More stories

  • in

    Google extends COVID Card vaccination certificate to Australia

    Image: Google
    Google last week announced extending its COVID Card feature to Australia, allowing Android users to access vaccination information on their device. Google said it worked with Services Australia to give “a convenient and secure way to view, save, and show your vaccination status and information, straight from your smartphone”.The information will show in the vaccination passport once a second dose has been administered.According to Google, vaccine information is only stored on the user’s device and not stored by Google.  However, when adding the certificate to Google Pay, users are prompted to confirm they agree to their data being stored offshore.”If you add your COVID-19 digital certificate to Google Pay, others with access to this device will be able to view the certificate. It’s your responsibility to keep your certificate secure,” the prompt says.”By selecting ‘Accept’, you provide consent for the Australian government to share the information contained in your COVID-19 digital certificate with Google for Google Pay who will store it on servers outside of Australia.

    “A copy of your certificate may also be stored on servers outside of Australia if you have other cloud applications stored on your device to backup your data.”When asked about the storing of data offshore, Services Australia said the COVID-19 digital certificate would be entirely optional for Australians. “Once provided to the individual, it is their choice as to how they use and store it,” a spokesperson for Minister Linda Reynolds told ZDNet. “This includes accessing the certificate via government apps, or downloading it to their phone, or storing it in their digital wallet.”The spokesperson confirmed the certificate was accessible without using the digital wallet storage option.”We know Australians are increasingly using digital wallets so people can choose to store their certificate in this way, if it suits them,” they continued. “Users are informed that the Apple or Google digital wallet utilises offshore storage before agreeing to use the service.”In its Secure Cloud Strategy, the Digital Transformation Agency (DTA) said entities operating in Australia must comply with Australian Privacy Principles (APP) when storing data on Australians. “The Privacy Act does not prevent an Australian Privacy Principle (APP) entity from engaging a cloud service provider to store or process personal information overseas. The APP entity must comply with the APPs in sending personal information to the overseas cloud service provider, just as they need to for any other overseas outsourcing arrangement,” it said. When asked if it had any concerns with the certificate information being stored offshore, the DTA said it was a question for Services Australia. Google is also yet to return a comment.Users can access their vaccination certificate via the Express Plus Medicare app or via the Medicare portal of the MyGov website, with the option to select “view your COVID-19 digital certificate” and “Save to Phone” to do just that.”For added convenience, you can access your vaccine information even when you’re offline, which means you do not need mobile or Wi-Fi connection,” Google added. “If you have the Google Pay app on your Android phone, you can also access the certificate from the same place where you access your other cards and other passes.”Every time a user accesses their certificate, they will be asked for the password, PIN, or biometric method that has been set up.As of 9pm AEST 8 August 2021, there were just over 4,700 active cases of COVID-19 in Australia, with a total of 36,330 cases since January 2020. Stay-at-home orders continue to be in place around the country, with a majority of the population of New South Wales under lockdown since June 25.In a bid to speed up the process of checking into venues and managing check-in history, the NSW government on Monday announced a new COVID-19 check-in card, as well as updates to the Service NSW app.Minister for Digital and Customer Service Victor Dominello said customers would soon be able to register for a COVID-19 check-in card which they could present to supermarkets and other essential retail businesses to scan as a faster and safer way to complete the self-service webform check-in or paper sign-in currently used by customers without a smartphone.Customers can download and print their COVID-19 check-in card or have a plastic card mailed to them. Their contact details will be  stored within the QR code, which will prepopulate the webform when scanned by the business. As the Service NSW app gives users the option for face biometrics to be used when logging in — a task made difficult with mandatory mask requirements — the government has also extended the log-in period to four hours.   MORE COVID IN AUSTRALIACOVIDSafe uploaded 1.65m ‘handshakes’ and was only used by NSW and VictoriaThe Australian government says its COVIDSafe app identified 2,827 potential close contacts from 37,668 encounters in NSW and Victoria. Only 17 cases in NSW were identified separately to manual contact tracing efforts, however.Auditor finds WA Police accessed SafeWA data 3 times and the app was flawed at launchWA Health released SafeWA check-in information for purposes other than COVID-19 contact tracing, with six requests being made by the police despite government messaging that the information would only be used to support contact tracing.Australia pins clearer idea of who got vaccinated on new portalMore than 100 days since Australia’s vaccine rollout started, the federal government is launching a portal that will provide information on who exactly has received the jab. More

