The Pentagon this week announced two finalists in the $10 billion, decade-long JEDI cloud contract process -- and Oracle was not one of them. From a report: In spite of lawsuits, official protests and even back-channel complaining to the president, the two finalists are Microsoft and Amazon. "After evaluating all of the proposals received, the Department of Defense has made a competitive range determination for the Joint Enterprise Defense Infrastructure Cloud request for proposals, in accordance with all applicable laws and regulations. The two companies within the competitive range will participate further in the procurement process," Elissa Smith, DoD spokesperson for Public Affairs Operations told TechCrunch. She added that those two finalists were in fact Microsoft and Amazon Web Services (AWS, the cloud computing arm of Amazon).

Ford CEO Jim Hackett scaled back hopes about the company's plans for self-driving cars this week, admitting that the first vehicles will have limits. From a report: "We overestimated the arrival of autonomous vehicles," said Hackett, who once headed the company's autonomous vehicle division, at a Detroit Economic Club event on Tuesday. While Ford still plans on launching its self-driving car fleet in 2021, Hackett added that "its applications will be narrow, what we call geo-fenced, because the problem is so complex." Hackett's announcement comes nearly six months after its CEO of autonomous vehicles, Sherif Markaby, detailed plans for the company's self-driving car service in a Medium post. The company has invested over $4 billion in the technology's development through 2023, including over $1 billion in Argo AI, an artificial intelligence company that is creating a virtual driver system. Ford is currently testing its self-driving vehicles in Miami, Washington, D.C. and Detroit.

Two security researchers disclosed details this week about a group of vulnerabilities collectively referred to as Dragonblood that impact the Wi-Fi Alliance's recently launched WPA3 Wi-Fi security and authentication standard. From a report: If ever exploited, the vulnerabilities would allow an attacker within the range of a victim's network to recover the Wi-Fi password and infiltrate the target's network. In total, five vulnerabilities are part of the Dragonblood ensemble -- a denial of service attack, two downgrade attacks, and two side-channel information leaks.

While the denial of service attack is somewhat unimportant as it only leads to crashing WPA3-compatible access points, the other four are the ones that can be used to recover user passwords. Both the two downgrade attacks and two side-channel leaks exploit design flaws in the WPA3 standard's Dragonfly key exchange -- the mechanism through which clients authenticate on a WPA3 router or access point. In a downgrade attack, Wi-Fi WPA3-capable networks can be coerced in using an older and more insecure password exchange systems, which can allow attackers to retrieve the network passwords using older flaws.

An anonymous reader quotes a report from The Verge: U.S. lawmakers have introduced a bill that would require large companies to audit machine learning-powered systems -- like facial recognition or ad targeting algorithms -- for bias. The Algorithmic Accountability Act is sponsored by Senators Cory Booker (D-NJ) and Ron Wyden (D-OR), with a House equivalent sponsored by Rep. Yvette Clarke (D-NY). If passed, it would ask the Federal Trade Commission to create rules for evaluating "highly sensitive" automated systems. Companies would have to assess whether the algorithms powering these tools are biased or discriminatory, as well as whether they pose a privacy or security risk to consumers.

The Algorithmic Accountability Act is aimed at major companies with access to large amounts of information. It would apply to companies that make over $50 million per year, hold information on at least 1 million people or devices, or primarily act as data brokers that buy and sell consumer data. These companies would have to evaluate a broad range of algorithms -- including anything that affects consumers' legal rights, attempts to predict and analyze their behavior, involves large amounts of sensitive data, or "systematically monitors a large, publicly accessible physical place." That would theoretically cover a huge swath of the tech economy, and if a report turns up major risks of discrimination, privacy problems, or other issues, the company is supposed to address them within a timely manner.

RockDoctor writes: A common trope in "the world is going to end, maybe tomorrow" alarmism is the prospect of the earth undergoing one of its frequent (but aperiodic) magnetic field reversals. Popular conceptions have migrating birds falling out of the sky, satellites and GPS systems no longer working, and much other such silliness. Of course, geologists point out that it has literally all happened before, that there is no significant association of extinction with reversals, and that what evidence there is points to a reversal taking a number of centuries to millennia to achieve. And then the next story comes out and the same old "sky is falling" garbage comes out again.

