Eliana Willis

Google has simplified its range of Titan security keys by dropping its Bluetooth Titan Security Key and making greater use of NFC.Moving forward, NFC will now be offered on both the USB-A and USB-C keys, which means that most users will be able to streamline their keys down to a single unit.Must read: Best security keys: Protect your online accounts
If you have an older system with USB-A ports, Google recommends that you buy a USB-A + NFC security key, which should work with most smartphones and tablets. This is the key recommended for iPad users who have a Lightning port on the iPad (they will also need an Apple Lightning adapter).USB-A + NFC security key
Google
If you have a more modern system that makes use of USB-C, then the key for you will be the USB-C + NFC security key.USB-C + NFC security key
Google
Bluetooth Titan Security Keys will continue to work, and warranties will continue to the honored by Google.The USB-A+NFC security key, which comes with a USB-A to USB-C adapter, costs $30, while the USB-C+NFC security key costs $35. Both are available from the Google Store.

A good alternative to Google’s Titan security keys are the YubiKey line, and come in a wide variety of options.  More

Digital Rights Watch (DRW) and Electronic Frontiers Australia (EFA) have sternly warned that if big tech giants including Apple, Google, Amazon, and Microsoft continue to be allowed to behave as monopolies when it comes to repairs, it could stifle innovation and competition. “Repair monopolies held by major tech companies, heavy handed Digital Rights Management (DRM) technologies, and onerous restrictions on documentation, parts, and third-party repair options significantly harm Australian consumers, innovation, and the planet,” they said in a joint submission [PDF] for the Productivity Commission’s right to repair inquiry. The pair believes introducing the right to repair would be one way to address that market imbalance.”A right to repair would enable consumers to make use of an inbuilt market mechanism to counter attempts at abuse of market power,” the submission said. “This counterbalance to market power would act as a kind of automatic stabiliser without the need to involve market regulators to intervene if a market failure occurred. We believe this is particularly important for technology products as the majority of such products are not manufactured in Australia.”The submission pointed out how Apple, for instance, uses “serialisation” to actively prevent independent repair of their iPhones. According to the pair, serialisation prevents hardware to be replaced even with identical parts made by the same manufacturer, unless the serial number of that component matched that which it originally was bought with.”It is inevitable that premature replacements of technological products will continue to occur at some degree, due to consumers choosing to purchase new items. Yet we believe it is important to address negative externalities created by manufacturers that actively promote a ‘disposable technology’ culture,” it said.

“The development of a right to repair may play a role in discouraging technology companies from such practices, and motivate them to pursue other, more environmentally sustainable revenue models. “The right to repair will also be essential in order to create a culture shift away from wasteful consumer habits. We cannot expect consumers to take part in a circular economy if the mechanisms and incentives are not in place for them to do so, or if the incentives are actively antithetical to a circular economy.”The submission added that if repairs remained monopolised, technology manufacturers would be creating additional barriers to careers and hobbies in technology. “Digital skills and hardware skills are fundamentally intertwined, and the ability to take apart and fix hardware, as well as inspect its code, is a critical part of developing these skills necessary to build a future-proof economy,” it said. “Proprietary machinery that deliberately obfuscates its components to ensure it cannot be repaired by third parties further abstracts the relationship between humans and the tools we use, which makes this educational journey much more difficult.”The DRW and EFA also took the opportunity to highlight that as the commission investigates how to best approach right to repair, factors such as digital security, environmental sustainability, and issues related to fairness should not be overlooked. They pointed out, for instance, that under the Competition and Consumer Act 2010, vendors are not currently required to service and repair goods for their full useful life, rather only for a “reasonable” amount of time. However, implementing a right to repair that includes software as well as hardware would ensure potentially vulnerable devices can be made safe.”A right to repair would ensure that vulnerable devices purchased by consumers can be made safe by repairing the software running on those devices, thereby reducing the threat to themselves and to others,” it said. “This would not require the participation of the vendor, which may no longer exist, and would prevent consumers from being punished for ‘jail-breaking’ devices they own and sharing the code, if the software vendor is no longer supporting the device. This facilitates community-based software support and repair efforts, as well as supporting the rights of a hardware owner to install software of their choice on their devices.”Meanwhile, the National Farmers’ Federation (NFF) noted the cost of inaction with respect to repairs could result in higher repair cost; inability to use preferred repairer outside of the authorised dealer network, who is often more experienced and qualified; long distance travel to access authorised repairs as use of local repairers would void warranties; and significant delays in repairs, which the NFF described as being be “fatal” for a farm business. The NFF also knocked back claims that access to software for the purpose of right to repair would supposedly harm public safety or cybersecurity. “Any right to repair regime would not entail an open access data regime, where there is a free-for-all with respect to consumers’ repair data. A properly defined right-to-repair regime would put consumers in the driving seat in providing access to their data, where they see benefit, and the use of data would be governed by the development of codes on the use and dissemination of data,” the NFF said in its submission [PDF]. “The claims … [are] unfounded.” Communications Alliance, on the contrary, argued that enabling unauthorised repairers to use uncertified parts or install uncertified firmware on devices, could result in making devices vulnerable to hacking or illegal interception. “We are concerned by the commission’s assertion in the draft report that security concerns may be overstated. Cybersecurity is a key focus for government, and the ACCC is actively working to educate and protect consumers from scams,” the Australian telco body stated in its submission [PDF].”Allowing unauthorised third-party repairers to work on these devices, and/or to use unapproved replacement parts, could both impact connectivity and create risks to communication networks — which are deemed critical infrastructure by government and subject to extensive rules and regulations to ensure they are protected,” the Communications Alliance added.MORE ON RIGHT TO REPAIR MOVEMENT  More

