The Wayback Machine - https://web.archive.org/web/20120713134328/http://www.wired.com/threatlevel/

Millions Will Flow to Privacy Groups Supporting Weak Facebook Settlement

Shari Steele, EFF’s executive director. The group supports the Facebook settlement solely for a $1 million payout. Photo: Scotte Beale/Flickr

Privacy and consumer groups are urging a federal judge to sign off on a controversial Facebook settlement over its “Sponsored Stories” advertising program which will net them a combined payout of $10 million, despite indifference to or confusion over the terms of the vaguely written settlement, according to interviews, e-mail and court records.

But groups not getting any money say the settlement does little for the privacy rights of Facebook’s 850 million users and want the deal scuttled, according to court documents and interviews.

Jeff Chester, executive director of the Center for Digital Democracy in Washington, D.C., said the settlement amounts to “just putting some more words in Facebook’s privacy policy that nobody reads.” He added in a telephone interview that, “The proposed changes to the privacy agreement don’t serve the class.”

The Facebook settlement, which needs a judge’s approval, provides a glimpse into the dark side of large class-action settlements: The plaintiff’s lawyers get rich, class members get little and non-profit groups often reap millions by urging judges to approve the deal regardless of its merits.

In this deal, which settles a year-old lawsuit, Facebook is agreeing to give its users the right to “limit” how the social-networking site uses their faces in ads under Facebook’s “Sponsored Stories” program.

But whether the settlement will allow Facebook users to completely opt out of the program, which turns the act of pressing the Facebook “Like” button into a potential commercial endorsement, is totally unclear in the settlement.

The suit, filed in April 2011, claimed Facebook did not adequately inform people of the feature or give them a way to opt out of the advertising program that began in January 2011.

The settlement provides $10 million in fees to the lawyers who brought the privacy litigation and a $10 million donation to charity — earmarked to dramatically boost the budgets of 15 consumer activist groups including the Electronic Frontier Foundation, the Center for Democracy & Technology and the Stanford Law School Center for Internet and Society.

Known in legal terms as cy pres awards, charity payouts to settle class actions are not unusual. Such arrangements often happen when there are so many members of a class-action suit that compensating them for their damages would literally annihilate a company, which judges are loath to do.

The EFF, known for its online freedom initiatives including ongoing litigation accusing the National Security Agency of vacuuming all of Americans’ electronic communications without warrants, stands to reap $1 million from the deal. That amounts to almost one-fourth of its $4.3 million annual budget last year. The group’s executive director, Shari Steele, told the federal judge presiding over the matter that the group backed the settlement. (.pdf)

The group’s legal director, Cindy Cohn, explained in a telephone interview that the San Francisco-based group supported the plan for budgetary reasons.

“We haven’t taken a position on this settlement, whether it’s a good idea or not,” Cohn said. “In general, EFF is happy to receive cy pres money. We can continue to educate people about privacy.”
Continue Reading “Millions Will Flow to Privacy Groups Supporting Weak Facebook Settlement” »

Pages: 1 2 View All

Tags: , ,
Back to top

FBI Investigating Major Chinese Firm for Selling Spy Gear to Iran

The FBI has launched an investigation into allegations that a top Chinese maker of phone equipment supplied Iran with U.S.-made hardware and software, including a powerful surveillance system, in violation of federal laws and a trade embargo, according to The Smoking Gun.

Investigators, who began their probe earlier this year, have also found evidence that the company planned to obstruct a Department of Commerce inquiry into the contract behind the sales.

Last March, Reuters reported that the Chinese firm had sold the Telecommunications Company of Iran (TCI) a powerful surveillance system as part of a $130 million contract in 2010 and that the equipment was capable of monitoring landline, mobile and internet communications.

Reuters had obtained a 907-page packing list of equipment shipped to Iran, which named hardware and software products from top U.S. firms, including Microsoft, Hewlett-Packard, Oracle, Cisco Systems, Dell, Juniper Networks and Symantec.

According to a non-public FBI affidavit obtained by The Smoking Gun, after Reuters broke the news about the sale of equipment to Iran, ZTE lawyers went into panic mode and allegedly began hatching a plot to shred documents and alter records to cover up the illegal transactions.

