EU: Ahead of the US But Maybe Too Late Again
August 30, 2022
When making up for decades of inaction, just create more bureaucracy. That seems to be the approach behind the move revealed in Reuters‘ brief article, “EU Mulls New Unit with Antitrust Veterans to Enforce Tech Rules—Sources.” The European Commission seems to think it might be difficult to force tech giants to comply with the recently passed Digital Markets Act (DMA). Now where would they get that idea? The write-up tells us:
“The landmark rules, agreed in March, will go into force next year. They will bar the companies from setting their own products as preferences, forcing app developers to use their payment systems, and leveraging users’ data to push competing services. The new directorate at the Commission’s powerful antitrust arm may be headed by Alberto Bacchiega, director of information, communication and media, in charge of antitrust and merger cases involving the tech, media and consumer electronics industries, one of the people [familiar with the matter] said. Bacchiega could also be assisted by Thomas Kramler, head of the unit dealing with antitrust cases in e-commerce and data economy, and currently spearheading investigations into Apple and Amazon, the person said. Both officials are already liasing with those at the Commission’s Directorate-General for Communications Networks, Content and Technology which will jointly enforce the DMA, a third person said.”
Conveniently, both Bacchiega and Kramler were away on vacation and could not be reached for comment. A spokesperson stated the Commission is shuffling employees, assigning about 80 staff members to enforce the DMA. We wonder whether that is enough to counter Big Tech’s corporate resources, even with a pair of seasoned antitrust veterans at the helm.
Cynthia Murrell, August 29, 2022
Meta: What Does the Modern MySpace Do?
August 24, 2022
Frankly I don’t know what the Zuck and his team of wizards can do. I read “Teens, Social Media and Technology 2022.” The link leads to a study summary, a page of general info, and a summary of the Pew methodology.
One finding from the survey mavens at Pew Research caught my attention. If the methodology was on the money and the data processed in a way that kept the butcher’s thumb off the weighing pan, here’s a thrilling statement:
the share of teens who say they use Facebook, a dominant social media platform among teens in the Center’s 2014-15 survey, has plummeted from 71% then to 32% today.
In the span of 72 months, the Zuckbook watched teens who are considered a part of the future of the datasphere shift to short form videos. The write up included one of those charts colored in such a way to make legibility a bit of a joke. Here’s a screenshot with the bold blue line heading south. Note that despite the legibility, the other lines are heading up. YouTube is a floating dot at the top of the chart because, well, YouTube. Quasi-monopoly. Most popular online service in the “Stans.”
Should YouTube be worried? Not yet. The write up reports:
About three-quarters of teens visit YouTube at least daily, including 19% who report using the site or app almost constantly.
For more Pew data, follow the links in the cited article.
There’s not much analysis of the whys and wherefores, but the data are clear. The allegedly Chinese linked outfit TikTok has access to useful data from young people. What could a crafty person do with these data? Wait until one cluster identified as susceptible individuals and then approach or attempt to influence them.
Stephen E Arnold, August 24, 2022
Yandex: Has Russia Embraced the Chinese Approach to Social Media and Online?
August 23, 2022
The answer to the question “Has Russia Embraced the Chinese Approach to Technology?” is, “Seems like it.”
Like China, Russia has come to understand the power and threat online services represent to the entities holding nation state power. Technology companies which follow different rules than “regular” countries have to be brought under control or killed outright. Russia is into control.
Vkontakte top dog is the scion of Mr. Putin’s top dog. If you are into Russian names, the boss of Vkontakte is Vladimir Kirienko. Mr. Putin’s confidante and senior administrator is Sergei Kirienko. But a tame CEO is not enough. Threats have to be put in a cage and made subject to a higher power, not people with mobile phones.
Vkontakte is a semi-Facebook, just in Russian. It has about 100 million users. The company’s properties include Mail.ru, the social network Odnoklassniki, and a food delivery outfit. According to “Yandex Reaches Binding Deal to Divest News Service, Homepage to VK”:
Yandex said it is pursuing a “strategic exit from its media businesses” with the sale of Yandex.News, Yandex.ru and the Yandex.Zen blogging tool to VK. The Yandex.ru domain will be renamed dzen.ru under VK’s control and further development. Yandex’s main page — with search, mail and non-media tools — will be renamed ya.ru.
What happens to Yandex email addresses? In addition to being read and analyzed by the watch dogs, the future of Yandex mail is fuzzy.