Image: Apple
Apple has produced an FAQ [PDF] in response to criticism levelled at it after announcing plans to have devices scan for child abuse material in images uploaded to iCloud. The child sexual abuse material (CSAM) detection system will have devices running iOS 15, iPadOS 15, watchOS 8, and macOS Monterey matching images on the device against a list of known CSAM image hashes provided by the US National Center for Missing and Exploited Children (NCMEC) and other child safety organisations before an image is stored in iCloud. If a hashing match is made, metadata that Apple is calling “safety vouchers” will be uploaded along with the image, and once an unnamed threshold is reached, Apple will manually inspect the metadata and if it regards it as CSAM, the account will be disabled and a report sent to NCMEC. Much of the criticism has revolved around the idea that even if Apple was well-intentioned and currently limited, the system could be expanded by Apple alone, or following a court order, it could hunt for other types of material. Apple said its processes were designed to prevent that occurrence from happening. “CSAM detection for iCloud Photos is built so that the system only works with CSAM image hashes provided by NCMEC and other child safety organizations,” Apple said. “There is no automated reporting to law enforcement, and Apple conducts human review before making a report to NCMEC. As a result, the system is only designed to report photos that are known CSAM in iCloud Photos.

“In most countries, including the United States, simply possessing these images is a crime and Apple is obligated to report any instances we learn of to the appropriate authorities.” On the prospect of being forced to add other hashes to its dataset, Apple referred to its past refusals to help US law enforcement. “Apple will refuse any such demands,” it said. “We have faced demands to build and deploy government-mandated changes that degrade the privacy of users before, and have steadfastly refused those demands. We will continue to refuse them in the future. “Let us be clear, this technology is limited to detecting CSAM stored in iCloud and we will not accede to any government’s request to expand it. Furthermore, Apple conducts human review before making a report to NCMEC. In a case where the system flags photos that do not match known CSAM images, the account would not be disabled and no report would be filed to NCMEC.” Apple claimed its system would prevent non-CSAM images being injected and flagged since the company does not add the set of hashes used for matching, and humans are involved in the verification process. “The same set of hashes is stored in the operating system of every iPhone and iPad user, so targeted attacks against only specific individuals are not possible under our design,” Apple said. “As a result, system errors or attacks will not result in innocent people being reported to NCMEC.” The iPhone maker reiterated its claims that the solution had privacy benefits over being able to scan images uploaded to it. “Existing techniques as implemented by other companies scan all user photos stored in the cloud,” it said. “This creates privacy risk for all users. CSAM detection in iCloud Photos provides significant privacy benefits over those techniques by preventing Apple from learning about photos unless they both match to known CSAM images and are included in an iCloud Photos account that includes a collection of known CSAM.” Apple also said the feature would not run if users have iCloud Photos disabled and would not work on “private iPhone photo library on the device”. On the scanning of images in iMessage, Apple expanded on the requirements for parents to be alerted once a family group is created and parents opt-in. “For child accounts age 12 and younger, each instance of a sexually explicit image sent or received will warn the child that if they continue to view or send the image, their parents will be sent a notification. Only if the child proceeds with sending or viewing an image after this warning will the notification be sent,” it said. “For child accounts age 13-17, the child is still warned and asked if they wish to view or share a sexually explicit image, but parents are not notified.” Apple said it was looking at adding “additional support to Siri and Search to provide victims — and people who know victims — more guidance on how to seek help”. Although the CSAM system is currently limited to the US, Cupertino could soon be facing pressure from Canberra to bring it to Australia. On Monday, the government unveiled a set of rules for online safety that will cover social media, messaging platforms, and any relevant electronic service of any kind. The provider is expected to minimise the availability of cyberbullying material targeted at an Australian child, cyber abuse material targeted at an Australian adult, a non-consensual intimate image of a person, class 1 material, material that promotes abhorrent violent conduct, material that incites abhorrent violent conduct, material that instructs in abhorrent violent conduct, and material that depicts abhorrent violent conduct. The expectations also boast additional expectations, such as that the provider of the service will take reasonable steps to proactively minimise the extent to which material or activity on the service is or may be unlawful or harmful. Australia’s eSafety Commissioner will have the power to order tech companies to report on how they are responding to these harms and issue fines of up to AU$555,000 for companies and AU$111,000 for individuals if they don’t respond. Related Coverage More

