Friday the Free Software Foundation awarded their coveted "Respects Your Freedom" (RYF) certification to another new product: the Free Software Wireless-N Mini Router v3 (TPE-R1300) from ThinkPenguin, Inc.

Just 45 products currently hold the FSF's certification "that these products meet the FSF's standards in regard to users' freedom, control over the product, and privacy." (That is to say, they run on 100% free software, allow the installation of modified software, and are free from DRM, spyware and tracking.) The FSF writes: As with previous routers from ThinkPenguin, the Free Software Wireless-N Mini Router v3 ships with an FSF-endorsed fully free embedded GNU/Linux distribution called libreCMC. It also comes with a custom flavor of the U-Boot boot loader, assembled by Robert Call, who is the maintainer of libreCMC and a former FSF intern.

The router enables users to run multiple devices on a network through a VPN service, helping to simplify the process of keeping their communications secure and private. While ThinkPenguin offers a VPN service, users are not required to purchase a subscription to their service in order to use the router, and the device comes with detailed instructions on how to use the router with a wide variety of VPN providers...

"ThinkPenguin once again demonstrates a long-standing commitment to protecting the rights of their users. With the latest iteration of the Wireless-N Mini Router, users know that they'll have up to date hardware they can trust for years to come," said the FSF's licensing and compliance manager, Donald Robertson, III.
Phoronix points its readers to the device's page at ThinkPenguin.com "should you be looking to build out your wireless network using the decade old 802.11n standard."

Last week came the news that Dan Kaminsky, security researcher (and popular speaker at security conferences), had passed away at the age of 42. In a half hour the DEF CON security convention will hold a special online memorial for Dan Kaminsky on Discord.

But interestingly, Kaminsky was also one of ICANN's "Trusted Community Representatives," part of a small community involved in a ceremonial root key generation, backup and signing process. (Since 2010 Kaminsky was one of the seven "Recovery Key Share Holders" entrusted with a fragment of a cryptographic key and reporting in for its annual inventory.)

So who will take Dan's place? Slashdot contacted ICANN's vice president of IANA Services, Kim Davies. His response? We maintain an open invitation for volunteers who believe they are qualified, and review those volunteers when a vacancy arises. The selection process is documented, but in essence means we try to maintain a balance of skills and geographic location so that in the aggregate the TCRs are diverse.

The selection is not in chronological order, and will not necessarily result in selecting someone who most matches Dan's attributes. Ultimately the replacement will be a volunteer that the evaluation panel feels best contrasts and complements the attributes of the remaining TCRs.
Davies also shared this remembrance of Dan Kaminsky: He played a critical role in the evolution of the DNS by bringing attention to the practical cache poisoning vulnerability he discovered. He was a greater collaborator who worked closely with us to rapidly address the issue in critical infrastructure, and then worked to promote technologies like DNSSEC that can mitigate it effectively in the long term. He really provided a significant catalyst that resulted in DNSSEC being put into widespread production in 2010.

His service as a Trusted Community Representative was just a part of his commitment to these issues, and while his work on the DNS is perhaps his most famous contribution, he has an amazing resume of accomplishments throughout his career.

Personally I found him a delight to work with and we are deeply mourning the loss.
Of course, there's another way to follow in Dan's footsteps. Long-time Slashdot reader destinyland writes: Jeff Moss, founder of DEF CON and Black Hat, has proposed nominating Kaminsky for the Internet Hall of Fame, or even creating a Kaminsky award to honor "the core ideals" of the security researcher. But there's another complementary direction to go in... Black Hat board member Matt Devost tweeted last weekend that, "No one that knew Dan Kaminsky well is talking about DNS today. They are talking about kindness, boundless energy and positivity, spontaneous adventures, and how hard he worked to lift others up. Want to emulate one of the greatest hackers of all time? Let that be your guide."

And last week a self-described hacker named Dr. Russ even tweeted, "In an effort to honor Dan Kaminsky's character and legacy, we should all make a random act of Kaminsky weekly. Make it a point to be kind and helpful to someone, friend or stranger. Legit helpful and kind, take it over the finish line. Be the persistent guide he was. Then do it again."

I propose we call that "pulling a Kaminsky."
Presumably in the way later generations in William Gibson's Count Zero talked of "pulling a Wilson...."

