Pinboard (jm) https://pinboard.in/u:jm/public/ recent bookmarks from jm Microsoft runs out of capacity, routes requests outside the GDPR region 2026-04-16T13:18:55+00:00 https://chaos.social/@thunfisch/116414098310170847 jmApparently #Microsoft is not able to get enough compute within EU datacenters to handle #Copilot requests. Instead, it will do "Flex-Routing", which processes some requests in non-EU datacenters. This is Opt-Out. The only notification was an e-mail to Admins. If they missed that, companies might be leaking PII outside of the EU from tomorrow on. Get your GDPR Nightmare letters ready! ]]> fail microsoft gdpr regulation security copilot eu flex-routing pii privacy https://pinboard.in/ https://pinboard.in/u:jm/b:e0414b8f8629/ OkCupid gave 3 million dating-app photos to facial recognition firm, FTC says 2026-04-01T10:12:21+00:00 https://arstechnica.com/tech-policy/2026/03/okcupid-match-pay-no-fine-for-sharing-user-photos-with-facial-recognition-firm/ jmOkCupid and its owner Match Group reached a settlement with the Trump administration for not telling dating-app customers that nearly 3 million user photos were shared with [Clarifai], an [AI] company making a facial recognition system. OkCupid also gave the facial recognition firm access to user location information and other details without customers’ consent, the Federal Trade Commission said. ]]> us-politics data-protection privacy dating-apps okcupid match.com clarifai ftc https://pinboard.in/ https://pinboard.in/u:jm/b:7848c1547a27/ Research highlight: Cliopatra: Extracting Private Information from LLM Insights 2026-03-18T10:50:26+00:00 https://desfontain.es/blog/cliopatra.html#fn:caveat jmWhen Anthropic came up with a new "privacy-preserving analysis system" to gain insights into AI use, and didn't use any provably robust notion to back up their privacy claims, I was mildly surprised. Surely they have both the money and the scientific maturity level to do better? But Clio, the system in question, sounded relatively reasonable, with multiple layers of risk mitigation built-in. Maybe adding differential privacy would have been overkill. I also didn't want to publicly criticize their approach in the absence of demonstrated real-world risk. So I didn't comment on their approach. You can probably guess where this is going. Fast forward to last week, and a new paper: Cliopatra: Extracting Private Information from LLM Insights, by Meenatchi Sundaram Muthu Selva Annamalai, Emiliano De Cristofaro, and Peter Kairouz. The authors show that with carefully designed attacks on Clio, they can bypass all the ad hoc mitigations, and successfully extract users' medical histories (1), in a way that provides 100% attacker certainty for some records. This is a new and clever take on an old attack. We've known for decades that k-anonymity is vulnerable to active attacks. Here, this is combined with prompt injection to encourage the LLM "summarizer" to actually include information from unique records. Perhaps more surprisingly, the authors find that some defensive layers are simply ineffective: the "LLM auditors" systematically report low privacy risk, and entirely fail to detect the attacks. ]]> privacy differential-privacy anonymity data-protection claude llms cliopatra infosec leakage https://pinboard.in/ https://pinboard.in/u:jm/b:fe149dbf6a35/ Persona identity verification is a GDPR nightmare 2026-02-24T13:16:07+00:00 https://thelocalstack.eu/posts/linkedin-identity-verification-privacy/ jm For a three-minute identity check, this is what Persona collected: - My full name — first, middle, last - My passport photo — the full document, both sides, all data on the face of it - My selfie — a photo of my face taken in real-time - My facial geometry — biometric data extracted from both images, used to match the selfie to the passport - My NFC chip data — the digital info stored on the chip inside my passport - My national ID number - My nationality, sex, birthdate, age - My email, phone number, postal address - My IP address, device type, MAC address, browser, OS version, language - My geolocation — inferred from my IP And then there’s the weird stuff: - Hesitation detection — they tracked whether I paused during the process - Copy and paste detection — they tracked whether I was pasting information instead of typing it Behavioral biometrics. On top of the physical biometrics. For a LinkedIn badge. Persona didn’t just use what I gave them. They went and cross-referenced me against what they call their “global network of trusted third-party data sources”: - Government databases - National ID registries - Consumer credit agencies - Utility companies - Mobile network providers - Postal address databases They use uploaded images of identity documents — that’s my passport — to train their AI. They’re teaching their system to recognize what passports look like in different countries. They also use your selfie to “identify improvements in the Service.” The legal basis? Not consent. Legitimate interest. Meaning they decided on their own that it’s fine. Under GDPR, they’re supposed to balance their “interest” against your fundamental rights. Whether feeding European passports into machine learning models passes that test — well, that’s a question worth asking. I came for a badge. I stayed as training data. The whole thing took three minutes. Scan, selfie, done. Understanding what I actually agreed to took me an entire weekend reading 34 pages of legal documents. I handed a US company my passport, my face, and the mathematical geometry of my skull. They cross-referenced me against credit agencies and government databases. They’ll use my documents to train their AI. And if the US government comes knocking, they’ll hand it all over — even if it’s stored in Europe, even if I’m European, and possibly without ever telling me. It seems they are also linked to Roblox and Reddit as an age verification provider, which is worrying -- this level of deeply-intrusive background check is massive overkill for a simple age verification process. ORG are calling for regulation of the age verification industry, BTW: https://www.openrightsgroup.org/press-releases/online-safety-act-org-calls-for-regulation-of-age-assurance-industry/ ]]> age-verification discord reddit roblox linkedin tech peter-thiel org persona gdpr privacy data-protection data-privacy https://pinboard.in/ https://pinboard.in/u:jm/b:9170ebca7ec9/ censorship circumvention via VPN 2025-09-02T15:25:29+00:00 https://news.ycombinator.com/item?id=45055604 jm censorship vpns networking privacy politics https://pinboard.in/ https://pinboard.in/u:jm/b:27c9c09d5677/ Microsoft can't protect French data from US government access 2025-07-21T10:55:10+00:00 https://ppc.land/microsoft-cant-protect-french-data-from-us-government-access/ jmMicrosoft France's legal director conceded under sworn testimony that the company cannot guarantee French citizen data stored in EU datacenters remains protected from US agency access. The June 10, 2025 French Senate hearing marked a significant moment in European digital sovereignty discussions as Microsoft executives addressed concerns over extraterritorial data access. During proceedings before the Senate inquiry commission investigating public procurement's role in promoting digital sovereignty, Anton Carniaux, Microsoft France's director of public and legal affairs, admitted fundamental limitations regarding data protection guarantees. When asked directly whether he could guarantee under oath that French citizen data would never be transmitted to US authorities without explicit French authorization, Carniaux responded: "No, I cannot guarantee it." The testimony contradicts years of Microsoft's security assurances regarding European data hosting. Despite implementing encryption and technical safeguards, the company acknowledged that US legislation ultimately supersedes protective measures when federal agencies issue valid data requests. So much for the EU Sovereign Cloud, eh.]]