  • in

    Australian Electoral Commission is seeking a new Senate ballot scanning solution

    Image: Getty Images
    The Australian Electoral Commission (AEC) has gone to tender for an “end-to-end” digital ballot scanning solution, hoping to have something in place for the 2021/22 election.Specifically, the AEC said it requires a solution to digitise all Senate ballot papers, which includes capturing the preferences and metadata, completed in a federal election. “It is estimated this will be in the order of 16 million ballot papers for the 2021/2022 event and will grow by 5 to 10% for each federal electoral event after that,” it adds in the market notification published over the weekend. “Given the size and complexity of the project and operational phase, the AEC’s preference is to purchase an end to end solution.”Senate ballot paper digitisation must be completed by no later than 27 calendar days after election day and the first ballot papers will be available for scanning from the Tuesday after election day. The Senate ballot papers must be processed in the state for which the Senate ballot paper has been returned.”The process for the digitisation of Senate ballot papers will start once the division has finished their processing of the Senate ballot papers,” it said. “AEC is open to solutions as suggested by the provider as to the location(s) of the digitisation solution in each state and territory.”As detailed in the market notification, the successful provider must design, develop, test, build, implement, and support an accurate and secure digitisation solution for the AEC to facilitate the count of Senate ballot papers for an electoral event in compliance with the Commonwealth Electoral Act 1918.The solution must be able to process and export the data from approximately 16 million ballot papers within 27 days from election day.

    As part of the end-to-end mandate, the provider will be responsible for the development and implementation of the solution, including project management, business analysis, design, and build. The digitisation solution, the AEC said, must protect all data when it is at rest and when it is in transit, and adhere to all security requirements as outlined by the Australian Cyber Security Centre (ACSC).The AEC in 2018 handed Fuji Xerox Businessforce a two-year, AU$27 million contract to provide a ballot scanning system for the then-upcoming federal election. The solution was a “very similar” solution to the one used for the 2016 federal election, which the Australian National Audit Office (ANAO) called out for lacking on the security front.In particular, the ANAO said AEC ditched compliance with Australian government IT security frameworks and said insufficient attention was paid to assuring the security and integrity of the data generated both during and after operation, as the focus was on delivering a Senate scanning system by polling day — 12 weeks out from the election.AEC commissioner Tom Rogers said he was satisfied with the risks that the AEC accepted ahead of its go-live.  One of the concerns raised with Rogers was that Fuji Xerox Businessforce was handed the contract not through conducting a public tender, but rather the AEC used an existing standing deed of offer with Fuji Xerox.During Senate Estimates in May, Rogers was questioned on the ballot scanning process.”The process is that data is manually entered, and that’s matched with the automated process,” he said. “All paper is scanned when it first arrives, and, from that image, which is an image, that data is then entered, and then the data from the scan is then compared with that to make sure that they match. Where they don’t match, we undertake further processes.”It captures an image, Rogers said, and that image is then presented to the data entry operator, who enters the data from that image.”At the same time, the data-capture process — as part of capturing the image — is then compared with that manual process. Where that matches, that’s taken to be an accurate match and it’s included in the count. Where it doesn’t match, we undertake further processes,” he continued. The AEC was asked about its security posture at the Senate Estimates prior, with Rogers dismissing the proposal to allow a non-government researcher to conduct a security audit on its systems.At the time, he said the AEC works with a range of partners, including the ACSC, and that the agency has had its internal code audited and checked to assure that its systems are running smoothly.Closing day for indication of interest is 16 August 2021.See also: Australian Electoral Commission wants VR but thankfully only for educationThe Department of Foreign Affairs and Trade (DFAT) has also approached the market this week, seeking the delivery of a threat intelligence platform and cyber threat intelligence services.”The procurement is to include strategic, operational, and tactical cyber threat intelligence products/services to be integrated into the provided Threat Intelligence Platform, to allow the department to detect and manage threats posed by malicious actors against the government sector and the department itself; enable the department to search, explore, and investigate threats and vulnerabilities, including its IP addresses, domains, brands, supply chain or technology stack; and request custom threat intelligence products on an ad hoc basis,” it wrote in the request for quote.For the threat intelligence platform, DFAT is seeking a vendor to provide a service, either cloud-based or on-premise, for the purposes of ingesting cyber threat intelligence feeds, with the intention of using it for the management of cyber threat intelligence. The tender closes 27 August 2021.LATEST FROM CANBERRA More

  • in

    Optus and TPG will have some 900MHz 5G spectrum set aside

    Image: Chris Duckett/ZDNet
    Minister for Communications Paul Fletcher has directed the Australian Communications and Media Authority to set aside spectrum for Optus and TPG in the upcoming auction of low-band sub-1GHz spectrum. “This will guarantee these operators the opportunity to acquire 10MHz of 900MHz band spectrum at the auction to support continuity of services. Optus and TPG Telecom rely heavily on their 900MHz holdings for their national mobile networks,” the minister said in a statement.The Australian Competition and Consumer Commission (ACCC) previously said it was worried about the low-band holdings of Optus. “Optus’ ability to compete effectively in the mobile services market will likely be constrained if it does not acquire more sub-1GHz band spectrum in the 850/900MHz allocation,” the competition watchdog wrote in April. “In particular, there is a risk that Optus may not be able to roll out 5G technology widely and efficiently in Australia in the absence of more sub-1GHz spectrum.” At the time, the ACCC was not impressed by the concept of setting aside spectrum. “The recommended allocation limit provides a reasonable opportunity for Optus and TPG to acquire spectrum in the 900MHz band that would enable them to continue to provide existing services,” the ACCC said.