There was a big announcement this week from Mozilla. They've joined Fastly, Intel, and Microsoft "in announcing the incorporation and expansion of the Bytecode Alliance, a cross-industry partnership to advance a vision for fast, secure, and simplified software development based on WebAssembly." Building software today means grappling with a set of vexing trade-offs. If you want to build something big, it's not realistic to build each component from scratch. But relying on a complex supply chain of components from other parties allows a defect anywhere in that chain to compromise the security and stability of the entire program.

Tools like containers can provide some degree of isolation, but they add substantial overhead and are impractical to use at per-supplier granularity. And all of these dynamics entrench the advantages of big companies with the resources to carefully manage and audit their supply chains.

Mozilla helped create WebAssembly to allow the Web to grow beyond JavaScript and run more kinds of software at faster speeds. But as it matured, it became clear that WebAssembly's technical properties — particularly memory isolation — also had the potential to transform software development beyond the browser by resolving the tension described above. Several other organizations shared this view, and we came together to launch the Bytecode Alliance as an informal industry partnership in late 2019. As part of this launch, we articulated our shared vision and called for others to join us in bringing it to life... [W]e asked prospective members to be patient and, in parallel with ongoing technical efforts, worked to incorporate the Alliance as a formal 501(c)(6) organization. That process is now complete, and we're thrilled to welcome Arm, DFINITY Foundation, Embark Studios, Google, Shopify, and University of California at San Diego as official members of the Bytecode Alliance.

We have a real opportunity to change how software is built, and in doing so, enable small teams to build big things that are both secure and fast.

Achieving the elusive trifecta — easy composition, defect isolation, and high performance — requires both the right technology and a coordinated effort across the ecosystem to deploy it in the right way. Mozilla believes that WebAssembly has the right technical ingredients to build a better, more secure Internet, and that the Bytecode Alliance has the vision and momentum to make it happen.

"Despite early claims by #Tesla #ElonMusk, Autopilot WAS engaged in tragic crash in The Woodlands," tweeted U.S. Congressman Kevin Brady on Wednesday. (Adding "We need answers.")

But maybe it depends on how you define Autopilot. CNN reports: Tesla said Monday that one of Autopilot's features was active during the April 17 crash that killed two men in Spring, Texas....

Lars Moravy, Tesla's vice president of vehicle engineering, said on the company's earnings call Monday that Tesla's adaptive cruise control was engaged and accelerated to 30 mph before the car crashed. Autopilot is a suite of driver assistance features, including traffic-aware cruise control and Autosteer, according to Tesla's website... The North American owner's manuals for the Model 3, Model S and Model X, all describe traffic-aware cruise control as an Autopilot feature. Tesla's revelation may be at odds with the initial description of the crash from its CEO Elon Musk, who said two days after the crash that "data logs recovered so far show Autopilot was not enabled."
Alternately, Forbes suggests there may just be some confusion, noting that earnings call included descriptions of tests Tesla performed on one of their own cars after the accident. So when they said adaptive cruise control "only accelerated the car to 30mph [over] the distance before the car crashed," they could just have been referring to their own experiments. (Tesla also points out adaptive cruise control only engages when the driver is buckled — and disengages slowly if they're unbuckled — and after the Texas crash all seat belts were unbuckled.)

Why so much confusion? Part of the problem may be, as CNN points out, that Tesla "generally does not engage with the professional news media."

But The Drive shares another theory about the crash: A relative of the deceased told a local news station that the owner allegedly "may have hopped in the back seat after backing the car out of the driveway." Moments later, the car crashed when it failed to negotiate a turn at high speed.
CNN adds: Bryan Reimer, the associate director of the New England University Transportation Center at MIT, who studies driver assistance systems like Autopilot, said one of the plausible explanations for the crash is that the driver was confused and thought they had activated Autosteer, when only traffic-aware cruise control had been turned on. "The general understanding of Autopilot is that it's one feature, but in reality it is two things bolted together," said Reimer, referring to traffic-aware cruise control and Autosteer.
But according to the Washington Post, Tesla also disputes that theory: Tesla executives on Monday claimed a driver was behind the wheel at the time of a fatal crash that killed two in suburban Houston this month, contradicting local authorities who have previously said they were certain no one was in that seat. Tesla made the statement on its earnings call Monday... Lars Moravy, the company's vice president of vehicle engineering, said the steering wheel was "deformed," indicating a driver's presence at the time of the crash...

Mark Herman, constable for Harris County Precinct 4, told the station KHOU that police were "100 percent certain that no one was in the driver's seat."