> cloud-computing microsoft eu us-politics sovereignty data-protection privacy via:davey_cakes https://pinboard.in/ https://pinboard.in/u:jm/b:1cf52abd966f/ Delta moves toward eliminating set prices in favor of AI 2025-07-17T11:20:58+00:00 https://fortune.com/2025/07/16/delta-moves-toward-eliminating-set-prices-in-favor-of-ai-that-determines-how-much-you-personally-will-pay-for-a-ticket/ jm pricing delta consumer ai privacy data-protection grim capitalism travel fetcherr https://pinboard.in/ https://pinboard.in/u:jm/b:39b74132ba30/ SlimSocial for Facebook 2025-06-11T09:43:07+00:00 https://f-droid.org/packages/it.rignanese.leo.slimfacebook/ jm facebook meta privacy android f-droid apps https://pinboard.in/ https://pinboard.in/u:jm/b:3f1e83d5a000/ Covert Web-to-App Tracking via Localhost on Android 2025-06-04T09:52:48+00:00 https://localmess.github.io/ jm privacy meta facebook instagram apps android https://pinboard.in/ https://pinboard.in/u:jm/b:4132d4d78200/ O2 VoLTE: locating any customer with a phone call 2025-05-20T09:13:35+00:00 https://mastdatabase.co.uk/blog/2025/05/o2-expose-customer-location-call-4g/ jm phone privacy security infosec o2 volte sip phones mobile https://pinboard.in/ https://pinboard.in/u:jm/b:7a0b46ec5a1c/ Five things privacy experts know about AI 2025-01-14T12:35:38+00:00 https://desfontain.es/blog/privacy-in-ai.html jm llms ai differential-privacy damien-desfontaines privacy training anonymisation memorization https://pinboard.in/ https://pinboard.in/u:jm/b:56a10be8e10b/ Privacy Disasters: FaceHuggers Are Eating Your Skeets 2024-12-02T12:36:41+00:00 https://insights.priva.cat/p/privacy-disasters-facehuggers-are jmOnce again, we’ve got a collective action problem that’s being ignored in favor of technological progress, big money, data extraction, and libertarian notions of ‘public data’. It’s a shitty look. Both Bluesky and HF are acting like the host who’s egging the dickheads on, and it’s really disappointing as a user to know that this is probably what we should have expected all along. ]]> data hugging-face ai training bluesky public data-protection privacy datasets scraping https://pinboard.in/ https://pinboard.in/u:jm/b:3db238684d6e/ Irish Data Protection Commission launches inquiry into Google AI 2024-09-12T09:36:22+00:00 https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-launches-inquiry-google-ai-model jmThe Data Protection Commission (DPC) today announced that it has commenced a Cross-Border[1] statutory inquiry into Google Ireland Limited (Google) under Section 110 of the Data Protection Act 2018. The statutory inquiry concerns the question of whether Google has complied with any obligations that it may have had to undertake an assessment, pursuant to Article 35[2] of the General Data Protection Regulation (Data Protection Impact Assessment), prior to engaging in the processing of the personal data of EU/EEA data subjects associated with the development of its foundational AI model, Pathways Language Model 2 (PaLM 2). A Data Protection Impact Assessment (DPIA)[3], where required, is of crucial importance in ensuring that the fundamental rights and freedoms of individuals are adequately considered and protected when processing of personal data is likely to result in a high risk. Great to see this. If this inquiry results in some brakes on the widespread misuse of "fair use" in AI scraping, particularly where it concerns European citizens, I'm all in favour. ]]> eu law scraping fair-use ai dpia dpc data-protection privacy gdpr https://pinboard.in/ https://pinboard.in/u:jm/b:44a04f4a54d6/ European Alternatives 2024-08-27T08:12:57+00:00 https://european-alternatives.eu/ jm eu europe privacy saas infrastructure ops gdpr dsa https://pinboard.in/ https://pinboard.in/u:jm/b:046da05e1270/ Invasions of privacy during the early years of the photographic camera 2024-07-16T16:46:16+00:00 https://www.historynewsnetwork.org/article/overexposed jmIn 1904, a widow named Elizabeth Peck had her portrait taken at a studio in a small Iowa town. The photographer sold the negatives to Duffy’s Pure Malt Whiskey, a company that avoided liquor taxes for years by falsely advertising its product as medicinal. Duffy’s ads claimed the fantastical: that it cured everything from influenza to consumption; that it was endorsed by clergymen; that it could help you live until the age of 106. The portrait of Elizabeth Peck ended up in one of these dubious ads, published in newspapers across the country alongside what appeared to be her unqualified praise: “After years of constant use of your Pure Malt Whiskey, both by myself and as given to patients in my capacity as nurse, I have no hesitation in recommending it.” Duffy’s lies were numerous. Elizabeth Peck was not a nurse, and she had not spent years constantly slinging back malt beverages. In fact, she fully abstained from alcohol. Peck never consented to the ad.  The camera’s first great age — which began in 1888 when George Eastman debuted the Kodak — is full of stories like this one. Beyond the wonders of a quickly developing artform and technology lay widespread lack of control over one’s own image, perverse incentives to make a quick buck, and generalized fear at the prospect of humiliation and the invasion of privacy. Fantastic story, and interesting to see parallels with the modern experience of AI.]]> ai future history photography privacy camera https://pinboard.in/ https://pinboard.in/u:jm/b:797d8d6854b4/ Phone geodata is being widely collected by US government agencies 2024-07-16T15:34:48+00:00 https://www.politico.com/news/magazine/2024/02/28/government-buying-your-data-00143742 jm[Byron Tau was told] the government was buying up reams of consumer data — information scraped from cellphones, social media profiles, internet ad exchanges and other open sources — and deploying it for often-clandestine purposes like law enforcement and national security in the U.S. and abroad. The places you go, the websites you visit, the opinions you post — all collected and legally sold to federal agencies. In his new book, _Means of Control_, Tau details everything he’s learned since that dinner: An opaque network of government contractors is peddling troves of data, a legal but shadowy use of American citizens’ information that troubles even some of the officials involved. And attempts by Congress to pass privacy protections fit for the digital era have largely stalled, though reforms to a major surveillance program are now being debated. Great quote:
Politico: You compare to some degree the state of surveillance in China versus the U.S. You write that China wants its citizens to know that they’re being tracked, whereas in the U.S., “the success lies in the secrecy.” What did you mean by that? That was a line that came in an email from a police officer in the United States who got access to a geolocation tool that allowed him to look at the movement of phones. And he was essentially talking about how great this tool was because it wasn’t widely, publicly known. The police could buy up your geolocation movements and look at them without a warrant. And so he was essentially saying that the success lies in the secrecy, that if people were to know that this was what the police department was doing, they would ditch their phones or they would not download certain apps.
Based on Wolfie Christl's research in Germany, the same data is being scraped here, too, regardless of any protection the GDPR might supposedly provide: https://x.com/WolfieChristl/status/1813221172927975722]]> government privacy surveillance geodata phones mobile us-politics data-protection gdpr https://pinboard.in/ https://pinboard.in/u:jm/b:88a788492c39/ How to keep using adblockers on chrome and chromium 2024-06-12T13:18:05+00:00 https://gist.github.com/velzie/053ffedeaecea1a801a2769ab86ab376 jmGoogle's manifest v3 has no analouge [sic] to the webRequestBlocking API, which is neccesary for (effective) adblockers to work starting in chrome version 127, the transition to mv3 will start cutting off the use of mv2 extensions alltogether this will inevitably piss of enterprises when their extensions don't work, so the ExtensionManifestV2Availability key was added and will presumably stay forever after enterprises complain enough You can use this as a regular user, which will let you keep your mv2 extensions even after they're supposed to stop working. ]]> google chrome chromium adblockers extensions via:micktwomey privacy https://pinboard.in/ https://pinboard.in/u:jm/b:d0b78a909b24/ AI trained on photos from kids’ entire childhood without their consent 2024-06-11T13:32:14+00:00 