    “The limit also allows a potential price-based allocation process to determine the value that Optus and TPG place on the ability to continue to provide existing services in the band, which is likely to result in a more efficient allocation of spectrum than if a set aside was in place.” Nevertheless, the set aside direction has taken place, as well as Fletcher limiting how much spectrum a single operator can have in the 850MHz and 900MHz bands. In metro areas, the limit will be 40%, or 82MHz, while in regional and remote areas that ceiling will be raised to 45% or 92MHz. The auction is expected to begin in late November or early December. The ministerial decision was welcomed by Optus. “We applaud the minister for standing by what he knows is in the best interests of Australians, despite our largest competitor throwing their massive weight behind a scare campaign to close out competition from regional Australia,” Optus vice president for regulator and public affairs Andrew Sheridan said. “Regional Australians will benefit from continued access to competitive services and choice, an outcome our largest competitor sought to deny. The decision also reflects the considered advice of the independent consumer regulator, the Australian Competition and Consumer Commission, while still cleverly addressing some of the complexities of technical limitations of these bands.” Elsewhere on Monday, NBN announced it would be creating 44 more business fibre zones, which allows businesses to get a full fibre Enterprise Ethernet connection, as well as reduced rates and connection fees. The new zones will cover 60,000 businesses, and be available from September. In NSW, the new zones are: Northern Beaches, Camden, Casino, Cessnock, Hunters Hill, Lithgow, Nelson Bay, Singleton, Wauchope, and Lake Macquarie – West covering Morisset, Toronto, West Wallsend, and Edgeworth. Victoria will get zones in Balwyn-Surrey Hills, Bentleigh, Cowes, Eltham, Glenroy, Hampton-Sandringham, Hastings-Tyabb, Melton, Ocean Grove, Rosebud, Tatura, Torquay, and Yarrawonga. Queensland gains Ayr, Dalby, Emerald, Goondiwindi, Hervey Bay, Nambour, North Lakes, Warwick, and Yeppoon. Western Australia receives Cottesloe, Joondalup, Maddington, and Collie. South Australia gets business zones in Goolwa, Modbury, Naracoorte, Port Pirie, and Stirling. Tasmania gets one zone in George Town and Bell Bay, while the ACT will get business fibre in Gungahlin and Tuggeranong. NBN said it will have 284 business fibre zones capable of hooking up 850,000 businesses around the nation. Related Coverage More

  • in

    ACCC hauls Telstra, Optus, and TPG to court on alleged misleading NBN FttN speed claims

    An NBN FttN node getting a Nokia line card installed
    Image: Corinne Reichert/ZDNet
    The Australian Competition and Consumer Commission (ACCC) began proceedings in Federal Court on Monday against the nation’s three biggest telcos: Telstra, Optus, and TPG. The consumer watchdog is alleging the trio made false representations to consumers over being able to test lines to determine the maximum speed on fibre-to-the-node connections, notify the customer of test results, and offer remedies if a line was performing below the speed the telco sold it as. The ACCC also said it was alleging that the trio “wrongly accepted payments” from customers for NBN plans when they could not receive promised speeds. It has put the number of impacted customers in the “hundreds of thousands” range. The watchdog said the telcos did not have “adequate systems” in place to complete the speed tests, notifications, and remedies process. “Telstra, Optus and TPG each promised to tell consumers within a specific or reasonable timeframe if the speed they were paying for could not be reached on their connection. They also promised to offer them a cheaper plan with a refund if that was the case,” ACCC chair Rod Sims said. “Instead, we allege, they failed to do these things, and as a result many consumers paid more for their NBN plans than they needed to.” The statements made by the telcos were on telco websites and emails from the start of April 2019 to the end of April 2020 for Telstra and TPG, and covering calendar year 2019 for Optus.