Just for a change, an astronomer has thrown in his few cents worth. In a letter to The Astrophysical Journal (Warning: source paywalled; alternative source), Manasvi Lingam of Harvard University looks at the implications of a magnetic reversal, or of the "switching on" of the Earth's "dynamo" on the flux of radiation experienced by an organism living near the surface. Lingam deduces that during a reversal (or before the dynamo started) "neither the biological radiation dose rates [...] would vary by more than a factor of 2." Behind the "..." is a prospect which will appeal to those looking for ways to die, as "the atmospheric escape rate" is also somewhat affected by the strength of the magnetic field. As a theoretical astronomer, Lingam agrees with the geological record (yay!) that field reversals are unlikely to have major effects on life, or on the atmosphere, or really, on anything other than astronomers' and geophysicists' gauges and dials. None of this will even slightly slow down the overblown hysteria that accompanies the next twitch of the magnetic field.

"A growing cadre of neuroscientists is using sophisticated technology -- and some very complicated math -- to capture what happens in one brain, two brains, or even 12 or 15 at a time when their owners are engaged in eye contact, storytelling, joint attention focused on a topic or object, or any other activity that requires social give and take," reports Scientific American. "Although the field of interactive social neuroscience is in its infancy, the hope remains that identifying the neural underpinnings of real social exchange will change our basic understanding of communication and ultimately improve education or inform treatment of the many psychiatric disorders that involve social impairments." Here's an excerpt from the report: [T]he first study to successfully monitor two brains at the same time took place nearly 20 years ago. Physicist Read Montague, now at Virginia Tech, and his colleagues put two people in separate functional magnetic resonance imaging (fMRI) machines and observed their brain activity as they engaged in a simple competitive game in which one player (the sender) transmitted a signal about whether he or she had just seen the color red or green and the other player (the receiver) had to decide if the sender was telling the truth or lying. Correct guesses resulted in rewards. Montague called the technique hyperscanning, and his work proved it was possible to observe two brains at once.

Initially, Montague's lead was followed mostly by other neuroeconomists rather than social neuroscientists. But the term hyperscanning is now applied to any brain imaging research that involves more than one person. Today the techniques that fit the bill include electroencephalography (EEG), magnetoencephalography and functional near-infrared spectroscopy. Use of these varied techniques, many of them quite new, has broadened the range of possible experiments and made hyperscanning less cumbersome and, as a consequence, much more popular. The report also mentions a study from earlier this year that "used hyperscanning to show that eye contact prepares the social brain to empathize by activating the same areas of each person's brain simultaneously: the cerebellum, which helps predict the sensory consequences of actions, and the limbic mirror system, a set of brain areas that become active both when we move any part of the body (including the eyes) and when we observe someone else's movements."

Amazon reportedly employs thousands of people around the world to help improve its Alexa digital assistant. "The team listens to voice recordings captured in Echo owners' homes and offices," reports Bloomberg. "The recordings are transcribed, annotated and then fed back into the software as part of an effort to eliminate gaps in Alexa's understanding of human speech and help it better respond to commands." From the report: The team comprises a mix of contractors and full-time Amazon employees who work in outposts from Boston to Costa Rica, India and Romania, according to the people, who signed nondisclosure agreements barring them from speaking publicly about the program. They work nine hours a day, with each reviewer parsing as many as 1,000 audio clips per shift, according to two workers based at Amazon's Bucharest office, which takes up the top three floors of the Globalworth building in the Romanian capital's up-and-coming Pipera district. The modern facility stands out amid the crumbling infrastructure and bears no exterior sign advertising Amazon's presence. The work is mostly mundane. One worker in Boston said he mined accumulated voice data for specific utterances such as "Taylor Swift" and annotated them to indicate the searcher meant the musical artist. Occasionally the listeners pick up things Echo owners likely would rather stay private: a woman singing badly off key in the shower, say, or a child screaming for help. The teams use internal chat rooms to share files when they need help parsing a muddled word -- or come across an amusing recording.