https://arstechnica.com/tech-policy/2024/06/ai-trained-on-photos-from-kids-entire-childhood-without-their-consent/ jmLAION began removing links to photos from the dataset while also advising that "children and their guardians were responsible for removing children’s personal photos from the Internet." That, LAION said, would be "the most effective protection against misuse." [Hye Jung Han] told Wired that she disagreed, arguing that previously, most of the people in these photos enjoyed "a measure of privacy" because their photos were mostly "not possible to find online through a reverse image search.” Likely the people posting never anticipated their rarely clicked family photos would one day, sometimes more than a decade later, become fuel for AI engines. And indeed, here we are, with our family photos ingested long ago into many, many models, mainly hosted in jurisdictions outside the GDPR, and with no practical way to avoid it. Is there a genuine way to opt out, at this stage? Even if we do it for LAION, what about all the other model scrapes that have gone into OpenAI, Apple, Google, et al? Ugh, what a mess. ]]> privacy data-protection kids children family laion web-scraping ai models photos https://pinboard.in/ https://pinboard.in/u:jm/b:14b96bcdcbaf/ Apple Private Cloud Compute 2024-06-11T12:54:55+00:00 https://security.apple.com/blog/private-cloud-compute/ jm ai apple security privacy pii data-protection infosec apis https://pinboard.in/ https://pinboard.in/u:jm/b:abb3169e51f8/ _Surveilling the Masses with Wi-Fi-Based Positioning Systems_ 2024-05-28T10:53:20+00:00 https://arxiv.org/abs/2405.14975 jm Wi-Fi-based Positioning Systems (WPSes) are used by modern mobile devices to learn their position using nearby Wi-Fi access points as landmarks. In this work, we show that Apple's WPS can be abused to create a privacy threat on a global scale. We present an attack that allows an unprivileged attacker to amass a worldwide snapshot of Wi-Fi BSSID geolocations in only a matter of days. Our attack makes few assumptions, merely exploiting the fact that there are relatively few dense regions of allocated MAC address space. Applying this technique over the course of a year, we learned the precise locations of over 2 billion BSSIDs around the world. The privacy implications of such massive datasets become more stark when taken longitudinally, allowing the attacker to track devices' movements. While most Wi-Fi access points do not move for long periods of time, many devices -- like compact travel routers -- are specifically designed to be mobile. We present several case studies that demonstrate the types of attacks on privacy that Apple's WPS enables: We track devices moving in and out of war zones (specifically Ukraine and Gaza), the effects of natural disasters (specifically the fires in Maui), and the possibility of targeted individual tracking by proxy -- all by remotely geolocating wireless access points. We provide recommendations to WPS operators and Wi-Fi access point manufacturers to enhance the privacy of hundreds of millions of users worldwide. Finally, we detail our efforts at responsibly disclosing this privacy vulnerability, and outline some mitigations that Apple and Wi-Fi access point manufacturers have implemented both independently and as a result of our work.]]> geolocation location wifi wps apple google infosec privacy https://pinboard.in/ https://pinboard.in/u:jm/b:277b19975935/ ChatGPT provides false information about people, and OpenAI can’t correct it 2024-04-29T10:46:23+00:00 https://noyb.eu/en/chatgpt-provides-false-information-about-people-and-openai-cant-correct-it jm noyb.eu ai ethics ml privacy gdpr data-protection data-privacy https://pinboard.in/ https://pinboard.in/u:jm/b:df157426c691/ NHS and OpenSAFELY 2024-04-19T10:05:47+00:00 https://takes.jamesomalley.co.uk/p/how-to-use-nhs-data-for-scientific?r=2bac6x&triedRedirect=true jm privacy data-protection nhs medical-records medicine research python sql opensafely uk https://pinboard.in/ https://pinboard.in/u:jm/b:5500273f58a5/ How Tech Giants Cut Corners to Harvest Data for A.I. - The New York Times 2024-04-08T13:06:43+00:00 https://www.nytimes.com/2024/04/06/technology/tech-giants-harvest-data-artificial-intelligence.html jmMeta could not match ChatGPT unless it got more data, Mr. Al-Dahle told colleagues. In March and April 2023, some of the company’s business development leaders, engineers and lawyers met nearly daily to tackle the problem. [....] They also talked about how they had summarized books, essays and other works from the internet without permission and discussed sucking up more, even if that meant facing lawsuits. One lawyer warned of “ethical” concerns around taking intellectual property from artists but was met with silence, according to the recordings. ]]> ai copyright data training openai meta google privacy surveillance data-protection ip https://pinboard.in/ https://pinboard.in/u:jm/b:72d55c3af228/ DocuSign admit to training AI on customer data 2024-03-01T17:19:40+00:00 https://mastodon.social/@gvwilson/112012277852906749 jmDocuSign just admitted that they use customer data (i.e., all those contracts, affidavits, and other confidential documents we send them) to train AI: https://support.docusign.com/s/document-item?language=en_US&bundleId=fzd1707173174972&topicId=uss1707173279973.html They state that customers "contractually consent" to such use, but good luck finding it in their Terms of Service. There also doesn't appear to be a way to withdraw consent, but I may have missed that. Gotta say, I find this fairly jaw-dropping. The data in question is "Contract Lifecycle Management, Contract Lifecycle Management AI Extension, and eSignature (for select eSignature customers)". "DocuSign may utilize, at its discretion, a customizable version of Microsoft’s Azure OpenAI Service trained on anonymized customer's data." -- so not running locally, and you have to trust their anonymization. It's known that some anonymization algorithms can be reversed. This also relies on OpenAI keeping their data partitioned from other customers' data, and I'm not sure I'd rush to trust that. One key skill DocuSign should be good at is keeping confidential documents confidential. This isn't it. This is precisely what the EU AI Act should have dealt with (but won't, unfortunately). Still, GDPR may be relevant. And I'm sure there are a lot of lawyers now looking at their use of DocuSign with unease. (via Mark Dennehy)]]> ai privacy data-protection data-privacy openai docusign contracts fail https://pinboard.in/ https://pinboard.in/u:jm/b:86dca90befd9/ Google Chrome ad features checklist 2023-10-04T16:40:20+00:00 https://blog.zgp.org/google-chrome-checklist/ jm browsers chrome privacy data-privacy google https://pinboard.in/ https://pinboard.in/u:jm/b:b8a9db5ae318/ Massive Alexa hole used to stalk Richard Morrell 2023-06-29T12:44:40+00:00 https://practical-tech.com/2023/06/13/how-an-amazon-fire-kids-tablet-was-allegedly-used-to-stalk-a-security-pro/ jmIn Morrell’s case, he says an Amazon Fire 7 Kids tablet was been used to turn his Echo gadgets in his house into listening devices. ... When he found himself the target of a sophisticated stalking attack via an Amazon Fire 7 Kids tablet that he didn’t know was still connected to his account, he was shocked. Someone was listening in to him and looked into his activities and records for approximately two years.  This came even after he changed his Amazon account, refactored his two-factor authentication, and used a secure password generator to create a complex password. He assumed he was safe. He wasn’t. Because the adult account on the Amazon Fire 7 Kids tablet was his, this gave the person who had the tablet full access to his Amazon accounts and data.  Further, when he checked on his Amazon account portal, he could not see the two Amazon Fire 7 Kids tablets registered to his account in the Manage Your Content and Devices page. Here, you’re supposed to find your Fire tablets, Echo devices, and other Alexa API-enabled devices. But the two tablets were not listed. Had they appeared, he would have deregistered them. Morrell felt safe from unauthorized snooping.  He wasn’t. The Amazon Fire 7 Kids tablet acted as a trusted software token — a skeleton key to his Amazon records and devices. With it, this person could obtain access not just to his Alexa devices, but to his Alexa Auto and the Alexa instance on his Android and Apple phones as well.  