BBC: Darkode hacking forum forced offline

By Leo KelionTechnology desk editor  BBC

15 July 2015
From the sectionTechnology

The Darkode forum, which was created about six years ago, can no longer be accessed
Darkode - a notorious hacking forum used by Lizard Squad and other cybercriminals - has been shut down after an investigation carried out by authorities in 20 countries.
"We have dismantled a cyber-hornets' nest... which was believed by many, including the hackers themselves, to be impenetrable," said one of the US state attorneys involved.

Twenty-eight people have been arrested.

They include a 26-year-old man from Coventry, England.

In addition, the UK's National Crime Agency said an address in Paisley, Scotland, had been searched and material removed for examination. It said that five other suspected members of the site had previously been arrested.

The FBI added that dozens of other people linked to the site had been charged or had their property searched as part of the inquiry.

Restricted access
Darkode's members allegedly used the site to trade and to share hacking tools and information, including details of zero-day attacks - techniques that exploited flaws in products that neither their creators nor the wider security industry were aware of, and thus could not be protected against.

This information was password-protected.

"Only those proposed for membership by an existing user could join, but not until they posted a resume of the skills and achievements that could contribute to the criminal community," explained the NCA.

"There was a hierarchical membership structure, and the status of users determined who they could communicate with, and their access to the commodities and services on offer."

Although the site was not accessible to the general public, it was profiledextensively by the security blogger Brian Krebs, who posted several screenshots on his site.

Botnets - networks of hijacked computers used to mount co-ordinated attacks - were promoted on the site
"Most of the cybercrime forums are in Russian or some other language that's not English, but this was an English-language forum," he told the BBC.

"And it was a sort of meeting ground for cybercriminals from different nationalities and languages.

"A fairly significant number of people were selling botnet services there, and there were also services for deploying malware and phishing."

He added that the forum's visitors included members of Lizard Squad - a group of hackers which has carried out high-profile attacks on Sony, Microsoft and others.

"The guy that was most recently the admin of the forum used the nickname Sp3c," Mr Krebs recalled.

"He was a leading member of the Lizard Squad. What's interesting is that you don't see his name in the lists of those that were apprehended or charged as part of this.

"I don't really know what that means, but there was a definite connection between the Lizard Squad and this forum, at least in the last year or so."

The FBI said that Operation Shrouded Horizon had indicated up to 300 people had used the forum.

"During the investigation, the bureau focused primarily on the Darkode members responsible for developing, distributing, facilitating and supporting the most egregious and complex cybercriminal schemes targeting victims and financial systems," it said.

It added that its counterparts in Australia, Bosnia, Brazil, Israel, Colombia and Nigeria were among those involved in the international crackdown, and that efforts to trace other suspects were "ongoing".

Supreme Court declares warrantless searches of hotel registries illegal

Data included credit card, home address, driver's license, and vehicle license.


by David Kravets - Jun 22, 2015 11:00am PDT  Ars Technica


Todd Lappin

The Supreme Court gave a big boost to privacy Monday when it ruled that hotels and motels could refuse law enforcement demands to search their registries without a subpoena or warrant. The justices were reviewing a challenge to a Los Angeles ordinance requiring hotels to provide information to law enforcement—including guests' credit card number, home address, driver's license details, and vehicle license number—at a moment's notice. Similar ordinances exist in about a hundred other cities stretching from Atlanta to Seattle.

Los Angeles claimed the ordinance (PDF) was needed to battle gambling, prostitution, and even terrorism, and that guests would be less likely to use hotels and motels for illegal purposes if they knew police could access their information at will.

Justice Sonia Sotomayor, writing for the 5-4 majority, ruled (PDF) that the Los Angeles ordinance violated the Fourth Amendment and is an illegal "pretext to harass hotel operators and their guests."

"Even if a hotel has been searched 10 times a day, every day, for three months, without any violation being found, the operator can only refuse to comply with an officer’s demand to turnover the registry at his or her own peril," Sotomayor wrote.

Enlarge

The hotel operators who brought the challenge faced six months in jail and a $1,000 fine for refusing to comply.

But the decision doesn't mean that hotel operators are forbidden from divulging the information upon demand if they choose to do so, the majority ruled.

"To be clear, we hold only that a hotel owner must be afforded an opportunity to have a neutral decision maker review an officer's demand to search the registry before he or she faces penalties for failing to comply. Actual review need only occur in those rare instances where a hotel operator objects to turning over the registry," Sotomayor wrote.

Justice Antonin Scalia, writing for the dissent, said that "The law is constitutional in most, if not all, of its applications." He scoffed at Sotomayor saying the authorities should get a subpoena or warrant to acquire such information, which Los Angeles requires hotels to keep for at least 90 days. He said Monday's majority decision would hinder sex trafficking and human smuggling investigations, too.

"This proposal is equal parts 1984 and Alice in Wonderland," he wrote.

Sotomayor was joined by Justices Anthony Kennedy, Ruth Bader Ginsburg, Stephen Breyer, and Elena Kagan.

The case is the third high-profile Fourth Amendment decision the court has issued in three years. In 2012, the justices ruled that authorities generally need search warrants when they affix GPS devices to vehicles. And last year, the justices ruled that the authorities need warrants to peek into the mobile phones of suspects they arrest.

In the case decided Monday, Los Angeles hoteliers argued that the law violated their rights, and the San Francisco-based 9th US Circuit Court of Appeals agreed in 2013. The city of Los Angeles appealed, arguing (PDF) that the ordinance helps both local and federal authorities in investigations of all types. The case's briefs can be viewed here.

US House passes Bill to end domestic NSA bulk data collection

Summary:American residents could soon be exempt from the NSA's dragnet, unless surveillance is approved by the secretive FISA court, with the USA Freedom Act passing the US House of Representatives and heading to the Senate.

