]

    Clothilde Goujard

    Source link

  • Britain’s got some of Europe’s toughest surveillance laws. Now it wants more

    Britain’s got some of Europe’s toughest surveillance laws. Now it wants more

    [ad_1]

    Press play to listen to this article

    Voiced by artificial intelligence.

    LONDON — The U.K. already has some of the most far-reaching surveillance laws in the democratic world. Now it’s rushing to beef them up even further — and tech firms are spooked.

    Britain’s government wants to build on its landmark Investigatory Powers Act, a controversial piece of legislation dubbed the “snooper’s charter” by critics when introduced back in 2016.

    That law — introduced in the wake of whistleblower Edward Snowden’s revelations of mass state surveillance — attempted to introduce more accountability into the U.K. intelligence agencies’ sprawling snooping regime by formalizing wide-ranging powers to intercept emails, texts, web history and more.

    Now new legislation is triggering a fresh outcry among both industry execs and privacy campaigners — who say it could hobble efforts to protect user privacy.

    Industry body TechUK has written to Home Secretary James Cleverly airing its complaints. The group’s letter warns that the Investigatory Powers (Amendment) Bill threatens technological innovation; undermines the sovereignty of other nations; and could unleash dire consequences if it sets off a domino effect overseas.

    Tech companies are most concerned by a change that would allow the Home Office to issue notices preventing them from making technical updates that might impede information-sharing with U.K. intelligence agencies. 

    TechUK argues that, combined with pre-existing powers, the changes would “grant a de facto power to indefinitely veto companies from making changes to their products and services offered in the U.K.” 

    “Using this power, the government could prevent the implementation of new end-to-end encryption, or stop developers from patching vulnerabilities in code that the government or their partners would like to exploit,” Meredith Whittaker, president of secure messaging app Signal, told POLITICO when the bill was first unveiled. 

    The Home Office, Britain’s interior ministry, remains adamant it’s a technical and procedural set of tweaks. Home Office Minister Andrew Sharpe said at the bill’s committee stage in the House of Lords that the law was “not going to … ban end-to-end encryption or introduce a veto power for the secretary of state … contrary to what some are incorrectly speculating.”

    “We have always been clear that we support technological innovation and private and secure communications technologies, including end-to-end encryption,” a government spokesperson said. “But this cannot come at a cost to public safety, and it is critical that decisions are taken by those with democratic accountability.”

    Encryption threat

    Despite the protestations of industry and campaigners, the British government is whisking the bill through parliament at breakneck speed — risking the ire of lawmakers.

    Ministers have so far blocked efforts’ to refine the bill in the House of Lords, the U.K.’s upper chamber. But there are more opportunities to contest the legislation coming and industry is already making appeals to MPs in the hopes of paring it back in the House of Commons.

    Some companies including Apple have threatened to pull their services from the UK if asked to undermine encryption under Britain’s laws | Feline Lim/Getty Images

    “We stress the critical need for adequate time to thoroughly discuss these changes, highlighting that rigorous scrutiny is essential given the international precedent they will set and their very serious impacts,” the TechUK letter states.

    The backdrop to the row is the fraught debate on encryption that unfolded during the passage of the earlier Online Safety Act, which companies and campaigners argued could compel companies to break encryption in the name of online safety. 

    The bill ultimately said that the government can call for the implementation of this technology when it’s “technically feasible” and simultaneously preserves privacy. 

    Apple, WhatsApp and Signal have threatened to pull their services from the U.K. if asked to undermine encryption under U.K. laws. 

    Since the Online Safety Act passed in November, Meta announced that it had begun its rollout of end-to-end encryption on its Messenger service.

    In response, Cleverly issued a statement saying he was “disappointed” that the company had gone ahead with the move despite repeated government warnings that it would make identifying child abusers on the platform more difficult. 

    Critics see a pincer movement. “Taken together, it appears that the Online Safety Bill’s Clause 122 is intended to undermine existing encryption, while the updates to the IPA are intended to block further rollouts of encryption,” said Whittaker.  

    Beyond encryption 

    In addition to the notice regime, rights campaigners are worried that the bill allows for the more permissive use of bulk data where there are “low or no” expectations of privacy, for wide-ranging purposes including training AI models.

