Tag: mass surveillance

UN pushes COP27 app that has ability to spy on private conversations and access encrypted texts

Security advisers from Western countries are warning delegates attending the COP27 climate summit not to download the Egyptian government’s official app. The app is supposed to help attendees of the event with navigation but has major privacy concerns – allowing the app to be used as a surveillance tool.

The app is recommended on the official UN website for the COP27.

POLITICO says a potential vulnerability was found by four different cybersecurity experts that reviewed it. The news outlet claims that the app can allow the Egyptian government to read users messages, emails, and even communications via encrypted messaging platforms like Signal and WhatsApp.

The app can track location through GPS and WiFi. It also requires a permission that could allow the government to spy on conversations even when the device is in sleep mode.

The app also gives the government back-door privileges to scan users’ devices.

Some experts said much of the access and data the app gets are fairly standard. Additionally, so far, there is no evidence that people’s messages and emails have been read or users’ location tracked.

The main problem is the combination of the access it has and the Egyptian government’s record with tracking. According to Privacy International, following the Arab Spring, the Egyptian government has cracked down on dissidents and used emergency rules to track citizens both online and offline.

Keep reading

White House to partner with social media monitoring tool

The Biden administration is about to sign a contract with Dataminr – a licensing deal for the company’s product that is used in the monitoring of social media.

This is revealed in documents published by the Defense Information Systems Agency (DISA) which will buy 30 licenses to deploy Dataminr’s First Alert V2, designed for the public sector and the scouring of 200,000 online sources and data mining, then compiling real-time news alerts for the White House, and other clients.

Dataminr is a popular tool used by news desks and others that want to monitor the internet and it’s easy to see why it would be useful to the government. Portions of the press show an unfavorable attitude towards Dataminr because it was used by police in many cities, including New York and Los Angeles, to monitor the 2020 Black Lives Matter protests and riots.

US Defense Department’s non-civilian employees already use Dataminr’s services thanks to a 2021 contract signed with the Air Force.

DISA said in June it had no plans to directly or in another way “involve” Twitter as a subcontractor. In August, this agency that handles the White House communications said it needed a contract (with Dataminr) of its own because civilians it employs cannot utilize mass surveillance of social media through that Air Force deal.

New York-based Dataminr, which is also known for its work as one of Twitter’s official partners and bills itself as an AI company, has been awarded the contract but the details, such as its duration and the overall cost of licensing have not been announced.

Meanwhile, it is speculated that Dataminr was chosen by the US administration precisely for its association with Twitter, as DISA spelled it out in the document explaining the choice of the vendor by saying it must be a certified Twitter partner.

Keep reading

The Quiet Merger Between Online Platforms and the National Security State Continues

The steady march of the post-2016 tech censorship campaign has been picking up pace lately, and we’ve just learned of another leap forward. According to recent major reporting from the Intercept, the US Department of Homeland Security (DHS) has been involved in efforts aimed at corralling what it refers to as “MDM”: misinformation, disinformation, and “malinformation.”

Documents obtained and made publicly available by the news outlet show that the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) has been formulating a strategy to combat MDM regarding US elections and other matters. While seemingly unobjectionable on the surface ― who could be against combating false information, which is rife online? ― it raises serious questions about the extent of government involvement in the already-troubling phenomenon of tech censorship.

The conversations detailed in the documents show the federal government, and the DHS specifically, taking a more active role in tech companies’ efforts to suppress MDM. We’ve had some indications this was happening for a while, as when DHS secretary Alejandro Mayorkas told Andrea Mitchell of MSNBC in August that the government was “working with the tech companies” on “strengthen[ing] the legitimate use of their very powerful platforms and prevent[ing] harm from occurring,” and that it was doing so “across the federal enterprise” ― comments that were only reported in right-wing media.

