The Internet

The US-China Battle Over the Internet Goes Under the Sea (wired.com) 72

Last week, Washington strongly objected to a new project from Facebook and Google. It's too risky and offers "unprecedented opportunities" for Chinese government espionage, the Justice Department declared. The project, however, wasn't about online speech or contact tracing, but concerned an issue that would seem far less politically charged: building an undersea internet cable from the United States to Hong Kong. From a report: On June 17, Team Telecom -- the executive branch group charged with reviewing foreign telecoms for security risks (and recently in the news for escalating and apparently insufficient inspections) -- recommended the Federal Communications Commission stop the Hong Kong connection. It may seem odd for American officials to fret over undersea cable networks; rarely does your chosen crime show's protagonist kick a door in because someone is laying telecommunications fiber.

But geopolitical influence-projection on the internet isn't just about hacking other countries' intelligence databases. While not nearly as flashy, the development and maintenance of undersea cables, the landing points anchoring them above ground, and other physical internet infrastructure are a growing arm of cyber statecraft and source of security risk. This cable is just one element in a broader geopolitical contest. Facebook and Google joined the project, dubbed the Pacific Light Cable Network, back in 2016. Teaming up with New Jersey-based telecom TE SubCom and Pacific Light Data Communication Company, a Hong Kong subsidiary of the Chinese firm Dr. Peng Telecom & Media Group, the US giants jumped on a project already months underway: building a massive undersea internet cable -- the submarine-depth metal tubes hauling internet traffic from one land mass to another -- connecting the US, Hong Kong, Taiwan, and the Philippines.

To the US government, the Taiwan and Philippines part was up to scratch. Undersea cables have visible benefits, such as bolstering digital connections between regions and facilitating all forms of communication that follow. And for this 8,000-mile-long fiber-optic snake, connecting dispersed areas of the world was exactly the point. The stakeholders wrote as much in a December 2017 filing to the US government, noting this would be the first undersea cable moving internet traffic directly between Hong Kong and the United States, at speeds of 120 terabytes per second. But the government had security worries about the Chinese-owned Hong Kong subsidiary behind the effort, as well as the proposed line to Hong Kong itself. Google, Facebook, and their partners had already laid thousands of miles of cable and spent millions of dollars last August when word broke of the Justice Department's opposition to the project. Officials thought Beijing could physically access the cable for espionage -- in this case by capturing internet traffic.

The Courts

It's Unconstitutional For Cops To Force Phone Unlocking, Court Rules (arstechnica.com) 116

An anonymous reader quotes a report from Ars Technica: Indiana's Supreme Court has ruled that the Fifth Amendment allows a woman accused of stalking to refuse to unlock her iPhone. The court held that the Fifth Amendment's rule against self-incrimination protected Katelin Seo from giving the police access to potentially incriminating data on her phone. The courts are divided on how to apply the Fifth Amendment in this kind of case. Earlier this year, a Philadelphia man was released from jail after four years of being held in contempt in connection with a child-pornography case. A federal appeals court rejected his argument that the Fifth Amendment gave him the right to refuse to unlock hard drives found in his possession. A Vermont federal court reached the same conclusion in 2009 -- as did a Colorado federal court in 2012, a Virginia state court in 2014, and the Massachusetts Supreme Judicial Court in 2014.

But other courts in Florida, Wisconsin, and Pennsylvania have reached the opposite conclusion, holding that forcing people to provide computer or smartphone passwords would violate the Fifth Amendment. Lower courts are divided about this issue because the relevant Supreme Court precedents all predate the smartphone era. To understand the two competing theories, it's helpful to analogize the situation to a pre-digital technology.

Submission + - It's Unconstitutional For Cops To Force Phone Unlocking, Court Rules (arstechnica.com)

An anonymous reader writes: Indiana's Supreme Court has ruled that the Fifth Amendment allows a woman accused of stalking to refuse to unlock her iPhone. The court held that the Fifth Amendment's rule against self-incrimination protected Katelin Seo from giving the police access to potentially incriminating data on her phone. The courts are divided on how to apply the Fifth Amendment in this kind of case. Earlier this year, a Philadelphia man was released from jail after four years of being held in contempt in connection with a child-pornography case. A federal appeals court rejected his argument that the Fifth Amendment gave him the right to refuse to unlock hard drives found in his possession. A Vermont federal court reached the same conclusion in 2009—as did a Colorado federal court in 2012, a Virginia state court in 2014, and the Massachusetts Supreme Judicial Court in 2014.

