Facebook admits it collects users’ audio data and has it reviewed

Data Management & Networks, General, Mobile Security, Networking, Social Media

Facebook pays hundreds of contractors to transcribe bits of audio taken from its users, according to a report in Bloomberg.

Disturbing enough, but get this: the people contracted by Facebook to do this … shady work have no idea what the purpose of such work is. These contractors, who spoke to Bloomberg on condition of anonymity lest they face some kind of disciplinary action, have no information about where the recordings come from, how they were collected, nor why Facebook wants them transcribed. They are simply given audio of Facebook users’ conversations and told to write it down.

After hearing of the practice, the Irish Data Protection Commission announced that it would be performing an investigation to see whether Facebook is in violation of the European Union’s privacy laws.

Caught red-handed (like Apple was in recent weeks), Facebook said it has already stopped the activity. Surprise, surprise. “Much like Apple and Google, we paused human review of audio more than a week ago,” the tech giant said, the operative word being “human.” In another surprise (not), Facebook claims its users consented to having their audio recorded and transcribed. I’m sure they did so freely, voluntarily and knowingly, and not because they didn’t understand the implications of such a policy.

Founder Mark Zuckerberg was grilled about this, and many other things, during his testimony to the US Congress in 2018. He didn’t have answers of the lawmakers then, but his company submitted a few after the fact. With regard to the audio collection, Facebook said it “only accesses users’ microphone if the user have given our app permission and if they are actively using a specific feature that requires audio.”

Here’s a question for Facebook: if this is such an innocuous thing, to which users are voluntarily submitting, why discontinue it? Maybe because, as Bloomberg reports, “Facebook hasn’t disclosed to users that third parties may review their audio.”

It’s high time people initiated a mass boycott of Facebook. The company needs us far more than we need it.

MoviePass left thousands of user card numbers exposed in unprotected database

Data Management & Networks, Digital Systems Technology, General, Mobile Security

MoviePass, a subscription-only move ticket service, exposed tens of thousands of its users’ credit card information due to insufficient security of a server, TechCrunch reports. The exposed database, discovered by cybersecurity company SpiderSilk, reportedly contained 161 million records, many of which included credit card numbers and other private information. TechCrunch explains:

“These MoviePass customer cards are like normal debit cards: they’re issued by Mastercard and store a cash balance, which users who sign up to the subscription service can use to pay to watch a catalog of movies. For a monthly subscription fee, MoviePass uses the debit card to load the full cost of the movie, which the customer then uses to pay for the movie at the cinema.”

The tech publication examined a sample of 1,000 of the aforementioned records and found that more than half showed MoviePass debit card numbers, expiration dates, account balances and the time of activation. Also contained in the records were personal credit card numbers, including expiration date and billing information (names and addresses).

MoviePass has since closed the database, which was accessible for months. TechCruch says it reached out to MoviePass with a number of specific questions but that the company’s only response was the following generic statement:

“MoviePass recently discovered a security vulnerability that may have exposed customer records. After discovering the vulnerability, we immediately secured our systems to prevent further exposure and to mitigate the potential impact of this incident. MoviePass takes this incident seriously and is dedicated to protecting our customers’ information. We are working diligently to investigate the scope of this incident and its potential impact on our customers. Once we gain a full understanding of the incident, we will promptly notify any affected subscribers and the appropriate regulators or law enforcement.”

SpiderSilk’s Mossab Hussein, the researcher who first discovered the vulnerable database, told TechCrunch that there is no excuse for MoviePass’ negligence in this scenario, which is one we keep seeing played out over and over again across the digital world.

“We keep on seeing companies of all sizes using dangerous methods to maintain and process private user data,” he said. “In the case of MoviePass, we are questioning the reason why would internal technical teams ever be allowed to see such critical data in plaintext—let alone the fact that the data set was exposed for public access by anyone.”

Eminem sues Spotify

Big Data, Digital Systems Technology, General

Rapper Eminem has filed a lawsuit against Spotify through his publishing company, Eight Mile Style. The suit, filed Wednesday, alleges that the popular audio streaming platform engaged in copyright infringement by streaming more than 200 of the rapper’s songs, including “Lose Yourself.”

