Security

CISA Boss: Makers of Insecure Software Are the Real Cyber Villains (theregister.com) 120

Software developers who ship buggy, insecure code are the true baddies in the cyber crime story, Jen Easterly, boss of the US government's Cybersecurity and Infrastructure Security Agency, has argued. From a report: "The truth is: Technology vendors are the characters who are building problems" into their products, which then "open the doors for villains to attack their victims," declared Easterly during a Wednesday keynote address at Mandiant's mWise conference. Easterly also implored the audience to stop "glamorizing" crime gangs with fancy poetic names. How about "Scrawny Nuisance" or "Evil Ferret," Easterly suggested.

Even calling security holes "software vulnerabilities" is too lenient, she added. This phrase "really diffuses responsibility. We should call them 'product defects,'" Easterly said. And instead of automatically blaming victims for failing to patch their products quickly enough, "why don't we ask: Why does software require so many urgent patches? The truth is: We need to demand more of technology vendors."

News

Exploding Pagers Injure Thousands Across Lebanon 751

Wireless communication pagers, carried by thousands, exploded around the same time across Lebanon on Tuesday, injuring over 2,700 people and killing eight, in what security experts suspect was a sophisticated Israeli intelligence operation. New York Times: Hundreds of pagers blew up at the same time across Lebanon on Tuesday in an apparently coordinated attack that killed eight people and injured more than 2,700, health officials said on Tuesday. [...] Hezbollah said that pagers belonging to its members had exploded and accused Israel of being behind the attack. The Israeli military declined to comment.

[...] Three officials briefed on the attack said that it had targeted hundreds of pagers belonging to Hezbollah operatives who have used such devices for years to make it harder for their messages to be intercepted. The devices were programmed to beep for several seconds before exploding, according to the officials, who spoke on the condition of anonymity because of the sensitivity of the matter.
Further reading: Reuters; CNN; NPR; Fox News; and WSJ.

Edward Snowden said, "If it were iPhones that were leaving the factory with explosives inside, the media would be a hell of a lot faster to cotton on to what a horrific precedent has been set today. Nothing can justify this. It's a crime. A crime. And everyone in the world is less safe for it."
The Courts

Former MoviePass CEO Mitch Lowe Pleads Guilty to Securities Fraud Conspiracy (variety.com) 40

Former MoviePass CEO Mitch Lowe pleaded guilty to securities fraud, admitting he misled investors about the viability of the company's $9.95-a-month movie subscription service, and faces up to five years in prison. His co-defendant, former Helios and Matheson CEO Ted Farnsworth, faces similar charges and is scheduled for trial in March 2025; Farnsworth has been in federal custody since August 2023 due to bond violations involving misuse of company funds. Variety reports: Farnsworth and Lowe were the architects of MoviePass' doomed all-you-can-watch offering, which resulted in hundreds of millions of dollars in investor losses in 2017 and 2018. Investigators found that Lowe tried to stem the losses by throttling the service, forcing high-volume users to reset their passwords and verify their tickets. The two men were charged in November 2022 on counts of wire fraud and securities fraud. According to Lowe's plea agreement, the government estimates the total losses from the scheme at $303 million -- though Lowe contends it is less than that. Lowe remains free on bond, and is due back in court in Miami on March 21 for a status conference. Lowe published a memoir in 2022 in which he reflected on the downfall of MoviePass, entitled "Watch and Learn: How I Turned Hollywood Upside Down with Netflix, Redbox, and Moviepass."
Crime

Linux Developer Swatted and Handcuffed During Live Video Stream (tomshardware.com) 99

Last October Slashdot reported on René Rebe's discovery of a random illegal instruction speculation bug on AMD Ryzen 7000-series and Epyc Zen 4 CPUs — which Rebe discussed on his YouTube channel.

But this week's YouTube episode had a different ending, reports Tom's Hardware... Two days ago, tech streamer and host of Code Therapy René Rebe was streaming one of many T2 Linux (his own custom distribution) development sessions from his office in Germany when he abruptly had to remove his microphone and walk off camera due to the arrival of police officers. The officers subsequently cuffed him and took him to the station for an hour of questioning, a span of time during which the stream continued to run until he made it back...

[T]he police seemingly have no idea who did it and acted based on a tip sent with an email. Finding the perpetrators could take a while, and options will be fairly limited if they don't also live in Germany.