But other courts in Florida, Wisconsin, and Pennsylvania have reached the opposite conclusion, holding that forcing people to provide computer or smartphone passwords would violate the Fifth Amendment. Lower courts are divided about this issue because the relevant Supreme Court precedents all predate the smartphone era. To understand the two competing theories, it's helpful to analogize the situation to a pre-digital technology.

Medicine

Slashback: Forced Social Isolation Causes Neural Craving Similar To Hunger (scientificamerican.com) 105

This is the first story in a new occasional article series we're calling Slashback. We'll be covering a topic that may not be breaking news, but is interesting to us. Today's Slashback story features an article from Scientific American highlighting the profound effect of severe social isolation on the brain. From the report: The feeling of "wanting" something has repeatedly been shown to increase dopamine transmission in the brain reward circuit (see here and here). This circuit consists of the dopamingeric midbrain and the striatum. These areas are particularly active in response to images of food when hungry, to drug-related images for those who are addicted, and people with Internet Gaming Disorder who are deprived of gaming (see here, here, and here). What about social interactions? For social animals, it would make sense that social interactions would be a primary reward. However, so far such research has primarily been conducted on mice. In 2016, Gillian Matthews and colleagues published a paper showing that after 24 hours of social isolation, dopamine neurons in the midbrain were activated when mice sought social interaction. These dopamine neurons showed similar activation patterns to other cravings. It appears that the acute social isolation in these mice led to an aversive "loneliness-like" state that increased motivation for social engagement. Nevertheless, researchers have questioned whether these findings would apply to humans, especially since it's not possible to assess whether a mouse subjectively feels lonely.

Livia Tomova, a postdoctoral fellow in the Saxelab at MIT, was inspired by this earlier research on mice and pitched to Rebecca Saxe the idea of trying to replicate the findings in humans. [...] What did the researchers find? After only ten hours of social isolation-- and even despite people knowing exactly when their deprivation would end-- people reported substantially more social craving, loneliness, discomfort, dislike of isolation, and decreased happiness than they did at baseline. Similarly, the same findings were seen after ten hours of food fasting. Critically, the researchers found similar midbrain activity in response to food cues after fasting and social cues after isolation. The response was variable across participants, and those who reported more social craving after the social isolation period showed a larger brain response to the social stimuli. Interestingly, the variability across participants was also partially explained by the variability in pre-existing chronic levels of loneliness. Participants with higher levels of chronic loneliness at baseline reported less craving for social contact after 10 hours of isolation in response to the social stimuli, and showed a muted response in their midbrain in response to the social cues after social isolation (they also showed reduced midbrain responses to food cues after fasting). This finding is consistent with prior research showing that chronic loneliness is associated with reduced motivation to engage socially with others.

These results are exciting because they are consistent with the results from earlier research on mice and the "social homeostasis" hypothesis developed based on animal models. According to this hypothesis, since social connection is an innate need, animals evolved neural system to regulate "social homeostasis." The current findings suggest that there is a similar mechanism underlying social craving in humans, and that people who are forced to be isolated crave social interactions in a similar way as a hungry person craves food. As the researchers note, these findings are also encouraging for translating mouse models of mental health disorders that affect social motivation, such as autism spectrum disorder, social anxiety disorder, or depression.
While the article makes little to no mention of the coronavirus, it does make one ponder how the mandated period of isolation associated with it will affect us, especially as local governments around the country begin to lift restrictions and reopen.