The suit moreover accuses Spotify of violating the Music Modernization Act (MMA), a federal law put in place recently to address issues arising from streaming services and copryright infringement. Eight Mile Style also takes aim at the law itself.

The Hollywood Reporter obtained a copy of the document, which reportedly argues that Spotify does not have a license to reproduce Eminem’s music. Here’s a direct quote from the complaint: “Spotify has not accounted to Eight Mile or paid Eight Mile for these streams but instead remitted random payments of some sort, which only purport to account for a fraction of those streams.”

Further, Spotify has allegedly put “Lose Yourself” into its “Copyright Control” category (songs in this category have no known owner). “Eight Mile attacks the ‘absurd’ notion that it can’t be identified as the owner of such an iconic song, which was the centerpiece of the 2002 film 8 Mile, hit No. 1 on the Billboard Hot 100 and won an Oscar for best original song,” The Hollywood Reporter writes. “According to chart data, Eminem is among the most followed artists on Spotify with monthly listens on par with Bruno Mars, Coldplay and Taylor Swift.”

As for the MMA, which was signed into law by Donald Trump and which is supposed to simplify the task of identifying and remunerating owners of songs being streamed, Eight Mile Style alleges that Spotify is working around the new rules.

Here’s another quote from the lawsuit: “First, by its terms, the MMA liability limitation section only applies to compositions for which the copyright owner was not known, and to previously unmatched works (compositions not previously matched with sound recordings), and not to ‘matched’ works for which the DMP [Digital Music Provider] knew who the copyright owner was and just committed copyright infringement.”

The charge here is that Spotify pretended not to know who owned the rights to Eminem’s songs, thereby reducing its own liability and creating a situation in which it did not have to pay the artist as much as he legally should have been.

At any rate, the suit claims, Spotify “did not engage in the required commercially reasonable efforts to match sound recordings with the Eight Mile Compositions as required by the MMA.”

It will be interesting to see how the corporation responds.

NEW NAME FOR MCT

Communications

15 November 2004 by Richard Chirgwin

But Macquarie Telco’s Big News is in Services

Last Thursday (November 11) Macquarie Corporate Telecommunications unveiled a new identity – as Macquarie Telecom – and also lifted the lid on plans for a new range of services based on its own access network.

Faced with every telco’s problem – how to protect margin in a world where access to the customer is governed by Telstra’s access network – MT is to start creating services based on an Ethernet access network.

MT’s CEO David Tudehope said the company has spent 12 months planning its own metropolitan access network.

In corporate services, he said, “The critical success factor is the quality of the network”, and by creating an access network, “We create a real opportunity for business and corporate clients.”

The MT access network will embrace all of its existing offerings, but where possible, the access network will embrace a planned fibre rollout to customer premises. This, according to (title) Glen Noble, will depend on the economics.

Those economics, however, are helped by MT’s existing customer base. Noble told CommsWorld that instead of having to build a network and then recruit customers, MT can migrate an existing customer base to the access network. All-MT network rollout will chiefly focus on fibre loops in CBD areas, Noble said.

An Ethernet-based fibre rollout means MT will be able to support converged customer connections, with voice, data and video on a single QoS-enabled high speed customer tail. Noble also said the company will consider expanding the definition of “on-network” traffic; for example, allowing corporates using the MT access network for VoIP traffic to make on-network calls between each other.

FREE TRADE UNDER CORPORATE MONOPOLY

Business

22 November 2004 by

Richard Chirgwin

More on the Aus-US FTA as Letters Change Hands

Here’s a reference out of the dim dark past: in December 1997 (oh so long ago!), Australian Communications published a US price survey which found that country’s network kit vendors set prices (inclusive of exchange rate variations) as much as 84% higher in this country than back home.