"Chromium-based web browser Opera is all set to fully integrate with blockchain domain name provider Unstoppable Domains," reports TechRadar, "in a bid to provide millions of its users with decentralized web access." Opera users will now be able to access decentralized websites hosted via the InterPlanetary File System (IPFS) using Unstoppable Domains' popular .crypto NFT addresses from the Opera browser. This will include platforms such as iOS, Android, Windows, Mac or Linux. Right now, Opera has over 320 million monthly active users across its offerings, following the addition of a crypto wallet to its browsers in 2019.

Unstoppable Domains was launched in 2018 and provides domain names to users with no renewal fees. Users of Unstoppable Domains are granted full ownership and control when they claim a domain because it is minted as an NFT on the Ethereum blockchain. Domain names such as .crypto replace complex wallet addresses for payments across over 40 cryptocurrency wallets and exchanges in addition to accessing the decentralized web through Opera.

Maciej Kocemba, Product Director at Opera said that the company believes in giving all people the ability to access the full web, regardless of the technology behind it.
The Opera product director was further quoted by Business Insider: "We have always supported web innovation, and the decentralized web or Web3 is the natural next wave. Making Unstoppable Domains accessible in the Opera browsers means our users can try blockchain technologies for themselves. Registering your .crypto domain, which is forever yours, is a great first step into Web3," the company's product director Maciej Kocemba said.

Opera is quickly becoming a leader in pushing for the adoption of Web 3.0, also often described as the decentralized web.

Florida is on track to be the first state in America to punish social media companies that ban politicians, reports NBC News, "under a bill approved Thursday by the state's Republican-led Legislature." Gov. Ron DeSantis, a Republican and close Trump ally who called for the bill's passage, is expected to sign the legislation into law, but the proposal appears destined to be challenged in court after a tech industry trade group called it a violation of the First Amendment speech rights of corporations...

Suspensions of up to 14 days would still be allowed, and a service could remove individual posts that violate its terms of service. The state's elections commission would be empowered to fine a social media company $250,000 a day for statewide candidates and $25,000 a day for other candidates if a company's actions are found to violate the law, which also requires the companies to provide information about takedowns and apply rules consistently...

Florida Republican lawmakers have cited tech companies' wide influence over speech as a reason for the increased regulation. "What this bill is about is sending a loud message to Silicon Valley that they are not the absolute arbiters of truth," state Rep. John Snyder, a Republican from the Port St. Lucie area, said Wednesday... The Florida bill may offer Republicans in other states a road map for introducing laws that could eventually force social media companies and U.S. courts to confront questions about free speech on social media, including the questions raised by Thomas.

State Rep. Carlos Guillermo Smith, an Orlando area Democrat, said if Republicans want to stay on private services, they should follow the rules. "There's already a solution to deplatforming candidates on social media: Stop trafficking in conspiracy theories...."
NetChoice, a trade group for internet companies, argued the bill punishes platforms for removing harmful content, and that it would make it harder to block spam. But they also argued that the freedom of speech clause in the U.S. Constitution "makes clear that government may not regulate the speech of private individuals or businesses.

"This includes government action that compels speech by forcing a private social media platform to carry content that is against its policies or preferences."

Slashdot reader zantafio points out the bill specifies just five major tech companies — Google, Apple, Twitter, Facebook and Amazon.

And that the bill was also amended to specifically exempt Disney, Universal and any theme park owner that operates a search engine or information service.

An anonymous reader quotes a report from Ars Technica: Baidu, China's leading search engine, is often compared to Google. And just as Google has spun off Waymo to commercialize self-driving technology, so Baidu is developing self-driving technology of its own. On Thursday, the Chinese search giant announced the launch of what it is calling China's first paid autonomous vehicle service, known as Apollo Go. Arguably, the service is better described as a shuttle service than a taxi service. Customers are picked up and dropped off from one of eight predefined stations. The initial service area is 2.7 square kilometers -- a little over one square mile. The longest route in the network is 5 km (3 miles). That makes the service a lot smaller than the Waymo One taxi service in Phoenix, which has a service area of around 50 square miles.

Still, there's little doubt that Baidu is one of China's leading self-driving companies -- and that China is the world's No. 2 market for self-driving technology after the United States. In total, Baidu is testing fully driverless vehicles in three Chinese cities and is testing its technology with safety drivers in more than two dozen cities. Baidu has even gotten permission to test fully driverless vehicles near its Silicon Valley offices in Sunnyvale. Another Chinese company, AutoX, has been testing fully driverless vehicles in Shenzhen since December. The service has been open to select members of the public since January, though AutoX hasn't started charging for rides. Several other Chinese companies are working on self-driving technology.