ZTE designs and manufactures fixed and mobile communications and is the second largest maker of telecommunications equipment in China.

TCI, which is jointly owned by the Iranian government and a consortium of private entities, has a near-monopoly over Iran’s landline phone and internet services.

Mahmoud Tadjallimehr, a former telecommunications project manager in Iran, told Reuters that the ZTE monitoring system was “countrywide” in Iran and was “far more capable of monitoring citizens than I have ever seen in other equipment” Iran had purchased. He said the system could be used to intercept voice calls, text messaging, e-mails and chats, as well as to locate users.

Inside information about ZTE’s alleged plan to cover up its illegal activity came from a whistleblower named Ashley Kyle Yablon who spoke to the FBI and allowed the agency to copy files from his work computer in the course of their investigation, according to The Smoking Gun. Yablon is a 39-year-old attorney who was hired as general counsel by ZTE’s U.S. subsidiary in Dallas last October. He came to the company from a ZTE rival firm, Huawei Technologies.

Yablon, who still works for ZTE, was exposed as a whistleblower only after The Smoking Gun published the FBI affidavit on Thursday. He told investigators that after the Reuters story published, he saw a copy of the contract for the sale of the surveillance system to Iran and told investigators that it “essentially described how [ZTE] would evade the U.S. embargo and obtain the U.S.-manufactured components specified in the contract for delivery.”

He also told the FBI that he believed ZTE had set up a company named 8 Star Beijing solely to buy “U.S.-made goods subject to the U.S. embargo,” as well as another firm named ZTEC Parsian whose job was to “integrate the equipment for delivery to and installation in Iran.” He learned that the company planned to tell investigators that the equipment either had never been shipped to Iran and was still in warehouses or had been shipped to non-embargoed countries.

When Yablon was told about the alleged plan to coverup ZTE’s dealings, he told the company that he would resign rather than participate in a coverup and was later cut out of internal discussions about the issue.

Several of the U.S. companies whose products were allegedly sold to Iran told Reuters that they were unaware of the sales and were investigating their partnership with ZTE.

An FBI spokeswoman in Dallas declined to comment. ZTE did not immediately respond to a call for comment.

It’s not the first allegation of a company selling surveillance equipment to Iran. In 2009, the Wall Street Journal reported that Nokia Siemens Networks had also sold sophisticated surveillance equipment to Iran.

According to the Journal, Nokia Siemens Networks — a Finland-based joint venture between Nokia and Siemens — provided Iranian authorities with the ability to conduct deep-packet inspection of online communications to monitor the contents and track the source of e-mail, VoIP calls and posts to social networking sites such as Twitter, Myspace and Facebook. The newspaper also said authorities had the ability to alter content as it intercepted the traffic from a state-owned internet choke point.

A spokesman for Nokia Siemens Networks, later told Threat Level that although the company had sold equipment to Iran, the system was incapable of conducting deep-packet inspection of internet communications — or conducting any internet surveillance at all. The company said it installed a cellphone network in Iran, and like all modern telecom switches, the equipment included capability that allows the government to conduct wiretaps of telephone calls made from targeted numbers.

Telecommunication companies in the United States and other countries are required to provide so-called “lawful intercept” capability so that domestic law enforcement agencies can eavesdrop on calls to investigate criminal activity. In the United States, however, such interception generally requires a court order.

Back to top

WikiLeaks Wins Icelandic Court Battle Against Visa for Blocking Donations

Reykjavic, Iceland. Photo: srikanth_jandy/Flickr


The Icelandic partner of Visa and MasterCard violated contract laws when it imposed a block against credit card donations to the secret-spilling site WikiLeaks, a district court there has ruled.

The Reykjavík District Court ruled that Valitor, which handles Visa and MasterCard payments in Iceland, was in the wrong when it prevented card holders from donating funds to the site. The court ruled that the block should be removed within 14 days or Valitor will be fined the equivalent of about $6,000 a day.

WikiLeaks spokesman Kristinn Hrafnsson told the Associated Press that it was “a small but very important step in fighting back against these powerful banks.” He said other lawsuits are ongoing in Denmark and Belgium.

