As protests continue to rock Hong Kong, social media sites are now being used to share names, photos, phone numbers, ages and occupationa of individuals "on both sides of the protest line," reports the Guardian: Supporters of the Hong Kong government have sought to identify masked protesters at demonstrations, while protesters themselves also appear to have taken part, sharing private information about police officers and their families across Telegram... Hong Kong's privacy commission said it had received 1,376 complaints and 126 enquiries between 14 June and 18 September regarding personal information being leaked online, according to Stephen Kai-yi Wong, privacy commissioner for personal data. While journalists have become a high-profile target, about 40% of cases involve police officers while the rest concern government officials, community leaders, the families of police officers, and other citizens, Wong said....

Craig Choy, a spokesperson for Hong Kong's Progressive Lawyers Group and a specialist in data protection law, said the high volume of cases was unprecedented in Hong Kong... The privacy commission has referred nearly 1,000 cases for criminal investigation and consideration for prosecution. Eight people were arrested in July for doxxing police officers, according to Hong Kong Free Press. Choy said doxxing of police began after officers stopped wearing badge numbers on their uniforms when they attended protests -- leading protesters to attempt to identify officers independently as police tactics and arrests began to escalate.

An anonymous reader quotes Tom's Hardware: One Raspberry Pi can make a nice web server, but what happens if you put more than 1,000 of them together? At Oracle's OpenWorld convention on Monday, the company showed off a Raspberry Pi Supercomputer that combines 1,060 Raspberry Pis into one powerful cluster.

According to ServeTheHome, which first reported the story, the supercomputer features scores of racks with 21 Raspberry Pi 3 B+ boards each. To make everything run well together, the system runs on Oracle Autonomous Linux... Every unit connects to a single rebranded Supermicro 1U Xeon server, which functions as a central storage server for the whole supercomputer. The Oracle team also created custom, 3D printed brackets to help support all the Pis and connecting components...

ServeTheHome asked Oracle why it chose to create a cluster of Raspberry Pis instead of using a virtualized Arm server and one company rep said simply that "...a big cluster is cool."

An anonymous reader quotes a report from ZDNet: A software engineer pulled a personal project down after he found out that one of the companies using it had recently signed a contract with the U.S. Immigrations and Customs Enforcement (ICE). The engineer, Seth Vargo, cited the ICE's "inhumane treatment, denial of basic human rights, and detaining children in cages," as the reason for taking down his library. The project was called Chef Sugar, a Ruby library for simplifying work with Chef, a platform for configuration management. Varga developed and open-sourced the library while he worked at Chef, and the library was later integrated into Chef's source code.

Earlier this week, a Twitter user discovered that Chef was selling $95,000-worth of licenses through a government contractor to the ICE. The news didn't go well with Vargo, who, yesterday, September 19, took down the Chef Sugar library from both GitHub and RubyGems, the main Ruby package repository, in a sign of protest. "I have a moral and ethical obligation to prevent my source from being used for evil," Vargo wrote on the now-empty Chef Sugar GitHub repository. Vargo's actions didn't go unnoticed, and in a blog post published later in the day, Chef Software CEO Barry Crist said the incident impacted "production systems for a number of our customers." The Chef team fixed the issue by scouring some of the older Chef Sugar source code and re-uploading it on their own GitHub account. Following public criticism of the contract, Chef Software CEO Barry Crist responded by saying the company had been a long-time ICE collaborator for years, since the previous administration, long before ICE became the hated agency it is today.

"While I understand that many of you and many of our community members would prefer we had no business relationship with DHS-ICE, I have made a principled decision, with the support of the Chef executive team, to work with the institutions of our government, regardless of whether or not we personally agree with their various policies," Crist said.

"I want to be clear that this decision is not about contract value - it is about maintaining a consistent and fair business approach in these volatile times. I do not believe that it is appropriate, practical, or within our mission to examine specific government projects with the purpose of selecting which U.S. agencies we should or should not do business," Crist added.

India is planning to set up one of the world's largest facial recognition systems, potentially a lucrative opportunity for surveillance companies and a nightmare for privacy advocates who fear it will lead to a Chinese-style Orwellian state. Bloomberg reports: Prime Minister Narendra Modi's government will open bids next month to build a system to centralize facial recognition data captured through surveillance cameras across India. It would link up with databases containing records for everything from passports to fingerprints to help India's depleted police force identify criminals, missing persons and dead bodies. The government says the move is designed to help one of the world's most understaffed police forces, which has one officer for every 724 citizens -- well below global norms. It also could be a boon for companies: TechSci Research estimates India's facial recognition market will grow sixfold by 2024 to $4.3 billion, nearly on par with China.