Sometimes they hear recordings they find upsetting, or possibly criminal. Two of the workers said they picked up what they believe was a sexual assault. When something like that happens, they may share the experience in the internal chat room as a way of relieving stress. Amazon says it has procedures in place for workers to follow when they hear something distressing, but two Romania-based employees said that, after requesting guidance for such cases, they were told it wasn't Amazon's job to interfere. [...] Amazon, in its marketing and privacy policy materials, doesn't explicitly say humans are listening to recordings of some conversations picked up by Alexa. "We use your requests to Alexa to train our speech recognition and natural language understanding systems," the company says in a list of frequently asked questions. In Alexa's privacy settings, the company gives users the option of disabling the use of their voice recordings for the development of new features. A screenshot reviewed by Bloomberg shows that the recordings sent to the Alexa auditors don't provide a user's full name and address but are associated with an account number, as well as the user's first name and the device's serial number. An Amazon spokesperson said in a statement to Bloomberg: "We take the security and privacy of our customers' personal information seriously. We only annotate an extremely small sample of Alexa voice recordings in order [to] improve the customer experience. For example, this information helps us train our speech recognition and natural language understanding systems, so Alexa can better understand your requests, and ensure the service works well for everyone."

They added: "We have strict technical and operational safeguards, and have a zero tolerance policy for the abuse of our system. Employees do not have direct access to information that can identify the person or account as part of this workflow. All information is treated with high confidentiality and we use multi-factor authentication to restrict access, service encryption and audits of our control environment to protect it."

Further reading: How To Stop Amazon From Listening To Your Recordings

An anonymous reader quotes a report from The Register: An American company is to build a series of undersea cables linking Australia to China after the Aussie government put its foot down and kicked Huawei off the contract. Building on our reports from last year that Australia had blocked Huawei from building a 4,000km cable between Australia, Papua New Guinea and the Solomon Islands, U.S. company TE Subcom has reportedly won the deal to build the link.

"All options for meshing the Pacific Islands are good for the development of the economies of these countries," Keir Preedy, chief executive of the Solomon Island Submarine Cable Company, told Reuters. The company is developing the Solomons' new cable. In addition to the Aus-PNG-Solomons route previously announced, TE Subcom will build a cable spur to Hong Kong -- Chinese territory. "It is due for completion in 2022 and also includes a possible trans-Pacific branch to Los Angeles," the newswire stated.

Freshly Exhumed writes: RCMP officers spotted a man driving with earbuds plugged into his iPhone. The phone was not in his hands nor on his lap, was not playing music or video, and the driver was not using it to talk to someone or navigate. The battery was, in fact, completely dead. Nonetheless, a judge has ruled that "by plugging the earbud wire into the iPhone, the defendant had enlarged the device, such that it included not only the iPhone (proper) but also attached speaker or earbuds," he wrote. "Since the earbuds were part of the electronic device and since the earbuds were in the defendant's ears, it necessarily follows that the defendant was holding the device (or part of the device) in a position in which it could be used, i.e. his ears." On the question of the battery, the judge said he relied on a 2015 precedent set in a Canadian provincial court, which says that holding an electronic device in a position where it could be used constitutes an offense, even if it is temporarily not working.

An anonymous reader writes: If you were paying close attention during Google Cloud Next 2019 yesterday, you may have heard talk of Cloud Code. The new developer tool was only mentioned briefly, but today Google offered more details. Cloud Code extends two Integrated Development Environments (IDEs), IntelliJ and Visual Studio Code, to cloud-native Kubernetes applications. Google's message here is that moving to the cloud isn't just about data. It can also be about code, and the developers who write it. IDEs are designed for editing, compiling, and debugging code for local applications. Google wants to adapt them to developing applications for the cloud.

An anonymous reader quotes a report from Ars Technica: Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. What was unprecedented in this attack -- and of considerable concern to some researchers and critical infrastructure operators -- was the use of an advanced piece of malware that targeted the unidentified site's safety processes. The malware was named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. Its development was ultimately linked to a Russian government-backed research institute.