Australian security software house Click Studios has told customers not to post emails sent by the company about its data breach, which allowed malicious hackers to push a malicious update to its flagship enterprise password manager Passwordstate to steal customer passwords. TechCrunch reports: Last week, the company told customers to "commence resetting all passwords" stored in its flagship password manager after the hackers pushed the malicious update to customers over a 28-hour window between April 20-22. The malicious update was designed to contact the attacker's servers to retrieve malware designed to steal and send the password manager's contents back to the attackers. In an email to customers, Click Studios did not say how the attackers compromised the password manager's update feature, but included a link to a security fix.

But news of the breach only became public after Danish cybersecurity firm CSIS Group published a blog post with details of the attack hours after Click Studios emailed its customers. Click Studios claims Passwordstate is used by "more than 29,000 customers," including in the Fortune 500, government, banking, defense and aerospace, and most major industries.

In an update on its website, Click Studios said in a Wednesday advisory that customers are "requested not to post Click Studios correspondence on Social Media." The email adds: "It is expected that the bad actor is actively monitoring Social Media, looking for information they can use to their advantage, for related attacks." "It is expected the bad actor is actively monitoring social media for information on the compromise and exploit. It is important customers do not post information on Social Media that can be used by the bad actor. This has happened with phishing emails being sent that replicate Click Studios email content," the company said. The report says Click Studios has remained extremely tightlipped about the situation. The company has refused to comment or respond to questions; it's also unclear if the company has disclosed the breach to U.S. and EU authorities, which require companies to disclose data breach incidents or face hefty fines.

Boris Johnson's personal mobile phone number has been freely available on the internet for the past 15 years, it has been revealed. The BBC reports: It was published in a think tank press release in 2006, but never deleted -- and appears to be the one the PM uses. Labour leader Sir Keir Starmer said it was "a serious situation [that] carries a security risk." But Chancellor Rishi Sunak said that, as far as he was aware, "all security protocols have been followed." It appears the number has been switched off but Downing Street still has not confirmed if the number will now be changed.

The think tank press release with the PM's number on it was related to Mr Johnson's then-job as a shadow higher education minister - and MP for Henley - and invited journalists to contact him for further comment. Two years later, he successfully stood to become mayor of London. Former national security adviser Lord Ricketts warned hostile states with "sophisticated cyber capabilities" or criminal gangs could now have access to Mr Johnson's digits. The crossbench peer also told BBC Radio 4's Today program that he would have thought changing your mobile number when becoming PM would be an "elementary security precaution these days."

Earlier this week, The Verge reported that Microsoft now has 145 million people using its Microsoft Teams communications app, an increase of 26 percent over last year's reported 115 million daily active users. From the report: To put the 145 million figure in perspective, at the beginning of the pandemic, Microsoft had around 32 million daily active users of Microsoft Teams. That jumped to 75 million in a matter of weeks, and these numbers have more than doubled since even the early days of the pandemic. It's an impressive amount of growth, just as Microsoft has been aggressively pushing businesses to move to the cloud and adopt Teams over the past year.

As always, it's difficult to compare to rival services. Google and Zoom don't reveal daily active users and opt for a more vague daily active participants. This means a single user could be counted multiple times if they participate in different meetings during a day. Zoom revealed it had 300 million daily active participants last year, and Google said last year it had 100 million daily active participants. Slack revealed it had 12.5 million concurrent users during the beginning of the pandemic last year, but the company has shied away from daily active user counts ever since.

An anonymous reader quotes a report from TechCrunch: Following a controversial ban on political discussions earlier this week, Basecamp employees are heading for the exits. The company employs around 60 people, and roughly a third of the company appears to have accepted buyouts to leave, many citing new company policies. On Monday, Basecamp CEO Jason Fried announced in a blog post that employees would no longer be allowed to openly share their "societal and political discussions" at work. "Every discussion remotely related to politics, advocacy or society at large quickly spins away from pleasant," Fried wrote. "You shouldn't have to wonder if staying out of it means you're complicit, or wading into it means you're a target."

Basecamp's departures are significant. According to Twitter posts, Basecamp's head of design, head of marketing and head of customer support will all depart. The company's iOS team also appears to have quit en masse and many departing employees have been with the company for years. [...] According to Platformer, Fried's missive didn't tell the whole story. Basecamp employees instead said the tension arose from internal conversations about the company itself and its commitment to DEI work, not free-floating arguments about political candidates. Fried's blog post does mention one particular source of tension in a roundabout way, referencing an employee-led DEI initiative that would be disbanded. "We make project management, team communication, and email software," Fried wrote. "We are not a social impact company."