    Lib Dem peer Christopher Fox argued in the House of Lords that this “creates an essentially new and essentially undefined category of information” which marks “a departure from existing privacy law,” notably the Data Protection Act.

    Director of campaign group Big Brother Watch, Silkie Carlo, also has issues with the newly invented category. With CCTV footage or social media posts for example, people may not have an expectation of privacy, “[but] that’s not the point, the point is that that data taken together and processed in a certain way, can be incredibly intrusive.”

    Big Brother Watch is also concerned about how the bill deals with internet connection records — i.e. web logs for individuals for the last 12 months. These can currently be obtained by agencies when specific criteria is known, like the person of interest’s identity. Changes to the bill would broaden this for the purpose of “target discovery,” which Big Brother Watch characterizes as “generalized surveillance.”  

    Members of the House of Lords are also worried about the bill’s proposal to expand the number of people who can sanction spying on parliamentarians themselves. Right now, this requires the PM’s sign-off, but under the bill, the PM would be able to designate deputies for when he is not “available.” The change was inspired by the period in which former PM Boris Johnson was incapacitated with COVID-19.

    The bill will return to the House of Lords on January 23, before heading to the House of Commons to be debated by MPs | Tolga Akmen/AFP via Getty Images

    “The purpose of this bill is to give the intelligence agencies a bit of extra agility at the margins, where the existing Rolls Royce regime is proving a bit clunky and bureaucratic,” argues David Anderson, crossbench peer and author of a review that served as a blueprint for the bill. “If you start throwing in too many safeguards, you will negate that purpose, and you will not solve the problem that bill is addressing.” 

    Anderson proposed the changes relating to spying on MPs and peers are necessary “if the prime minister has got COVID, or if they’re in a foreign country where they have no access to secure communications.” 

    This could even apply in cases where there’s a conflict of interest because spies want to snoop on the PM’s relatives or the PM himself, he added.

    Amendments proposed by peers at the committee stage were uniformly rejected by the government. 

    The bill will return to the House of Lords for the next stage of the legislative process on January 23, before heading to the House of Commons to be debated by MPs.

    “Our overarching concern is that the significance of the proposed changes to the notices regime are presented by the Home Office as minor adjustments and as such are being downplayed,” reads the TechUK letter.

    “What we’re seeing across these different bills is a continual edging further towards … turning private tech companies into arms of a surveillance state,” says Carlo.

    [ad_2]

    Laurie Clarke

    Source link

  • It's not all doom and gloom: When cybersecurity gave us hope in 2023 | TechCrunch

    It's not all doom and gloom: When cybersecurity gave us hope in 2023 | TechCrunch

    [ad_1]

    A funny — but true — joke at TechCrunch is that the security desk might as well be called the Department of Bad News, since, well, have you seen what we’ve covered of late? There is a never-ending supply of devastating breaches, pervasive surveillance and dodgy startups flogging the downright dangerous.

    Sometimes though — albeit rarely — there are glimmers of hope that we want to share. Not least because doing the right thing, even (and especially) in the face of adversity, helps make the cyber-realm that little bit safer.

    Bangladesh thanked a security researcher for citizen data leak discovery

    When a security researcher found that a Bangladeshi government website was leaking the personal information of its citizens, clearly something was amiss. Viktor Markopoulos found the exposed data thanks to an inadvertently cached Google search result, which exposed citizen names, addresses, phone numbers and national identity numbers from the affected website. TechCrunch verified that the Bangladeshi government website was leaking data, but efforts to alert the government department were initially met with silence. The data was so sensitive, TechCrunch could not say which government department was leaking the data, as this might expose the data further.

    That’s when the country’s computer emergency incident response team, also known as CIRT, got in touch and confirmed the leaking database had been fixed. The data was spilling from none other than the country’s birth, death and marriage registrar office. CIRT confirmed in a public notice that it had resolved the data spill and that it left “no stone unturned” to understand how the leak happened. Governments seldom handle their scandals well, but an email from the government to the researcher thanking them for their finding and reporting the bug shows the government’s willingness to engage over cybersecurity where many other countries will not.