Rebe has been contributing to Linux "since as early as 1998," according to the article, "and started his own T2 SD3 Embedded Linux distribution in 2004, as well." (And he's also a contributor to many other major open source projects.)

The article points out that Linux and other communities "are compelled by little-to-no profit motive, so in essence, René has been providing unpaid software development for the greater good for the past two decades."
Crime

Sheriff's Facebook Post Announces Sentencing of 70-Year-Old Man For a 1980 Cold Case (go.com) 104

In 1980 a 23-year-old woman was shot multiple times by an unknown assailant in a small county in central Kansas.

44 years later, the county sheriff made a Facebook post... Over the years, dozens of law enforcement officers looked at the case to no avail. In mid-2022 I was approached by Detective Sgt. Adam Hales to reopen the case using new techniques and technology that were now available at the time of the murder. In all honesty, it was with some degree of skepticism that I authorized the expenditure of manpower and resources... Many of the witnesses as well as law enforcement officers that were originally involved in the case had died and interviews were not possible.
A statement from the Kansas attorney general's office says the police investigation culminated with an interview with Steven Hanks, a neighbor of the woman, who admitted to the killing. Hanks (who is now 70 years old) was arrested and charged with murder and second-degree, according to the county sheriff's Facebook post: On a personal note, I was 18 years old and a senior in high school when this homicide occurred. I remember it well. By 1982 I had started with the Sheriff's Office as a reserve deputy and have been associated with the Barton County Sheriff's Office ever since. I worked for the four Sheriff's that preceded me and this homicide has haunted all of us. It bothers me that many of the people who were so affected by this tragic crime have since passed away prior to bringing the suspect to justice. I consider myself fortunate that I had the resources and the diligent personnel to close this case.
The Facebook post ends with a 1980 photo of 23-year-old Mary Robin Walter — who besides being a nursing school student was also a wife and mother — next to a booking photo of 70-year-old Steven Hanks.

Hanks has been sentenced to up to 25 years in prison
Crime

$50M In Counterfeit Vintage Consoles and Videogames Seized From Italian Crime Ring (bbc.com) 30

Police in Italy "smashed" a videogame trafficking ring, reports the BBC. They seized fake vintage Nintendo, Sega and Atari consoles that didn't meet strict safety standards, as well as counterfeit games — including Mario Bros., Street Fighter and Star Wars — that together were worth almost €50m ($55.5m) Around 12,000 consoles holding over 47 million pirated video games were seized by police, Alessandro Langella, head of the economic crime unit for Turin's financial police, told the AFP news agency... They were "all from China" and were imported to be sold in specialised shops or online, Mr Langella said...

The seized games have been destroyed. Nine Italian nationals have been arrested and charged with trading in counterfeited goods. If found guilty, they face up to eight years in prison.

The Courts

Sam Bankman-Fried Files Appeal For Fraud Conviction (cointelegraph.com) 58

Former FTX CEO Sam Bankman-Fried's legal team has filed an appeal challenging his conviction on seven felony counts and his 25-year prison sentence. They argue that he was not presumed innocent, that the jury received incomplete information about FTX user funds, and that the prosecution's narrative was biased. CoinTelegraph reports: In a Sept. 13 filing in the United States Court of Appeals for the Second Circuit, SBF's lawyers filed a 102-page brief claiming that the former FTX CEO was "never presumed innocent," subject to scrutiny that allegedly affected prosecutors, the presiding judge, and treatment by the media. Bankman-Fried's legal team announced in April -- a few weeks after a federal judge sentenced him to 25 years in prison -- that they intended to appeal. According to the appeal, SBF's lawyers alleged the jury was "only allowed to see half the picture" with FTX user funds, claiming prosecutors had "presented a false narrative" that the money was permanently lost and Bankman-Fried intentionally caused that loss. They also claimed that counsel for the FTX debtors worked with the US government in a way that was above and beyond "cooperation," providing information allegedly as an "arm of the prosecution."