The documents give us details about what that work has entailed. In these discussions, the government did not directly carry out censorship. Rather, they involved government agencies: doing “debunking” and “pre-bunking”; directing the press, local and state governments, and other stakeholders to “trusted resources”; carrying out “rumor control”; boosting “trusted authoritative sources”; giving financial support to its external partners; and improving information literacy. Much of the focus is on elections, with participants talking about using these resources to prevent people being misled about how, where, and when to vote, and stressing that CISA should strictly be a “resource” that at most uses its “convening power.”

Keep reading

US citizens were given secret Covid “decree violation” scores

Voter analytics firm PredictWise harvested location data from tens of millions of US cellphones during the initial Covid lockdown months and used this data to assign a “Covid-19 decree violation” score to the people associated with the phones.

These Covid-19 decree violation scores were calculated by analyzing nearly two billion global positioning system (GPS) pings to get “real-time, ultra-granular locations patterns.” People who were “on the go more often than their neighbors” were given a high Covid-19 decree violation score while those who mostly or always stayed at home were given a low Covid-19 decree violation score.

Not only did PredictWise use this highly sensitive location data to monitor millions of Americans’ compliance with Covid lockdown decrees but it also combined this data with follow-up surveys to assign “Covid concern” scores to the people who were being surveilled. PredictWise then used this data to help Democrats in several swing states to target more than 350,000 “Covid concerned” Republicans with Covid-related campaign ads.

In its white paper, PredictWise claims that Democrats were able to “deploy this real-time location model to open up just over 40,000 persuasion targets that normally would have fallen off” for Mark Kelly who was running for Senate at the time and has now been elected.

“PredictWise understood that there were potential pockets of voters to target with Covid-19 messaging and turned high-dimensional data covering over 100 million Americans into measures of adherence to Covid-19 restrictions during deep lockdown,” the company states in the white paper.

PredictWise doesn’t provide the exact dates when this location data was collected but its white paper does note that the data was collected during Covid lockdowns and used during Senator Kelly’s 2020 election campaign. State-level US lockdowns began on March 15, 2020 and Kelly was elected on November 4, 2020 so the data appears to have been collected during the first few months of this 11 month period.

Keep reading

Google Employees Are Laughing at You for Thinking ‘Incognito Mode’ Is Private

According to a series of internal communications discovered in court, Google employees joked about Chrome’s “Incognito mode” and criticized the company for failing to meet users’ expectations of privacy.

Google is currently the target of a class action lawsuit in California over its misleading claims of privacy.

Court documents obtained by Bloomberg reveal that a Google engineer suggested in 2018 that the Incognito mode icon be changed to “Guy Incognito,” a Simpsons character who looks exactly like Homer Simpson except for his mustache. According to the Google employee, the character “accurately conveys the level of privacy [Incognito mode] provides” compared to Chrome’s standard browsing mode.

In a 2021 email, Google marketing chief Lorraine Twohill urged the implementation of a more secure Incognito mode as a means of gaining users’ trust.

“Make Incognito Mode truly private,” Twohill wrote. “We are limited in how strongly we can market Incognito because it’s not truly private, thus requiring really fuzzy, hedging language that is almost more damaging.”

Studies have shown that the language used by Google contributes to the misconception that “Incognito mode” is truly private.

“We found that browsers’ disclosures fail to correct the majority of the misconceptions we tested,” researchers at the University of Chicago and Leibniz University Hannover wrote in 2019. “These misconceptions included beliefs that private browsing mode would prevent geolocation, advertisements, viruses, and tracking by both the websites visited and the network provider.”

Keep reading

Firearms dealers now required to provide buyers’ addresses to feds for denied transactions

As part of a sweeping change that has gun rights groups alarmed, federally licensed firearms dealers (FFLs) are now required to provide the FBI with the personal addresses of individuals whose attempted purchases were denied.

In turn, the FBI must now provide details of the failed transactions — not only those denied but also those just delayed — and the personal information of the rejected individuals to local law enforcement, raising fears of greater government infringement on the Second Amendment.

The changes were quietly implemented last week by the FBI’s National Instant Criminal Background Check System (NICS) to comply with new federal law. NICS was established to determine if an individual is prohibited by law from receiving firearms and can either approve, deny, or delay a firearms purchase.