The key take away for me is that China and Russia recognize the threat social media and online information pose. If these nation states’ concerns are valid, will countries with uncontrolled social media operating without meaningful oversight and regulation tear themselves apart?
China’s and Russia’s strategic military thinkers could be anticipating this result. Which view is correct? Social media is the Zucker’s view of bringing people together or the opposite?
Interesting question to consider.
Stephen E Arnold, August 23, 2022
DARPA Works to Limit Open Source Security Threats
August 9, 2022
Isn’t it a little late? Open-source code has become an integral part of nearly every facet of modern computing, including military and critical infrastructure applications. Now, reports MIT Technology Review, “The US Military Wants to Understand the Most Important Software on Earth.” It seems military researchers have just realized there is no control over, or even accounting for, the countless contributors to open-source projects like the Linux kernel. That software alone underpins the operation of most computers. And yet the feature that makes open-source software free and, therefore, ubiquitous also makes it vulnerable to bad actors.
Since it cannot turn back the clock and consider security before open-source code got baked into critical software, DARPA will instead scrutinize the people and organizations behind open-source projects. The program, dubbed “SocialCyber,” will take 18 months and millions of dollars to implement. It will use a combination of the latest AI tech and good old-fashioned sociology to pinpoint potential threats. Reporter Patrick Howell O’Neill writes:
“The ultimate goal is to detect and counteract any malicious campaigns to submit flawed code, launch influence operations, sabotage development, or even take control of open-source projects. To do this, the researchers will use tools such as sentiment analysis to analyze the social interactions within open-source communities such as the Linux kernel mailing list, which should help identify who is being positive or constructive and who is being negative and destructive. The researchers want insight into what kinds of events and behavior can disrupt or hurt open-source communities, which members are trustworthy, and whether there are particular groups that justify extra vigilance. These answers are necessarily subjective. But right now there are few ways to find them at all. Experts are worried that blind spots about the people who run open-source software make the whole edifice ripe for potential manipulation and attacks. For Bratus, the primary threat is the prospect of ‘untrustworthy code’ running America’s critical infrastructure—a situation that could invite unwelcome surprises. …This kind of research also aims to find underinvestment—that is critical software run entirely by one or two volunteers.”
The program relies on partnerships between DARPA and several small cybersecurity research firms like New York’s Margin Research. These firms will ascertain who is working on what open-source projects. Margin will focus on Linux, considered the most urgent point of concern. Open-source programming language Python, which is often used in machine-learning projects, is another priority. SocialCyber is quite an undertaking—it is the pound of cure we could have avoided with an ounce of foresight several years ago.
Cynthia Murrell, August 9, 2022
TikTok: Is It a Helpful Service for Bad Actors?
August 9, 2022
Do you remember the Silicon Valley cheerleaders who said, “TikTok is no big deal. Not to worry.” Well, worry.
“TikTok: Suspected Gangs Tout English Channel Migrant Crossings on Platform” states:
The Home Office [TikTok] said posts which “promote lethal crossings” were unacceptable, but there are calls for more to be done to stop people-smuggling being advertised online.
TikTok is allegedly taking the position that such criminal promotions “have no place” on the China-linked service. The BBC report includes this statement:
A spokesman for TikTok said: “This content has no place on TikTok. We do not allow content that depicts or promotes people smuggling…and have permanently banned these accounts. “We work closely with UK law enforcement and industry partners to find and remove content of this nature, and participate in the joint action plan with the National Crime Agency to help combat organized immigration crime online.”
I am skeptical about TikTok for these reasons:
- Data collection
- Analyses which permit psychological profiling so that potential “insiders” can be identified
- Injection of content which undermines certain social concepts; that is, weaponized information.
Net net: Delete the app and restrict access to the system. Harsh? Maybe too little too late, cheerleaders.
Stephen E Arnold, August 9, 2022
YouTube: Latent Power and a Potential Flash Point within Russia?
August 8, 2022
I read the estimable Murdoch write up called “How YouTube Keeps Broadcasting Inside Russia’s Digital Iron Curtain.” And how about this subtitle?
Access to the video site allows Russians access to one of the few sources of independent information about the Ukraine war
(Keep in mind that you will have to pay to view the article on the WSJ.com site.)
I have suggested that Russia’s regulators see the Google as a giant piggy bank with a ceramic head resembling Godzilla’s. How powerful is Google’s YouTube? The write up suggests that the Alphabet Google YouTube DeepMind thing is pretty powerful. Well, actually what’s powerful is YouTube and its millions upon millions of videos.