    Apple throwing the kitchen sink at its spyware problem

    It’s been more than a decade since Apple dropped its now-infamous claim that Macs don’t get PC viruses (which while technically true, those words have plagued the company for years). These days the most pressing threat to Apple devices is commercial spyware, developed by private companies and sold to governments, which can punch a hole in our phones’ security defenses and steal our data. It takes courage to admit a problem, but Apple did exactly that by rolling out Rapid Security Response fixes to fix security bugs actively exploited by spyware makers.

    Apple rolled out its first emergency “hotfix” earlier this year to iPhones, iPads and Macs. The idea was to roll out critical patches that could be installed without always having to reboot the device (arguably the pain point for the security-minded). Apple also has a setting called Lockdown Mode, which limits certain device features on an Apple device that are typically targeted by spyware. Apple says it’s not aware of anyone using Lockdown Mode who was subsequently hacked. In fact, security researchers say that Lockdown Mode has actively blocked ongoing targeted hacks.

    Taiwan’s government didn’t blink before intervening after corporate data leak

    When a security researcher told TechCrunch that a ridesharing service called iRent — run by Taiwanese automotive giant Hotai Motors — was spilling real-time updating customer data to the internet, it seemed like a simple fix. But after a week of emailing the company to resolve the ongoing data spill — which included customer names, cell phone numbers and email addresses, and scans of customer licenses — TechCrunch never heard back. It wasn’t until we contacted the Taiwanese government for help disclosing the incident that we got a response immediately.

    Within an hour of contacting the government, Taiwan’s minister for digital affairs Audrey Tang told TechCrunch by email that the exposed database had been flagged with Taiwan’s computer emergency incident response team, TWCERT, and was pulled offline. The speed at which the Taiwanese government responded was breathtakingly fast, but that wasn’t the end of it. Taiwan subsequently fined Hotai Motors for failing to protect the data of more than 400,000 customers, and was ordered to improve its cybersecurity. In its aftermath, Taiwan’s vice premier Cheng Wen-tsan said the fine of about $6,600 was “too light” and proposed a change to the law that would increase data breach fines by tenfold.

    Leaky U.S. court record systems sparked the right kind of alarm

    At the heart of any judicial system is its court records system, the tech stack used for submitting and storing sensitive legal documents for court cases. These systems are often online and searchable, while restricting access to files that could otherwise jeopardize an ongoing proceeding. But when security researcher Jason Parker found several court record systems with incredibly simple bugs that were exploitable using only a web browser, Parker knew they had to see that these bugs were fixed.

    Parker found and disclosed eight security vulnerabilities in court records systems used in five U.S. states — and that was just in their first batch disclosure. Some of the flaws were fixed and some remain outstanding, and the responses from states were mixed. Florida’s Lee County took the heavy-handed (and self-owning) position of threatening the security researcher with Florida’s anti-hacking laws. But the disclosures also sent the right kind of alarm. Several state CISOs and officials responsible for court records systems across the U.S. saw the disclosure as an opportunity to inspect their own court record systems for vulnerabilities. Govtech is broken (and is desperately underserved), but having researchers like Parker finding and disclosing must-patch flaws makes the internet safer — and the judicial system fairer — for everyone.

    Google killed geofence warrants, even if it was better late than never

    It was Google’s greed driven by ads and perpetual growth that set the stage for geofence warrants. These so-called “reverse” search warrants allow police and government agencies to dumpster dive into Google’s vast stores of users’ location data to see if anyone was in the vicinity at the time a crime was committed. But the constitutionality (and accuracy) of these reverse-warrants have been called into question and critics have called on Google to put an end to the surveillance practice it largely created to begin with. And then, just before the holiday season, the gift of privacy: Google said it would begin storing location data on users’ devices and not centrally, effectively ending the ability for police to obtain real-time location from its servers.

    Google’s move is not a panacea, and doesn’t undo the years of damage (or stop police from raiding historical data stored by Google). But it might nudge other companies also subject to these kinds of reverse-search warrants — hello Microsoft, Snap, Uber and Yahoo (TechCrunch’s parent company) — to follow suit and stop storing users’ sensitive data in a way that makes it accessible to government demands.