"From day one, the prevailing narrative -- initially spun by the lawyers who took over FTX, quickly adopted by their contacts at the US Attorney's Office -- was that Bankman-Fried had stolen billions of dollars of customer funds, driven FTX to insolvency, and caused billions in losses," said the appeal. "Now, nearly two years later, a very different picture is emerging -- one confirming FTX was never insolvent, and in fact had assets worth billions to repay its customers. But the jury at Bankman-Fried's trial never got to see that picture." The legal team requested the appellate court grant SBF a new trial with a different judge. It's unclear whether the Second Circuit could rule to affirm Bankman-Fried's conviction in the US District Court for the Southern District of New York or reverse the decision and set the groundwork for a new trial.

Japan

Japan Rethinks 24/7 Police Boxes With Rise of Cybercrime (nikkei.com) 12

Japan is overhauling how its ubiquitous 24-hour mini-police stations are operated nationwide as more crime fighting moves from the streets to the web. From a report: Called koban in Japanese, officers at these small police boxes handle a variety of tasks from responding to crime and patrolling neighborhoods to handling lost items. There are also chuzaisho outposts where police officers live full-time. The National Police Agency will update operational rules on Friday to allow some outposts to shut down at night if necessary. It will also allow greater flexibility on the use of mobile or temporary outposts, depending on local needs and staffing considerations.

Prefectural police will decide on changes involving specific outposts. Japan's koban system dates back to 1874 and is believed to have started operating around the clock in the 1880s. There were 6,215 kobans and 5,923 live-in outposts across Japan as of April. They have inspired countries like Singapore and Brazil to set up similar outposts focused on community policing. The change comes amid shifting crime patterns. Roughly 700,000 crime cases were reported in 2023, down more than 70% from the post-World War II peak in 2002. Street crime, like purse-snatching and car break-ins, were down around 80% to 240,000 cases. Instead, online and phone-based crimes, like impersonation scams and romance scams, are on the rise.

Crime

Former Samsung Execs Arrested For Using Stolen Tech To Build Chip Factory In China (tomshardware.com) 18

South Korean police have arrested two former Samsung executives for allegedly leaking $3.2 billion worth of Samsung secrets to China to aid in building 20nm DRAM chips. Tom's Hardware reports: The authorities reported that one of the arrested suspects, 66-year-old Mr. Choi, set up a joint venture building chips in China alongside some local officials and served as its CEO. He was allegedly assisted by a plant designer, Mr. Oh, in this venture, while he also attempted to recruit other South Korean experts to work for him. However, Choi's arrest comes after being suspected of leaking Samsung memory technologies to build 20nm DRAM chips at the Chinese factory, Chengdu Gaozhen.

Samsung is one of the leading memory manufacturers, working with other major companies like Nvidia to produce VRAM while offering its own storage and memory solutions. The police said Choi's move "weakened the nation's competitiveness when the countries are in a global chip war." With the capture of the company's head, the authorities claim that this will stop the operation of the Chinese venture. However, investigators are still looking into the case to determine if other cases of industrial espionage will spring up from this case.

Crime

Pacific Islands Submit Court Proposal For Recognition of Ecocide As a Crime 58

Vanuatu, Fiji, and Samoa have proposed a change to the International Criminal Court (ICC) to recognize ecocide as a crime, allowing for the prosecution of individuals responsible for significant environmental harm. If successful, the change would recognize ecocide as a crime alongside genocide and war crimes. The Guardian reports: Vanuatu, Fiji and Samoa have proposed a formal recognition by the court of the crime of ecocide, defined as "unlawful or wanton acts committed with knowledge that there is a substantial likelihood of severe and either widespread or long-term damage to the environment being caused by those acts." The proposal was tabled before the ICC in New York on Monday afternoon, and will have to be discussed in full at a later date. Holding full discussions on the proposal is a process likely to take some years, and will face fierce opposition, though much of it will be behind the scenes as most countries will not wish to openly speak out against it.

Philippe Sands KC, a prominent international lawyer and professor of law at University College London, acted as a co-chair of the independent expert panel for the legal definition of ecocide, convened by the Stop Ecocide Foundation. He told the Guardian he was "100% certain" that ecocide would eventually be recognized by the court. "The only question is when," he said. "I was skeptical at first, but now I am a true believer. There has already been real change, as some countries have put it in domestic law. I think this is the right idea at the right time." Belgium recently adopted ecocide as a crime, and the EU has changed some of its guidance on international crime to include it as a "qualified" offense. Mexico is also considering such a law. [...]