Here’s the key statement in the “real” news article:
“Some banks are too big to fail, and some apps are too big to be blocked,” stated Nu Wexler, a former coverage communications staffer at Google, Meta and Twitter. “The Russian government knows they would face a backlash if they were to block a popular app like YouTube in the country.”
Why not enjoy the videos on Rutube, Rumble, or the high quality streamgun.vod site? The reason, according to one attendee at a law enforcement, crime analyst, and intelligence professional centric conference boils down to YouTube being Number One with a bullet.
The idea is that in some of the cheerful outposts in Siberia as well as the toasty towns in Sochi, YouTube is the primary source of entertainment. Okay, but I suggested vodka was the big dog. Wrong, I learned. Despite the quality of Russian state television and the outstanding Russian motion pictures, YouTube kept the young folks busy.
I have yet to see credible data which suggests that YouTube, not Russia billboards, is the information gun in Russia. There is, of course, TikTok and some of the low cost pirate streaming services. YouTube has triumphed it is alleged.
Here’s a factoid from the write up I saw:
YouTube had greater than 85 million month-to-month distinctive viewers in Russia in June, in line with analytics firm.
And how about this allegedly accurate item?
The video website was utilized by 47% of a pattern of Russians surveyed in April by the unbiased Russian pollster Levada Center, making it the nation’s second-most common social community behind native service VKontakte.
Maybe Rutube can displace the GOOG’s YouTube? Maybe:
Russian officers have stated state cash could be invested into Rutube, a unit of the state-owned vitality big Gazprom PJSC that options pro-Moscow content material. It had 9.7 million month-to-month distinctive viewers in Russia in June, SimilarWeb stated.
Net net: No wonder the Alphabet Google YouTube DeepMind operation finds pesky laws enacted by nation-states annoying. YouTube is able to do what Ukraine cannot: Displace that which it finds annoying and a threat to its data collection and advertising efforts. Google is in a position to trigger social unrest in Russia by pulling out of the country’s datasphere. That’s power. What if YouTube were used to incite citizen unrest in Russia and maybe a couple of other countries?
Interesting idea and worth consideration by some I suppose.
Stephen E Arnold, August 8, 2022
Closing the COPPA Loophole
August 3, 2022
We need updated legislation to protect children from their own phones and tablets, according to the Washington Post, because “Your Kids’ Apps Are Spying on Them [paywall].” Reporter Geoffrey A. Fowler writes:
“Apps are spying on our kids at a scale that should shock you. More than two-thirds of the 1,000 most popular iPhone apps likely to be used by children collect and send their personal information out to the advertising industry, according to a major new study shared with me by fraud and compliance software company Pixalate. On Android, 79 percent of popular kids apps do the same. Angry Birds 2 snoops when kids use it. So do Candy Crush Saga and apps for coloring and doing math homework. They’re grabbing kids’ general locations and other identifying information and sending it to companies that can track their interests, predict what they might want to buy or even sell their information to others.”
The article elaborates on the problem with details from that Pixalate study and other research. It emphasizes:
“Children’s privacy deserves special attention because kids’ data can be misused in some uniquely harmful ways. Research suggests many children can’t distinguish ads from content, and tracking tech lets marketers micro-target young minds. This is why kids are at the center of one of America’s few privacy laws, the 1998 Children’s Online Privacy Protection Act, or COPPA. It said that companies aren’t supposed to gather personal information about kids under 13 without parental permission.”
So if COPPA prohibits this data grab, why is it happening? Because of the “actual knowledge” loophole. App makers must simply pretend they do not know children are using their software. Preschool-type games featuring cute cartoon animals? Grade 3 homework helpers? We are supposed to believe those are meant for ages 13 and up. To make matters worse, Apple’s and Google’s app stores make it difficult for parents to find apps that do comply with COPPA. Instead, due diligence means combing through each and every app’s obfuscatory privacy policies.
Fowler notes several ways tech companies could prohibit apps they sell from gathering data on children, if only they wanted to. Sadly, they are unlikely to put children over profits unless forced to by an updated COPPA. One has been proposed by Senator Ed Markey, one of original bill’s authors, and Representative Kathy Castor. Will this or a similar bill ever become law? Or have tech giants amassed so much power we cannot even protect our kids from data scroungers?