Amazon replied that the company has been unable to discern how this could have happened, but it is looking into the issue. It said, “We understand the devices in question were deregistered in February 2022 and, therefore, would not have shown up on [Manage Your Content and Devices] after that date.” ]]> amazon privacy security fail alexa infosec dick-morrell fire-tablets https://pinboard.in/ https://pinboard.in/u:jm/b:425dbb9f0361/ Xandr's online-ads segment list 2023-06-08T12:11:24+00:00 https://themarkup.org/privacy/2023/06/08/from-heavy-purchasers-of-pregnancy-tests-to-the-depression-prone-we-found-650000-ways-advertisers-label-you jmIf you spend any time online, you probably have some idea that the digital ad industry is constantly collecting data about you, including a lot of personal information, and sorting you into specialized categories so you’re more likely to buy the things they advertise to you. But in a rare look at just how deep—and weird—the rabbit hole of targeted advertising gets, The Markup has analyzed a database of 650,000 of these audience segments, newly unearthed on the website of Microsoft’s ad platform Xandr. The trove of data indicates that advertisers could also target people based on sensitive information like being “heavy purchasers” of pregnancy test kits, having an interest in brain tumors, being prone to depression, visiting places of worship, or feeling “easily deflated” or that they “get a raw deal out of life.” (Via Johnny Ryan)]]> ads data-privacy xandr microsoft segmentation advertising privacy https://pinboard.in/ https://pinboard.in/u:jm/b:b60728398830/ "Data protection IS AI regulation" 2023-06-01T14:15:40+00:00 https://twitter.com/mer__edith/status/1664057265958055939 jm regulation ai ml training data-protection privacy ring amazon ftc https://pinboard.in/ https://pinboard.in/u:jm/b:238381e75a4a/ OpenAI’s hunger for data is coming back to bite it 2023-04-20T09:56:55+00:00 https://www.technologyreview.com/2023/04/19/1071789/openais-hunger-for-data-is-coming-back-to-bite-it/?truid=8c8f2699f50eb3b9985a111121cfee47&mc_cid=8f246dd37f&mc_eid=eaf496ebe1 jmThe company could have saved itself a giant headache by building in robust data record-keeping from the start, she says. Instead, it is common in the AI industry to build data sets for AI models by scraping the web indiscriminately and then outsourcing the work of removing duplicates or irrelevant data points, filtering unwanted things, and fixing typos. These methods, and the sheer size of the data set, mean tech companies tend to have a very limited understanding of what has gone into training their models.  ]]> training data provenance ai ml common-crawl openai chatgpt data-protection privacy https://pinboard.in/ https://pinboard.in/u:jm/b:8a1016bb2d53/ Timnit Gebru's anti-'AI pause' 2023-04-14T21:59:25+00:00 https://www.politico.com/newsletters/digital-future-daily/2023/04/11/timnit-gebrus-anti-ai-pause-00091450 jmWhat is your appeal to policymakers? What would you want Congress and regulators to do now to address the concerns you outline in the open letter? Congress needs to focus on regulating corporations and their practices, rather than playing into their hype of “powerful digital minds.” This, by design, ascribes agency to the products rather than the organizations building them. This language obfuscates the amount of data that is being collected — and the amount of worker exploitation involved with those who are labeling and supplying the datasets, and moderating model outputs. Congress needs to ensure corporations are not using people’s data without their consent, and hold them responsible for the synthetic media they produce — whether it is text or media spewing disinformation, hate speech or other types of harmful content. Regulations need to put the onus on corporations, rather than understaffed agencies. There are probably existing regulations these organizations are breaking. There are mundane “AI” systems being used daily; we just heard about another Black man being wrongfully arrested because of the use of automated facial analysis systems. But that’s not what we’re talking about, because of the hype. ]]> data privacy ai ml openai monopoly https://pinboard.in/ https://pinboard.in/u:jm/b:c02b89d4a2b8/ Employees Are Feeding Sensitive Business Data to ChatGPT 2023-03-27T20:55:14+00:00 https://www.darkreading.com/risk/employees-feeding-sensitive-business-data-chatgpt-raising-security-fears jmIn a recent report, data security service Cyberhaven detected and blocked requests to input data into ChatGPT from 4.2% of the 1.6 million workers at its client companies because of the risk of leaking confidential information, client data, source code, or regulated information to the LLM.  In one case, an executive cut and pasted the firm's 2023 strategy document into ChatGPT and asked it to create a PowerPoint deck. In another case, a doctor input his patient's name and their medical condition and asked ChatGPT to craft a letter to the patient's insurance company. ]]> chatgpt openai ip privacy data-protection security https://pinboard.in/ https://pinboard.in/u:jm/b:c3190be3e0ad/ The privacy loophole in your doorbell 2023-03-10T10:28:33+00:00 https://www.politico.com/news/2023/03/07/privacy-loophole-ring-doorbell-00084979 jm amazon police privacy surveillance dystopia us-politics https://pinboard.in/ https://pinboard.in/u:jm/b:f88e33e127c0/ This app will self-destruct: How Belarusian hackers created an alternative Telegram 2023-01-11T17:57:14+00:00 https://therecord.media/this-app-will-self-destruct-how-belarusian-hackers-created-an-alternative-telegram-for-activists/ jm When a 25-year-old activist from Minsk who goes by Pavlo was detained by Belarusian KGB security forces last summer, he knew they would search his phone, looking for evidence of his involvement in anti-government protests. The police officer asked for Pavlo’s password to Telegram, the most popular messenger app among Belarusian activists, which he gave him. The officer entered it and... found nothing. All secret chats and news channels had disappeared, and after a few minutes of questioning Pavlo was released. Pavlo’s secret? A secure version of Telegram, developed by a hacktivist group from Belarus called the Cyber Partisans. Partisan Telegram, or P-Telegram, automatically deletes pre-selected chats when someone enters the so-called SOS password.
... after entering a fake [SOS] password, P-Telegram can automatically log out of the account, delete selected chats and channels, and even send a notification about the arrest of the account owners to their friends or families. P-Telegram also allows other activists to remotely activate the SOS password on the detainee’s phone. For this, they need to send a code word to any of the shared Telegram chats. Another feature on P-Telegram automatically takes photos of law enforcement officers on the front camera when they enter a fake password. “We warn users that this can be dangerous, as this photo will be stored on the phone, revealing that a person may use Partisan Telegram,” Shemetovets said.  Cyber Partisans are constantly updating their app, fixing bugs, and adding new features. They also regularly conduct independent audits to ensure that P-Telegram complies with all security measures. A recent audit by Open Technology Fund’s Red Team Lab proved that it is almost impossible for “casual observers without technical knowledge and specialized equipment” to identify the existence of P-Telegram on a device.