Getting to the point where the ICC will consider the proposal has taken years. Stop Ecocide International has been campaigning on the issue since 2017, and Vanuatu made the first call for the crime to be recognized by the ICC in 2019. Although it could take as long as a decade from now before anyone is charged with ecocide even if the changes were implemented by the ICC, the proposal tabled on Monday was vital to gaining broader acceptance of the concept, according to [Jojo Mehta, a co-founder of the Stop Ecocide International campaigning group, which is an observer to the ICC]. "There has been growing progress, as people are increasingly aware of the threat of climate [breakdown]," she said. "People are saying that this much harm to the planet is just not acceptable."
Crime

US Government Asks 3D Printing Industry to Help Stop the Printing of Machine Gun Conversion Devices (apnews.com) 348

U.S. Justice Department officials "are turning to the 3D-printing industry to help stop the proliferation of tiny pieces of plastic transforming weapons into illegal homemade machine guns," reports the Associated Press: "Law enforcement cannot do this alone," [U.S. Deputy Attorney General Lisa Monaco said Friday] during a gathering in Washington of federal law enforcement officials, members of the 3D-printing industry and academia. "We need to engage software developers, technology experts and leaders in the 3-D-printing industry to identify solutions in this fight...."

Guns with conversion devices have been used in several mass shootings, including one that left four dead at a sweet sixteen party in Alabama last year... Monaco on Friday also announced several other efforts designed to crack down on the devices, including a national training initiative for law enforcement and prosecutors.

The deputy attorney general is also launching a committee designed to help spot trends and gather intelligence.

Crime

How an Engineer Exposed an International Bike Theft Ring - By Its Facebook Friends (msn.com) 50

Security engineer Bryan Hance co-founded the nonprofit Bike Index, back in 2013, reports the Los Angeles Times, "where cyclists can register their bikes and contact information, making it easier to reunite lost or stolen bikes with their owners." It now holds descriptions and serial numbers of about 1.3 million bikes worldwide.

"But in spring 2020, Hance was tipped to something new: Scores of high-end bikes that matched the descriptions of bikes reported stolen from locations across the Bay Area were turning up for sale on Facebook Marketplace and Instagram pages attached to someone in Mexico, thousands of miles away..." The Facebook page he first spotted disappeared, replaced by pages that were blocked to U.S. computers; Hance managed to get in anyway, thanks to creative use of a VPN. He started reaching out to the owners whose stolen bikes he suspected he was seeing for sale. "Can you tell me a little bit about how your bike was stolen," he would ask. Often, the methods were sophisticated and selective. Thieves would break into a bicycle room at an apartment complex with a specialized saw and leave minutes later with only the fanciest mountain bikes...

Over time, he spoke to more than a dozen [police] officers in jurisdictions across the Bay Area, including Alameda, Santa Clara, Santa Cruz, Marin, Napa and Sonoma counties... [H]ere was Hance, telling officers that he believed he had located a stolen bike, in Mexico. "That's gone," the officer would inform him. Or, one time, according to Hance: "We're not Interpol." Hance also tried to get Meta to do something. After all, he had identified what could be hundreds of stolen bikes being sold on its platforms, valued, he estimated, at well over $2 million. He said he got nowhere...

[Hance] believed he'd figured out the identity of the seller in Jalisco, and was monitoring that person's personal social media accounts. In early 2021, he had spotted something that might break open the case: the name of a person who was sending the Jalisco seller photos of bikes that matched descriptions of those reported stolen by Bay Area cyclists. Hance theorized that person could be a fence who was collecting stolen bikes on this side of the border and sending photos to Jalisco so they could be posted for sale. Hance hunted through the Jalisco seller's Facebook friends until he found the name there: Victor Romero, of San Jose. More sleuthing revealed that a man by the name of Victor Romero ran an auto shop in San Jose, and, judging by his own Facebook photos, was an avid mountain biker. There was something else: Romero's auto shop in San Jose had distinctive orange shelves. One photo of a bike listed for sale on the Jalisco seller's site had similar orange shelves in the backdrop.