    [ad_2]

    Zack Whittaker

    Source link

  • The first nail-biter election of 2024: Taiwan

    The first nail-biter election of 2024: Taiwan

    [ad_1]

    TAIPEI — 2024 will be a bumper year of elections around the world, but one of the first votes on the calendar will also be one of the most hotly contested and consequential: Taiwan, where there are vital strategic interests at play for both the U.S. and China on January 13.

    If the campaign started with expectations in the U.S. that the ruling, pro-independence Democratic Progressive Party (DPP), whose top brass are frequent and welcome guests in Washington, would stroll to victory, the final stages of the presidential and legislative race have turned into a nail-biter.

    Chinese President’s Xi Jinping’s Communist Party leadership, increasingly assertive in its claim that democratic Taiwan is part of China and keen to see the ruling party in Taipei ousted, is trying to swing the election through a disinformation campaign of hoaxes and outlandish claims on social media.

    And the tactics may be working. The latest polls for the first-past-the-post presidential race on the My Formosa portal have DPP leader William Lai on 35.2 percent, only just keeping his nose out in front of his main challenger from the Beijing-friendly Kuomintang (KMT), Hou Yu-ih, on 30.6 percent. On Tuesday, the Beijing-leaning United Daily News put both candidates on 31 percent.

    “This is not a walk in the park,” admitted Vincent Chao, a city councillor and prominent DPP personality, speaking to POLITICO’s Power Play podcast at a campaign event in New Taipei, a municipality surrounding the capital.

    It could hardly be a more febrile period in terms of security fears over the Taiwan Strait, where insistent Chinese maneuvering has been matched by a high-stakes U.S.-backed boost to the island’s defenses. Only on December 15, the U.S. approved another $300 million of spending on defense kit, sparking a retort from China that the expenditure would harm “security interests and threaten peace and stability across the Taiwan Strait.”

    Lai’s opponents are playing hard on these security implications of the vote, and are accusing him of bringing the island closer to conflict because of his past comments in favor of the island’s independence. China has, after all, continually warned that independence “means war” and Xi has said Beijing is willing to use “all necessary measures” to secure unification. Lai has hit back that his rivals “are parroting the [Chinese Communist Party line] as propaganda to score electoral benefits.”

    For the global economy, open war over Taiwan would be a disaster, perhaps even outstripping the shock of Russia’s invasion of Ukraine, due in particular to the island’s critical role in microchip supplies.

    Head-to-head race

    The specter of a DPP defeat has raised the temperature of the fevered last few weeks of the campaign.

    Chao, the DPP councillor and a former political secretary in Taiwan’s Washington representation, admitted that the DPP ends the year in “a head-to-head race” in the final stretch. “I mean, it’s democracy and the party has been in power for eight years. Anything could change,” he said.

    Wearing a jaunty white and green “Team Taiwan” tracksuit, the party’s signature colors, he talks above the backstage din of an evening event, held among the tower block estates of New Taipei. Volunteers hand out pork dumplings, the outgoing president Tsai Ing-wen gives a rousing speech about freedom and security, and there are ballads of national loyalty and singalong love songs. It feels heartfelt, but also very Taiwanese in its orderliness, the crowd sitting on stools in the evening heat, waving small flags in unison. 

    Chao is candid about the scale of China’s social media offensive.

    The specter of a DPP defeat has raised the temperature of the fevered last few weeks of the campaign | Annabelle Chih/Getty Images

    “What we’re seeing is a much more sophisticated China,” Chao reflected. “They’ve grown much more confident in their abilities to influence our elections, not through military coercion or other overt means, but through disinformation, through influencing public opinion, through controlling the information that people see … through social media organizations like TikTok.”

    One of the many unfounded stories that gained currency on social posts was a claim the U.S. had asked Taiwan to develop biological weapons research, a rumor aimed at raising anxiety about an arms race. Another accused the DPP of covert surveillance of its rivals.

    Trade and business links are another lever. According to Japan’s Nikkei newspaper, some 300 executives from big Taiwanese businesses operating China were called to a meeting by by China’s Taiwan Affairs Office Director Song Tao, a close ally of China’s President Xi, in early December and roundly encouraged to fly home to Taiwan support a pro-Beijing outcome in January.