Visa, MasterCard, PayPal, Bank of America and other U.S. financial institutions began to block donations to WikiLeaks in 2010 after the controversial site began publishing more than 250,000 U.S. State Department cables that the group allegedly received from former Army intelligence analyst Bradley Manning. The financial services cited violations of their “terms of service” agreements as the reason for blocking the donations.

The U.S. State Department called the publication of the 250,000 diplomatic cables “illegal,” but no charges have been filed against the site. Publishing government documents, even classified ones, is not explicitly illegal in the United States, though it is in the United Kingdom.

WikiLeaks and its credit card processor, DataCell, sued Valitor in Iceland over the shutdown.

WikiLeaks and DataCell also filed a complaint with the European Commission. The Commission is expected to make a decision about what to do before the end of August, according to a statement from WikiLeaks.

“This is a significant victory against Washington’s attempt to silence WikiLeaks,” WikiLeaks founder Julian Assange said in a statement about the win in Iceland. “We will not be silenced. Economic censorship is censorship. It is wrong. When it’s done outside of the rule of law it’s doubly wrong. One by one those involved in the attempted censorship of WikiLeaks will find themselves on the wrong side of history.”

The Associated Press reports that Valitor can appeal the decision, but even if it chooses to comply with the judgment, it’s not clear that Visa or MasterCard will still allow customers to make donations to DataCell or WikiLeaks.

WikiLeaks received $1.9 million in donations in 2010 but last year announced it was halting publication of documents due to claims that it was running short on funds. The site resumed publication of documents this month when it began publishing more than 2 million e-mails stolen from Syrian officials, government ministries and companies. Members of an Anonymous group have claimed responsibility for stealing the e-mails and giving them to WikiLeaks.

Back to top

Report: Half a Million Yahoo User Accounts Exposed in Breach

Photo: Schill/Flickr

Hackers have published half a million login credentials for what appear to be Yahoo Voices user accounts that were stolen from a server.

More than 453,000 login credentials were posted by a hacking group calling itself D33Ds Company, who say the credentials were stored in plaintext, an amateur security blunder. The hackers said, in a note posted online, that they used a SQL injection attack to grab the credentials, but did not say from which Yahoo service they were taken “to avoid further damage.”

But based on a domain hostname that the hackers left in the data (dbb1.ac.bf1.yahoo.com) they posted, researchers have concluded that the credentials appear to have been stolen from Yahoo Voices, a user-generated content service and blogging platform that was formerly part of Associated Content. Yahoo Voices claims on its website that it has “more than 600,000 contributors and growing.”

“We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat,” the hackers wrote in a note accompanying their disclosure. “There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage.”

The page where the hackers originally published the credentials is not currently available, but the credentials have also been posted in a searchable format at Dazzlepod.com, with the passwords redacted. Users who find their credentials on the list can send an email to Dazzlepod requesting that their credentials be removed from the online list. A spokesperson at Dazzlepod, which published the credentials early Thursday morning, says their site has received more than 120 removal requests from account holders so far.

Yahoo said in a statement that it is investigating the breach claim. The breach is the latest in a rash of credential breaches that have occurred in the last few months involving unsecured servers and unencrypted credentials. LinkedIn, eHarmony and Last.fm have all been victims of similar breaches lately.

The attacks highlight the danger of re-using passwords at different websites, as hackers can mine the data and attempt to use the same credentials with more sensitive accounts that users may have, such as online banking and e-mail accounts.

Back to top

When Art, Apple and the Secret Service Collide: ‘People Staring at Computers’

Steve Jobs, staring at the first version of Photo Booth. All watercolors courtesy of David Pierce.

I really wasn’t expecting the Secret Service.

Maybe an email, or a phone call from Apple. Instead, my first indication that something was “wrong” was a real-life visit from the organization best known for protecting the President of the United States of America.

They rang the doorbell a few times. It woke me up, and I tried to ignore it. There were always kids playing with the doorbells in our apartment building. But the kids don’t normally shout, “this is the Secret Service, open the door,” so I took that as my cue to get out of bed.

I cracked the door open a few inches, and an agent was already leaning into the frame. He explained that he was from the Electronic Crimes Task Force, and that they had a search warrant. Under different circumstances it could have been quite cinematic, but it was an incredibly hot summer morning in Brooklyn. I was tired, and wearing only gym shorts. I saw the two agents behind him look me up and down, and they relaxed.