    The investigation kicked off after Telstra self-reported parts of its conduct to the ACCC. “It is important that internet providers like Telstra, Optus and TPG give their customers accurate information so they can make an informed choice about the service that best suits their needs and budget,” Sims said. “We are pleased that Telstra, Optus and TPG have promised to compensate consumers even before the court case is finalised.” The ACCC said it would be asking the court for orders including declarations, injunctions, pecuniary penalties, publication orders, and the implementation of compliance programs. TPG said in a statement it would be “making things right” with its impacted customers who never received a maximum attainable speed notice. “For the oversight, we are sorry,” a company spokesperson said. “There were two key contributing factors to this issue. The first was failure by NBN Co to provide timely and accurate speed information to TPG Internet. The second was anomalies in TPG Internet’s legacy processes in place since 2017, and these have been fixed post-merger.” TPG added its intent was not to avoid obligations, and of its 2 million customers, “only a small percentage” did not receive information. OAIC opens investigation into Optus White Pages privacy breach The Office of the Australian Information Commissioner (OAIC) has opened an investigation into Optus, following concerns the company breached the data of individuals by publishing their information in the White Pages. The OAIC is investigating Singtel Optus Pty Ltd (Optus) under the Privacy Act 1988. It said the investigation follows preliminary inquiries by the OAIC into data breaches involving publication of Optus customer details in the White Pages, when individuals had asked for their details not to be published. “The public disclosure of personal information against the wishes of individuals may have the potential to cause harm,” it wrote. In 2019, Optus confirmed that customer details were published on Sensis White Pages. Around 50,000 customers were told by the telco that their name, address, mobile, and home phone numbers were published. Optus at the time said around 40,000 were new customers who already listed. “The majority of the affected customers’ details were already listed with Sensis prior to joining Optus,” a spokesperson told ZDNet at the time. “As a priority, Optus arranged for Sensis to remove customer details from their online website directory, operator-directory assistance, and any future printed editions of directories.”The company said it had “notified and apologised” to impacted customers.   The breach was discovered by Optus during a routine audit of 10 million customers. The OAIC accepted an enforceable undertaking from ARC Mercantile back in 2016 following a breach of personal customer data which occurred when an ARC employee posted a spreadsheet of customers owing money to Optus on Freelancer.com. “Optus takes the protection of customer data and privacy seriously,” an Optus spokeswoman told ZDNet in a statement at the time. On Friday, Australian Information Commissioner and Privacy Commissioner Angelene Falk had her post extended for another three years. “Since her appointment in 2018, Ms Falk has effectively led the Office of the Australian Information Commissioner,” a statement from Australia’s Attorney-General said. “She has worked to increase the Australian public’s trust and confidence in the protection of personal information by promoting the understanding of privacy issues and effectively resolving privacy complaints and investigations.” RELATED COVERAGE More

  • in

    Canberra asks big tech to introduce detection capabilities in encrypted communication

    The Australian government has prepared a set of draft rules that requires the likes of social media companies to adhere to if they want to provide a service down under. While failure to comply with reporting requirements could see the provider slapped with a AU$555,000 fine, the draft rules also build in encryption-busting expectations.Australia’s eSafety Commissioner from January will have sweeping new powers afforded to her under the Online Safety Act 2020. Such powers include oversight of new set of Basic Online Safety Expectations (BOSE) that sets out a series of demands for big tech.These expectations [PDF] will apply to service providers including social media; “relevant electronic service of any kind”, such as messaging apps and games; and other designated internet services, such as websites.Under the proposed Draft Online Safety (Basic Online Safety Expectations) Determination 2021, it is expected the provider would have to take reasonable steps to ensure safe use. This includes the “core” expectation that the provider of the service will take reasonable steps to ensure that end-users are able to use the service in a safe manner.The provider is expected to minimise the availability of cyberbullying material targeted at an Australian child, cyber abuse material targeted at an Australian adult, a non-consensual intimate image of a person, class 1 material, material that promotes abhorrent violent conduct, material that incites abhorrent violent conduct, material that instructs in abhorrent violent conduct, and material that depicts abhorrent violent conduct.The expectations also boast additional expectations, such as that the provider of the service will take reasonable steps to proactively minimise the extent to which material or activity on the service is or may be unlawful or harmful.

    Reasonable steps that could be taken, the document said, could be through the development or implementation of processes to detect, moderate, report, and remove material or activity on the service that is or may be unlawful or harmful.In the case of a service or a component of a service, such as an online app or game, that is used by children, the company must ensure the default privacy and safety settings are robust and set to the most restrictive level.The draft BOSE also designate that those involved in providing the service, such as employees or contractors, are trained in, and are expected to implement and promote, online safety. The company must also continually improve safety in its tech and ensure that assessments of safety risks and impacts are undertaken, and safety review processes are implemented, throughout the design, development, deployment, and post-deployment stages for the service.The rules, however, as currently drafted, mandate that if the service uses encryption, the provider of the service will take reasonable steps to develop and implement processes to detect and address material or activity on the service that is or may be unlawful or harmful.See also: Apple child abuse material scanning in iOS 15 draws fireThe government also wants providers to prevent anonymous accounts from being used to deal with material, or for activity, that is or may be unlawful or harmful.It proposes the service could have processes that prevent the same person from repeatedly using anonymous accounts to post material, or to engage in activity, that is unlawful or harmful, and introduce the requirements to verify identity or ownership of accounts.Australia’s eSafety Commissioner will have the power to order tech companies to report on how they are responding to these harms and issue fines of up to AU$555,000 for companies and AU$111,000 for individuals if they don’t respond.Also provided under the legislative instrument are expectations regarding reports and complaints.The provider of the service will be required to have clear and readily identifiable mechanisms that enable end-users to report and make complaints about material provided on the service. The companies will be required to keep records of complaints or reports for five years.eSafety will be backed to receive information requests from providers within 30 days around complaints it has received, removal notice compliance, and measures the provider takes to make their space safe.The provider would also be required to appoint a designated contact for the purpose of the Act.The Bill allows the responsible minister, currently Paul Fletcher, to determine the details of these expectations by legislative instrument. The minister may also determine that the expectations apply to specific services.As such, the government has prepared a consultation paper [PDF] and is accepting submissions until 15 October 2021.HERE’S MOREAustralia’s eSafety and the uphill battle of regulating the ever-changing online realmThe eSafety Commissioner has defended the Online Safety Act, saying it’s about protecting the vulnerable and holding the social media platforms accountable for offering a safe product, much the same way as car manufacturers and food producers are in the offline world.eSafety says tweeting commissioner will not qualify as a formal Online Safety Act requestThe Office of the eSafety Commissioner has said the Twitter dispute that the incumbent has found herself in this week is part of the advice the office provides and that tagging the commissioner will not qualify as a formal request under the new Online Safety Act.Protecting women in the cloud: eSafety hopes the Online Safety Act will do just thatThe commissioner said a lot of online abuse is rooted in misogyny and intended to silence women’s voices. She hopes the new Online Safety Act will go some way to prevent such abuse. More