What happens when a person starved of food is suddenly presented with the ability to eat? They gorge themselves. What about when a person who has been socially isolated for weeks suddenly gets to socialize? Perhaps they'll jump on the chance to surround themselves with others. We're already starting to see more people booking local holidays...
The Internet

Solving Online Events (ben-evans.com) 7

Benedict Evans: I suspect part of the answer to this is actually that a lot of physical events will come back in some form as we emerge from lockdown. But this also makes me think that there will be new tools with much more radically new approaches, and some new behaviours and habits. Hence, it's often struck me that networking events are pretty inefficient and random. If you're going to spend an hour or two in a room with 50 or 500 people, then you could take that as a purely social occasion and enjoy yourself. But if your purpose is to have professionally useful conversations, then what proportion of the people in the room can you talk to in an hour and how likely is it that they'll be the right ones? Who's there? I sometimes suggest it would be helpful if we all wore banners, as in the image at the top, so that you could look across the room and see who to talk to. (First Tuesday did something like this in 1999, with different coloured badges.)

This might just be that I'm an introvert asking for a machine to manage human connections for me (and I am), but there is also clearly an opportunity to scale the networking that happens around events in ways that don't rely on random chance and alcohol tolerance. A long time ago Twitter took some of that role, and the explosion of online dating also shows how changing the way you think about pools and sample sets changes outcomes. In 2017, 40% of new relationships in the USA started online. Next, before lockdown, you would often have planned to schedule a non-urgent meeting with a partner or client or connection 'when we're in the same city.' That might be at some specific event, but it might also just be for some ad hoc trip -- 'next time I'm in the Bay Area' or 'next time you're in New York.' In January most people would never actually have thought of making a video call, but today every meeting is a video call, so all of those meetings can be a video call too, and can happen this week rather than 'next time I fly to that city' -- or 'at CES/NAB/MIPCOM.' In the last few months video calls have broke through that habit. I wonder what happens if we accelerate all of those meetings in that way. To argue against some of this, James Turrell has said that part of the value of Roden Crater's remoteness is that you have to really care to go there. Getting a plane and a hotel and a ticket, and taking days of time, has some of the same effect for a conference -- it gives a selection filter for people who care. There is value in aggregating people around a professional interest graph, and in doing that in a focused way, perhaps even around a particular time. (There are also, of course, exclusionary effects to this.)

Government

Germany Bans Digital Doppelganger Passport Photos (reuters.com) 58

Germany will outlaw the morphing of passport photos, in which pictures of two people are digitally combined, making it possible to assign multiple identities to a single document. Reuters reports: Morphing can trick artificial intelligence used at passport control into recognizing different individuals. The government on Wednesday backed a law requiring people to either have their photo taken at a passport office or, if they use a photographer, have it submitted in digital form over a secure connection, spokesman Steffen Seibert said. Researchers at the Fraunhofer Institute for Computer Graphics have found that it is possible to morph photos of the faces of different people who are not even related. A certain degree of similarity is sufficient, such as the eyes being aligned. Such manipulation of photos is typically invisible to the human eye, the researchers found.
Science

A Monday Is a Tuesday Is a Sunday as COVID-19 Disrupts Internal Clocks (scientificamerican.com) 49

A global natural experiment examines the time warp of life under quarantine. From a report: In April Jenny Rappaport sat down to inspect her calendar because she could not tell how many days had passed since New Jersey's stay-at-home order took effect. Before COVID-19, her life had structure and a pace, and she knew the day of the week without giving it a second thought. The pandemic has changed all of that. Several research groups have taken advantage of this unplanned natural experiment to gauge the psychological impacts of time distortions and, in turn, their effects on mental health. Psychologists know that time sense links to well-being. Its perceived slower passage can represent signs of depression or post-traumatic stress disorder (PTSD).

Rappaport's feelings jibe with the findings of preliminary studies. Overall, people seem to be experiencing time more slowly, according to data that are beginning to be compiled. In a not yet peer-reviewed preprint paper, Sylvie Droit-Volet, a time perception researcher at the University of Clermont Auvergne in France, and her colleagues show that people there report the clock moving more slowly during the lockdown. The researchers also document feelings of sadness and boredom and tie them to the overall feeling of deceleration. "Their findings directly support the emotional connection with time perception," says Philip Gable of the University of Alabama. He is also using survey data to examine how people across the U.S. experience time during the pandemic. "It's a societal event that's going to have a profound psychological influence on us," Gable says, adding that the temporal shift is an integral part of our feelings about what is happening. He plans to collect data over the next nine months, but so far has found evidence that the everyday tempo now lags. Nearly 50 percent of people experienced time dragging during March, whereas about 24 percent perceived it to be speeding up.