Getty Images/iStockphoto
Political candidates should formally commit to treating campaigning as a mode that’s distinct from engagement with citizens when in government, a report from the Australian Strategic Policy Institute (ASPI) says. “A healthy online public sphere requires political will,” ASPI’s latest report [PDF], Influence for hire: The Asia-Pacific’s online shadow economy, says.”Transparency about government funding of public messaging when in office would allow citizens and civil society to engage with trust in the digital public sphere. “Political representatives should commit to not using networks of inauthentic, fake, or repurposed social media accounts to manipulate political discourse.”But it isn’t just political, with ASPI recommending for platforms to take on some of the accountability.”Platforms could implement country-specific oversight committees to manage prominent account bans, to ensure the consistent application of content moderation policies to capture inauthentic behaviour, and to participate in mandatory transparency reporting,” ASPI says.There is also a case for government and industry to work together to develop policies and initiatives that offer digital entrepreneurs pathways beyond low-cost content-farm work and that reward ethical content creation.

“The influencer economy could be encouraged to self-regulate through the development of codes of conduct,” the report says.According to ASPI, commercial influence-for-hire services will continue to proliferate for as long as there’s a market for them and cheap digital labour to deliver their services. ASPI said this creates risks for societies that aspire to meaningful democratic participation and opportunities for foreign interference. “A manipulated information environment doesn’t serve democracy well,” it added. “It’s particularly harmful to societies that are emerging from historically more authoritarian forms of governance, have weak democratic governance, fragile civil societies, or any combination of those factors.”In line with testimony provided recently by Facebook, ASPI said there was growing evidence of states using commercial influence-for-hire networks — PR firms.It pointed to research [PDF] from the Oxford Internet Institute that found 48 instances of states working with influence-for-hire firms in 2019-20, an increase from 21 in 2017-18 and nine in 2016-17.”A surplus of cheap digital labour makes the Asia-Pacific a focus for operators in this economy,” ASPI added.While currently, much of the responsibility for taking action against the covert manipulation of online audiences falls to the social media companies, ASPI said solutions must involve responsibility and transparency in how governments engage with their citizens.”The technology industry, civil society, and governments should make that alignment of values the bedrock of a productive working relationship,” it said. “Structures bringing these stakeholders together should reframe those relationships — which are at times adversarial — in order to find common ground.”Further recommendations made by ASPI to ensure that the information environment and digital economy best align with democratic forms of governance, include multi-stakeholder “whole-of-society” approaches, which would require a revisit of the existing “adversarial approach” between governments and the companies that provide the infrastructure for the digital economy. “Democracies and industry must partner to fund capacity-building programs that bolster civil society organisations in emerging democracies in the Asia–Pacific region. Civil society organisations can work to apply transparency to state manipulation of the information environment,” it wrote.It has also suggested the creation of an Asia-Pacific centre of excellence in democratic resilience could provide a vehicle for public-private multilateral partnerships designed to maintain the health of the region’s online public sphere. ASPI has been calling for the establishment of an independent statutory authority to oversee operations of all social media platforms that operate down under.”We suggest an independent statutory authority that is empowered to observe and report on how the incentives, policies, algorithms, and enforcement actions of social media platforms are operating, with the ultimate goal being to maximise benefits and reduce harm for society and its citizens,” ASPI wrote in a to the Senate Select Committee on Foreign Interference through Social Media last year.ASPI hopes for such an authority to be granted explicit insight into how content is filtered, blocked, amplified, or suppressed, both from a moderation and algorithmic amplification point of view.”Crucially, these obligations should be placed on all social media operating in Australia, including those companies that originate from authoritarian regimes and those fringe platforms servicing niche communities — not just the dominant Western platforms such as Facebook, Twitter, Instagram, and Snapchat,” it said.”These transparency and oversight measures would go some way towards countering the default incentive towards sensational, provocative, and potentially polarising content.”RELATED COVERAGEDisinformation for hire: PR firms are the new battleground for FacebookFacebook’s head of security policy has testified before an Australian Parliamentary inquiry that his company has witnessed an increasing use of marketing firms or PR agencies that are essentially hired to run disinformation campaigns.Australia warned to not ignore domestic misinformation in social media crackdownCommittee has been warned against outsourcing the job of deciding what is true or false in an Australian context to a handful of private US companies.Countering foreign interference and social media misinformation in AustraliaDFAT, the Attorney-General’s Department, and the AEC have all highlighted what measures are in place to curb trolls from spreading misinformation across social media. More