  • in

    Apple child abuse material scanning in iOS 15 draws fire

    Image: Apple
    On Friday, Apple revealed plans to tackle the issue of child abuse on its operating systems within the United States via updates to iOS 15, iPadOS 15, watchOS 8, and macOS Monterey. The most contentious component of Cupertino’s plans is its child sexual abuse material (CSAM) detection system. It will involve Apple devices matching images on the device against a list of known CSAM image hashes provided by the US National Center for Missing and Exploited Children (NCMEC) and other child safety organisations before an image is stored in iCloud. “Before an image is stored in iCloud Photos, an on-device matching process is performed for that image against the known CSAM hashes. This matching process is powered by a cryptographic technology called private set intersection, which determines if there is a match without revealing the result,” Apple said. “The device creates a cryptographic safety voucher that encodes the match result along with additional encrypted data about the image. This voucher is uploaded to iCloud Photos along with the image.” Once an unstated threshold is reached, Apple will manually look at the vouchers and review the metadata. If the company determines it is CSAM, the account will be disabled and a report sent to NCMEC. Cupertino said users will be able to appeal to have an account re-enabled. Apple is claiming its threshold will ensure “less than a one in one trillion chance per year of incorrectly flagging a given account”. The other pair of features Apple announced on Friday were having Siri and search provide warnings when a user searches for CSAM-related content, and using machine learning to warn children when they are about to view sexually explicit photos in iMessages.

    “When receiving this type of content, the photo will be blurred and the child will be warned, presented with helpful resources, and reassured it is okay if they do not want to view this photo. As an additional precaution, the child can also be told that, to make sure they are safe, their parents will get a message if they do view it,” Apple said. “Similar protections are available if a child attempts to send sexually explicit photos. The child will be warned before the photo is sent, and the parents can receive a message if the child chooses to send it.”
    Image: Apple
    Plans labelled as a backdoor Apple’s plans drew criticism over the weekend, with Electronic Frontier Foundation labelling the features as a backdoor. “If you’ve spent any time following the Crypto Wars, you know what this means: Apple is planning to build a backdoor into its data storage system and its messaging system,” the EFF wrote. “Apple can explain at length how its technical implementation will preserve privacy and security in its proposed backdoor, but at the end of the day, even a thoroughly documented, carefully thought-out, and narrowly-scoped backdoor is still a backdoor.” EFF warned that once the CSAM system was in place, changing the system to search for other sorts of content would be the next step. “That’s not a slippery slope; that’s a fully built system just waiting for external pressure to make the slightest change,” it said. “The abuse cases are easy to imagine: governments that outlaw homosexuality might require the classifier to be trained to restrict apparent LGBTQ+ content, or an authoritarian regime might demand the classifier be able to spot popular satirical images or protest flyers.” The EFF added that with iMessage to begin scanning images sent and received, the communications platform was no longer end-to-end encrypted. “Apple and its proponents may argue that scanning before or after a message is encrypted or decrypted keeps the ‘end-to-end’ promise intact, but that would be semantic manoeuvring to cover up a tectonic shift in the company’s stance toward strong encryption,” the foundation said. Head of WhatsApp Will Cathcart said the Facebook-owned platform would not be adopting Apple’s approach and would instead rely on users reporting material. “This is an Apple built and operated surveillance system that could very easily be used to scan private content for anything they or a government decides it wants to control. Countries where iPhones are sold will have different definitions on what is acceptable,” Cathcart said. The WhatsApp chief asked how the system would work in China, and what would happen once a spyware crew figured out how to exploit the system. WhatsApp does scan unencrypted imagery — such as profile and group photos — for child abuse material. “We have additional technology to detect new, unknown CEI within this unencrypted information. We also use machine learning classifiers to both scan text surfaces, such as user profiles and group descriptions, and evaluate group information and behavior for suspected CEI sharing,” the company said. Former Facebook CSO Alex Stamos said he was happy to see Apple taking responsibility for the impacts of its platform, but questioned the approach. “They both moved the ball forward technically while hurting the overall effort to find policy balance,” Stamos said. “One of the basic problems with Apple’s approach is that they seem desperate to avoid building a real trust and safety function for their communications products. There is no mechanism to report spam, death threats, hate speech, NCII, or any other kinds of abuse on iMessage.” Instead of its “non-consensual scanning of local photos, and creating client-side ML that won’t provide a lot of real harm prevention”, Stamos said he would have preferred if Apple had robust reporting in iMessage, staffed a child safety team to investigate reports, and slowly rolled out client-side machine learning. The former Facebook security chief said he feared Apple had poisoned the well on client-side classifiers. “While the PRC has been invoked a lot, I expect that the UK Online Safety Bill and EU Digital Services Act were much more important to Apple’s considerations,” he said. Whistleblower Edward Snowden accused Apple of deploying mass surveillance around the globe. “Make no mistake: if they can scan for kiddie porn today, they can scan for anything tomorrow,” he said. “They turned a trillion dollars of devices into iNarcs—*without asking.*” Late on Friday, 9to5Mac reported on an internal memo from Apple that contained a note from NCMEC. “We know that the days to come will be filled with the screeching voices of the minority,” NCMEC reportedly said. Related Coverage More