Communications

In $16 Billion Push To Expand Broadband, America Is Flying Through a Fog (wsj.com) 65

Spurred by the coronavirus pandemic, federal policy makers are pushing to spend billions of dollars to close gaps in America's high-speed internet network. From a report: There is one big obstacle: Government officials say they don't have a clear picture of where service gaps exist, meaning parts of the country will be left out when it is time to distribute the funds. While the Federal Communications Commission estimates more than 94% of Americans -- or about 309 million people -- have access to high-speed internet services, it acknowledges that number is based on flawed data from internet-service providers. The FCC requires these companies to report that they serve a census block if they can reach even a single home or business there. That means if one of your neighbors has a broadband connection, the FCC might count your house as having broadband, too -- even if the local internet-service provider can't reach you.
The Internet

Researchers Claim New Internet Speed Record of 44.2 Tbps (theverge.com) 47

Researchers based out of Australia's Monash, Swinburne, and RMIT universities say they've set a new internet speed record of 44.2 Tbps, according to a paper published in the open-access journal Nature Communications. That's theoretically enough speed to download the contents of more than 50 100GB Ultra HD Blu-ray discs in a single second. The Verge reports: What's interesting about the research is that it was achieved over 75km of standard optical fiber using a single integrated chip source, meaning it has the potential to one day benefit existing fiber infrastructure. The test fiber connection ran between RMIT's Melbourne City campus and Monash University's Clayton campus, and the researchers say it mirrors infrastructure used by Australia's National Broadband Network (NBN). The findings represent a "world-record for bandwidth," according to Swinburne University Professor David Moss, one of the team members responsible.

Those speeds were achieved, thanks to a piece of technology called a micro-comb, which offers a more efficient and compact way to transmit data. This micro-comb was placed within the cable's fibers in what the researchers say is the first time the technology has been used in a field trial. Now, the researchers say the challenge is to turn the technology into something that can be used with existing infrastructure. "Long-term, we hope to create integrated photonic chips that could enable this sort of data rate to be achieved across existing optical fiber links with minimal cost," RMIT's Professor Arnan Mitchell says.

Microsoft

Windows 10 Previews DNS Over HTTPS (thurrott.com) 90

An anonymous reader quotes a report from Paul Thurrott: With the new build of Windows 10 [19628], Microsoft is starting to test DNS over HTTPS. The new build comes with Microsoft's initial support for DNS over HTTPS on Windows, and Insiders will have to manually enable the new feature. If you would like to enable DNS over HTTPS in Windows 10, you will have to first install the latest Insider build. After that, you will have to go into the registry and tweak an entry to first enable the new DNS over HTTPS client, and then update the DNS servers your computer is using. It's not as easy as ticking a checkbox, but Microsoft has shared the instructions to enable the feature in detail, so make sure to check it out here. What is DNS over HTTPS and why is it important? "DNS, to put simply, is the process where an easy-to-read and write domain address is translated into an actual IP address for where a web resource is located," writes Thurrott. "Although most websites already use HTTPS for added privacy, your computer is still making DNS requests and resolving addresses without any encryption. With DNS over HTTPS, your device will perform all the required DNS requests over a secured HTTPS connection, which improves security thanks to the encrypted connection."
Science

Gigantic New 3D Map Traces Every Neuron In a Tiny Mouse Brain (livescience.com) 35

Rick Schumann shares a report from Live Science: Researchers at the Allen Institute for Brain Science, a Seattle nonprofit dedicated to neuroscience, have been painstakingly recording every brain cell and every connection between those neurons in mice for the past several years. The result represents major progress since an earlier, simpler map they released in 2016. The now-complete map encompasses about 100 million cells, the institute reported in a paper published today (May 7) in the journal Cell.

Typically, researchers trace connections between brain cells using thin slices of tissue that can be imaged and explored layer by layer. To build a comprehensive, three-dimensional map, the Allen Institute team instead broke the mouse brain into "voxels" -- 3D pixels -- and then mapped the cells and connections within each voxel. The result comprises an "average" of the brains of 1,675 laboratory mice, to make sure the map was as standard as possible. [...] Mice are common "model organisms" in neuroscience. Their brains have fairly similar structures to humans', they can be trained, they breed easily, and researchers have already developed robust understandings of how their brains work. The hope is that the map will bring that understanding to a new level, the Allen Institute said. In doing so, neuroscientists will have a tool with which to develop new research programs and accelerate research already underway.