It's been just over a year since Microsoft announced it had hit its goal of 1 billion monthly active Windows 10 devices. It took a while to get there, but Microsoft now says Windows 10 is growing even faster, reaching a whopping 1.3 billion active installs in the last quarter. From a report: Like a number of other technology firms, Microsoft has the global pandemic to thank for its windfall. It turns out people buy more computers when they're stuck at home. "Over a year into the pandemic, digital adoption curves aren't slowing down. They're accelerating, and it's just the beginning," said CEO Satya Nadella. The latest device count comes from Microsoft's earnings report, which featured a stunning $41.7 billion in revenue for the quarter.

English soccer teams and organizations are all shutting down their Facebook, Twitter, and Instagram accounts for the weekend as part of a massive social media blackout to advocate for better policies regarding discrimination and abuse that players and members of clubs receive on those platforms. From a report: Groups participating in the blackout include the Premier League, the English Football League, the Professional Footballers' Association, the Football Association, the League Managers Association, the Football Supporters' Association, and more. Clubs that are part of the Premier League, EFL, Barclays FA Women's Super League, and Women's Championship will all be shutting down their social channels over the weekend as part of the protest. The blackout comes after the various English soccer organizations banded together in February to request changes from Facebook CEO Mark Zuckerberg and Twitter CEO Jack Dorsey in an open letter requesting that the companies take stronger action against discriminatory and racist comments.

Trade groups representing AT&T, Verizon and other telecom companies are opening fire on a new law requiring them to provide discounted internet service to low-income households in New York. From a report: New York's first-in-the-nation law could be adopted by other states at a time when the White House has signaled it wants to reduce broadband prices for all Americans. Driving the news: Trade associations USTelecom, CTIA, the New York State Telecommunications Association and others representing smaller companies filed a lawsuit Friday against New York's new law requiring providers in the state to offer broadband service for $15 a month to low-income households. New York estimates that 7 million people in 2.7 million households will qualify for the discounted service. "This program -- the first of its kind in the nation -- will ensure that no New Yorker will have to forego having reliable home internet service and no child's education will have to suffer due to their economic situation," Governor Andrew Cuomo said in a statement when he signed the legislation in April.

In the Great Recession more than a decade ago, big tech companies hit a rough patch just like everyone else. Now they have become unquestioned winners of the pandemic economy. From a report: The combined yearly revenue of Amazon, Apple, Alphabet, Microsoft and Facebook is about $1.2 trillion, according to earnings reported this week, more than 25 percent higher than the figure just as the pandemic started to bite in 2020. In less than a week, those five giants make more in sales than McDonald's does in a year. The U.S. economy is cranking back from 2020, when it contracted for the first time since the financial crisis. But for the tech giants, the pandemic hit was barely a blip. It's a fantastic time to be a titan of U.S. technology -- as long as you ignore the screaming politicians, the daily headlines about killing free speech or dodging taxes, the gripes from competitors and workers, and the too-many-to-count legal investigations and lawsuits.

America's technology superpowers aren't making bonkers dollars in spite of the deadly coronavirus and its ripple effects through the global economy. They have grown even stronger because of the pandemic. It's both logical and slightly nuts. The wildly successful last year also raises uncomfortable questions for tech company bosses, the public and elected officials already peeved about the industry: Is what's good for Big Tech good for America? Or are the tech superstars winning while the rest of us are losing?

Google was one of the first big companies to move its workforce out of the office in the early days of the pandemic, but now it's calling employees back. Some of them said they don't intend to return. From a report: While tech firms such as Microsoft and Twitter have announced plans to allow employees to work from home permanently, Google has resisted going fully remote, and employees said there's an increasing sense of frustration among a faction of the workforce. That frustration spilled onto social media last week: "Spoken to quite a few colleagues at Google that say they'll quit if forced to go back to the office in September," Chris Broadfoot, a Google Cloud programmer, tweeted on Thursday. Other employees joined the thread to cosign the message, with some saying they may look for another job if Google makes them go back to the office.

A half-dozen Google employees who spoke with Insider shared a similar sentiment or said they knew colleagues who had made permanent moves during the pandemic. They asked to remain anonymous because they were not authorized to speak to the press. "A lot of my colleagues have moved away with no real intention of coming back," one of those employees said. "Especially in that 30s-40s age bracket. I would say that's predominantly where it is." That same employee told Insider they had handed in their notice after their request to work in a location outside of the Bay Area was shot down by their manager. Further reading: Google Is Saving Over $1 Billion a Year by Working From Home.