By Chris Duckett | May 14, 2015 -- 07:04 GMT (00:04 PDT)
ZDNet

The US House of Representatives has voted 338 for and 88 against ending the NSA's dragnet collection of telephone, email, and other online data from millions of Americans, a controversial program that was revealed in 2013 by former security contractor Edward Snowden.

The USA Freedom Act is seen as a big win for privacy and civil rights advocates. The White House backs the reforms, saying the Bill protects privacy while preserving essential national security authorities.

After passing the House, the measure is now heading for a vote in the Senate, where the clash between reformists and supporters of the intelligence community, coming within the context of warnings on the increasing digital reach of the Islamic State terror group, transcends party lines.

Both liberals and staunch conservatives, often at odds on most major legislation, have united in opposition against domestic spying by the National Security Agency.

The Bill, which focuses on people in the US and not overseas, would amend controversial sections of the USA Patriot Act, which was passed in the wake of the September 11, 2001, attacks and will expire on June 1.

The reforms scrap the bulk collection detailed in Section 215 of the Patriot Act, replacing it with a targeted program that allows intelligence agencies to collect data from specific individuals or groups, but only with prior approval of the secret national security FISA court.


Under Section 215, the government stored the acquired data, but the new reforms would compel telcos and other data companies to keep the information to be accessible to intelligence agencies only through court order.The data dragnet was operating in complete secrecy after 2001, and has been under the supervision of the FISA court since 2006. It was consistently renewed by the administrations of George W Bush and Barack Obama.

"Today's vote was a major win for surveillance reform and a major rebuke for those who want to reauthorise the Patriot Act without change," said Center for Democracy & Technology president Nuala O'Connor.

Passage through the House was welcomed by Mozilla, whose head of public policy Chris Riley called for the Senate to swiftly pass the legislation.

"This legislation significantly curtails bulk collection under the Patriot Act and other authorities, and puts us on a path to a more private and secure internet," Riley said.

"We are staunchly opposed to any short- or long-term reauthorisation of these sections of the Patriot Act absent meaningful reforms. Now is not the time to delay on these much-needed reforms."

The Electronic Frontier Foundation (EFF) said US business is being hurt by the NSA's actions, and it hopes the Senate will add amendments to strengthen the Bill.

"The legislation is a good start to shutting backdoors," the EFF said. "The time to fix the backdoor problem is now."

The vote came just a week after a US appeals court ruled that the bulk data collection goes far beyond what congress authorised.

"The text of [section 215] cannot bear the weight the government asks us to assign to it, and that it does not authorize the telephone metadata program," wrote judge Gerard E Lynch last week.

Earlier this month, the French lower house approved legislation allowing authorities to spy on suspected terrorists without prior authorisation from a judge.

The new law, to go before the French Senate later this month, allows authorities to spy on the digital and mobile communications of anyone linked to a "terrorist" inquiry without judicial authorisation, and forces internet service providers and phone companies to give up data upon request.

Intelligence services will have the right to place cameras and recording devices in private dwellings and install keylogging devices.

As the US restricts some of its data surveillance schemes, Australia is in the midst of setting up its own data-retention scheme.

In this week's Australian Budget, AU$131 million was allocated by the government for the creation and maintenance of systems to store all Australians' telecommunications data for two years for warrantless access by law enforcement.

However, the money from the government is expected to cover only between one third and half of the cost to implement the scheme.

The Internet Society of Australia CEO Laurie Patton said the government should guarantee to top up the funding if it is inadequate for all ISPs.

"The government's original cost estimate was not based on widespread industry consultation, and the Internet Society is concerned that the costs have been significantly underestimated, especially in respect of small to medium-sized ISPs that don't have the resources to undertake the work in-house, and therefore will be required to pay for external assistance," he said in a statement.

BBC: Staff-tracking app faces legal scrutiny in US

BBC

The woman is alleging that an app which tracks movements 24/7 invaded her privacy
A US sales executive is suing her employer for invasion of privacy, alleging that she was fired after deleting an app which tracked her movements.
The action alleges that Intermex, a firm which arranges money transfers, tracked employees even when off-duty.

Myrna Arias alleges that she was "scolded" for removing the app and fired a few weeks later.

The company has not responded to the allegations.

According to court documents published by website Ars Technica, employees were instructed to download the app, called Xora, to their phones in April 2014.

Xora is described on its website as a workplace management app which allows companies to "remotely manage" their workers by keeping track of their hours and other aspects of their job.

Xora's website says that the app uses GPS to allow bosses "to see the location of every mobile worker on a Google Map".

According to the lawsuit, Ms Arias's manager "admitted that employees would be monitored while off-duty and bragged that he knew how fast she was driving at specific moments ever since she had installed the app on her phone".

"He confirmed that she was required to keep her phone's power on 24/7 to answer phone calls from clients," reads the court document.

It goes on to detail that Ms Arias had "no objection" to being monitored at work but felt that monitoring her location during non-work hours was an invasion of her privacy.

She likened the app to a prisoner's ankle bracelet.

Tracking employees
Her boss "scolded the plaintiff when she de-installed the app in late April in order to protect her privacy", reads the court document.

She was fired on 5 May.

Ms Arias is seeking damages for lost earnings in excess of $500,000.

Mark Weston, a partner at law firm Matthew Arnold & Baldwin, tod the BBC that an employer "would not be allowed to track an employee without the consent of that employee".

Clauses that allow for tracking apps would have to be built into contracts, he said.

As for the legality of firing an employee for refusing to use such an app, Mr Weston said: "In the US, things may be looser because many employees there are employees 'at will'. Accordingly, employers have far greater flexibility than in Europe to dismiss an employee who is not playing ball."

Warrants not required for police to get your cell phone cell-site records

Mobile callers' cell-tower history is fair game for cops—probable cause unnecessary.

by David Kravets - May 5, 2015 3:25pm PDT  ars technica


Michael Dorausch

A federal appeals court ruled Tuesday that the government does not need a warrant to obtain a suspect's cell-site location data records.