I told them I’d be glad to help however I could, and invited them in.

“Are there any drugs or weapons in the house?”

“No sir.”

He was incredulous. “Are you sure?”

“Yes.” I almost felt bad for not being a more stereotypical rebellious young artist. Like I was letting him down.

“If we find anything, it’s going to make things complicated.”

I didn’t want to make things complicated. I thought about it harder. Maybe I was forgetting something?

“Well, there’s some beer in the fridge, and some knives in the kitchen.”

I was completely serious, but he wasn’t sure what to make of it.

“Ok. Is there anyone else in the house?”

“No sir.”

They opened up two doors and found my roommates sleeping. “Who is this?”

“Oh, those are my roommates.” I didn’t realize it was 8 am. I was up late the night before, and I figured it was 10 or 11 already, and that they had left for work.

An agent walked my groggy roommates to the living room to keep an eye on them.

It’s been kind of an unexpected wake up call. “Do you mind if I put on a shirt? And I think I’m going to sit down. I’m not feeling well.”

“Go ahead, we don’t want you fainting on us.”

I sat down on my bed and put on my glasses. While my stomach was resetting, I looked up at the agent watching over me. In this weather, I was struck with empathy for the weight of his suit, and the tightness of his tie. “Do you guys really wear that outfit year-round?”

“Yes.” I think he’s still not sure what to make of me.

“So do you know why we’re here?”

That’s like “Do you know why I pulled you over?” I had to think for a moment before responding. On one hand, I’ve always heard that the last thing you want to do is give out information. That you shouldn’t answer questions unless you have to. On the other hand, I can’t stand the idea of any relationship based on a lack of communication. And I have a naive hope that if I tell them everything they’ll understand the project better. They’ll see that I did nothing “wrong,” I’m just dealing with some kind of uncomfortable topics.

I decided to tell them everything.

In early 2009 I read an article on radical openness.

In “Thoughts on total openness of information,” Dan Paluska brainstorms about the possibility of posting all your “personal” information online, asking what the repercussions would be. What if people could see every bank transaction you made? Or read every email you wrote? I started answering these questions for myself with “keytweeter,” a yearlong performance starting in June 2009. Keytweeter was a custom keylogger that tweeted every 140 characters I typed. Over that year, I learned a lot about myself and what “privacy” means. I learned that every conversation belongs to all the parties involved, so I put disclaimers in my emails. I learned that I was more honest, with myself and with others, when I knew everyone could see what I was saying.

After keytweeter, I started working on a project with Wafaa Bilal called “3rdi.” He told me he wanted to implant a camera on the back of his head that would upload a geotagged image to the internet every minute, as an exploration of “photography without a photographer.” So I worked with Wafaa to create a system that made this possible. As a professor at NYU, he had some trouble while at school due to privacy concerns. They came to a compromise where he would keep the camera on, but covered. This performance also lasted a year, over the course of 2011.

After working with text for “keytweeter,” I started exploring visual equivalents. One experiment, “scrapscreen,” made a scrapbook from your screen over the course of a day: every mouse movement “tore away” that part of the screen and saved it to a continually overlapping image. Another experiment, called “Important Things,” captures every click as a 32×32 pixel icon in a massive grid.

Later that year I worked with interactive artist Theo Watson on an extension of “Important Things,” called “Happy Things,” which took a screenshot every time you smiled, and uploaded it to the web. We got pictures from all around the world, with people smiling at everything, from cat memes to the Wikipedia article for Nicholas Cage.

Sometimes this kind of work is associated with “human-computer interaction,” but this term makes it sound like we’re interacting with computers, when in fact, most of the time, we’re interacting with each other. I like to think of it as “computer-mediated interaction.”

In mid-May, 2011, I took a timelapse using my laptop’s webcam to get a feeling for how I looked at the computer. After a few days of recording, I watched the video.
Continue Reading “When Art, Apple and the Secret Service Collide: ‘People Staring at Computers’” »

Pages: 1 2 3 4 5 6 7 8 View All

Back to top
« OLDER POSTS