YouTube TV has been removed from Roku's channel store, after Roku and YouTube TV parent Google failed to come to a distribution agreement amid accusations that the tech giant made anti-competitive demands. From a report: These spats happen regularly between Pay-TV providers and linear TV networks. But in the digital era, this is one of the rare times in which consumers will have a major streaming network removed from their platform's channel store due to a breakdown in negotiations. The channel will still be available for existing YouTube TV customers, but new users that wish to download the app from Roku's channel store will no longer have the ability to do so. Roku is keeping the app available to existing users so that customers don't get caught up in the messy negotiations. Earlier this week, Roku notified customers that YouTube TV may be forced off its platform if it couldn't come to an agreement with Google over a distribution deal. Notably, the dispute between Google and Roku is not over financial terms.

Hmmmmmm shares a report from The Guardian: The French government is planning to harden counter-terrorism laws, permitting the use of algorithms to detect online extremist activity, amid a growing political row over security in the run up to next year's presidential race. The interior minister, Gerald Darmanin, said attackers were now "isolated individuals, increasingly younger, unknown to intelligence services, and often without any links to established Islamist groups." This was a growing problem for France because they self-radicalized very quickly, within days or weeks. These attackers no longer used text messages or mobile phones to communicate but instead went online or used social media direct messaging, he said. Darmanin said algorithms would allow the state to potentially pick up if a person was repeatedly searching online for a topic such as beheadings. He argued that Google and other online commercial sites already used algorithms and the state should be able to as well, with independent oversight -- despite concern from some rights lawyers that there would not be enough transparency.

"The last nine attacks on French soil were committed by individuals who were unknown to the security services, who were not on a watchlist and were not suspected of being radicalised," Darmanin told France Inter radio. This meant new methods were needed, he said, adding that of 35 attacks prevented by the state since 2017, two were stopped by intelligence work online. Since 2017, French security agencies have been able to use algorithms to monitor messaging apps. The new bill would make that experimental use permanent and extend the use of algorithms to websites and web searches. The legislation makes permanent several temporary measures in use since France's state of emergency after the Islamist terrorist attacks in 2015. It would give security agencies more power to watch over and limit the movements of high-risk individuals after release from jail, for two years rather than one.

According to Bloomberg, Verizon is considering selling AOL and Yahoo -- two once high-flying dot-com brands it purchased in 2015 and 2017, respectively. Bloomberg reports: Verizon Media could fetch as much as $5 billion [...]. The company is talking to Apollo Global Management about a deal, they said. It couldn't immediately be learned how a deal would be structured or if other suitors may emerge. No final decision has been made and Verizon could opt to keep the unit. The move comes as Verizon divests tertiary media assets while ramping up its focus on its wireless business and the the rollout of its 5G service. Last year, it agreed to sell the HuffPost online news service to BuzzFeed Inc. and it unloaded the blogging platform Tumblr in 2019. This divestiture would mark Verizon's final retreat from an expensive foray into online advertising, a strategy that never really took off.

schwit1 shares a report from Threatpost: Quick-response (QR) codes used by a COVID-19 contact-tracing program were hijacked by a man who simply slapped up scam QR codes on top to redirect users to an anti-vaccination website, according to local police. He now faces two counts of "obstructing operations carried out relative to COVID-19 under the Emergency Management Act," the South Australia Police said in a statement announcing the arrest. His arrest may just be a drop in the bucket: Reports of other anti-vax campaigners doing the same thing abound. Law enforcement added an additional warning to would-be QR code scammers: "Any person found to be tampering or obstructing with business QR codes will likely face arrest and court penalty of up to $10,000." The police said no personal data was breached, but the incident highlights that truly all an attacker needs is a printer and a pack of Avery labels to do real damage.

In this case, the QR codes were being used by the South Australian government's official CovidSafe app to access a device's camera, scan the code and collect real-time location data to be used for contact tracing in case of a COVID-19 outbreak, ABC News Australia reported. That's a lot of personal data linked to a single QR code just waiting to be stolen. "In this instance, people who scanned the illegitimate QR code were redirected to a website distributing misinformation from the anti-vaxxer community," Bill Harrod, vice president of public sector at Ivanti, told Threatpost. "While this is concerning, the outcome could have been far more perilous."