The 9-2 decision (PDF) by the 11th US Circuit Court of Appeals said that the records of towers that a mobile phone uses to make calls are considered "business records" maintained by a "third party" and are not protected by the Fourth Amendment. That means the government may obtain these records if it believes they are relevant to an investigation.

The case concerns a Florida man, Quartavious Davis, who was sentenced to life in prison for a string of robberies in a prosecution that was built with the suspect's cell site records.

...Davis can assert neither ownership nor possession of the third-party’s business records he sought to suppress. Instead, those cell tower records were created by MetroPCS, stored on its own premises, and subject to its control. Cell tower location records do not contain private communications of the subscriber. This type of non-content evidence, lawfully created by a third-party telephone company for legitimate business purposes, does not belong to Davis, even if it concerns him. Like the security camera surveillance images introduced into evidence at his trial, MetroPCS’s cell tower records were not Davis’s to withhold. Those surveillance camera images show Davis’s location at the precise location of the robbery, which is far more than MetroPCS’s cell tower location records show.

The majority ruling by Judge Frank Hull is a big boost to the government. Warrantless cell-site tracking has become among the government's preferred methods of electronically tracking suspects in the wake of a 2012 Supreme Court ruling that the authorities generally needed a warrant to attach GPS devices onto vehicles and track their every move.

Meanwhile, the Atlanta-based appeals court had ruled the opposite way last year by a vote of 2-1. But the 11th Circuit revisited the case with a larger panel of 11 judges at the government's request. The outcome brings the number of appellate courts that have ruled for the authorities to four. There are 13 appeals courts nationwide. None have gone the other way. Without conflicting rulings, the US Supreme Court might not take up the issue any time soon.

In all the decisions, the appellate courts cited analog-aged 1979 US Supreme Court precedent, known as Smith v. Maryland, that allows the government's telephone metadata snooping program that Edward Snowden exposed.

Orin Kerr, a former federal prosecutor and a Fourth Amendment expert, said he agreed with the court's ruling—to an extent.

Granted, I want there to be a circuit split to get the case up to the Supremes. That leaves me in an odd position: Although I think a judge should follow Smith, I also kinda want a lower court to not follow precedent in order to tee up the issue for the Supreme Court.
The 11th Circuit originally decided in June that a warrant was required because the public had a reasonable expectation of privacy in their public movements.

"Thus, the exposure of the cell site location information can convert what would otherwise be a private event into a public one. When one’s whereabouts are not public, then one may have a reasonable expectation of privacy in those whereabouts," the court ruled. (PDF)

But what a different a larger panel of judges makes when it comes to deciding the constitutionality of so-called § 2703(d) orders:

The stored telephone records produced in this case, and in many other criminal cases, serve compelling governmental interests. Historical cell tower location records are routinely used to investigate the full gamut of state and federal crimes, including child abductions, bombings, kidnappings, murders, robberies, sex offenses, and terrorism-related offenses.

Such evidence is particularly valuable during the early stages of an investigation, when the police lack probable cause and are confronted with multiple suspects. In such cases, § 2703(d) orders—like other forms of compulsory process not subject to the search warrant procedure—help to build probable cause against the guilty, deflect suspicion from the innocent, aid in the search for truth, and judiciously allocate scarce investigative resources.
For the two-judge dissent, Judge Beverly Martin wrote:

"While I admire the majority’s attempt to cabin its holding to the technology of five years ago, its assurances in this regard seem naïve in practice. As a result of today’s decision, I have little doubt that all government requests for cell site location data will be approved, no matter how specific or invasive the technology."
The MetroPCS records at issue in the case were from August 1, 2010 to October 6, 2010. The defendant, Davis, made roughly 86 calls a day.

The data included the telephone numbers of calls made by and to Davis' mobile phone; whether a call was outgoing or incoming; the date, time and duration of calls. The key dispute in this case concerned other data that was turned over. That included the number assigned to the cell tower that wirelessly connected the calls from and to Davis, and the sector number associated with the tower.

Davis' attorney, Nathan Freed Wessler of the American Civil Liberties Union, said that the "dissenting judges recognized outdated legal doctrines from the analog age should not be mechanically extended to undermine our privacy rights in the voluminous digital records that come with modern life."



David Kravets / The senior editor for Ars Technica. Founder of TYDN fake news site. Technologist. Political scientist. Humorist. Dad of two boys. Been doing journalism for so long I remember manual typewriters with real paper.

Mountain of Electrical Waste Reaches New Peak

APR 19, 2015 09:55 AM ET // BY AFP  Discovery


Less than one-sixth of all e-waste is properly recycled.
A record amount of electrical and electronic waste hit the rubbish tips in 2014, with the biggest per-capita tallies in countries that pride themselves on environmental consciousness, a report said Sunday.

Last year, 41.8 million tons of so-called e-waste -- mostly fridges, washing machines and other domestic appliances at the end of their life -- was dumped, it said.

Stop Making Trash: How To Go Garbage Free

PLAY VIDEO

Where Does Our Garbage Go?

Researchers at the Massachusetts Institute of Technology have figured out how to track trash. They are doing this to get a better sense of people's disposal habits, which they hope will improve recycling efforts.

That's the equivalent of 1.15 million heavy trucks, forming a line 23,000 kilometers (14,300 miles) long, according to the report, compiled by the United Nations University, the UN's educational and research branch.

Less than one-sixth of all e-waste was properly recycled, it said.

In 2013, the e-waste total was 39.8 million tons -- and on present trends, the 50-million-ton mark could be reached in 2018.

Topping the list for per-capita waste last year was Norway, with 28.4 kilograms (62.5 pounds) per inhabitant.