Before anyone gives me some bromide about transport costs, I should make this clear: then, as now, most of the stuff was made in Asia, and delivered from Asia. It had nothing to do with transport: it had to do with price-fixing. Since that’s illegal, vendors had to use their control of the channel to achieve it: anoint just one importer, give it just one price, and leave the rest to the need for profit. The same survey found that countries with the most import channels also had the least “export mark-up”.

The reason I mention this is because over the years, the ACCC has worked hard on the issue of import monopolies, with some success. Sure, US vendors will still sprout the most outrageous humbug about “grey marketing”, pretending there’s something illegal or immoral about it. But parallel importation is a legal activity.

Not for long, and that’s my gripe against the time-serving circle-jerking slackers of the Canberra gallery.

In all the hundreds of thousands of words written about the Australia-US free trade agreement, you will find nearly nothing highlighting this paragraph:

“ Each Party shall provide that the exclusive right of the patent owner to prevent importation of a patented product, or a product that results from a patented process, without the consent of the patent owner shall not be limited by the sale or distribution of that product outside its territory, at least where the patentee has placed restrictions on importation by contract or other means.”

(Article 17.9, paragraph 4).

To boil it down to its effect: this paragraph commits the Australian government to make “grey marketing” illegal, and this paragraph has passed by the entire Canberra press gallery and (with the sole exception of Ross Gittins) every single commentator who has written about the FTA.

It’s easier to make egregiously stupid statements, like SBS’s Peter Martin who told the world that Banjo Patterson’s works will return to copyright under the FTA, than to break out of the mindset which follows the bum of the sheep in front.

Why would parallel import rules be “out of scope” for nearly every commentator on the FTA? The right of US companies of all kinds to engage in price-fixing in Australia through controlled imports reaches into every single household in the country.

Moreover: it’s open to exploitation in a modern, multinational world. The right to impose import monopolies is held by the patent owner: if patents are held by an American company, then that company sets the import rules to Australia.

In other words, an Ethernet switch vendor whose engineering is in Singapore, whose call centre is in the Philippines, and whose manufacturing plant is in Korea can still take advantage of the FTA, by setting up an office in Delaware and assigning all patents over its products to the American company. It’s an unlikely scenario for anyone whose competitive edge is low price – but in the long term, you can bet that if something is able to be exploited, it will be.

Of course, my focus has been on what such a provision would do to network equipment. But it’s not just Ethernet that could suffer from a patent migration scam: there is precious little, in the modern world, which doesn’t fit the bill of being “patented” or “the result of a patented process”.

Now, you can understand why there would be a deathly silence in any News-controlled outlet over such a point. News owns music labels and movie studios, and likes import monopolies. The business advocates of the FTA were never going to kick. They like import monopolies; it lets them blame higher price on someone upstream, while passing on those prices (with a little extra markup) to consumers.

But someone should have noticed that everything from sandshoes to ink-jet refills is swept up in the import monopoly rules.

Why do I return to the issue, given that I wrote about it to deafening silence back in August? Because this week, the group-think has been at work again. Australia and America exchanged “diplomatic notes” in which, among other things, our government made commitments to “address” America’s concerns about our FTA implementation legislation.

The group-thinkers used the occasion to justify rehashing what they’d already said about the FTA. But they didn’t go so far as to ask for the text of the letters exchanged between us and America. The same time-serving, circle-jerking slackers who didn’t read the full text of the FTA at the beginning of this year stay true to form right up to the end of the year: “he said” is more important than the text.

Richard Chirgwin

CLUE-FREE REPORTING AT ITS BEST

Government

 22 November 2004 by Richard Chirgwin

Here is a hilarious coincidence.

This morning (Sunday, November 21 at 8.15am), Centrelink’s home page is down.

In the next Mozilla tab, I have a list of headlines detailing the history of Centrelink. Apart from the string of leaks to the computer press designed to get it some favourable press – stories like its commitment to open source software – we also get the darker side. I’ll get to that in a minute.

The third Mozilla tab has the most ludicrously unsceptical report I’ve seen in the IT press this year, from Federal Computer Weekly in America. FCW – the story is at www.fcw.com/fcw/articles/2004/1115/web-aussie-11-16-04.asp – is telling us how wonderful is Centrelink, as demonstrated by an address given by its CIO, Jane Treadwell, to a conference in America.