In March, Congress passed and President Biden signed a massive appropriations package for fiscal year 2022 that included the Violence Against Women Act Reauthorization Act (VAWA). Tucked into the VAWA was a bipartisan measure called the NICS Denial Notification Act, which mandates that the FBI’s NICS Section alert state and local law enforcement of all denied attempts to purchase a firearm within 24 hours.

The stated purpose of the bill is to stop criminals and prevent gun crimes before they happen.

Keep reading

The US edges closes to passing digital ID legislation

The Senate Homeland Security and Governmental Committee has approved the Improving Digital Identity Act, a legal framework for digital ID systems for US citizens.

We obtained a copy of the bill for you here.

The House Oversight and Reform Committee already voted to pass the legislation in July.

The Improving Digital Identity Act is a bipartisan bill sponsored by Senators Cynthia Lummis (R-Wyo.) and Kyrsten Sinema (D-Ariz.). It aims to create a public-private digital identity task force tasked with “improving” digital ID verification systems in government agencies.

The legislation would also allow the Department of Homeland Security to award grants for advancements to digital identity verification systems. Territorial, tribal, local, and state governments would be eligible to receive funding for the establishment of interoperable and secure digital ID systems.

The legislation would also require the Government Accountability Office (GAO) to provide Congress with reports on the cost savings of the wide use of digital ID systems.

Critics of digital ID systems say such systems raise privacy concerns. Supporters of these systems argue that they will help prevent identity fraud and improve economic activity by providing secure online transactions.

Keep reading

We Can’t Hear You? Public Buses Across Country Quietly Adding Microphones To Record Passenger Conversations

Transit authorities in cities across the country are quietly installing microphone-enabled surveillance systems on public buses that would give them the ability to record and store private conversations, according to documents obtained by a news outlet.

The systems are being installed in San Francisco, Baltimore, and other cities with funding from the Department of Homeland Security in some cases, according to the Daily, which obtained copies of contracts, procurement requests, specs and other documents.

The use of the equipment raises serious questions about eavesdropping without a warrant, particularly since recordings of passengers could be obtained and used by law enforcement agencies.

It also raises questions about security, since the IP audio-video systems can be accessed remotely via a built-in web server (.pdf), and can be combined with GPS data to track the movement of buses and passengers throughout the city.

According to the product pamphlet for the RoadRecorder 7000 system made by SafetyVision (.pdf), “Remote connectivity to the RoadRecorder 7000 NVR can be established via the Gigabit Ethernet port or the built-in 3G modem. A robust software ecosystem including LiveTrax vehicle tracking and video streaming service combined with SafetyNet central management system allows authorized users to check health status, create custom alerts, track vehicles, automate event downloads and much more.”

The systems use cables or WiFi to pair audio conversations with camera images in order to produce synchronous recordings. Audio and video can be monitored in real-time, but are also stored onboard in blackbox-like devices, generally for 30 days, for later retrieval. Four to six cameras with mics are generally installed throughout a bus, including one near the driver and one on the exterior of the bus.

Keep reading

New Zealand expands surveillance network that was used to hunt down three Covid-positive women

The surveillance networks that New Zealand police used to hunt down three Covid-infected women are being rolled out in other parts of the country.

Police have taken advantage of tapping into a surveillance system run by two private companies, allowing them to access thousands of cameras that are constantly scanning and documenting car number plates, even when they don’t own the cameras.

Police issued new rules about the use of automated number plate recognition (ANPR) cameras last week.

We obtained a copy of the rules for you here.

New Zealand police have spent years pushing for the development of a second privately-owned network of almost 5000 CCTV cameras owned by businesses, local governments, and more – all that is accessible by police officers through the use of a simple app.

The approach, similar to new proposals in San Francisco, joins the public law enforcement tools with private surveillance and raises extensive privacy concerns.

Further, the new law that allows this also shields police from liability for data breaches.

Keep reading