It was followed by Switzerland (26.3 kg per capita), Iceland (26.1 kilos), Denmark (24.0 kilos), Britain (23.5 kilos), the Netherlands (23.4 kilos), Sweden (22.3 kilos), France (22.2 kilos) and the United States and Austria (22.1 kilos per person each).

The region with the lowest amount of e-waste per inhabitant was Africa, with 1.7 kilos per person. It generated a total of 1.9 million tons of waste.

In volume terms, the most waste was generated in the United States and China, which together accounted for 32 percent of the world's total, followed by Japan, Germany and India.

Waste that could have been recovered and recycled was worth $52 billion (48.5 billion euros), including 300 tons of gold -- equal to 11 percent of the world's gold production in 2013.

But it also included 2.2 million tons of harmful lead compounds, as well as mercury, cadmium and chromium, and 4,400 tons of ozone-gobbling chlorofluorocarbon (CFC) gases.

"Worldwide, e-waste constitutes a valuable 'urban mine' -- a large potential reservoir of recyclable materials," UN Under Secretary-General David Malone said.

"At the same time, the hazardous content of e-waste constitutes a 'toxic mine' that must be managed with extreme care."

Almost 60 percent of e-waste by weight came from large and small kitchen, bathroom and laundry appliances.

Seven percent was generated by thrown-out mobile phones, calculators, personal computers and printers.

BBC: High price of '.sucks' to be investigated

13 April 2015 BBC

Vox Populi says its prices for ".sucks" website names are "well within the rules"

The authority that decides which letters a web address is allowed to finish with says it is concerned at the high charges for the new ".sucks" name.

The Internet Corporation for Assigned Names and Number (Icann) has asked the US and Canadian trade authorities to investigate Vox Populi, which secured the rights to sell the name.

The company denies any wrongdoing.

Many companies and celebrities have bought their name with controversial suffixes such as ".porn" or ".xxx".

Predatory selling

The last part of a web address that follows the final dot, such as ".com", ".org", and ".net", is referred to as a generic top level domain (gTLD).

Icann relaxed the rules governing gTLDs in 2012, and the latest to go up for sale is ".sucks".

Many companies and celebrities buy their brand or name with various gTLDs, to avoid any confusion with their official website addresses or to stop others buying them and posting negative content.

Taylorswift.xxx has been reserved but not used, to prevent others from buying it

For example, singer Taylor Swift bought up taylorswift.xxx to prevent anyone else from using it.

Specialist online website Domain Incite reports that actor "Kevin Spacey, Microsoft, Google and Apple have already bought up '.sucks' sites in a bid to protect their reputations".

This practice is known as "defensive registering".

Icann granted Vox Populi permission to sell the ".sucks" names but is now concerned at the price levels the Canadian company has set.

Kevin Murphy, from Domain Incite, told the BBC two key elements of the way Vox Populi was handling the sale were causing concern.

"They are charging a $2,000 'sunrise' premium to those wishing to register '.sucks' addresses early, before the addresses go on sale to the general public [next month]," he said.

"Also they are using a list of words or names that have been defensively registered in the past, for which they are charging the top amount."

Mr Murphy said the company was working from a list of keywords that had been part of web addresses bought up early on in similar new domain web address sales and using that to decide which ".sucks" addresses to charge more for.

The base fee for any ".sucks" web address is $199 a year

New gTLDs such as ".rocks" or ".forsale" typically sell for between $5 (£3.42) and $20 a year.

Beyond jurisdiction

But Murphy said: "They [Vox Populi] are charging a much bigger amount that you'd expect.

"They were considering a fee of $25,000 at one point when we spoke to them.

"I think they are charging as much as they can get away with.

"It [Vox Populi] justified the $2,000 premium price tag [for certain '.sucks' addresses] as being 'a reasonable part of a company's PR budget'.

"It appears they are basing prices on what firms can afford not on the product services they are providing."

In a strongly worded letter to Icann, the authority's own advisory body, the Intellectual Property Constituency (IPC), demanded a "halt" to Vox Populi's "illicit", "predatory" and "coercive" selling scheme.

But even though Icann approved the ".sucks" domain name sale and issued the licence to sell the related website addresses, it appears not to have jurisdiction over how they are sold.

There is no evidence that Vox Populi has done anything wrong, and the company told Domain Incite its pricing and policies were "well within the rules".

Icann has referred Vox Populi to the two bodies it believes may have the regulatory authority to investigate the company's practices: the Federal Trade Commission in the United States and the Canadian Office of Consumer Affairs, as the company is registered in Canada.

But unless the company has broken the law, it is not clear what powers Icann has over Vox Populi's handing of the sale of ".sucks".

Mass surveillance case against UK government heads to Europe's highest court

Summary:Three human rights and privacy groups suing the British government against mass surveillance will have their case heard by the European Court of Human Rights.


By Zack Whittaker | April 10, 2015 -- 15:36 GMT (08:36 PDT)
ZDNet

RAF Menwith Hill in Yorkshire, UK, home to a surveillance base (Image: Wikimedia Commons)

A lawsuit aimed at challenging the UK government's mass surveillance programs has been filed with the highest human rights court in Europe.

The case, filed by Amnesty International, Liberty, and Privacy International on Wednesday, is now in the hands of the European Court of Human Rights after the groups said they "exhausted" all legal avenues in the UK.



As the Snowden leaks began, there was "fear and panic" in Congress

Just a few minutes after the first NSA leak was published, the phones of US lawmakers began to buzz, hours before most of America would find out over their morning coffee.
Read More
The suit aims to determine that the UK and US mass surveillance operations were in breach of Europe's human rights laws.

The joint application was submitted just weeks after the UK's Investigatory Powers Tribunal ruled that the UK intelligence agencies it oversees were not at the time breaching the laws. That decision was made because the UK government had by that point declassified how it was tapping the communications of millions of people, but noted that there was a prior lack of transparency.