Now, researchers at FireEye -- the same security firm that discovered Triton and its ties to Russia -- say they have uncovered an additional intrusion that used the same malicious software framework against a different critical infrastructure site. As was the case in the first intrusion, the attackers focused most of their resources on the facility's OT, or operational technology, which are systems for monitoring and managing physical processes and devices. The discovery has unearthed a new set of never-before-seen custom tools that shows the attackers have been operational since as early as 2014. The existence of these tools, and the attackers' demonstrated interest in operational security, lead FireEye researchers to believe there may be other sites beyond the two already known where the Triton attackers were or still are present. "After establishing an initial foothold on the corporate network, the Triton actor focused most of their effort on gaining access to the OT network," FireEye researchers wrote in a report published Wednesday. "They did not exhibit activities commonly associated with espionage, such as using key loggers and screenshot grabbers, browsing files, and/or exfiltrating large amounts of information. Most of the attack tools they used were focused on network reconnaissance, lateral movement, and maintaining presence in the target environment."

T-Mobile today unveiled a new name for its Layer3 TV internet television service -- TVision Home -- with enhanced features, and announced a deal with Amazon to add Prime Video to the service later in 2019. From a report: TVision Home will be available starting April 14 in eight markets (the same areas Layer3 TV has already been available): Chicago, Dallas-Fort Worth, Los Angeles, New York City, Philadelphia, San Francisco, Washington D.C., and Longmont, Colo. It's not a skinny bundle: TVision Home starts at $90 per month, which includes more than 150 channels, local broadcast stations and regional sports networks, as well as 15,000 VOD titles. Premium TV packages like HBO and Showtime are extra. In addition, TVision Home users must pay a $10 monthly set-top fee per connected TV. (Actually, the regular price of TVision Home for non-T-Mobile wireless customers is $99.99 per month, but the carrier is including a $9.99-per-month discount to all new subs for a limited time.)

Bowing to growing pressure from opponents who say that cashless stores leave out low-income Americans, Amazon plans to take cash at its 10 cashierless "Go" stores. From a report: Amazon Go stores, located in San Francisco, Chicago and Seattle, use AI and cameras to check out customers. Amazon reportedly is considering opening up to to 3,000 by 2021. "We are working to accept cash," a spokesperson for Amazon said Wednesday. "Paying cash at Amazon Go will work as you would expect: you'll check out, pay with cash, and then get your change." Amazon did not say when Go stores will begin accepting cash. Amazon also said its bookstores will start taking cash, but did not share any details.

Steve Kessel, Amazon's senior vice president of physical stores, told employees last month that Go stores would add "additional payment mechanisms," CNBC reported earlier on Wednesday. Kessel was responding to a question about how Amazon plans to address "discrimination and elitism" at cashierless stores, according to the report. Further reading: As More Retailers Ban Paper Money, It's Making Things Awkward For Customers Without Plastic.

An anonymous reader writes: Google wants to block some file downloads carried out via HTTP on websites that use HTTPS. The plan is to block EXE, DMG, CRX, ZIP, GZIP, BZIP, TAR, RAR, and 7Z file downloads when the download is initiated via HTTP but the website URL shows HTTPS.

Google said it's currently not thinking of blocking all downloads started from HTTP sites, since the browser already warns users about a site's poor security via the "Not Secure" indicator in the URL bar. The idea is to block insecure downloads on sites that appear to be secure (loaded via HTTPS) but where the downloads take place via plain ol' HTTP.

YouTube TV isn't immune to the latest wave of rate hikes plaguing the streaming world. From a report: The Google-owned service has announced that it's raising the base monthly price to $50 ($55 if you subscribe directly through an Apple TV), effective immediately for new subscribers and from May 13th onward for existing customers. You'll at least get something for your trouble, though, as YouTube TV will finally offer a host of additional channels.

You now have access to eight Discovery channels that include the original as well as Animal Planet, Food Network, HGTV, Investigation Discovery, MotorTrend, TLC and Travel Channel. Oprah Winfrey's OWN channel is coming later in 2019, and Epix's movie-oriented channel is available today if you're willing to spend extra.

Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.