Submission + - Gigantic New 3D Map Traces Every Neuron In A Tiny Mouse Brain (livescience.com) 1

Rick Schumann writes: Researchers at the Allen Institute for Brain Science, a Seattle nonprofit dedicated to neuroscience, have been painstakingly recording every brain cell and every connection between those neurons in mice for the past several years. The result represents major progress since an earlier, simpler map they released in 2016. The now-complete map encompasses about 100 million cells, the institute reported in a paper published today (May 7) in the journal Cell.

Mice are common "model organisms" in neuroscience. Their brains have fairly similar structures to humans', they can be trained, they breed easily, and researchers have already developed robust understandings of how their brains work. The hope is that the map will bring that understanding to a new level, the Allen Institute said. In doing so, neuroscientists will have a tool with which to develop new research programs and accelerate research already underway.

Businesses

Samsung Heir Apologizes For Corruption and Union-Busting Scandals (nytimes.com) 18

An anonymous reader quotes a report from The New York Times: The de facto head of Samsung, Lee Jae-yong, apologized on Wednesday for the corruption and union-busting scandals that have bedeviled his conglomerate, declaring that he will be the last of his family members to lead the South Korean corporate empire. During a nationally televised news conference, Mr. Lee, 51, said Samsung would also respect its workers' right to organize independent labor unions, ending its decades-old "no-union" philosophy. That stance was often cited as one of the key reasons Samsung could grow so rapidly while other conglomerates, like Hyundai, were often crippled by militant labor activism at their work sites.

"Samsung has not strictly complied with laws and ethics," Mr. Lee said with a bow during the news conference at a Samsung headquarters in Seoul. "Although it has been lauded for being first rate in technology and products, Samsung has faced harsh criticism." "This is my fault," he said. "I apologize." Over the decades, Samsung and its top leaders have often apologized for bribery, tax-evasion and other crimes. But corruption scandals have continued at Samsung, South Korea's largest and most profitable business group. Both analysts and critics have said those scandals stemmed largely from the Lee family's attempts to ensure a father-to-son transfer of managerial power over Samsung at all costs, even if that meant breaking laws and buying political influence. On Wednesday, Mr. Lee accepted such criticism. "All of the problems basically started from this succession issue," he said. "From now on, I will make sure that no controversy happens again regarding the succession issue." Mr. Lee said he had no intention of bequeathing managerial powers to his own children and vowed to give professional managers greater roles in Samsung.
In 2017, Lee Jae-yong was charged with bribery and embezzlement in connection with the corruption scandal that led to the impeachment of South Korea's president Park Geun-hye. He was later freed from prison after an appeals court reduced and suspended his five-year prison sentence.
Hardware

USB 4 Will Fully Support DisplayPort 2, Including 8K HDR Monitors (engadget.com) 78

VESA has announced that USB 4 will fully support the massive bandwidth available for the DisplayPort 2.0 standard, including support for 8K 60Hz HDR or even 16K 60Hz monitors. Engadget reports: Since USB 4 works at 40Gbps and DisplayPort 2.0 supports 80Gbps speeds, how will this work? USB 4 can actually send and receive at 40Gbps at the same time, so VESA took advantage of that with a new spec called DisplayPort Alt Mode 2.0. Since DisplayPort is primarily used for video, which only sends data one way from your PC to a monitor, the Alt Mode 2.0 standard remaps USB-C's data pins to work in one direction only -- giving you double the speeds.

According to Anandtech, Alt Mode 2.0 will support regular USB 4 cables. At the same time, monitors won't need to have USB 4 controllers, which should simplify display designs. Since it also supports the Thunderbolt 3 standard, USB 4 will become a universal connection standard for both smartphones and PCs, supporting things like "docking, gaming, AR/VR HMDs, and professional HDR displays," VESA said.