However, the tribunal also found that the intelligence-sharing relationship between the UK and the US was unlawful prior to December 2014, because rules governing the UK's access to US mass electronic surveillance programs -- including the clandestine PRISM system -- were secret.

"It is ridiculous that the government has been allowed to rely on the existence of secret policies and procedures discussed with the Tribunal behind closed doors -- to demonstrate that it is being legally transparent," said Nick Williams, legal counsel for Amnesty International, in a statement Friday.

Although the case could go either way, the groups note that the Strasbourg court has a long history of pushing back on European member states' intelligence agencies, particularly when non-European countries are involved.



About Zack Whittaker

Zack Whittaker is a writer-editor for ZDNet, and sister sites CNET and CBS News. He is based in the New York newsroom. His PGP key is: EB6CEEA5.

BBC: Illegal downloading: Australia internet firms must supply data

7 April 2015
BBC

Thousands of Australians have illegally downloaded The Dallas Buyers' Club, starring Matthew McConaughey and Jared Leto

An Australian court has ordered internet service providers (ISPs) to hand over details of customers accused of illegally downloading a US movie.

In a landmark move, the Federal Court told six firms to divulge names and addresses of those who downloaded The Dallas Buyers Club.

The case was lodged by the US company that owns the rights to the 2013 movie.

The court said the data could only be used to secure "compensation for the infringements" of copyright.

In the case, which was heard in February, the applicants said they had identified 4,726 unique IP addresses from which their film was shared online using BitTorrent, a peer-to-peer file sharing network. They said this had been done without their permission.

Once they received the names of account holders, the company would then have to prove copyright infringement had taken place.

The judgment comes amidst a crackdown by the Australian government on internet piracy.

Australians are among the world's most regular illegal downloaders of digital content. The delay in release dates for new films and TV shows, and higher prices in Australia for digital content, have prompted many Australians to find surreptitious ways to watch new shows.

Australians are some of the world's most enthusiastic illegal downloaders

Deterrent

The ISPs involved in the case, including Australia's second-largest provider iiNet, said releasing customer information would be a breach of privacy and lead to what is known in the US as "speculative invoicing".

This is where account holders are threatened with court cases that could result in large damages unless smaller settlement fees are paid.

The ISPs argued also that the monetary claims which the US company, Dallas Buyers Club LLC, had against each infringer were so small "that it was plain that no such case could or would be maintained by the applicants".

But Justice Nye Perram ruled that the customer information could be released on condition it was only used to recover compensation for copyright infringement.

"I will also impose a condition on the applicants that they are to submit to me a draft of any letter they propose to send to account holders associated with the IP addresses which have been identified," he ruled.

Justice Perram said the ruling was also important for deterring illegal downloading.

"It is not beyond the realm of possibilities that damages of a sufficient size might be awarded under this provision in an appropriately serious case in a bid to deter people from the file-sharing of films," he said.

The case came to court after Dallas Buyers Club LLC contacted iiNet and other ISPs, asking them to divulge customer details without a court order. The ISPs refused.

The ISPs have yet to say if they will appeal against the court ruling.

Professor of Law at the University of Technology, Sydney, Michael Fraser said it was an important judgement for ISPs and customers.

"If this [judgement] is upheld then the days of anonymous pirating may be over," Prof Fraser told ABC TV.

U.S. Internet users pay more and have fewer choices than Europeans

Areas of service rarely overlap between Internet providers

By Allan Holmesemail Chris Zubak-Skeesemail
5:00 am, April 1, 2015 Updated: 5:00 am, April 1, 2015

Center for Public Integrity

More than a quarter of Americans cannot go online at home to check their children’s grades at school, apply for jobs, pay bills or research health issues. They don’t have what has become a crucial service for participation in modern society: Internet service at home.

The proportion of households with Internet service had been rising steadily for decades, according to the Pew Research Center, until the past few years when the adoption rate slowed.

One reason? The high cost of broadband and the lack of competition that leads to those high prices.

A Center for Public Integrity analysis of Internet prices in five U.S. cities and five comparable French cities found that prices in the U.S. were as much as 3 1/2 times higher than those in France for similar service. The analysis shows that consumers in France have a choice between a far greater number of providers — seven on average — than those in the U.S., where most residents can get service from no more than two companies. The Center’s analysis echoes the findings of several studies on Internet pricing disparities worldwide.

By mapping the service areas of U.S. providers, The Center for Public Integrity also found that telecommunications companies appear to carve up territory to avoid competing with more than one other provider.

Higher broadband prices don’t just mean fewer dollars in Americans’ wallets at the end of every month. They make it difficult for low- to middle-income families to afford fast Internet service, which has become a necessity for job training, education, health care.

According to data in a report by the U.S. National Technology and Information Administration, more than 8 percent of U.S. households say they cannot afford broadband. President Barack Obama this year called for faster, more affordable Internet service for everyone.

“Just like we today expect clean running water, sewage and electricity as essential, so is broadband necessary to partake in society, to interact with government, to learn, to inform and be informed, to be a fully functioning member of society,” said Rudolf van der Berg, a telecommunications and broadband policy analyst who studies policy at the Organisation for Economic Co-operation and Development (OECD).

Many studies have been conducted looking at price and competition. The Center’s research isn’t as comprehensive. Rather, it’s a snapshot meant to show the state of broadband for some American cities. The high prices and lack of competition and in towns like these — and there are many — add to a growing divide between the connected and unconnected. And for the unconnected, the increasing gap will be measured in fewer economic opportunities, less access to healthcare and other inequities.

5 Domestic Smart Devices That Are Spying On You Right Now

Dan Price

On 30th March, 2015

MakeUseOf

A couple of weeks ago we experienced a media-wide furore over Samsung’s smart TVs potentially recording all your privately spoken words, with the company’s privacy policy advising owners not to disclose “personal or other sensitive information [because] that information will be among the data captured and transmitted to a third party through your use of Voice Recognition”.