Hance contacted a San Francisco police detective who had seemed interested in what he was doing. Check out this guy's auto shop, he advised. San Francisco police raided Romero in the spring of 2021. They found more than $200,000 in cash, according to a federal indictment, along with screenshots from his phone they said showed Romero's proceeds from trafficking in stolen bikes. They also found a Kona Process 153 mountain bike valued at about $4,700 that had been reported stolen from an apartment garage in San Francisco, according to the indictment. It had been disassembled and packaged for shipment to Jalisco.

In January, a federal grand jury indicted Victoriano Romero on felony conspiracy charges for his alleged role in a scheme to purchase high-end stolen bicycles from thieves across the Bay Area and transport them to Mexico for resale.

But bikes continue to be stolen, and "The guy is still operating," Hance told the Los Angeles Times.

"We could do the whole thing again."
Crime

During Georgia School Shooting, Newly-Installed Tech Spread Warnings and Called Police (cnn.com) 255

A schoolteacher using an interactive whiteboard is surprised by an alert. Their school is in "hard lockdown." They knew — instantly — something was about to happen, and "got everybody into a corner," they later told CNN. Classroom doors at the school are always locked, so they then "turned off the lights. And just kind of held everyone nice and tight, and just said, 'Wait for everything to happen, everything to pass.'"

The school was Apalachee High School in Winder, Georgia, where on Wednesday 11 students were shot and two killed. Two schoolteachers were also killed. But according to CNN, social studies teacher Stephen Kreyenbuhl "said the school's new alert system bought him critical time to prepare and protect his students before a shooter opened fire just down the hall..." The CrisisAlert system, designed by Centegix, includes a device the size of an ID badge. It's equipped with a button that, when pressed rapidly, can quietly notify administrators and local law enforcement to the exact location of an active emergency. The company works with school districts and law enforcement agencies to integrate the system into their current safety procedures and automate as much as possible. Barrow County Sheriff Jud Smith told CNN Apalachee High School had the system for less than a week and had tested it for the first time only the day before the shooting... Brent Cobb, the company's CEO, told CNN in an interview earlier this year that their CrisisAlert technology was designed following the 2018 Parkland high school shooting in Florida to give teachers and administrators a fast and discreet way to call for help.... "[Y]ou need everyone to know immediately" that a crisis is taking place.

Once a lockdown is activated, the CrisisAlert system is designed to trigger a series of responses: Pre-recorded warnings sound over the intercom system to alert the entire campus to the lockdown, while on-site safety administrators, like school resource officers [a law-enforcement officer with arrest powers, usually armed], are notified of the location of the incident. Cobb told CNN in some school districts the system is also integrated with local law enforcement agencies and can automatically call 911 and send messages to officers of the exact location of the incident. This is what happened in Barrow County. The goal, he said, is to help decrease police response times, an issue that has come under scrutiny in recent years following the shooting at Robb Elementary School in Uvalde, Texas, where it took officers 77 minutes to adequately respond to a shooter.

In an exclusive interview with CNN Thursday, Smith scrolled through the series of alerts and the detailed map his officers received to guide them to where the shooting was happening... [Social studies teacher] Kreyenbuhl said he is grateful the district implemented a system that enabled him to protect his students. "I actually saw the lockdown initiate before I even heard the gunshots, so I had time to prepare," he said.... "It's insane the technology we have access to."

Social Networks

'Thousands" of Telegram Channels Sell Stolen Identities, Reports WSJ (msn.com) 91

The Wall Street Journal writes that Telegram "has become the premier internet platform to buy everything from hacked data and weapons to illicit drugs and child sexual abuse material, according to current and former law-enforcement officials and cybercrime researchers..."

And it's also being used by identity thieves: There are thousands of channels and groups on Telegram that offer stolen identities that can be used to open bank and investment accounts. Some claim to offer already created bank accounts created with stolen details. A channel called Bank Store Online listed accounts at over 60 banks and cryptocurrency exchanges for sale, ranging from $80 for a personal account to $1,800 for a business one. Payments were charged in crypto... There are thousands of channels and groups on Telegram that offer stolen identities that can be used to open bank and investment accounts. Some claim to offer already created bank accounts created with stolen details. A channel called Bank Store Online listed accounts at over 60 banks and cryptocurrency exchanges for sale, ranging from $80 for a personal account to $1,800 for a business one. Payments were charged in crypto.