But the project is also ringing alarm bells in a nation with no data privacy laws and a government that just shut down the internet for the last seven weeks in the key state of Kashmir to prevent unrest. While India is still far from implementing a system that matches China's ability to use technology to control the population, the lack of proper safeguards opens the door for abuses.

An anonymous reader quotes a report from Gizmodo: Two individuals were arrested this week in connection with a fraud scheme that manipulated thousands of victims into paying for invented tech services that they didn't need. The Department of Justice announced that the two individuals Romana Leyva, 35, and Ariful Haque, 33, were arrested Wednesday for their alleged participation in the fraud scheme, which involved convincing victims -- many of whom were elderly -- in both the U.S. and Canada that they needed tech and virus protection services that were neither real nor required.

Between March 2015 and December 2018, both Ariful and Haque were allegedly involved with the fraud ring responsible for the crimes. According to an unsealed indictment, the scheme involved targeting victims with pop-up windows -- sometimes under the guise of being a legitimate tech company -- that claimed their computer had been infected with a virus and directed them to call a number for technical support. In some cases, the message threatened that if the individual closed the window or shut down their computer, it would either bork their device or result in a "complete data loss." Once users contacted the number, they were connected with a fake technician. To convince victims to hand over money, after receiving "permission" from the victim, the fraud ring allegedly remotely accessed the individual's computer, loaded an anti-virus tool that's available for free online, and informed the individual that their computer was infected with a virus (which, again, was a lie). The DOJ says the scheme was able to successfully scam "at least" 7,500 victims out of a combined $10 million.

Both of the individuals arrested are charged with one count of wire fraud and one count of conspiracy to commit wire fraud. Each count carries a maximum penalty of 20 years imprisonment.

Freshly Exhumed shares a report from Phoronix, detailing a new set of systemd capabilities shown off by lead developer Lennart Poettering at the annual All Systems Go conference: Improving the Linux handling of user home directories is the next ambition for systemd. Among the goals are allowing more easily migratable home directories, ensuring all data for users is self-contained to the home directories, UID assignments being handled to the local system, unified user password and encryption key handling, better data encryption handling in general, and other modernization efforts. Among the items being explored by systemd-homed are JSON-based user records, encrypted LUKS home directories in loop-back files, and other next-gen features to offering secure yet portable home directories. Systemd-homed is currently being developed in Lennart's Git tree but hopes to see it merged for either systemd 244 (the current cycle) or systemd 245.

As noted by Zatz Not Funny, TiVo is testing pre-roll video ads that start playing when customers view one of their recordings. The Verge reports: The ad spots are noticeably low-res and worse quality than the DVR'd content that starts playing afterward, according to one TiVo owner who has been served spots for Amazon, Keurig, and Toyota. It sounds like the users can fast-forward through the ads, but doing so is "not that seamless."

There are several potential reasons for TiVo ramping up advertising. Maybe the company plans to offer an ad-supported subscription with lower (or no) monthly fees compared to what regular customers are paying (similar to Amazon's Kindle devices with ads). No one who has paid for a lifetime subscription or even a monthly plan will be pleased to see pre-roll ads. TiVo also handles DVR functionality for many midsized and international cable providers. Squeezing in ads wherever possible could be something that those companies are pushing for as more of their customers spend increased time streaming shows and movies elsewhere.

MojoKid writes: Lakka with RetroArch is one of the most comprehensive open-source retro-gaming console front ends available, with support for a wide array of single-board computers and multiple operating systems. Although the more powerful Raspberry Pi 4 was released months ago, the developers of Lakka had a number of bugs to contend with that prevented an official stable release, until yesterday. Lakka 2.3 (with RetroArch 1.7.8) is available now though, and it appears to leverage the additional horsepower of the Pi 4 quite well. It's even able to play some of the more demanding Sega Dreamcast and Saturn games -- among many other retro-consoles, like the Atari 2600, SuperNES, and many others. In addition to the Pi 4, this latest Lakka release also adds support for the ROCKPro64 and incorporates a wide range of bug fixes and feature enhancements.

An anonymous reader quotes a report from Ars Technica: Apple released iOS 13 with a bunch of new features. But it also released the new OS with something else: a bug disclosed seven days ago that exposes contact details without requiring a passcode or biometric identification first. Independent researcher Jose Rodriguez published a video demonstration of the flaw exactly one week ago. It can be exploited by receiving a FaceTime call and then using the voiceover feature from Siri to access the contact list. From there, an unauthorized person could get names, phone numbers, email addresses, and any other information stored in the phone's contacts list. An Apple representative told Ars the bypass will be fixed in iOS 13.1, scheduled for release on Sept. 24.