Although Samsung quickly moved to quell fears by telling users that they could deactivate voice recognition or disconnect their TVs from their Wi-Fi network, the very fact that a such clause was inserted into the privacy policy in the first place should be disconcerting, if not downright frightening.

Smart TVs are far from being the only offenders, however. With Facebook recording our every click, Google tracking us around the web, and smartphones saving our locations on a worryingly frequent basis, we are increasingly living in an Orwellian dystopia. The advent of the smart home and the Internet of Things (IoT) is only exacerbating the problem, and there are now so many devices spying on us that they’re becoming ubiquitous.

Here we look at some of those devices, along with what exactly they’re recording, and who’s benefitting:

Sense

What is it?

Manufactured by Hello, the Sense device claims to be “the first system for understanding your sleep and bedroom”. It comes in two parts – a bedside device which monitors external factors such as noise, light, temperature, humidity and particles in the air, and a “Sleep Pill” which attaches to your pillow and monitors your movements and the quality of your sleep by using an accelerometer and gyroscope. It was one of the most-backed Kickstarter projects of last year.

Why should you be concerned?

The bedside device contains an “always-on” microphone, with all audio sent back to Sense’s cloud for easy playback by its owners. While eight hours of snoring might not be very interesting, there are an untold number of reasons why this is a privacy nightmare, with anything from personal details to the sound of two consenting adults being put into a space that the owner has no control over.

Most worrying? A glance at Hello’s privacy policy shows that the company takes no responsibility when it comes to deleting your information, saying:

“You agree that Hello has no responsibility or liability for the deletion of or failure to store any data or other content maintained or uploaded by the service.”

It means that if you accidentally discuss your finances, reveal your personal data, or discuss other sensitive topics, that audio could be stored in the cloud for a long, long time.

LG Smart Thinq Fridge

What is it?

It’s that thing in the corner of your kitchen that you keep food (or beer) in…!

On a serious note, the fridge aims to take over everything to do with cooking and preparing meals. It’ll tell you what’s inside it, help to create shopping lists, inform you when expiration dates are approaching, suggests recipes, sync with your smartphone, and even tell you the weather.

Why should you be concerned?

In order to function effectively, smart fridges need to connect to your Wi-Fi network, and that means that they can be commandeered by hackers and criminals. In fact, Dawn Meyerriecks, the Deputy Director of the CIA’s Directorate of Science and Technology recently told the Aspen Security Centre Forum in Colorado that “Smart refrigerators have been used in distributed denial of service attacks”, and claimed that “At least one smart fridge played a role in a massive spam attack last year, involving more than 100,000 Internet-connected devices and more than 750,000 spam emails”.

This raises wider concerns about security within the Internet of Things. The nature of the sector means access points are going to grow exponentially over the coming years, and while a typical home user might currently have less than ten access points that need to be secured, the IoT could expand that number into the hundreds. Without adequate security, everything from your fridge to your in-car entertainment system could become a potentially exploitable route into your personal data and information.

MyLink

What is it?

MyLink is a product by American car manufacturer Chevrolet that aims to turn a normal vehicle into a smart vehicle. It provides drivers with hands-free control of the hi-fi, an ability to access phone contacts, and access to SiriusXM. That’s all great. What’s less great from a privacy perspective is its built-in data grabber, enticingly called “Valet Mode with Performance Data Recorder.”

Why should you be concerned?

“Valet Mode” allows you to monitor you own car remotely, while the “Performance Data Recorder” and tracks data such as GPS location, speed, RPM, gears, and distance driven. The concerning part is that its privacy policy entitles Chevrolet to profile driving activity and sell it in an “anonymous and aggregated form” to third parties – meaning other companies will have access to how and where you drive. Could this information eventually find its way into the hands of the police? Possibly. For example, is it that hard to imagine cloud-based speeding tickets in the not-to-distant future?

iSmart Alarm

What is it?

The iSmart Alarm is a cloud-based, real-time, “intelligent”, home security system. It was founded out of Silicon Valley back in 2012 and has gone on to win multiple awards from publications such as CNet and PC Mag. It offers on-demand video streaming from around your home, control of all your electrical outlets, instant notifications of intruders, control over your lighting, and remote control management of the system.

Why should you be concerned?

The idea of streaming video of your empty house to the Internet should instantly ring alarm bells. Where is the data stored? Who has access to it? Could criminals determine your movements to establish a pattern of whether or not you’re at home? Would the alarm manufacturer also be notified if you got a notification about an intrusion?

Concerns of this nature extend to all “smart systems” in the home. For example, would the manufacturer of a Wi-Fi based entertainment system be able to get information about your choice of audio? Would energy companies ultimately get access to data provided by your smart thermostat, allowing them to hike their rates if they know you’re using the air conditioning?

Xbox Kinect

What is it?

Xbox Kinect is an add-on for Microsoft’s Xbox gaming console. It uses a camera to monitor and record a player’s movements, enabling them to both interact with Windows, games and issue spoken commands. It was originally Microsoft’s response to the popularity of the Nintendo Wii, but has since become an integral part of Microsoft’s entertainment product suite.

Why should you be concerned?

Originally, it was Microsoft’s intention to make it an “always-on” device, but users were not happy. It’s no surprise, and it’s all because of the power of the device’s camera. As the company itself boasts:

“Microsoft’s Xbox One system has a high-definition camera that can monitor players at thirty frames per second. Using a technology called Time of Flight, it can track the movement of individual photons, picking up minute alterations in a viewer’s skin colour to measure blood flow, then calculate changes in heart rate. The software can monitor six people simultaneously, in visible or infra-red light, charting their gaze and their basic emotional states”.

Are you comfortable with Microsoft knowing your emotional state at any given moment? Probably not…

Who is Benefiting?

As with almost everything privacy related, two main groups of people stand to benefit: advertisers and criminals.