The Internet

NordVPN Unveils First Mainstream WireGuard Virtual Private Network (zdnet.com) 51

One of the largest VPN companies, NordVPN, is rolling out NordLynx -- it's first mainstream WireGuard virtual private network for its Windows, Mac, Android and iOS client-software applications. ZDNet reports: NordVPN's own tests have shown NordLynx easily outperforms the other protocols, IKEv2/IPsec and OpenVPN. How much faster? According to NordVPN's 256,886 speed tests, "When a user connects to a nearby VPN server and downloads content that's served from a content delivery network (CDN) within a few thousand miles/kilometers, they can expect up to twice higher download and upload speed." While speed is what customers will notice, security experts like WireGuard for its code's simplicity. With only about 4,000 lines of code, WireGuard's code can be comprehensively reviewed by a single individual.

Besides WireGuard, NordVPN adds in its double Network Address Translation (NAT) system to protect users' privacy. This enables users to establish a secure VPN connection while storing no identifiable user data on a server. You're assigned a dynamic local IP address that remains assigned only while the session is active. User authentication is done with the help of a secure external database. To switch to NordLynx, users need to update their NordVPN app to the latest version. The NordLynx protocol can be chosen manually from the Settings menu.

Space

SpaceX Successfully Launches 60 More Starlink Satellites as it Continues Towards 2020 Service Debut (techcrunch.com) 98

SpaceX has launched another big batch of Starlink satellites, the low Earth orbit spacecraft that will provide connectivity for its globe-spanning high-bandwidth broadband internet network. This brings the total number of Starlink satellites on orbit to 422, though the company plans to de-orbit two of those (the first two prototypes launched) shortly. From a report: Already, SpaceX is the largest private satellite operator in existence -- by a wide and growing margin. It's also managed to keep up the frequent pace of its Starlink launches despite the global COVID-19 crisis, with its last launch taking place March 18. In total, it has flown four such missions since the start of the year, just four months into 2020. The company has good reason to want to keep up that aggressive pace: Each launch brings it closer to the eventual launch of the Starlink broadband service that the satellites will provide the network backbone for. SpaceX wants that network to be live with coverage available in Canada and the Northern U.S. by sometime later this year, and because of the way its approach works, with small satellites orbiting much closer to Earth than traditional geostationary internet satellites and handing off the connection to one another as they pass the coverage area, they need a whole lot of them to provide stable, reliable, low-latency connections for consumers and businesses.
Security

Zoom's Security Woes Were No Secret to Business Partners Like Dropbox (nytimes.com) 33

Dropbox privately paid top hackers to find bugs in software by the videoconferencing company Zoom, then pressed it to fix them. From a report: One year ago, two Australian hackers found themselves on an eight-hour flight to Singapore to attend a live hacking competition sponsored by Dropbox. At 30,000 feet, with nothing but a slow internet connection, they decided to get a head start by hacking Zoom, a videoconferencing service that they knew was used by many Dropbox employees. The hackers soon uncovered a major security vulnerability in Zoom's software that could have allowed attackers to covertly control certain users' Mac computers. It was precisely the type of bug that security engineers at Dropbox had come to dread from Zoom, according to three former Dropbox engineers.

Now Zoom's videoconferencing service has become the preferred communications platform for hundreds of millions of people sheltering at home, and reports of its privacy and security troubles have proliferated. Zoom's defenders, including big-name Silicon Valley venture capitalists, say the onslaught of criticism is unfair. They argue that Zoom, originally designed for businesses, could not have anticipated a pandemic that would send legions of consumers flocking to its service in the span of a few weeks and using it for purposes -- like elementary school classes and family celebrations -- for which it was never intended.

[...] The former Dropbox engineers, however, say Zoom's current woes can be traced back two years or more, and they argue that the company's failure to overhaul its security practices back then put its business clients at risk. Dropbox grew so concerned that vulnerabilities in the videoconferencing system might compromise its own corporate security that the file-hosting giant took on the unusual step of policing Zoom's security practices itself, according to the former engineers, who spoke on the condition of anonymity because they were not authorized to publicly discuss their work. As part of a novel security assessment program for its vendors and partners, Dropbox in 2018 began privately offering rewards to top hackers to find holes in Zoom's software code and that of a few other companies. The former Dropbox engineers said they were stunned by the volume and severity of the security flaws that hackers discovered in Zoom's code -- and troubled by Zoom's slowness in fixing them.