In Russia, where Durov launched Telegram in 2013, it is also the go-to platform where middlemen arrange deals that get around U.S. sanctions, such as smuggling in weapons parts, the Journal previously reported. Several groups advertise the sale of drones and Starlinks — small antennas to access the satellite internet network run by Elon Musk's SpaceX — to Russian combat units in Ukraine. In February, Musk tweeted that no Starlinks had been directly or indirectly sold to Russia, to the best of the company's knowledge. "It's ground zero for every illicit activity you can think of," said Evan Kohlmann, founder of Cloudburst Technologies, which monitors cybercrime on Telegram and elsewhere, and a frequent adviser to U.S. agencies.

Crime

New York Times Calls Telegram 'A Playground for Criminals, Extremists and Terrorists' (yahoo.com) 107

The New York Times analyzed over 3.2 million Telegram messages from 16,220 channels. Their conclusion? Telegram "offers features that enable criminals, terrorists and grifters to organize at scale and to sidestep scrutiny from the authorities" — and that Telegram "has looked the other way as illegal and extremist activities have flourished openly on the app."

Or, more succinctly: "Telegram has become a global sewer of criminal activity, disinformation, child sexual abuse material, terrorism and racist incitement, according to a four-month investigation." Look deeper, and a dark underbelly emerges. Uncut lumps of cocaine and shards of crystal meth are for sale on the app. Handguns and stolen checks are widely available. White nationalists use the platform to coordinate fight clubs and plan rallies. Hamas broadcast its Oct. 7 attack on Israel on the site... The Times investigation found 1,500 channels operated by white supremacists who coordinate activities among almost 1 million people around the world. At least two dozen channels sold weapons. In at least 22 channels with more than 70,000 followers, MDMA, cocaine, heroin and other drugs were advertised for delivery to more than 20 countries.

Hamas, the Islamic State and other militant groups have thrived on Telegram, often amassing large audiences across dozens of channels. The Times analyzed more than 40 channels associated with Hamas, which showed that average viewership surged up to 10 times after the Oct. 7 attacks, garnering more than 400 million views in October. Telegram is "the most popular place for ill-intentioned, violent actors to congregate," said Rebecca Weiner, the deputy commissioner for intelligence and counterterrorism at the New York Police Department. "If you're a bad guy, that's where you will land...." [Telegram] steadfastly ignores most requests for assistance from law enforcement agencies. An email inbox used for inquiries from government agencies is rarely checked, former employees said...

"It is easy to search and find channels selling guns, illicit narcotics, prescription drugs and fraudulent ATM cards, called clone cards..." according to the article. The Times "found at least 50 channels openly selling contraband, including guns, drugs and fraudulent debit cards." In December 2022, Hayden Espinosa began serving a 33-month sentence in federal prison in Louisiana for buying and selling illegal firearms and weapon parts he made with 3D printers. That did not stop his business. Using cellphones that had been smuggled into prison, Espinosa continued his illicit trade on a Telegram channel... Espinosa's gun market on Telegram might never have been uncovered except that one of its members was Payton Gendron, who massacred 10 people at a supermarket in Buffalo, New York, in 2022. Investigators scouring his life online for motives for the shooting discovered the channel, which also featured racist and extremist views he had shared.
"Operating like a stateless organization, Telegram has long behaved as if it were above the law," the article concludes — though it adds that "In many democratic countries, patience with the app is wearing thin.

"The European Union is exploring new oversight of Telegram under the Digital Services Act, a law that forces large online platforms to police their services more aggressively, two people familiar with the plans said."
Social Networks

Telegram Disables 'Misused' Features As CEO Faces Criminal Charges (theverge.com) 33

Following the arrest of its CEO Pavel Durov last month, the encrypted messaging service said it has disabled some "outdated" and "misused" features used by anonymous users. The Verge reports: The first changes to the app following his arrest in France last month affect its built-in blog posts and a "People Nearby" location-based feature. [...] Durov's first post-arrest statement Thursday said, "Telegram's abrupt increase in user count to 950M caused growing pains that made it easier for criminals to abuse our platform. That's why I made it my personal goal to ensure we significantly improve things in this regard." He also said that during the four-day interview after his arrest, "I was told I may be personally responsible for other people's illegal use of Telegram, because the French authorities didn't receive responses from Telegram."