]]> p-telegram hacktivism security telegram messaging privacy activism duress-passwords https://pinboard.in/ https://pinboard.in/u:jm/b:fb64152bf54b/ A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook? 2022-12-20T10:19:05+00:00 https://www.technologyreview.com/2022/12/19/1065306/roomba-irobot-robot-vacuums-artificial-intelligence-training-data-privacy/ jm ai privacy surveillance ml roomba irobot https://pinboard.in/ https://pinboard.in/u:jm/b:b7db8007bf8c/ Facebook Engineers Don’t Know Where They Keep Your Data 2022-09-08T10:56:35+00:00 https://theintercept.com/2022/09/07/facebook-personal-data-no-accountability/ jmIn the March 2022 hearing, Zarashaw and Steven Elia, a software engineering manager, described Facebook as a data-processing apparatus so complex that it defies understanding from within. The hearing amounted to two high-ranking engineers at one of the most powerful and resource-flush engineering outfits in history describing their product as an unknowable machine. [...] The fundamental problem, according to the engineers in the hearing, is that [...] the company never bothered to cultivate institutional knowledge of how each of these component systems works, what they do, or who’s using them. ]]> data engineering facebook meta privacy fail culture work https://pinboard.in/ https://pinboard.in/u:jm/b:f425923a47a2/ What is Fog Data Science? 2022-09-06T08:50:20+00:00 https://www.eff.org/deeplinks/2022/06/what-fog-data-science-why-surveillance-company-so-dangerous jmFog claims that their product is made of [location] data willingly given by people. But people did not hand their geolocation data over to Fog or the police, willingly or even knowingly. Rather, they gave it over, for example, to a weather app so that they could see if it will rain in their town today. When they downloaded the app, they may have clicked a box purporting to grant various so-called “consents,” but no reasonable person expects this will result in the app tracking all their movements, the app developer selling this sensitive information to a data broker, and police ultimately buying it. and this is why the GDPR is so valuable. ]]> fog police surveillance gdpr privacy data-privacy location https://pinboard.in/ https://pinboard.in/u:jm/b:582ef18d2a24/ Chuck Johnson Claims He Cofounded Clearview AI 2022-05-25T09:56:55+00:00 https://gizmodo.com/right-wing-troll-chuck-johnson-claims-he-cofounded-faci-1846506909 jmWhile Johnson and Ton-That hung out .... they mused about discredited sciences that could be explored in the modern age with new technologies. At one point, the conversation turned to physiognomy, the pseudoscientific judgment of a person’s character based on their facial features. .... Johnson claims he set up a meeting between Thiel and Ton-That; he then introduced him to Schwartz via email. Approximately seven months later, Schwartz apparently emailed Johnson “draft formation documents” for a new company called Smartchekr which “granted equal ownership to Schwartz, Ton-That, and Johnson.” ]]> clearview gdpr privacy facial-recognition chuck-johnson charles-johnson nazis us-politics https://pinboard.in/ https://pinboard.in/u:jm/b:ec679b36b121/ Chat Control 2022-05-13T09:50:56+00:00 https://www.patrick-breyer.de/en/posts/messaging-and-chat-control/ jm The EU wants to oblige providers to search all private chats, messages, and emails automatically for suspicious content – generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance by means of fully automated real-time messaging and chat control and the end of secrecy of digital correspondence. Other consequences of the proposal are ineffective network blocking, screening of person cloud storage including private photos, mandatory age verification leading to the end of anonymous communication, censorship in Appstores and the paternalism and exclusion of minors in the digital world. ]]> surveillance censorship chat-control eu laws messaging apps privacy data-privacy https://pinboard.in/ https://pinboard.in/u:jm/b:133f804a604c/ Data Broker Is Selling Location Data of People Who Visit Abortion Clinics 2022-05-04T10:03:59+00:00 https://www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood jm abortion capitalism data data-privacy privacy location safegraph https://pinboard.in/ https://pinboard.in/u:jm/b:785d2d9cd559/ An Post & OSI company “GeoDirectory” uses Census data to profile every Irish home 2022-05-03T08:39:42+00:00 https://www.iccl.ie/news/iccl-data-complaint-an-post-osi-company-profiles-irish-peoples-income-and-homes-and-sells-data-to-data-brokers-and-insurance-companies/ jmThe Irish Council for Civil Liberties (ICCL) reveals that An Post & OSI use Census data to profile every Irish home and sell ‘location intelligence’ to data brokers and insurance companies. ICCL has lodged a complaint with the Data Protection Commission. In particular, buyers include Experian, one of the world's biggest data brokers. There's no way this meets the spirit, if not the word, of the GDPR, there's no data privacy here.]]> data-privacy data-protection iccl experian an-post osi census data privacy ireland https://pinboard.in/ https://pinboard.in/u:jm/b:f47b892b723f/ Life360 sells kids' location data to "approximately a dozen data brokers" 2021-12-07T14:47:21+00:00 https://twitter.com/WolfieChristl/status/1467927612626550786 jm refractive-surveillance surveillance children privacy data-privacy location gps life360 tile data-brokers https://pinboard.in/ https://pinboard.in/u:jm/b:b6bb8b12bba3/ A sample GDPR Data Subject Access Request 2021-11-05T10:49:21+00:00 https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ jm eu europe gdpr privacy dsar letters boilerplate https://pinboard.in/ https://pinboard.in/u:jm/b:cf18f3e484b9/ How Data Brokers Sell Access to the Backbone of the Internet 2021-08-26T10:45:16+00:00 https://www.vice.com/en/article/jg84yy/data-brokers-netflow-data-team-cymru jm"I'm concerned that netflow data being offered for commercial purposes is a path to a dark fucking place," one source familiar with the data told Motherboard. [...] At a high level, netflow data creates a picture of traffic flow and volume across a network. It can show which server communicated with another, information that may ordinarily only be available to the server owner or the ISP carrying the traffic. Crucially, this data can be used for, among other things, tracking traffic through virtual private networks, which are used to mask where someone is connecting to a server from, and by extension, their approximate physical location. Team Cymru, one threat intelligence firm, works with ISPs to access that netflow data, three sources said. Keith Chu, communications director for the office of Senator Ron Wyden which has been conducting its own investigations into the sale of sensitive data, added that Team Cymru told the office "it obtains netflow data from third parties in exchange for threat intelligence." Companies that may source Team Cymru's data include cybersecurity firms hired to respond to data breaches or proactively hunt out hackers. On its website, Team Cymru says it works with both public and private sector teams to "to help identify, track and stop bad actors both in cyber space and on the ground." "I'm less worried about a bad guy hacker and more worried about a bad guy government or company or politician," one source familiar with the data said. A source in the threat intelligence industry added that they "always thought it was kinda bonkers," referring to Team Cymru's sale of netflow data. ]]> vpns surveillance web privacy team-cymru netflow isps threat-intelligence https://pinboard.in/ https://pinboard.in/u:jm/b:0f8dc0c59e69/ google/fully-homomorphic-encryption 2021-06-16T08:49:04+00:00 https://github.com/google/fully-homomorphic-encryption jmThis repository contains open-source libraries and tools to perform fully homomorphic encryption (FHE) operations on an encrypted data set. [...] Fully Homomorphic Encryption (FHE) is an emerging data processing paradigm that allows developers to perform transformations on encrypted data. FHE can change the way computations are performed by preserving privacy end-to-end, thereby giving users even greater confidence that their information will remain private and secure. ]]> cryptography encryption google security fhe homomorphic privacy data-privacy https://pinboard.in/ https://pinboard.in/u:jm/b:533ecf4cf2e5/ US Soldiers Expose Nuclear Weapons Secrets Via Flashcard Apps 2021-05-28T15:53:11+00:00 https://www.bellingcat.com/news/2021/05/28/us-soldiers-expose-nuclear-weapons-secrets-via-flashcard-apps/ jmFor US soldiers tasked with the custody of nuclear weapons in Europe, the stakes are high. Security protocols are lengthy, detailed and need to be known by heart. To simplify this process, some service members have been using publicly visible flashcard learning apps — inadvertently revealing a multitude of sensitive security protocols about US nuclear weapons and the bases at which they are stored. [...] the flashcards studied by soldiers tasked with guarding these devices reveal not just the bases, but even identify the exact shelters with “hot” vaults that likely contain nuclear weapons. They also detail intricate security details and protocols such as the positions of cameras, the frequency of patrols around the vaults, secret duress words that signal when a guard is being threatened and the unique identifiers that a restricted area badge needs to have. omgwtf!]]