Privacy

Easy-To-Pick 'Smart' Locks Gush Personal Data, FTC Finds (arstechnica.com) 59

An anonymous reader quotes a report from Ars Technica: A padlock -- whether it uses a combination, a key, or "smart" tech -- has exactly one job: to keep your stuff safe so other people can't get it. Tapplock, Inc., based in Canada, produces such a product. The company's locks unlock with a fingerprint or an app connected by Bluetooth to your phone. Unfortunately, the Federal Trade Commission said, the locks are full of both digital and physical vulnerabilities that leave users' stuff, and data, at risk. The FTC's complaint (PDF) against Tapplock, released Monday, basically alleges that the company misrepresented itself, because it marketed its products as secure and tested when they were neither. A product -- any product -- simply being kind of crappy doesn't necessarily fall under the FTC's purview. Saying untrue things about your product in your advertisement or privacy policy, however, will make the commission very unhappy with you indeed.

The lock may be built with "7mm reinforced stainless steel shackles, strengthened by double-layered lock design with anti-shim and anti-pry technologies," as Tapplock's website promises, but according to the FTC, perhaps it should have considered anti-screwdriver technologies. As it turns out, a researcher was able to unlock the lock "within a matter of seconds" by unscrewing the back panel. Oops. The complaint also pointed to several "reasonably foreseeable" software vulnerabilities that the FTC alleges Tapplock could have avoided if the company "had implemented simple, low-cost steps."

One vulnerability security researchers identified allowed a user to bypass the account authentication process entirely in order to gain full access to the account of literally any Tapplock user, including their personal information. And how could this happen? "A researcher who logged in with a valid user credential could then access another user's account without being re-directed back to the login page, thereby allowing the researcher to circumvent Respondent's authentication procedures altogether," the complaint explains. A second vulnerability allowed researchers the ability to access and unlock any lock they could get close enough to with a working Bluetooth connection. That's because Tapplock "failed to encrypt the Bluetooth communication between the lock and the app," leaving the data wide open for the researchers to discover and replicate. The third vulnerability outlined in the complaint also has to do with a failure to secure communication data. That app that allows "unlimited" connections? The primary owner can of course add and revoke authorized users from the lock. But someone whose access was revoked could still access the lock because the vulnerability allowed for sniffing out the relevant data packets.
As part of the settlement, the FTC is requiring Tapplock to create a security program for its products. "That program is required to include training for employees; timely disclosure of 'covered incidents,' including both loss of personal information and also unauthorized access to systems; actual penetration testing of the network; and several other elements, including annual review," reports Ars Technica.

Submission + - Easy-To-Pick 'Smart' Locks Gush Personal Data, FTC Finds (arstechnica.com)

An anonymous reader writes: A padlock—whether it uses a combination, a key, or "smart" tech—has exactly one job: to keep your stuff safe so other people can't get it. Tapplock, Inc., based in Canada, produces such a product. The company's locks unlock with a fingerprint or an app connected by Bluetooth to your phone. Unfortunately, the Federal Trade Commission said, the locks are full of both digital and physical vulnerabilities that leave users' stuff, and data, at risk. The FTC's complaint (PDF) against Tapplock, released Monday, basically alleges that the company misrepresented itself, because it marketed its products as secure and tested when they were neither. A product—any product—simply being kind of crappy doesn't necessarily fall under the FTC's purview. Saying untrue things about your product in your advertisement or privacy policy, however, will make the commission very unhappy with you indeed.

The lock may be built with "7mm reinforced stainless steel shackles, strengthened by double-layered lock design with anti-shim and anti-pry technologies," as Tapplock's website promises, but according to the FTC, perhaps it should have considered anti-screwdriver technologies. As it turns out, a researcher was able to unlock the lock "within a matter of seconds" by unscrewing the back panel. Oops. The complaint also pointed to several "reasonably foreseeable" software vulnerabilities that the FTC alleges Tapplock could have avoided if the company "had implemented simple, low-cost steps."