New submitter Bioblaze shares a report from CNET: Google has reportedly built a quantum computer more powerful than the world's top supercomputers. A Google research paper was temporarily posted online this week, the Financial Times reported Friday, and said the quantum computer's processor allowed a calculation to be performed in just over 3 minutes. That calculation would take 10,000 years on IBM's Summit, the world's most powerful commercial computer, Google reportedly said. Google researchers are throwing around the term "quantum supremacy" as a result, the FT said, because their computer can solve tasks that can't otherwise be solved. "To our knowledge, this experiment marks the first computation that can only be performed on a quantum processor," the research paper reportedly said.

New submitter screwdriver1 shares a report from The Next Web: In a yet another instance of Android adware, New Zealand-based independent security researcher Andy Michael found four apps with cumulative downloads of over 500 million that not only serve ads while running the background, but are also placed outside the apps, including the home screen. The apps in question are Hotspot VPN, Free VPN Master, Secure VPN, and Security Master by Cheetah Mobile. It's notable that all these apps originate from Hong Kong and China, where citizens have typically relied on VPNs to get around the Great Firewall. The apps are live on the Play Store to this date. But in an interesting twist, the apps containing the adware were all VPN or antivirus apps, suggesting that developers are increasingly banking on users' trust in security-related apps to commit "outside ad fraud."

Google has a strict policy with regards to adware and disruptive ads in general. "We don't allow apps that contain deceptive or disruptive ads. Ads must only be displayed within the app serving them. We consider ads served in your app as part of your app. The ads shown in your app must be compliant with all our policies." The company, when reached for a response, said it would take action on the apps if they're indeed found in violation of its policies. Some VPN apps lie to us and Google shouldn't allow it.

An anonymous reader quotes a report from TechCrunch: Google announced today that it was investing approximately $3.3 billion to expand its data center presence in Europe. What's more, the company pledged the data centers would be environmentally friendly. This new investment is in addition to the $7 billion the company has invested since 2007 in the EU, but today's announcement was focused on Google's commitment to building data centers running on clean energy, as much as the data centers themselves.

In a blog post announcing the new investment, CEO Sundar Pichai, made it clear that the company was focusing on running these data centers on carbon-free fuels, pointing out that he was in Finland today to discuss building sustainable economic development in conjunction with a carbon-free future with prime minister Antti Rinne. Of the 3 billion Euros, the company plans to spend, it will invest 600 million to expand its presence in Hamina, Finland, which he wrote "serves as a model of sustainability and energy efficiency for all of our data centers." Further, the company already announced 18 new renewable energy deals earlier this week, which encompass a total of 1,600-megawatts in the U.S., South America and Europe. Google is also "investing in new skills training, so people can have the tools to be able to handle the new types of jobs these data centers and other high tech jobs will require," the report says. "The company claims it has previously trained 5 million people in Europe for free in crucial digital skills, and recently opened a Google skills hub in Helsinki."

After successfully predicting laboratory earthquakes, a team of geophysicists has applied a machine learning algorithm to quakes in the Pacific Northwest. From a report: In May of last year, after a 13-month slumber, the ground beneath Washington's Puget Sound rumbled to life. The quake began more than 20 miles below the Olympic mountains and, over the course of a few weeks, drifted northwest, reaching Canada's Vancouver Island. It then briefly reversed course, migrating back across the U.S. border before going silent again. All told, the monthlong earthquake likely released enough energy to register as a magnitude 6. By the time it was done, the southern tip of Vancouver Island had been thrust a centimeter or so closer to the Pacific Ocean. Because the quake was so spread out in time and space, however, it's likely that no one felt it. These kinds of phantom earthquakes, which occur deeper underground than conventional, fast earthquakes, are known as "slow slips." They occur roughly once a year in the Pacific Northwest, along a stretch of fault where the Juan de Fuca plate is slowly wedging itself beneath the North American plate.

More than a dozen slow slips have been detected by the region's sprawling network of seismic stations since 2003. And for the past year and a half, these events have been the focus of a new effort at earthquake prediction by the geophysicist Paul Johnson. Johnson's team is among a handful of groups that are using machine learning to try to demystify earthquake physics and tease out the warning signs of impending quakes. Two years ago, using pattern-finding algorithms similar to those behind recent advances in image and speech recognition and other forms of artificial intelligence, he and his collaborators successfully predicted temblors in a model laboratory system -- a feat that has since been duplicated by researchers in Europe. Now, in a paper posted this week on the scientific preprint site arxiv.org, Johnson and his team report that they've tested their algorithm on slow slip quakes in the Pacific Northwest. The paper has yet to undergo peer review, but outside experts say the results are tantalizing. According to Johnson, they indicate that the algorithm can predict the start of a slow slip earthquake to "within a few days -- and possibly better."