> army dystopia nuclear nukes privacy flashcards apps security weapons https://pinboard.in/ https://pinboard.in/u:jm/b:49cce505e1ff/ inside the LAPD/LASD usage of Palantir 2020-09-30T09:33:08+00:00 https://www.buzzfeednews.com/article/carolinehaskins1/training-documents-palantir-lapd jmMuch of the LAPD data consists of the names of people arrested for, convicted of, or even suspected of committing crimes, but that’s just where it starts. Palantir also ingests the bycatch of daily law enforcement activity. Maybe a police officer was told a person knew a suspected gang member. Maybe an officer spoke to a person who lived near a crime “hot spot,” or was in the area when a crime happened. Maybe a police officer simply had a hunch. The context is immaterial. Once the LAPD adds a name to Palantir’s database, that person becomes a data point in a massive police surveillance system. [...] At great taxpayer expense, and without public oversight or regulation, Palantir helped the LAPD construct a vast database that indiscriminately lists the names, addresses, phone numbers, license plates, friendships, romances, jobs of Angelenos — the guilty, innocent, and those in between. This is absolute garbage -- total bias built-in. No evidence required to get a person in the firing line: “The focus of a data-driven surveillance system is to put a lot of innocent people in the system,” Ferguson said. “And that means that many folks who end up in the Palantir system are predominantly poor people of color, and who have already been identified by the gaze of police.”]]> palantir databases privacy law lapd lasd los-angeles surveillance big-brother police crime gangs https://pinboard.in/ https://pinboard.in/u:jm/b:414f0c4a714e/ Prio 2020-09-24T11:23:08+00:00 https://crypto.stanford.edu/prio/paper.pdf jm nizk zero-knowledge snark prio crypto privacy data-privacy statistics quantiles percentiles aggregation https://pinboard.in/ https://pinboard.in/u:jm/b:2aa675a6dbfc/ The EU General Data Protection Regulation explained by Americans 2020-07-13T11:47:33+00:00 https://hroy.eu/posts/gdprExplainedByUS/ jmBashing the European Union’s General Data Protection Regulation (GDPR) seems to have become one of American activists’ favourite hobbies in the tech field. Some criticism is entirely justified. But many claims that the GDPR is “counterproductive” or “misses the point” are based on misconceptions, rather than an accurate understanding of European data protection laws. As a result, several US privacy advocates have therefore suggested alternative principles or rules… many of which, actually, have been part of EU data protection law since 1995. ]]> gdpr privacy data-protection eu data-privacy us-politics https://pinboard.in/ https://pinboard.in/u:jm/b:7499f520b9c7/ Facial recognition technology is racist 2020-06-24T10:21:07+00:00 https://www.nytimes.com/2020/06/24/technology/facial-recognition-arrest.html jm facial-recognition law justice privacy faces racism technology future bias machine https://pinboard.in/ https://pinboard.in/u:jm/b:ddabdefd71ad/ The Trump 2020 app is a voter surveillance tool of extraordinary power | MIT Technology Review 2020-06-23T09:44:52+00:00 https://www.technologyreview.com/2020/06/21/1004228/trumps-data-hungry-invasive-app-is-a-voter-surveillance-tool-of-extraordinary-scope/ jmTrump’s casino-like campaign app seems to be his own attempt to create a “one-way tool of propaganda.” Its deployment is part of a global trend, piggybacking on years of unresolved privacy and security issues within the app ecosystem. As researchers studying the intersection of technology and propaganda, we understand that political groups tend to lag behind the commercial ad industry. But when they catch up, the consequences to truth and civil discourse can be devastating.  The array of data-gathering tools the Trump and Modi apps use are a legacy of a “freemium” social-media and app landscape that is manipulative, non-transparent, and purposefully addictive, with a mentality of “collect data first and ask question later.” For the last five to 10 years, the pervasiveness of these tools and their use in data scooping has been well documented. Sporadic, state-by-state data regulations have been the only response. In Europe, the GDPR was a big step toward meaningful consent and transparency, but the Official Trump 2020 App does not fall under its jurisdiction. A global perspective is now critical to understanding the implications of data-fueled political manipulation and preparing for the next wave of disinformation. Countries must work together to create effective regulation, and citizens must demand this of them. It took about five years for Modi’s strategies to jump from India to the US, and in the next few years we are on track to see the arrival of strategies used in the dark-money disinformation campaigns of Mexico and Latin America. The Mexican journalist we'd interviewed for our study put it this way: “I think what’s coming all around the world is going to be very chaotic, at least in [the US], I think you’re on the brink of a sort of civil war in one or two years ... You’re going to have a lot of work to do.” ]]> trump politics apps surveillance advertising voting modi gdpr privacy data-privacy https://pinboard.in/ https://pinboard.in/u:jm/b:add5fa6051a6/ Joint Statement regarding the NHSX contact tracing app 2020-04-29T15:03:31+00:00 https://drive.google.com/file/d/1uB4LcQHMVP-oLzIIHA9SjKj1uMd3erGu/view jmIt has been reported that NHSX is discussing an approach which records centrally the de-anonymised ID of someone who is infected and also the IDs of all those with whom the infected person has been in contact. This facility would enable (via mission creep) a form of surveillance. Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified. Such invasive information can include the “social graph” of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens' real-world activities. We are particularly unnerved by a declaration that such a social graph is indeed aimed for by NHSX. We understand that the current proposed design is intended to meet the requirements set out by the public health teams, but we have seen conflicting advice from different groups about how much data the public health teams need. We hold that the usual data protection principles should apply: collect the minimum data necessary to achieve the objective of the application. We hold it is vital that if you are to build the necessary trust in the application the level of data being collected is justified publicly by the public health teams demonstrating why this is truly necessary rather than simply the easiest way, or a “nice to have”, given the dangers involved and invasive nature of the technology. ]]> nhs nhsx privacy data-privacy security contact-tracing covid-19 surveillance https://pinboard.in/ https://pinboard.in/u:jm/b:e282a2426f1a/ Will CovidTracker Ireland work? 2020-04-22T20:00:32+00:00 http://progcity.maynoothuniversity.ie/2020/04/will-covidtracker-ireland-work/ jmIt is essential that the government follow the guidance of the European Data Protection Board that recommends that strong measures are put in place to protect privacy, data minimization is practised, the source code is published and regularly reviewed, there is clear oversight and accountability, and there is purpose limitation that stops control creep. If implemented poorly, the app could have a profound chilling effect on public trust and public health measures that might be counterproductive. As a consequence, the Ada Lovelace Institute, a leading UK centre for artificial intelligence research, is advising governments to be cautious, ethical and transparent in their use of app-based contact tracing. Ireland might do well to heed their advice. ]]> data-privacy privacy covid-19 hse apps ireland contact-tracing https://pinboard.in/ https://pinboard.in/u:jm/b:29dcbc692710/ EDPB on COVID-19 contact tracing apps 2020-04-15T11:11:33+00:00 https://edpb.europa.eu/sites/edpb/files/files/file1/edpbletterecadvisecodiv-appguidance_final.pdf jm edpb data-privacy privacy covid-19 eu ec contact-tracing https://pinboard.in/ https://pinboard.in/u:jm/b:a50c5b028683/ DP^3T 2020-04-14T14:28:07+00:00 https://github.com/DP-3T/ jm open-source dp3t privacy data-privacy covid-19 contact-tracing https://pinboard.in/ https://pinboard.in/u:jm/b:2a8f9336fd08/ Private Contact Tracing Protocols Compared: DP-3T and CEN 2020-04-07T18:02:30+00:00 https://www.zfnd.org/blog/private-contact-tracing-protocols-compared/ jmit’s critically important to prevent the creation of new surveillance infrastructure [...] But contact tracing will be a critical part of COVID-19 recovery, particularly in the period after the surge of cases, but before widespread immunity prevents transmission. So it’s been incredibly exciting to see how many people have been working on this problem in a spirit of radical collaboration. Some of these projects are mentioned in our previous post on design tradeoffs in contact tracing systems. At the Zcash Foundation, we’ve been collaborating with existing efforts on the CEN Protocol, originally started as a joint effort between two projects, CoEpi and Covid-Watch. And earlier this week, a group of European academics from eight universities announced a new effort called DP-3T. These protocols are very similar, and it would be great if they could both evolve towards a common standard. To support that goal, this post will compare and contrast the current designs of the DP-3T and CEN protocols. ]]> contact-tracing protocols crypto covid-19 dp-3t cen security privacy https://pinboard.in/ https://pinboard.in/u:jm/b:b7ee60b3c99e/ CCC's 10 requirements for the evaluation of "Contact Tracing" apps 2020-04-06T20:27:59+00:00 https://www.ccc.de/en/updates/2020/contact-tracing-requirements jm"Corona apps" are on everyone's lips as a way to contain the SARS-CoV-2 epidemic. CCC publishes 10 requirements for their evaluation from a technical and societal perspective. Currently, technically supported "contact tracing" is being considered as means to counteract the spread of SARS-CoV-2 in a more targeted manner. The general motivation is to allow greater freedom of movement for the broad spectrum of society by allowing quick tracing and interruption of infection chains. Contacts of infected persons should be alerted more quickly and thus be able to quarantine themselves more quickly. This, in turn, should prevent further infections. A "corona app" could therefore protect neither ourselves nor our contacts: It would be designed to break chains of infection by protecting the contacts of our contacts. ]]> covid-19 pandemics contact-tracing ccc privacy data-privacy https://pinboard.in/ https://pinboard.in/u:jm/b:4344f9c0f634/ Unified research on privacy-preserving contact tracing and exposure notification for COVID-19 - Google Docs 2020-04-03T16:57:26+00:00 https://docs.google.com/document/d/16Kh4_Q_tmyRh0-v452wiul9oQAiTRj8AdZ5vcOJum9Y/edit jm docs gdocs contact-tracing privacy apps coding tech covid-19 collaboration https://pinboard.in/ https://pinboard.in/u:jm/b:404df94aa455/ PEPP-PT 2020-04-01T19:46:10+00:00 https://www.pepp-pt.org/ jmPan-European Privacy-Preserving Proximity Tracing (PEPP-PT) makes it possible to interrupt new chains of SARS-CoV-2 transmission rapidly and effectively by informing potentially exposed people. We are a large and inclusive European team. We provide standards, technology, and services to countries and developers. We embrace a fully privacy-preserving approach. We build on well-tested, fully implemented proximity measurement and scalable backend service. We enable tracing of infection chains across national borders.  (via Cory) ]]> coronavirus tracing gdpr covid-19 privacy contact-tracing apps europe via:doctorow https://pinboard.in/ https://pinboard.in/u:jm/b:e8e1d90b3f4b/ Safe Paths 2020-03-18T18:04:26+00:00 https://www.technologyreview.com/s/615372/coronavirus-infection-tests-app-pandemic-location-privacy/ jmThe news: An app that tracks where you have been and who you have crossed paths with—and then shares this personal data with other users in a privacy-preserving way—could help curb the spread of Covid-19, says Ramesh Raskar at the MIT Media Lab, who leads the team behind it. Called Private Kit: Safe Paths, the free and open-source app was developed by people at MIT and Harvard, as well as software engineers at companies such as Facebook and Uber, who worked on it in their free time.   ]]> mit contact-tracing privacy apps smartphones android ios covid-19 epidemics pandemics https://pinboard.in/ https://pinboard.in/u:jm/b:ca9d8a70f22c/ COVID-19 Risk App 2020-03-17T23:02:56+00:00 https://www.covid19risk.com/about.html jm COVID-19 has a relatively long infectious incubation period, averaging five days but potentially up to two weeks, during which there may be asymptomatic transmission. In other words, there may be a period of time in which people who carry COVID-19 don't necessarily show symptoms and may not even realise they are infected, but are still capable of infecting others. This makes it harder for health professionals and epidemiologists to trace who has come into contact with infected persons ('contact tracing'), which in turn makes the virus more difficult to effectively contain. Many people, however, now carry GPS-enabled smartphones which already track their location over time - most mapping apps, like Google Maps or MapQuest, already collect this data by default. We believe that this information could be used to rapidly and automatically perform a type of contact tracing, helping limit the spread of COVID-19 and other infectious diseases. These phones are usually also Bluetooth-enabled, allowing them to track and record which other phones they're in proximity to. We believe that together, these two pieces of information can be used to inform and empower our users in a range of ways. Firstly, we can generate heatmaps of high-risk areas from demographic data, known cases, and epidemiological modelling, allowing users to adjust their behaviour accordingly. Secondly, we can use Bluetooth connections between users to enact cryptographically secure contact tracing and alerting them if we learn that they have been exposed to COVID-19, without revealing the identities or infection status of any other users. ]]> covid-19 contact-tracing apps android ios smartphones privacy location https://pinboard.in/ https://pinboard.in/u:jm/b:e56e9084f32f/ Twitter Likes Deleter 2020-02-03T14:41:28+00:00 http://twitter-likes-deleter.glitch.me/ jm likes twitter social-media snooping via:anildash privacy https://pinboard.in/ https://pinboard.in/u:jm/b:911668910adf/ Revealed: betting firms use schools data on 28m UK children 2020-01-20T10:22:18+00:00 https://www.thetimes.co.uk/article/revealed-betting-firms-use-schools-data-on-28m-children-dn37nwgd5 jmBetting companies have been given access to an educational database containing names, ages and addresses of 28 million children and students in one of the biggest breaches of government data. They have used it to help increase the proportion of young people who gamble online. It contains details of children age 14 and above in state schools, private schools and colleges in England, Wales and Northern Ireland. ]]> privacy data-protection children kids schools uk betting gambling https://pinboard.in/ https://pinboard.in/u:jm/b:fc4aac3bf7fe/ Facial recognition for the public: Yandex 2020-01-08T20:58:09+00:00 https://nelsonslog.wordpress.com/2020/01/07/facial-recognition-for-the-public-yandex/ jmYou can use Yandex Image Search right now as a pretty good facial recognition system for anyone who has labelled photos on the Web. I believe this is the first generally accessible facial recognition system with a large database. Yandex isn’t designed for this purpose. The trick is to upload photos cropped to a face and it’ll work more or less to find similar faces. this is really odd. Definitely seems like they designed the image similarity engine to support faces as a special case.]]