One vulnerability security researchers identified allowed a user to bypass the account authentication process entirely in order to gain full access to the account of literally any Tapplock user, including their personal information. And how could this happen? "A researcher who logged in with a valid user credential could then access another user’s account without being re-directed back to the login page, thereby allowing the researcher to circumvent Respondent’s authentication procedures altogether," the complaint explains. A second vulnerability allowed researchers the ability to access and unlock any lock they could get close enough to with a working Bluetooth connection. That's because Tapplock "failed to encrypt the Bluetooth communication between the lock and the app," leaving the data wide open for the researchers to discover and replicate. The third vulnerability outlined in the complaint also has to do with a failure to secure communication data. That app that allows "unlimited" connections? The primary owner can of course add and revoke authorized users from the lock. But someone whose access was revoked could still access the lock because the vulnerability allowed for sniffing out the relevant data packets.

United States

The Story of The Doctor Who Ordered America's First Covid-19 Lockdown (mercurynews.com) 164

Long-time Slashdot reader bsharma shared the story of doctor/public health officer who "went first," ordering America's very first coronavirus lockdown in six counties on March 16th after the identification of only the 7th known case of Covid-19 in the United States.

The Bay Area Newsgroup reports that on January 31st, Cody's cellphone rang at 6:49 a.m. "You've got your first positive," the voice said. Right then, Cody — Santa Clara County's Public Health Officer since 2013 — was positive that even by Silicon Valley standards, life as we know it here was about to change....

Back in the early 2000s, with the country on edge after 9/11, Cody, Karen Smith and Marty Fenstersheib led the health department's effort to build Santa Clara County's model for a massive, coordinated emergency response to a bioterrorism attack or pandemic that included social distancing, shutting schools and the most extreme, mandating that people stay home. It's the one they would turn to this month to slow the untraceable path of this new disease known as COVID-19. "None of us really believed we would do it," Smith, 63, said in a recent interview. "I was slightly terrified to think we were putting in place stay-at-home orders, tools that we think work but don't really know...."

Through the years, Cody has learned that public health officers never have all the information they need and are always operating with uncertainty. But the stakes are so much higher now. The second confirmed case of coronavirus in the county came 48 hours after the first; both were travelers from China. But the criteria for sending swabs for testing to the U.S. Centers for Disease Control and Prevention in Atlanta was so stringent and the bottleneck for test results so long, that the county was left hamstrung trying to figure out how big of a problem it really had. Not until nearly a month later, on Feb. 28, two days after the county was finally given authorization to use its own lab and judgment for testing, was the third "positive" confirmed.

It would be a "sentinel case" — a turning point for the virus' spread across the Bay Area — a woman in her 60s with other health conditions. Unlike the first two, this was a clear case of "community transmission," meaning the woman had become infected somewhere in our community, with no clear connection to a traveler. "In very short order," Cody said, "it became apparent we needed to start scaling up fast...." By March 9, the sick woman in her 60s — the sentinel case — had died, and 43 cases had been confirmed, the highest of any county in California. Santa Clara County would now be branded across the country as a coronavirus "hot zone...."

"It was clear to me already how quickly it was moving, and that's what gave me a sense of urgency," Cody said. "We just needed to embrace the risk and do it."

"I recognize that this is unprecedented," Cody said in announcing the lockdown. "But we must come together to do this and we know we need a regional response... We must all do our part to slow the spread of COVID-19."

A professor of epidemiology at the University of California San Francisco has told the same newspaper "That's going to turn out to be — if all goes well and I'm reading the tea leaves right — one of the major public health triumphs of modern times." That article reports that while California had roughly the same number of cases as New York in the first week of March, "by the end of the month, New York had 75,795 cases while California had a tenth of that — 7,482."

An infectious disease doctor (and associate executive director with Permanente Medical Group) also told Politico Tuesday that at Kaiser Permanente hospitals across Northern California, they're "seeing a leveling off of Covid-19 cases in our hospitals." And one writer even quoted an emergency room doctor at the UCSF hospital who said last weekend they'd seen less than half the normal number of emergency room patients, and "My colleagues at Stanford, as well as at other facilities in San Francisco report much of the same conditions in their hospitals...

"It seems very likely, that the 'shelter in place' policy has had a significant, positive effect on containing the spread of COVID-19 in the Bay Area."

Slashdot Top Deals