House lawmakers on Wednesday approved a Democrat-backed bill (alternative source) that would restore rules requiring AT&T, Verizon and other Internet providers to treat all Web traffic equally, marking an early step toward reversing one of the most significant deregulatory moves of the Trump era. From a report: But the net neutrality measure is likely to stall from here, given strong Republican opposition in the GOP-controlled Senate and the White House, where aides to President Trump this week recommended that he veto the legislation if it ever reaches his desk. The House's proposal, which passed by a vote of 232-190, would reinstate federal regulations that had banned AT&T, Verizon and other broadband providers from blocking or slowing down customers' access to websites. Adopted in 2015 during the Obama administration, these net neutrality protections had the backing of tech giants and startups as well as consumer advocacy groups, which together argued that strong federal open Internet protections were necessary to preserve competition and allow consumers unfettered access to movies, music and other content of their choice.

It's a browser feature few users will have heard of, but forthcoming versions of Chrome, Safari and Opera are in the process of removing the ability to disable a long-ignored tracking feature called hyperlink auditing pings. From a report: This is a long-established HTML feature that's set as an attribute -- the ping variable -- which turns a link into a URL that can be tracked by website owners or advertisers to monitor what users are clicking on. When a user follows a link set up to work like this, an HTTP POST ping is sent to a second URL which records this interaction without revealing to the user that this has happened. It's only one of several ways users can be tracked, of course, but it's long bothered privacy experts, which is why third-party adblockers often include it on their block list by default.

Until now, an even simpler way to block these pings has been through the browser itself, which in the case of Chrome, Safari and Opera is done by setting a flag (in Chrome you type chrome://flags and set hyperlink auditing to 'disabled'). Notice, however, that these browsers still allow hyperlink auditing by default, which means users would need to know about this setting to change that. It seems that very few do.

An anonymous reader quotes a report from Gizmodo: Chinese journalists and netizens recently found that Apple Music's Chinese streaming service censored a song by Hong Kong singer Jacky Cheung that references the 1989 Tiananmen Square pro-democracy protests, an extremely politically sensitive topic for the Chinese Communist Party. The incident's 30th anniversary is coming up in June. Sophie Richardson, the China Director at Human Rights Watch, called the reported move "spectacularly craven." The Tiananmen protests are emblematic of a larger pro-democracy movement in China that was snuffed out by the Beijing government. Thousands of protesters were killed, but the exact numbers have themselves been censored by Chinese government officials.

Apple Music has also reportedly censored Anthony Wong and Denise Ho, two pro-democracy singers. After being noticed by Chinese netizens, the removals were reported by the Hong Kong Free Press and The Stand, two Hong Kong-based news outlets. Taiwan News also reported the censorship of Cheung's "Ren Jian Dao." The music remains available on Apple Music's North American products. "By removing a song referring the Tiananmen Massacre, @apple is actively participating in the Chinese Communist Party's agenda of scrubbing the colossal violations it has committed against the Chinese people from collective memory and rewriting history," tweeted Yaqiu Wang, a Chinese researcher with Human Rights Watch.

Udacity, the $1 billion online education startup, has laid off about 20 percent of its workforce and is restructuring its operations as the company's co-founder Sebastian Thrun seeks to bring costs in line with revenue without curbing growth, TechCrunch has learned. From the report: The objective is to do more than simply keep the company afloat, Thrun told TechCrunch in a phone interview. Instead, Thrun says these measures will allow Udacity from a money-losing operation to a "break-even or profitable company by next quarter and then moving forward." The 75 employees, including a handful of people in leadership positions, were laid off earlier today as part of a broader plan to restructure operations at Udacity. The startup now employs 300 full-time equivalent employees. It also employs about 60 contractors.

Udacity, which specializes in "nanodegrees" on a range of technical subjects that include AI, deep learning, digital marketing, VR and computer vision, has been struggling for months now, due in part to runaway costs and other inefficiencies. The company grew in 2017, with revenue increasing 100 percent year-over-year thanks to some popular programs like its self-driving car and deep learning nanodegrees, and the culmination of a previous turnaround plan architected by former CMO Shernaz Daver. New programming was added in 2018, but the volume slowed. Those degrees that were added lacked the popularity of some of its other degrees. Meanwhile, costs expanded and their employee ranks swelled.