  • in

    Why is your identity trapped inside a social network?

    The thing that makes the Internet the Internet is that everything connects. And the reason that everything connects is because almost everything on the Internet has an address. An Ethernet port that connects a computer to the network has what’s called a “MAC” address. A host computer is reachable via an IP address. And servers each have a URL so they can be contacted.  All of these forms of address are the result of what are called protocols. Protocols, the central achievement of the Internet, are an agreement about how things will be addressed so that everything can to be reached. They are protocols because they are not owned by anyone, they are agreed to by everyone who wants to participate, and they are universal. But human beings don’t have a protocol on the Internet. To the extent that people on the Internet connect to one another as people, it is only via private databases. People only interact to the extent that one party, the owner of that database, allows them to interact. Facebook is the social graph of people’s identities, created and kept inside a private database. Twitter is the information graph of people’s interests, created and kept inside a private database.  For all intents and purposes, humans don’t exist as individuals on social networks. Their identities are the creation of advertising databases, phantoms of the daydreams of a computer program.
    Tiernan Ray for ZDNet
    The same is true for identities inside of Snap and Pinterest and Tik Tok and LinkedIn and everywhere else that people’s identities are formed. To the extent that interaction with others — and particularly individual control over those interactions — forms a core part of one’s identity, no one has an identity on the Internet except what is created inside those private social databases.  The stakes are high for identity, because Facebook, in particular, but others as well, view identity as the last frontier to replace the Internet with something of their own creation. On Facebook’s Q2 conference call last month, founder and CEO Mark Zuckerberg described what he coined the “metaverse,” a world that sounds like a replacement for the Internet:  So what is the metaverse? It’s a virtual environment where you can be present with people in digital spaces. And you can kind of think about this as an embodied Internet that you’re inside of rather than just looking at, and we believe that this is going to be the successor to the mobile Internet. You’re going to be able to access the metaverse from all different devices and different levels of fidelity, from apps on phones and PCs to immersive virtual and augmented reality devices. Within the metaverse, you’re going to be able to hang out, play games with friends, work, create, and more. You’re basically going to be able to do everything that you can on the Internet today as well as some things that don’t make sense on the Internet today like dancing. The defining quality of the metaverse is presence, which is this feeling that you’re really there with another person or in another place. Creation, avatars, and digital objects are going to be central to how we express ourselves. This is going to lead to entirely new experiences and economic opportunities. Just like that, Facebook will redefine connecting to one another as being inside — deep inside — a Facebook reality.