While it is true that all the gadgets naturally aim to bring benefits to the user – be those entertainment benefits, practical benefits, or health benefits – all the gadgets we listed also offer clear benefits to manufacturers and advertisers. The manufacturer can collect user data and sell it to third parties, who can then use it to build up a consumer profile of your likes and dislikes – serving you differing adverts depending on your preferences, your mood, or what time of day it is. Ultimately, it means both parties are making a lot of money off your usage of their products.

A further consequence of all this connectivity is that criminals can also benefit. Home networks and company infrastructure can be hacked and exploited, identities can be stolen, and malware and computer viruses can be spread. Why do they do this? The same reason as the companies themselves. Money. Your data is hugely valuable in both the corporate world and criminal underworld. Legal and illegal groups are both willing to go to extreme lengths to get their hands on it.

What do you think?

Is it worth knowing how much milk you’ve got left or how frequently you woke up during the night in order to expose yourself to these risks?

Are some of these smart gadgets really designed with the user in mind, or are they strategies developed by corporate entities to exploit us in every way possible? Do we actually need a car that tells us the average RPM during our last journey?

We’d love to hear your thoughts, you can leave your feedback in the comments below.

Image Credits: Woman tasting smell her meal Via Shutterstock

BBC: Wikimedia Foundation sues NSA over surveillance

10 March 2015 Last updated at 07:53 ET BBC

The extent of NSA surveillance has been revealed by whistle-blower Edward Snowden
The NSA's mass surveillance programme violates US laws on freedom of speech, alleges a lawsuit begun by the Wikimedia Foundation.
The legal action has been filed against the spy agency and the US Department of Justice.

The legal action, co-signed by eight other organisations, seeks to end the NSA's large-scale surveillance efforts.

The Foundation is the non-profit group that oversees the running of the Wikipedia online encyclopedia.

The Wikmedia Foundation said it was taking action against the NSA's so-called "upstream" surveillance work which targets communication with people not in the US.

Such spying violates US laws on free speech and those that govern against unreasonable search and seizure, it said.

The scale of the monitoring carried out by the NSA has been revealed in documents made public by whistleblower Edward Snowden over the last two years. Some of those papers show the NSA tapped the net's backbone network to siphon off data. The backbone is made up of high-speed cables that link big ISPs and key transit points on the net.

"By tapping the backbone of the internet, the NSA is straining the backbone of democracy," said Lila Tretikov, executive director of the Wikimedia Foundation, in a blogpost announcing the legal action.

Targeting the backbone means the NSA casts a "vast net" and inevitably scoops up data unrelated to any target and will also include domestic communications, violating the rules governing what the NSA can spy on, said Ms Tretikov.

Information in the Snowden papers revealed that Wikipedia has been explicitly targeted, said the blogpost.

"By violating our users' privacy, the NSA is threatening the intellectual freedom that is central to people's ability to create and understand knowledge," said Ms Tretikov.

In an accompanying editorial published in the New York Times, Wikipedia founder Jimmy Wales said he hoped the lawsuit would bring an "end to the NSA's dragnet surveillance of Internet traffic".

Other organisations joining the lawsuit include Human Rights Watch, Amnesty International USA, the National Association of Criminal Defence Lawyers and the Global Fund for Women.

The NSA and DoJ have yet to comment on the legal action.

BBC: Lenovo taken to task over 'malicious' adware

19 February 2015 Last updated at 07:30 ET

Share this page

• Print

• Share
• Facebook
• Twitter

By Jane WakefieldTechnology reporter  BBC

A security expert said Lenovo had betrayed users' trust

Continue reading the main story

Related Stories

• Lenovo profits beat expectations
• Android adware 'infects millions'

Computer maker Lenovo has been forced to remove hidden adware that it was shipping on its laptops and PCs after users expressed anger.

The adware - dubbed Superfish - was potentially compromising their security, said experts.

The hidden software was also injecting adverts on to browsers using techniques more akin to malware, they added.

Lenovo faces questions about why and for how long it was pre-installed on machines - and what data was collected.

The company told the BBC in a statement: "Lenovo removed Superfish from the preloads of new consumer systems in January 2015. At the same time Superfish disabled existing Lenovo machines in the market from activating Superfish.

Complaining

"Superfish was preloaded on to a select number of consumer models only. Lenovo is thoroughly investigating all and any new concerns raised regarding Superfish."

Users began complaining about Superfish in Lenovo's forums in the autumn, and the firm told the BBC that it was shipped "in a short window from October to December to help customers potentially discover interesting products while shopping".

User feedback, it acknowledged, "was not positive".

Last month, forum administrator Mark Hopkins told users that "due to some issues (browser pop up behaviour, for example)", the company had "temporarily removed Superfish from our consumer systems until such time as Superfish is able to provide a software build that addresses these issues".

He added it had requested that Superfish issue an auto-update for "units already in market".

Was Superfish given permission to issue its own certificates?

Superfish was designed to help users find products by visually analysing images on the web to find the cheapest ones.

Such adware is widely regarded in the industry as a form of malware because of the way it interacts with a person's laptop or PC.

Security expert from Surrey University Prof Alan Woodward said: "It is annoying. It is not acceptable. It pops up adverts that you never asked for. It is like Google on steroids.

"This bit of software is particularly naughty. People have shown that it can basically intercept everything and it could be really misused."

According to security experts, it appears that Lenovo had given Superfish permission to issue its own certificates, allowing it to collect data over secure web connections, known in malware parlance as a man-in-the-middle attack.

"If someone went to, say, the Bank of America then Superfish would issue its own certificate pretending to be the Bank of America and intercept whatever you are sending back and forth," said Prof Woodward.

Ken Westin, senior analyst at security company Tripwire, agreed: "If the findings are true and Lenovo is installing their own self-signed certificates, they have not only betrayed their customers' trust, but also put them at increased risk."