Cynthia Murrell,August 3, 2022
TikTok: Is Joe Rogan the Person to Blow the Whistle on Chinese Surveillance?
August 3, 2022
TikTok has been around since 2015 as A.me and Douyin. If you want to scrape below the shiny surface of the TikTok rags-to-riches story, there something called Musical.ly which surfaced in 2014. In 2018, the Musical.ly management team decided that selling to ByteDance was a super great idea. Then TikTok was created to entertain and log data. Few talk about the link to certain entities in the Chinese political structure. Even fewer think that short videos were bad. Sure, there were allegations of self harm, addiction, erosion of self worth, and students who preferred watching vids pumped at them by a magical algorithm. Nobody, including some Silicon Valley real news people with an inflated view of their intellectual capabilities said, “Yo, TikTok is a weaponized content delivery and surveillance system.” Nope. Just cute videos. What’s the problemo?
Who is now concerned about TikTok? The NSA? The CIA? The badge-and-gun entities in the US Federal government? Well, maybe. But the big voice is now a semi-real sports event announcer. “Joe Rogan Warns Americans about TikTok: China Knows Every … Thing You type.” Hey, Joe, don’t forget psychographic profiling to identify future insider operators, please.
The article reports:
Rogan listed the other data being collected by the popular platform. “‘User agent, mobile carrier, time zone settings, identifiers for advertising purpose, model of your device, the device system, network type, device IDs, your screen resolution and operating system, app and file names and types,’” he said. “So all your apps and all your file names, all the things you have filed away on your phone, they have access to that.” He continued: “‘File names and types, keystroke patterns or rhythms.’”
Hot intel, Mr. Rogan.
Where did this major news originate? From Mr. Rogan’s wellness infused research?
Nope. He read the terms of service.
The estimable newspaper pointed out:
… the tech news site Gizmodo reported that leaked internal documents from TikTok showed the extent to which the app sought to “downplay the China association.” The documents, labeled “TikTok Master Messaging” and “TikTok Key Messages,” detail the social media giant’s public relations strategy during a period of mounting scrutiny from regulators and lawmakers over its parent company ByteDance and its ties to the Chinese Community Party.
Gizmodo? Is this Silicon Valley type “real news” outlet emulating Cryptome.org?
According to the cited New York Post story:
TikTok has pledged to “publish insights about the covert influence operations we identify and remove from our platform globally to show how seriously we take attempts to mislead our community.”
That sounds good just like a cyber security firm’s PowerPoint deck. Talk, however, is not action.
Maybe Mr. Rogan can use his ring announcer voice to catch people’s attention? I am not sure some of the TikTok lovers will listen or believe what Mr. Rogan discovered in the super stealthy terms of service for TikTok.
That’s real open source intel. Put Mr. Rogan on a panel at the next OSINT conference, please. I mean TikTok has a 10 year history and it seems to be quite new to some folks.
Stephen E Arnold, August 3, 2022
Google and Kids: The School Push Squeezes Some New Concessions… Allegedly
August 1, 2022
I read “Chrome Use Subject to Restrictions in Dutch Schools over Data Security Concerns.” The write up reports:
Several schools and other educational organizations are having to restrict usage of Google’s software, including its Chrome browser and Chrome OS offerings over security and privacy fears. The Dutch Ministry of Education has ordered the country’s education industry to implement the changes following over fears that Google’s software is in conflict with the General Data Protection Regulation (GDPR) and other privacy-related regulations in the country.
I am not surprised. I noted that the article presents some familiar wordage; for example:
… The ministers discussed these issues with the representatives of Google, Microsoft, and Zoom, and that these companies assured the ministers that their future versions will be more transparent, and more compatible, with the country’s (and the EU bloc’s) privacy and data protection laws.
I like the “assured the ministers” phrase. It reminds me of “Senator, thank you for the question. I will forward the information to your office. And I am sorry, really, really sorry. We are constantly trying to improve.”
Improve what?
Well, in my opinion it is the collection of fine grained data, actionable intelligence, and insight into what those kiddies are doing. But that’s just my point of view. The giant technology firms just want to do good. No, really.
Do good.
Those assurances sparked an update to the original article and guess what?
… Chrome and Chrome OS are not banned in the education sector of the country, and that schools may continue using them provided that they perform certain actions themselves to strengthen data security and ensure student privacy.
Progress.