    Given the rather stark prospect of the metaverse as a single Internet controlled by one company, one wonders, Why should it be the case that the open arrangement of the Internet doesn’t extend to the one area of humans’ participation that is arguably most important to each individual, their identity? And by extension, why doesn’t the Internet have a personal protocol to ensure connectivity between people just as it does between computers?  Also: Physics explains why there is no information on social media The simplest answer is that the people who created the Internet didn’t foresee that it would be used for social activities. They didn’t foresee it, so they didn’t build it. “I totally missed the entire world of social networks,” said Leonard Kleinrock, one of the key inventors of the Internet, in a recent talk via Zoom to a small audience.  Kleinrock sent the first packets of data over the Internet from his laboratory at UCLA in 1969. “I was still thinking of computers talking to each other, maybe people talking to computers, but not people talking to people,” Kleinrock reflected. Kleinrock was speaking as the guest in a forum last month, the Collective[i] Forecast, which is organized by Collective[i], which bills itself as “an AI platform designed to optimize B2B sales.” No one, said Kleinrock, in the early days expected anything like social, or even email, which got underway shortly after the first packets were sent, in 1972.  “Nobody saw email, nobody saw YouTube, nobody saw the Web, nobody saw peer-to-peer transfer, nobody saw blockchain,” said Kleinrock. “It came in a surprising way, and as soon as it hit, it became contagious, explosive, and very quickly almost dominated the network.” “I totally missed the entire world of social networks,” says Leonard Kleinrock, one of the key inventors of the Internet. “I was still thinking of computers talking to each other, maybe people talking to computers, but not people talking to people.”
    Collective[i]
    As a consequence of that blind spot by Kleinrock and others, the network never developed what might have been a personal protocol. Kleinrock, looking back, regards the lack of built-in authentication of people as one of the failings of the Internet. The Internet, he said, should have built in both file authentication and “strong user authentication.” The latter would make sure that ‘If you’re talking to me, you’ve got to prove it’s you.” For lack of a protocol, social media stepped in to fill the void.  Numerous effects have flowed from that role of social, including many pernicious ones.  One bad effect is that social media is an island that exists inside the Internet, a gatekeeper of interconnection. People cannot connect to one another unless they subscribe to a given service. The same presumption of universal connectivity between machines doesn’t exist between people. In fact, the only way for users of a service such as Facebook to alert users of a service such as Twitter, and vice versa, is for both users to back off to a service that is actually open and ubiquitous, email.   Also: Exclusive: Internet pioneer Kleinrock returns to fix what ails the internet A larger implication is privacy. Every user of a social network signs on to give vast control over personal information to social media, with potentially disastrous consequences, as seen in the Cambridge Analytica scandal. There is no lever by which an individual can negotiate with social media companies for what they would like as the treatment of their information — precisely because within a social network, a person’s information belongs not to them, but to the operator of that private database. “When’s the last time Facebook asked you what privacy protocol you would like applied to you?” Kleinrock pointed out in his talk. “Industry is abusing its power right now.” When individuals want to avoid mis-use of information, such as rampant cookie tracking, their only hope is that another large corporation, such as Apple, will start a fight with social media, and that the outcome may be to the user’s benefit.  The implications of that privacy wormhole stretch far beyond social media. The lack of a personal protocol means every new personal tech gadget is similarly appropriating your personal information without consent.  As Shoshana Zuboff writes in The Age of Surveillance Capitalism, Google’s Nest thermostat “comes with a ‘privacy policy,’ a ‘terms-of-service agreement, and an ‘end-user licensing agreement’,” each of which gather all kinds of personal information.  “Nest takes little responsibility for the security of the information it collects and none for how the other companies in its ecosystem will put those data to use.” With a personal protocol, it is conceivable users could be given some control in the form of deliberate consent to such terms.A third implication of the lack of a personal protocol is the relative lack of competition in social networks. As seen by the collapse of Google’s Google+ effort, building a competitive social graph to vie with Facebook’s social graph is a losing proposition.  Never mind that Twitter is competition for Facebook, and so is Pinterest, and Snap and LinkedIn, etc., and all of them are competing for the same eyeballs. They may have different styles, but they don’t ensure diversity in social. The services all tend toward a certain sameness, a formula meant to shape behavior to sell advertising.  Collectively, there is little to no information on social media, and that is a direct consequence of the fact that social media doesn’t have enough competition in the absence of an open protocol. Legislators and regulators have tried to draught legislation to undo the stanglehold of Facebook and the rest on social, but that’s unlikely to achieve much. A surer form of breaking the oligopoly would be to continue the unfinished business of the Internet. A personal protocol, like every other protocol on the Internet, could allow for multiple different social graphs and interest graphs. Each one would each have to solicit the interest of users and bargain for their information. By definition, those users’ information would be portable, since it would belong to them, not to a database. That would allow movement between social networks, which could result in greater diversity and greater connectedness of individuals.   The question is whether anything can be done at this point in time, given the enormous momentum behind Facebook and the rest. There have been efforts over the years to develop something like an open social media protocol. For example, the OpenSocial working group was active in the World Wide Web Consortium, the W3C, from 2014 to 2017 as an effort to develop a programming interface by which applications could move between different social networks, known as the Social Web. The effort was ended in early 2018. The social networks that supported OpenSocial, moreover, went away or withered, including Google+ and MySpace. Remember Friendster?  Some work on a form of OpenSocial seems to have continued on an open-source effort called the Social Hub and the Fediverse. It appears to be in the hands of a very small group of devotees, with little momentum at present.  Newer efforts suggest the appetite is still there for alternatives. The W3C has a federated identity community group that claims it “will both support federated identity and prevent untransparent, uncontrollable tracking of users across the web.”  The W3C is also working on something called the Metaverse, which the organization describes as an effort to “bridge virtual worlds by designing and promoting protocols for identity, social graphs, inventory, and more.” It’s totally separate from Zuckerberg’s metaverse.   A third initiative is the portable personal data preferences effort, which seeks to “define a way for users to express preferences regarding the collection, use, and disclosure of their personal information.” Kleinrock, in the same talk at the Collective[i] Forecast, laid out what a social protocol should like. It would have a heavy emphasis on the control by an individual of their own personal information: It should be possible for you to articulate what privacy policy you want. You’d be able to say, in some simple language, not a thirty page document, I don’t want you to take my contact database, I don’t want you to track my behavior on the Web, I’ll allow you to do this and not that. And you get a simple graphical picture as to what you’re allowed. And then the industry group comes and says, this is the privacy policy I’m applying. If it fits, fine. If it doesn’t, you negotiate. If you can’t negotiate, you walk. What I’m asking for is a customized privacy policy for every user. And the industry says, what are you talking about, we can’t afford to have a unique privacy policy for every user. And I say, baloney, they already feed you adds which are perfectly customized to you. It sounds simple, but there are major hurdles. One is what’s known as Metcalfe’s Law, coined by Bob Metcalfe, the inventor of Ethernet, and the University of Texas at Austin professor of innovation.  “It’s my point of view that the most important new fact about the human condition is that we are now connected,” says Bob Metcalfe, inventor of the ethernet networking standard. 
    Collective[i]
    Metcalfe’s Law says that the value of a computer network increases as the square of the number of nodes that it can connect. Metcalfe was talking about nodes as computers, but think of nodes in the case of social media as being people. (In fact, Metcalfe has shown how his Law perfectly describes the exponential growth of social networking.) With 1.91 billion daily users on Facebook, and hundreds of millions of people on all the other social networks, there is a built-in momentum that acts as intertia against a new protocol luring users away from the private databases. That momentum is what Metcalfe refers to as “network effects,” the centrifical force that keeps participants in a network from leaving. No one has proven that network effects can not be undone or reversed. However, as Kleinrock said during his forum, there is the additional challenge that changing Internet infrastructure is harder now that the Internet has built into it certain usage patterns and infrastructure dependency. “It’s really hard, when you have billions of people out there, to change a) their behavior; or b) the rules by which they operate or the protocols they use,” said Kleinrock. “The legacy system is huge.””In the early days of the Arpanet, we had a totally clean sheet. We had it very easy. Now it’s very difficult to make those changes.”Again, the stakes are high. As Metcalfe pointed out during an appearance in another Collective[i] Forecast forum, “It’s my point of view that the most important new fact about the human condition is that we are now connected.” “In fifty years, more than half the human race has gone onto the Internet,” said Metcalfe. “More of us need to focus on studying connectivity per se.” As things stand, humans on the Internet don’t really exist in cyberspace as individuals. They exist as the creation of advertising machines to monetize a manufactured identity by monopolizing information. Humans exist as phantoms, daydreams of a computer program. More