    A third concern is an international system buckling under new conflicts and crises, with less time to devote to Taiwan’s freedoms, all compounded by an uncertain outcome in the upcoming U.S. election. In the wake of Beijing’s ’s clampdown on freedoms in Hong Kong and with the backwash of the Ukraine crisis, anxieties run high among DPP supporters about Taiwan’s outlook and the need for high levels of deterrence.

    “We really do not want to be the next Ukraine,” Chao added, with feeling.

    Bending with Beijing

    Opinion is strongly divided about the smartest tactical response toward China’s muscle flexing.

    Opinion is strongly divided about the smartest tactical response toward China’s muscle flexing. | Annabelle Chih/Getty Images

    Across town, at one of the opposition’s bases, where campaigners wear tracksuits in the white and blue of the Kuomintang party, International Relations Director Alexander Huang said his political troops were “within touching distance” of a possible victory.

    Keen to shake off a reputation of being reflexively pro-China, as opposed to merely cautious about riling its powerful neighbour, the KMT hosted cocktails for foreign journalists in a trendy, Christmas-decorated bar, bringing together Chinese news-agency writers with Western reporters covering the election.

    Huang, who hails from a military intelligence background and studied Chinese military and security doctrine in Washington, argued renewed Western support and commitments of defence expenditure by the U.S. administration increased the risk of something backfiring over Taiwan’s security. “We are under a great military threat [from China],” he told Power Play. “Our position is deterrence without provocation: assurance without appeasement.”

    He also reckoned the current chilly relations between the governing DPP party and Beijing were widening distrust. “Our current government has no direct communication with the other side. If you are not able to communicate your view to your adversary, how can you change that?”

    It’s less clear what reassurances the KMT expects from Beijing in return for a more accommodating relationship. Huang cites a possible decrease in trade tensions, which can hit Taiwanese agriculture and fishing when Beijing turns the screws, and further action on climate change and pollution (Taiwan is downwind of China’s emissions).

    Colorful cast

    The race certainly does not lack for colorful personalities.

    The DPP’s presidential candidate, Lai, is a doctor and parliamentarian, while his KMT rival Hou is a former policeman and mayor in New Taipei. Mindful that the mood has become cynical about political elites, both sides have chosen frontmen who can claim humble roots: Hou hails from a family that scratched a living as food market traders, while Lai, the epitome of a slick Taiwanese professional, grew up with a widowed mother after his father died in a mining accident. 

    Hou is a former policeman and mayor in New Taipei | Annabelle Chih/Getty Images

    The “Veep” contenders are flashier than the main candidates and more media-friendly. Hsiao Bi-khim, educated in the U.S. and until recently ambassador to Washington, is a pet-lover who styles herself as an agile “cat warrior” in stark contrast to China’s pugnacious “wolf-warrior” diplomats. Her KMT opponent is Jaw Shaw-kong, a formidable, populist-tinged debater and TV personality, who channels overt pro-Beijing sentiment, recently calling for more alignment in military planning with China’s leadership. 

    The billionaire Foxconn founder Terry Gou, who had run as a maverick, wafting pets as incentives to couples to have more babies to combat a worryingly low birthrate, quit the race after China’s tax authorities launched punitive investigations into his company, the builder of iPhones.

    Russell Hsiao of the Global Taiwan Institute, a non-partisan research organization, reckoned that even if the DPP wins, its mandate will be less compelling than in the glory days of 2020, when it surged to a record level.

    The guessing game of how likely an intervention — or even invasion — by China is helps explain the nervy tenor of this race.

    The KMT’s Huang thought a “full-scale, kinetic invasion” is unlikely in the immediate future. How long does he think that guarantee would hold? “I would say not for the next five years, if we get our policy right.” 

    Hardly the most durable time-frame. 

    Taipei politics being a small world, Huang is a longstanding frenemy of the DPP’s Chao, who counters that Taiwan urgently needs to retain its defiant stance and deepen its strategic alliances with the West. They just disagree widely on the means to secure its future.