Reuters: Uber Technologies sued New York City on Friday over a new rule limiting how much time its drivers can spend in their vehicles in Manhattan without passengers, saying the rule threatens to undermine the company's ride sharing model. In its complaint filed in a New York state court in Manhattan, Uber called the "cruising cap" rule adopted last month "arbitrary and capricious," and said it was based on a flawed economic model.

Facebook revealed Friday that it had suspended "tens of thousands" of apps that may have mishandled users' personal data, [Editor's note: the link may be paywalled; alternative source] part of an investigation sparked by the social giant's entanglement with Cambridge Analytica. From a report: The suspensions -- far more than the hundreds against which Facebook has taken action against in the past -- occurred for a "variety of reasons," the company said in a blog post, without elaborating. They were associated with about 400 developers. Facebook said it had investigated millions of apps and targeted those that Facebook said had access to "large amounts of information" or had the "potential to abuse" its policies. Facebook said some of the apps were banned for inappropriately sharing users' data, the same violation of company policy that led to the Cambridge Analytica scandal. It added that its investigation, now 18 months long, isn't yet complete.

The F.B.I. has used secret subpoenas to obtain personal data from far more companies than previously disclosed, The New York Times reported Friday, citing newly released documents. From the report: The requests, which the F.B.I. says are critical to its counterterrorism efforts, have raised privacy concerns for years but have been associated mainly with tech companies. Now, records show how far beyond Silicon Valley the practice extends -- encompassing scores of banks, credit agencies, cellphone carriers and even universities. The demands can scoop up a variety of information, including usernames, locations, IP addresses and records of purchases. They don't require a judge's approval and usually come with a gag order, leaving them shrouded in secrecy. Fewer than 20 entities, most of them tech companies, have ever revealed that they've received the subpoenas, known as national security letters.

The documents, obtained by the Electronic Frontier Foundation through a Freedom of Information Act lawsuit and shared with The New York Times, shed light on the scope of the demands -- more than 120 companies and other entities were included in the filing -- and raise questions about the effectiveness of a 2015 law that was intended to increase transparency around them. "This is a pretty potent authority for the government," said Stephen Vladeck, a law professor at the University of Texas who specializes in national security. "The question is: Do we have a right to know when the government is collecting information on us?"

Cyberattacks are now considered by most execs to be the top business concern, far outranking economic uncertainty, brand damage, and regulation, according to a survey by insurance consultancy Marsh and tech giant Microsoft. From a report: The global survey of over 1,500 business leaders illustrates the rapid change in business leaders' perceived risks to their organizations and shows that having a cyber insurance policy is now more common than two years ago. In 2017, Marsh and Microsoft found that 62% of respondents saw cyberattacks as a top-five risk, whereas this year 79% do. The share of respondents who see cyber attacks as the number one risk has also risen from 6% to 22% over two years. This year, the second most widely considered top-five risk is economic uncertainty, followed by brand damage, regulation, and loss of key personnel. [...] According to Marsh and Microsoft's survey, 47% of organizations have cyber insurance [PDF], up from 34% in 2017. Additionally, 57% of large firms with annual revenues of over $1bn report having cyber insurance compared with 36% of organizations with revenues below $100m. Nearly all respondents, totaling 89%, are confident their cyber insurance policy would cover the cost of a cyber event.

An anonymous reader quotes a report from TechCrunch: Silicon Valley is terrified. In a little over three months, California will see the widest-sweeping state-wide changes to its privacy law in years. California's Consumer Privacy Act (CCPA) kicks in on January 1 and rolls out sweeping new privacy benefits to the state's 40 million residents -- and every tech company in Silicon Valley. California's law is similar to Europe's GDPR. It grants state consumers a right to know what information companies have on them, a right to have that information deleted and the right to opt-out of the sale of that information.