> privacy face-recognition yandex search similarity images web https://pinboard.in/ https://pinboard.in/u:jm/b:3a385d71b7b1/ Opinion | Twelve Million Phones, One Dataset, Zero Privacy - The New York Times 2019-12-19T14:55:14+00:00 https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html?te=1&nl=the-privacy%20project&emc=edit_priv_20191219?campaign_id=0&instance_id=0&segment_id=0&user_id=7c8ff3fc774920a57c39e5d6cb28327e&regi_id=020191219 jm technology privacy surveillance phones mobile location location-tracking tracking geo https://pinboard.in/ https://pinboard.in/u:jm/b:2f425d3391e7/ China’s Operating Manuals for Mass Internment and Arrest by Algorithm - ICIJ 2019-11-25T14:07:55+00:00 https://www.icij.org/investigations/china-cables/exposed-chinas-operating-manuals-for-mass-internment-and-arrest-by-algorithm/ jm“The Chinese have bought into a model of policing where they believe that through the collection of large-scale data run through artificial intelligence and machine learning that they can, in fact, predict ahead of time where possible incidents might take place, as well as identify possible populations that have the propensity to engage in anti-state anti-regime action,” said Mulvenon, the SOS International document expert and director of intelligence integration. “And then they are preemptively going after those people using that data.” Mulvenon said IJOP is more than a “pre-crime” platform, but a “machine-learning, artificial intelligence, command and control” platform that substitutes artificial intelligence for human judgment. He described it as a “cybernetic brain” central to China’s most advanced police and military strategies. Such a system “infantilizes” those tasked with implementing it, said Mulvenon, creating the conditions for policies that could spin out of control with catastrophic results. The program collects and interprets data without regard to privacy, and flags ordinary people for investigation based on seemingly innocuous criteria, such as daily prayer, travel abroad, or frequently using the back door of their home. Perhaps even more significant than the actual data collected are the grinding psychological effects of living under such a system.  With batteries of facial-recognition cameras on street corners, endless checkpoints and webs of informants, IJOP generates a sense of an omniscient, omnipresent state that can peer into the most intimate aspects of daily life.  As neighbors disappear based on the workings of unknown algorithms, Xinjiang lives in a perpetual state of terror. The seeming randomness of investigations resulting from IJOP isn’t a bug but a feature, said Samantha Hoffman, an analyst at the Australian Strategic Policy Institute whose research focuses on China’s use of data collection for social control. “That’s how state terror works,” Hoffman said. “Part of the fear that this instills is that you don’t know when you’re not OK.” ]]> terror dystopia china algorithms ijop future policing grim-meathook-future privacy data-privacy uighurs https://pinboard.in/ https://pinboard.in/u:jm/b:56d5edb57106/ How ICE Picks Its Targets in the Surveillance Age - The New York Times 2019-10-03T10:12:45+00:00 https://www.nytimes.com/2019/10/02/magazine/ice-surveillance-deportation.html#click=https://t.co/106daANqmy jmTracking immigrants in this country is an increasingly trivial exercise because it’s an increasingly trivial exercise to track any of us. [...] Over the course of more than a year, I tried to reverse-engineer individual ICE officers’ use of America’s vast post-Sept. 11 domestic-surveillance apparatus, retracing their hunt for targets down to the very searches they entered into their computers. The scale of domestic surveillance of the general population in the US is huge. We need more friction: 'What may be most unusual about Washington State is not what it collects and not what it has shared but the degree to which it has been forced to become transparent about the vast quantity of personal data that courses through its bureaucracy. For decades, the overriding objective of American business and government has been to remove friction from the tracking system, by linking networks, by speeding connections, by eliminating barriers. But friction is the only thing that has ever made privacy, let alone obscurity, possible. If there’s no friction, if we can all be profiled instantly and intimately, then there’s nothing to stop any of our neighbors from being targeted — nothing, that is, except our priorities.']]> ice privacy data-protection data-privacy immigration us-politics trump surveillance palantir great-oak tracking https://pinboard.in/ https://pinboard.in/u:jm/b:b5462c83960f/ Observations on Technology Use in Hong Kong Protests 2019-09-19T16:12:46+00:00 https://idlewords.com/talks/hk_stanford.html jm china communication hong-kong protests protesting privacy telegram future messaging https://pinboard.in/ https://pinboard.in/u:jm/b:d171a80f0dd1/ Google release an open-source differential-privacy lib 2019-09-09T14:24:03+00:00 https://developers.googleblog.com/2019/09/enabling-developers-and-organizations.html jmDifferentially-private data analysis is a principled approach that enables organizations to learn from the majority of their data while simultaneously ensuring that those results do not allow any individual's data to be distinguished or re-identified. This type of analysis can be implemented in a wide variety of ways and for many different purposes. For example, if you are a health researcher, you may want to compare the average amount of time patients remain admitted across various hospitals in order to determine if there are differences in care. Differential privacy is a high-assurance, analytic means of ensuring that use cases like this are addressed in a privacy-preserving manner. Currently, we provide algorithms to compute the following: Count Sum Mean Variance Standard deviation Order statistics (including min, max, and median) ]]> analytics google ml privacy differential-privacy aggregation statistics obfuscation approximation algorithms https://pinboard.in/ https://pinboard.in/u:jm/b:98439e468432/ Well Networked Self-Driving Cars Become A Surveillance Nightmare? 2019-08-29T13:04:06+00:00 https://www.forbes.com/sites/bradtempleton/2019/08/29/well-networked-self-driving-cars-become-a-surveillance-nightmare/#7e27bd14612f jmIt's time to establish precedents that the fleets of advanced cars on the road do not become a giant surveillance apparatus. That it should be illegal for police to request that car fleets perform surveillance for them. That companies operating fleets resist such requests when they come, in the courts if they have to. ]]> cars driving future surveillance cctv anpr alpr police privacy https://pinboard.in/ https://pinboard.in/u:jm/b:0fddeb24bf6b/ Solid advice on what to do in case the government shuts down the internet 2019-08-29T11:54:08+00:00 https://twitter.com/Pinboard/status/1166946106321670144 jmDear Hong Kong friends: as people are worried about an internet shutdown, do not be afraid to make plans now. Find a VPN that you like and test it out. If Telegram is unusable, use Signal or WhatsApp (both are safe). If LIHGK is not usable, use Reddit or Facebook groups. Above all, please remember that one of the biggest enemies you face are rumors. These will get worse if Internet access is curtailed; be careful about unverified news. As a general rule, you are best served by using a very big site (like Facebook or Google) than something small. The very big sites are harder to shut down and to attack. They also have security teams that make it harder for people to interfere with them. Whatever backup plan you have, test it while things are still working, so you don't have to learn it when under lots of stress. Twitter is another good choice for sharing information quickly. Google is also a safe option for chat/messages. All of these companies have experience fighting Chinese interference and will fight for you in case there is an effort to limit internet access in Hong Kong. My biggest piece of advice: do not forget to look at cat pictures once in a while to reduce anxiety and stress! VPN recommendations, via Zeynep Tufekci: 'the three I heard most about were: @getcloak (now encrypt.me), @theTunnelBear (PAID) and @FreedomeVPN. Don't use free ones.']]> security privacy internet shutdown via:pinboard via:zeynep hong-kong https://pinboard.in/ https://pinboard.in/u:jm/b:852e7f16b3ba/