Telegram has since reworked some of its language surrounding private chats and moderation and followed up with these new updates. It's also adding Star giveaways and enabling a reading mode for its in-app browser. "While 99.999% of Telegram users have nothing to do with crime, the 0.001% involved in illicit activities creates a bad image for the entire platform," Durov's message says. "That's why this year we are committed to turn moderation on Telegram from an area of criticism into one of praise."

Durov says the service has stopped new media uploads to its standalone blogging tool, Telegraph, because it was "misused by anonymous actors." Telegram has also removed its People Nearby feature, which lets you find and message other users in your area. Durov says the feature has "had issues with bots and scammers" and was only used by less than 0.1 percent of users. Telegram will replace this feature with "Businesses Nearby" instead, allowing "legitimate, verified businesses" to display products and accept payments.

Crime

Fake CV Lands Top 'Engineer' In Jail For 15 Years (bbc.com) 90

Daniel Mthimkhulu, former chief "engineer" at South Africa's Passenger Rail Agency (Prasa), was sentenced to 15 years in prison for claiming false engineering degrees and a doctorate. His fraudulent credentials allowed him to rise rapidly within Prasa, contributing to significant financial losses and corruption within the agency. The BBC reports: Once hailed for his successful career, Daniel Mthimkhulu was head of engineering at the Passenger Rail Agency of South Africa (Prasa) for five years -- earning an annual salary of about [$156,000]. On his CV, the 49-year-old claimed to have had several mechanical engineering qualifications, including a degree from South Africa's respected Witwatersrand University as well as a doctorate from a German university. However, the court in Johannesburg heard that he had only completed his high-school education.

Mthimkhulu was arrested in July 2015 shortly after his web of lies began to unravel. He had started working at Prasa 15 years earlier, shooting up the ranks to become chief engineer, thanks to his fake qualifications. The court also heard how he had forged a job offer letter from a German company, which encouraged Prasa to increase his salary so the agency would not lose him. He was also at the forefront of a 600m rand deal to buy dozens of new trains from Spain, but they could not be used in South Africa as they were too high. [...] In an interview from 2019 with local broadcaster eNCA, Mthimkhulu admitted that he did not have a PhD. "I failed to correct the perception that I have it. I just became comfortable with the title. I did not foresee any damages as a result of this," he said.

Politics

'Error' Causes Alexa To Endorse Kamala Harris, Refuse To Discuss Trump (theregister.com) 288

An anonymous reader shares a report: It would be perfectly reasonable to expect Amazon's digital assistant Alexa to decline to state opinions about the 2024 presidential race, but up until recently, that assumption would have been incorrect. When asked to give reasons to vote for former President Donald Trump, Alexa demurred, according to a video from Fox Business. "I cannot provide responses that endorse any political party or its leader," Alexa responded. When asked the same about Vice President Kamala Harris, the Amazon AI was more than willing to endorse the Democratic candidate.

"There are many reasons to vote for Kamala Harris," Alexa said. Among the reasons given was that Harris has a "comprehensive plan to address racial injustice," that she promises a "tough on crime approach," and that her record on criminal justice and immigration reform make her a "compelling candidate." Harris has been dividing Silicon Valley since she took up the Democratic nomination from President Joe Biden, with some leaders in the tech industry touting her potential as a pro-tech president, and others diving head-first into the misinformation circus that's being driven by new tools like AI.
An Amazon spokesperson said this "was an error that was quickly fixed."
The Military

Navy Chiefs Conspired To Get Themselves Illegal Warship Wi-Fi (navytimes.com) 194

During a 2023 deployment, senior enlisted leaders aboard the Navy ship USS Manchester secretly installed a Starlink Wi-Fi network, allowing them exclusive internet access in violation of Navy regulations. "Unauthorized Wi-Fi systems like the one [then-Command Senior Chief Grisel Marrero] set up are a massive no-no for a deployed Navy ship, and Marrero's crime occurred as the ship was deploying to the West Pacific, where such security concerns become even more paramount among heightened tensions with the Chinese," reports Navy Times. From the report: As the ship prepared for a West Pacific deployment in April 2023, the enlisted leader onboard conspired with the ship's chiefs to install the secret, unauthorized network aboard the ship, for use exclusively by them. So while rank-and-file sailors lived without the level of internet connectivity they enjoyed ashore, the chiefs installed a Starlink satellite internet dish on the top of the ship and used a Wi-Fi network they dubbed "STINKY" to check sports scores, text home and stream movies. The enjoyment of those wireless creature comforts by enlisted leaders aboard the ship carried serious repercussions for the security of the ship and its crew. "The danger such systems pose to the crew, the ship and the Navy cannot be understated," the investigation notes.