Since the law passed, tech giants have pulled out their last card: pushing for an overarching federal bill. In doing so, the companies would be able to control their messaging through their extensive lobbying efforts, allowing them to push for a weaker statute that would nullify some of the provisions in California's new privacy law. In doing so, companies wouldn't have to spend a ton on more resources to ensure their compliance with a variety of statutes in multiple states. Just this month, a group of 51 chief executives -- including Amazon's Jeff Bezos, IBM's Ginni Rometty and SAP's Bill McDermott -- signed an open letter to senior lawmakers asking for a federal privacy bill, arguing that consumers aren't clever enough to "understand rules that may change depending upon the state in which they reside." Then, the Internet Association, which counts Dropbox, Facebook, Reddit, Snap, Uber (and just today ZipRecruiter) as members, also pushed for a federal privacy law. "The time to act is now," said the industry group. If the group gets its wish before the end of the year, the California privacy law could be sunk before it kicks in. TechNet, a "national, bipartisan network of technology CEOs and senior executives," also demanded a federal privacy law, claiming -- and without providing evidence -- that any privacy law should ensure "businesses can comply with the law while continuing to innovate." Its members include major venture capital firms, including Kleiner Perkins and JC2 Ventures, as well as other big tech giants like Apple, Google, Microsoft, Oracle and Verizon

"It's no accident that the tech industry launched this campaign right after the California legislature rejected their attempts to undermine the California Consumer Privacy Act," Jacob Snow, a technology and civil liberties attorney at the ACLU of Northern California, told TechCrunch. "Instead of pushing for federal legislation that wipes away state privacy law, technology companies should ensure that Californians can fully exercise their privacy rights under the CCPA on January 1, 2020, as the law requires."

The team overseeing the Hayabusa2 mission for the Japan Aerospace Exploration Agency (JAXA) is putting the vehicle through its paces one more time as it prepares to release the last rover it has on board. "That rehearsal, which took place Sept. 16 (Sept. 17 local time at mission control), sent two target markers toward the asteroid," reports Space.com. From the report: Each target marker is a reflective ball that's about 4 inches (10 centimeters) across and filled with smaller balls -- like a high-tech beanbag. Hayabusa2 launched with five of these markers and had already deployed two, one last October and one in May. Two more left the spacecraft during the rehearsal this week, according to JAXA. During the procedure, the spacecraft photographed the target markers every 4 seconds, producing the raw material that mission personnel have turned into stunning would-be multiple-exposure images.

As the camera snapped, the target marker itself stayed more or less in the same place, while the spacecraft itself rose at a speed of about 4 inches per second, according to a statement from JAXA. All told, the target markers took a few days to reach the asteroid's surface, on account of the space rock's very weak gravity. Since deploying the two target markers, Hayabusa2 has focused on observing the pair, which it will continue to do until Sept. 23, according to JAXA. The agency has not yet announced when it will deploy the spacecraft's final rover. That deployment marks the last task Hayabusa2 needs to complete before it ferries its precious space-rock cargo back to Earth. The spacecraft will leave Ryugu in November or December.

An anonymous reader quotes a report from Ars Technica: If you've noticed an uptick of spam that addresses you by name or quotes real emails you've sent or received in the past, you can probably blame Emotet. It's one of the world's most costly and destructive botnets -- and it just returned from a four-month hiatus. A post published on Tuesday by researchers from Cisco's Talos security team helps explain how Emotet continues to threaten so many of its targets.

Spam sent by Emotet often appears to come from a person the target has corresponded with in the past and quotes the bodies of previous email threads the two have participated in. Emotet gets this information by raiding the contact lists and email inboxes of infected computers. The botnet then sends a follow-up email to one or more of the same participants and quotes the body of the previous email. It then adds a malicious attachment. The result: malicious messages that are hard for both humans and spam filters to detect. The use of previously sent emails isn't new, since Emotet did the same thing before it went silent in early June. But with its return this week, the botnet is relying on the trick much more. About 25% of spam messages Emotet sent this week include previously sent emails, compared with about 8% of spam messages sent in April. "To make sending the spam easier, Emotet also steals the usernames and passwords for outgoing email servers," the report adds. "Those passwords are then turned over to infected machines that Emotet control servers have designated as spam emitters. The Talos researchers found almost 203,000 unique pairs that were collected over a 10-month period."

Malwarebytes says Emotet has brought back another tactic where it refers to targets by name in subject lines. "Once opened, the documents attached to the emails claim that, effective September 20, 2019, users can only read the contents after they have agreed to a licensing agreement for Microsoft Word," reports Ars Technica. "And to do that, according to a post from security firm Cofense, users must click on an Enable Content button that turns on macros in Word."

"After Office macros are enabled, Emotet executables are downloaded from one of five different payload locations," Cofense researchers Alan Rainer and Max Gannon wrote. "When run, these executables launch a service that looks for other computers on the network. Emotet then downloads an updated binary and proceeds to fetch TrickBot if a (currently undetermined) criteria of geographical location and organization are met."