Clean install

Although Lenovo has said that it has removed Superfish from new machines and disabled it from others, it was unclear what the situation would be for machines where it had already been activated.

Prof Woodward said: "Lenovo is being very coy about this but it needs to explain how long it has been doing this, what the scale is and where all the data it has collected is being stored.

"There will be remnants of it left on machines and Lenovo does not ship the disks that allow people to do a clean install."

It raises wider questions about the deals that computer manufacturers do with third parties and the amount of software that comes pre-installed on machines.

Mr Westin said: "With increasingly security and privacy-conscious buyers, laptop and mobile phone manufacturers may well be doing themselves a disservice by seeking outdated advertising based monetisation strategies."

Users were particularly angry that they had not been told about the adware.

One Lenovo forum user said: "It's not like they stuck it on the flier saying... we install adware on our computers so we can profit from our customers by using hidden software.

"However, I now know this. I now will not buy any Lenovo laptop again."

The problem also caused a storm on Twitter, where both Lenovo and Superfish were among the most popular discussion topics.

BBC: US and UK accused of hacking Sim card firm to steal codes

20 February 2015 Last updated at 09:32 ET  BBC

Share this page

• Print

• Share
• Facebook
• Twitter

The stolen encryption keys allowed agencies to decode data that passes between mobile phones and cell towers

Continue reading the main story

Related Stories

• Millions of phones 'at risk of hack'
• Snowden: I was a high-tech US spy
• Cyber thieves profit via mobile malware

US and British intelligence agencies hacked into a major manufacturer of Sim cards in order to steal codes that facilitate eavesdropping on mobiles, a US news website says.

The Intercept says the revelations came from US intelligence contractor turned whistleblower Edward Snowden.

The Dutch company allegedly targeted - Gemalto - says it is taking the allegations "very seriously".

It operates in 85 countries and has more than 40 manufacturing facilities.

The Intercept says that "the great Sim heist" gave US and British surveillance agencies "the potential to secretly monitor a large portion of the world's cellular communications, including both voice and data".

It says that among the clients of the Netherlands-based company are AT&T, T-Mobile, Verizon, Sprint and "some 450 wireless network providers around the world".

Full investigation

The Intercept alleges that the hack organised by Britain's GCHQ and the US National Security Agency (NSA) began in 2010, and was organised by operatives in the "Mobile Handset Exploitation Team". Neither agency has commented directly on the allegations.

However GCHQ reiterated that all its activities were "carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate".

Experts say that the alleged hack is a major compromise of worldwide mobile phone security

How does the hack work?

Each Sim card has an individual encryption key, installed by the chip manufacturer, that secures communications between the handset in which it inserted and mobile phone masts.

This means that if anyone were to snoop on conversations or text messages, they would receive garbled, unintelligible data.

That is, of course, unless those carrying out the surveillance get hold of the encryption key. With that information, they can even decrypt previously intercepted communications.

However, this tactic only works for phone conversations and text messages. Communications through mobile applications such as Whatsapp, iMessage and many email services have separate encryption systems.

The stolen encryption allowed the agencies to decode data that passes between mobile phones and cell towers. They were able to decrypt calls, texts or emails intercepted out of the air.

A Gemalto spokeswoman said the company was unable to verify whether there had indeed been a breach, and highlighted that other Sim manufacturers could also have been targeted.

She added: "We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such highly sophisticated techniques to try to obtain Sim card data".

Global ripples

Reacting to The Intercept's revelations, Eric King, deputy director of the campaign group Privacy International, said the NSA and GCHQ had "lost sight of what the rule of law means and how to weigh what is necessary and proportionate".

He said trust in the security of our communications systems is "essential for our society and for businesses to operate with confidence". And the impact of these latest revelations will have "ripples all over the world."

Gemalto also manufactures ID chips for passports, among other technologies

Privacy International is currently engaged in legal action against GCHQ over its alleged hacking practices.

Gemalto makes Sim cards for mobile phones and furnishes service providers with encryption codes to keep the data on each phone private.

The Intercept claims that by first cyber-stalking employees at Gemalto and then penetrating their emails, the spy agencies were able to steal thousands of encryption keys at source.

This would allow them to eavesdrop easily on phone calls and texts without seeking permission from telecoms companies or foreign governments, and without leaving a trace.

The Intercept cites as its source documents leaked by Edward Snowden, the former NSA contractor who is currently living in Russia.

'Weakest link'

Karsten Nohl, a security researcher who has exposed previous Sim card vulnerabilities, told the BBC the leak showed that "it is still not terribly difficult" to circumvent encryptions on mobile phone communications.

He added that since it was Gemalto, and not the mobile providers, which sets Sim encryption codes, this makes the Dutch firm the "weakest link of the security chain".

Other Gemalto clients, such as passport agencies, buy blank chips and set the codes themselves.

"A lot of telecom companies will be scrambling to find out what went wrong," said Mr Nohl.

Analysis: Joe Miller, BBC technology reporter

If The Intercept's report is to be believed, the most striking discovery is how easily those wanting to engage in mass surveillance can eavesdrop on our mobile communications.

Gemalto, the company which was allegedly targeted, manufactures an estimated 30% of all Sim cards worldwide. And crucially, it creates the security key for each item. All security agencies needed to do was obtain (by hacking, allegedly) the list of security keys from the firm. Then, as security expert Karsten Nohl says, they could snoop on phone calls with a "few hundred dollars worth of radio equipment in strategically important locations".

This contrasts with security procedures used, for example, for chips in passports. Many are are also manufactured by Gemalto. These are delivered to the relevant authorities as a blank chip, and the Passport Office - not the company - creates the security key.

Many of Edward Snowden's allegations have shone a light on complex surveillance tactics by the NSA. But perhaps this latest leak has done more to highlight how a single company is in control of millions of people's private data.