  • in

    5G network infrastructure revenue to grow by more than $5 billion in 2021: Gartner

    A new report from Gartner has predicted a revenue growth of 39% for the worldwide 5G network infrastructure market in 2021. The estimated $19.1 billion in revenue will far surpass 2020’s figure of $13.7 billion, according to Gartner. Michael Porowski, senior principal research analyst at Gartner, said the COVID-19 pandemic “spiked demand for optimized and ultrafast broadband connectivity to support work-from-home and bandwidth-hungry applications, such as streaming video, online gaming and social media applications.” “Business and customer demand is an influencing factor in this growth. As consumers return to the office, they will continue to upgrade or switch to gigabit fiber to the home service as connectivity has become an essential remote work service,” said Porowski. “Users will also increasingly scrutinize CSPs for both office and remote work needs.”The shift corresponded with an acceleration in 5G development in 2020 and 2021 thanks to communications service providers (CSPs) in mature markets. Gartner found that 5G accounted for 39% of the total revenue brought in from wireless infrastructure this year. The report also noted that investment in other wireless infrastructure is waning “rapidly” across “all regions” as CSPs shift to 5G small cells.Through increased adoption of dynamic spectrum sharing and millimeter wave base stations, CSPs across North America will reach $4.3 billion in 5G revenue in 2021, up from $2.9 billion last year. CSPs in Western Europe are taking a different tack, focusing on licensing spectrum, modernizing mobile core infrastructure and navigating regulatory processes as they slowly grow 5G revenue from $794 million in 2020 to nearly $2 billion in 2021. 

    Gartner added that the Greater China region would still retain its top spot, with $9.1 billion in 2021 through 5G revenue.By 2024, Gartner predicts that 60% of CSPs will provide commercializable 5G services.Gartner researchers also touted the 10-Gigabit-capable symmetric-PON (XGS-PON) technology, which they believe will be used by 60% of the Tier-1 CSPs by 2025. More