    “The aim of [Beijing’s] engagements is unification … by force if necessary. Democracy, freedom, they are not just words. They represent what our people sincerely believe and hope to uphold.”

    Stuart Lau contributed reporting.

    Anne McElvoy is host of POLITICO’s weekly Power Play interview podcast, whose latest episode comes from the Taiwan election campaign.

    [ad_2]

    Anne McElvoy

    Source link

  • Google moves to end geofence warrants, a surveillance problem it largely created | TechCrunch

    Google moves to end geofence warrants, a surveillance problem it largely created | TechCrunch

    [ad_1]

    Google will soon allow users to store their location data on their devices rather than on Google’s servers, effectively ending a long-running surveillance practice that allowed police and law enforcement to tap Google’s vast banks of location data to identify potential criminals.

    The use of so-called “geofence warrants” have exploded in recent years, in large part thanks to the ubiquity of smartphones coupled with hungry data companies like Google vacuuming up and storing huge amounts of its users’ location data, which becomes obtainable by law enforcement requests.

    Police can use geofence warrants (also known as reverse-location warrants) to demand that Google turn over information on which users’ devices were in a particular geographic area at a certain point in time.

    But critics say geofence warrants are unconstitutional and inherently overly broad, since these demands often also include the information of entirely innocent people who were nearby at a time when a crime was committed. Even the courts cannot agree on whether geofence warrants are legal, likely setting up an eventual challenge at the U.S. Supreme Court.

    Google’s announcement this week did not mention geofence warrants specifically, saying only that the move to store location data on their devices would give users’ “more control” over their data. In reality, the move forces police to seek a search warrant to access that specific device instead, rather than asking Google for the data.

    While Google is not the only company subject to geofence warrants, Google has been far the biggest collector of sensitive location data, and the first to be tapped for it.

    The practice of police tapping Google for users’ location data was first revealed in 2019. Google has long relied on its users’ location data to drive its advertising business, which during 2022 alone brought in about 80% of Google’s annual revenues, some $220 billion.

    But in reality, this surveillance technique is thought to be far wider. Law enforcement later expanded its demands for location data to other companies. Microsoft and Yahoo (which owns TechCrunch) are known to receive geofence warrants, though neither company has yet disclosed how many demands for users’ location data they receive.

    In recent years, the number of legal cases involving geofence demands have rocketed.

    Police in Minneapolis used a geofence warrant to identify individuals who attended protests following the police killing of George Floyd. The overturning of Roe v. Wade in 2022 prompted fears that law enforcement in states where access to abortion care is limited or seeking an abortion is illegal could use geofence warrants to identify those who seek care. Lawmakers subsequently urged Google to stop collecting location data over fears the information could be used to identify people seeking abortions.

    Although the companies have said little about how many geofence warrants they receive, Google, Microsoft and Yahoo last year backed a New York state bill that would have banned the use of geofence warrants across the state. The bill failed to advance into law.

    Google has not said how many geofence warrants it has received in recent years. Google published its most recent (and only) disclosure on the number of geofence warrants it received in 2021 following pressure to disclose the figures after mounting criticisms of the surveillance practice.

    The data showed Google received 982 geofence warrants in 2018, then 8,396 geofence warrants in 2019, and 11,554 geofence warrants in 2020 — or about one-quarter of all the legal demands that Google received. The disclosure, while limited, offered the first glimpse into the sharp rise in the number of these requests, but Google did not say how often the search giant pushes back against these legal demands for users’ location data — if at all.

    News that Google will soon move its users’ location data to their devices was met with cautious praise.

    The Electronic Frontier Foundation, which has challenged the constitutionality of geofence warrants in court, said in a blog post that “for now, at least, we’ll take this as a win.” But the EFF noted that there are other ways that Google can still turn over sensitive personal data on its users. Law enforcement uses similar legal demands, dubbed “reverse keyword” warrants, to identify Google accounts that searched for a particular keyword in time, such as prior to a crime being committed. Google has not said if it plans to close the loophole that allows police and law enforcement to serve so-called “reverse keyword” warrants for users’ search queries.