Led by the senior enlisted leader of the ship's gold crew, then-Command Senior Chief Grisel Marrero, the effort roped in the entire chiefs mess by the time it was uncovered a few months later. Marrero was relieved in late 2023 after repeatedly misleading and lying to her ship's command about the Wi-Fi network, and she was convicted at court-martial this spring in connection to the scheme. She was sentenced to a reduction in rank to E-7 after the trial and did not respond to requests for comment for this report. The Navy has yet to release the entirety of the Manchester investigation file to Navy Times, including supplemental enclosures. Such records generally include statements or interview transcripts with the accused.

But records released so far show the probe, which wrapped in November, found that the entire chiefs mess knew about the secret system, and those who didn't buy into it were nonetheless culpable for not reporting the misconduct. Those chiefs and senior chiefs who used, paid for, helped hide or knew about the system were given administrative nonjudicial punishment at commodore's mast, according to the investigation. All told, more than 15 Manchester chiefs were in cahoots with Marrero to purchase, install and use the Starlink system aboard the ship. "This agreement was a criminal conspiracy, supported by the overt act of bringing the purchased Starlink onboard USS MANCHESTER," the investigation said. "Any new member of the CPO Mess which then paid into the services joined that conspiracy following the system's operational status."

Records obtained by Navy Times via a Freedom of Information Act request reveal a months-long effort by Marrero to obtain, install and then conceal the chiefs Wi-Fi network from superiors, including the covert installation of a Starlink satellite dish on the outside of the Manchester. When superiors became suspicious about the existence of the network and confronted her about it, Marrero failed to come clean on multiple occasions and provided falsified documents to further mislead Manchester's commanding officer, the investigation states. "The installation and usage of Starlink, without the approval of higher headquarters, poses a serious risk to mission, operational security, and information security," the investigation states.

Crime

Was the Arrest of Telegram's CEO Inevitable? (platformer.news) 174

Casey Newton, former senior editor at the Verge, weighs in on Platformer about the arrest of Telegram CEO Pavel Durov.

"Fending off onerous speech regulations and overzealous prosecutors requires that platform builders act responsibly. Telegram never even pretended to." Officially, Telegram's terms of service prohibit users from posting illegal pornographic content or promotions of violence on public channels. But as the Stanford Internet Observatory noted last year in an analysis of how CSAM spreads online, these terms implicitly permit users who share CSAM in private channels as much as they want to. "There's illegal content on Telegram. How do I take it down?" asks a question on Telegram's FAQ page. The company declares that it will not intervene in any circumstances: "All Telegram chats and group chats are private amongst their participants," it states. "We do not process any requests related to them...."

Telegram can look at the contents of private messages, making it vulnerable to law enforcement requests for that data. Anticipating these requests, Telegram created a kind of jurisdictional obstacle course for law enforcement that (it says) none of them have successfully navigated so far. From the FAQ again:

To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data. [...] To this day, we have disclosed 0 bytes of user data to third parties, including governments.

As a result, investigation after investigation finds that Telegram is a significant vector for the spread of CSAM.... The company's refusal to answer almost any law enforcement request, no matter how dire, has enabled some truly vile behavior. "Telegram is another level," Brian Fishman, Meta's former anti-terrorism chief, wrote in a post on Threads. "It has been the key hub for ISIS for a decade. It tolerates CSAM. Its ignored reasonable [law enforcement] engagement for YEARS. It's not 'light' content moderation; it's a different approach entirely.

The article asks whether France's action "will embolden countries around the world to prosecute platform CEOs criminally for failing to turn over user data." On the other hand, Telegram really does seem to be actively enabling a staggering amount of abuse. And while it's disturbing to see state power used indiscriminately to snoop on private conversations, it's equally disturbing to see a private company declare itself to be above the law.

Given its behavior, a legal intervention into Telegram's business practices was inevitable. But the end of private conversation, and end-to-end encryption, need not be.

Slashdot Top Deals