Stephen E Arnold, August 1, 2022
Surprise: NSO Group Pegasus Is in the News Again
July 28, 2022
On July 27, 2022, the winger wonder Pegasus cast a shadow over the desks of the House Intelligence Committee. The flapping of the mythical creatures wings could not be stilled. Gavel pounding, heavy breathing from lobbyists in the gallery, and convoluted statements by elected leaders did not cause the beastie to fly away. Nope. Pegasus with its NSO Group logo branded on its comely haunch was present. Even mythical creatures can leave behind a mess.
And it appears as if the mess is semi-permanent and odiferous.
“We’re Likely Only Seeing the Tip of the Iceberg of Pegasus Spyware Use Against the US” states:
US lawmakers heard testimony from Citizen Lab senior researcher John Scott-Railton; Shane Huntley, who leads Google’s Threat Analysis Group; and Carine Kanimba, whose father was the inspiration for Hotel Rwanda and who was, herself, targeted by Pegasus spyware. This, of course, is the now-infamous malware that its developer, Israel’s NSO Group, claims is only sold to legitimate government agencies — not private companies or individuals. Once installed on a victim’s device, Pegasus can, among other things, secretly snoop on that person’s calls, messages, and other activities, and access their phone’s camera without permission.
I like the Hotel Rawanda reference. Younger elected officials may not know much about intelware, but they definitely know about the motion picture in my opinion. Hutus Tutsis and a big box office. A target of Pegasus. Credibility? Yep.
The hearings continue of July 28, 2022. According to the article:
Schiff called NSO’s software and similar eavesdropping tools “a threat to Americans,” and pointed to news reports from last year about cellphones belonging to US diplomats in Uganda being compromised by Pegasus. It is my belief that we are very likely looking at the tip of the iceberg, and that other US government personnel have had their devices compromised, whether by a nation-state using NSO’s services or tools offered by one of its lesser known but equally potent competitors,” Schiff said.
Google — the go to source for objective information — is allegedly tracking 30 firms “that sell exploits or surveillance capabilities to government-backed groups.
Just 30? Interesting, but, hey, Google knows surveillance cold I suppose.
A handful of observations:
- NSO Group’s Pegasus continues to capture attention like a Kentucky Derby winner which allegedly has banned substances rubbed on its belly. Some of those rub ons have a powerful scent. Even a boozy race track veterinarian can wince when checking a specific thoroughbred’s nether region.
- The knock on effect of NSO Group’s alleged management oversight means that scrutiny of intelware companies is going to spotlight the founders, funders, and stakeholders. I think this is like a deer standing on railroad tracks mesmerized by the bright white light heading down the rails at 60 miles per hour. In the train versus deer competitions in the past, trains hold a decided advantage.
- Individual companies in the specialized software business face an uncertain future.
How uncertain?
Regulations and bans seem to be on the menus in a number of countries. Also, there are a finite number of big dollar contracts for specialized software and smaller firms are going to have to get big fast, sell out to a larger company with multiple lines of law enforcement, defense, and intelligence revenue, or find a way to market without marketing “too well.”
And the “too well”?
Since NSO Group’s spotlight appearances, smaller intelware companies have had to be very careful abut their sales and marketing activities. Why? There are reporters from big time newspapers nosing around for information. There are online podcasts which have guests who talk about what specialized software can do, where the data originate, and how a “food chain” of information providers provide high value information. There are the tireless contributors of Twitter’s #OSINT threads who offer sometimes dumb and less frequently high-value nuggets about specialized services vendors. Finally, there are the marketers at specialized services firms themselves who use email blasts to tout their latest breakthroughs. Other small specialized software vendors prowl the niche law enforcement and intelligence conferences in search of sales leads. In some cases, there are more marketers than there are individuals who can license a data set, an analytics package, or the whole enchilada needed to monitor — how shall I phrase it — comprehensively. These energetic marketers learn that their employer becomes a journalist’s subject of interest.
Net net: When I reflect on the golden years of specialized software and services marketing, testing, and deploying, I have one hypotheses: NSO Group’s visibility has changed the game. There will be losers and a very few big winners. Who could have foreseen specialized software and services working like a bet on the baccarat tables in Monaco? Who anticipated NSO Group-type technology becoming “personal” to the US? I sure did not. The light at the end of the tunnel, once the train clears the deer, is that the discipline of “marketing without marketing too much” may become mainstream in France, Germany, Israel, Switzerland, and the US. I hear that train a-comin’ do you?
Stephen E Arnold, July 28, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