    It’s not to say that geofence warrants will fizzle out overnight. Google still retains huge banks of historical location data that police can tap into any time, up until whenever Google decides it no longer wants to keep it. And all the while tech companies store vast troves of users’ location data, they too can be subject to similar legal demands.

    But there is hope that Google shutting the door on geofence warrants — at least going forward — could significantly curtail this surveillance loophole.

    In its most recent transparency report in 2022, Apple said it received 13 geofence warrants demanding its customers’ location data, but provided no data in return. Apple said it “does not have any data to provide in response to geofence requests” as the data resides on users’ devices, which Apple says it cannot access.

    [ad_2]

    Zack Whittaker

    Source link

  • Edward Snowden warns Mike Johnson against crossing red line

    Edward Snowden warns Mike Johnson against crossing red line

    [ad_1]

    U.S. House Speaker Mike Johnson will feel the wrath of his party if he pushes warrantless surveillance, according to former National Security Agency intelligence contractor Edward Snowden.

    Johnson, who has been in his role for about two months following the ousting of former Speaker Kevin McCarthy on October 3, could face a similar political fallout based on his approach to defense spending and including an extension of the Foreign Intelligence Surveillance Act (FISA) within the National Defense Authorization Act (NDAA), an annual bill that is instrumental to authorizing funding for the Department of Defense (DOD).

    A list of internal talking points obtained by Axios shows Johnson being compared to ex-Republican House Speaker John Boehner, including one memo that refers to this year’s NDAA as “an utter disaster for House Republicans and a massive unforced error from leadership.”

    U.S. Senate Majority Leader Chuck Schumer and U.S. Speaker of the House Mike Johnson listen during remarks at a Capitol Menorah lighting ceremony at the U.S. Capitol Building on December 12, 2023, in Washington, D.C. Johnson has been scrutinized by members of his own conference due to a claimed closed-door brokering the National Defense Authorization Act (NDAA).
    Anna Moneymaker/Getty Images

    “If Mike Johnson (@SpeakerJohnson) abuses the NDAA to smuggle into law an extension of the warrantless surveillance regime (FISA702) that the FBI exploited to spy ON AMERICANS more than TWO HUNDRED THOUSAND times in JUST ONE YEAR, he should be dumped just like McCarthy,” Snowden, who remains exiled in Russia after leaking classified documents in 2013, wrote on X. “No excuse.”

    Newsweek reached out to Johnson’s office via email for comment.

    U.S. intelligence officials argue that FISA Section 702 allows their agencies to conduct warrantless surveillance of non-American citizens outside the U.S. during investigations.

    However, privacy concerns exist among many Americans and some members of Congress based on information collected on U.S. citizens that could be stored in the form of various communications for a number of years as part of a wide-ranging database.

    Other vocal House Republicans chastising Johnson include Georgia Representative Marjorie Taylor Greene, who on Wednesday claimed collusion between Johnson and Democrats based on multiple measures included in the final draft of the NDAA.

    Along with criticizing included policies like funding abortion travel and still allowing trans members of the military, she expressed disenchantment towards what she claims was a closed-door agreement between the GOP House leader and Senate Majority Leader Chuck Schumer, a Democrat.

    “Speaker Johnson worked with Chuck Schumer to cut a deal that removes all abortion and trans surgery prohibitions we passed under Speaker McCarthy,” Greene said on Wednesday. “It also would pass a CLEAN FISA [Foreign Intelligence Surveillance Act] extension. Not to mention, more of your taxpayer dollars sent to Ukraine to fund the proxy war.”

    She said she is a “hell no” when it comes to approving the bill.

    But Johnson’s office has defended the contents of the NDAA, saying that it targets initiatives and policies outlined by conservatives like Greene—including taxpayer-funded censorship of conservative media, banning critical race theory in the military, and “hollowing out” President Biden’s DEI [Diversity, Equity and Inclusion] “bureaucracy at the Pentagon,” per a statement provided to Axios.

    “Speaker Johnson and committee leaders fought tooth and nail to refocus the Pentagon on core national defense priorities and away from the Biden Administration’s social experiments and climate agenda that in recent years have decimated our military’s recruitment, morale, and readiness,” Johnson’s office said.