FCW got the quotes right, and pretty much nothing else.

It described Centrelink as an e-government project, rather than a government agency which has an e-government project (in the usual self-congratulatory terms, Centrelink ‘serves Australians on the ground and online’). It’s described as having ‘customers’ when in fact it’s mostly in charge of delivering various kinds of welfare (hint: you don’t buy welfare; calling the unemployed ‘customers of Centrelink’ is double-speak). And its main role, in the blinkered faraway world of the US press, is … well, I’ll let the words of FCW speak for themselves: ‘One of Centrelink’s top services provides Australians the ability to change their addresses’.

But what’s stunning is the gap between the glowing media it gets as a conference presenter, and the kinds of headlines I find in Australia. Headlines like ‘ Planning flaws put Centrelink system at risk’ (AFR, October 27 2003), ‘ Glitch causes Centrelink scar e Millions of mistakes by Centrelink’ (The Australian, February 14, 2004), ‘ Office porn purge at Centrelink’ (Herald Sun, January 21, 2004), ‘ Computers block fix on errors’ (The Australian, February 16, 2004), ‘ Centrelink’s $5.3m website’ (The Australian, March 16, 2004), ‘IT failures that hit the public purse’ (AFR, April 20, 2004), ‘ Centrelink changes may cut back technical help’ (AFR, April 28, 2004), ‘ Centrelink web lost in the past’ (The Australian, July 23, 2004), ‘Glitch hits agency’s debt recovery’ (The Australian, August 3, 2004), and ‘ Privacy concern at data sharing’ (The Australian, August 27, 2004) .

And, proving that Americans haven’t stopped patronising this country, some dude from Washington seriously and with a straight face told FCW that Australia would have gone broke without Centrelink.

Centrelink’s $5.3 million Website returned to life some time this afternoon.

ATTACKING THE ATTACKER

Business, Technology

22 November 2004 by Richard Chirgwin

ForeScout Launches SecuredWire in Oz

A newly-arrived security vendor is taking what I might call the honeypot principle as the basis of a suite of products designed to overcome the “day zero” problem.

ForeScout Technologies’ SecuredWire is, as general manager Richard Galpin told CommsWorld late last week, designed to focus on the attacker rather than the attack.

Here’s the operation which Galpin described: the ForeScout technology creates a weak “ghost” server outside the corporate firewall. Visible to the Internet, this virtual server will be polled and scanned by potential attackers (very much like a honeypot).

Having identified a weak address and port, the attacker will then try to initiate a conversation with that port, at which point the ForeScout server can capture the attacker’s IP address. It then blocks the address at the firewall for a user-configurable time (since most users are on dynamically-allocated addresses, Galpin said, there’s no point in blocking an ‘attack’ address forever).

While the virtual server has a normal IP address, the ‘real’ SecuredWire server does not. The company’s designed the system to communicate over a private Ethernet connection with the secured side of the network, to prevent attackers identifying the presence of the device.

There are, he said, three possible configurations. A SecuredWire server configured with one NIC – really only suitable for evaluation purposes – will be a fully visible member of the IP network it’s attached to. With two NICs, the device can sniff Internet connections without exposure, using a private IP address on the second NIC to communicate on the secured side of the corporate network.

A third, more secure configuration uses three NICs: one for the stealth sniffer, one for the private network, and the third providing a direct connection to the firewall.

The system can also be used to defend corporate networks against attacks such as worms which have already entered the system (for example, through a laptop). By shutting down only the source of malicious internal traffic, the company claims it can keep networks operational even after some machines have suffered virus or worm infection.

If you’re a pessimist like myself, you will have noticed that there is an attack vector which could be used against ForeScout: hit the system with a large number of attacks, apparently from a large number of originating IP addresses. If successfully used against a SecuredWire-defended e-commerce site, this could act as a denial-of-service attack in which ‘real’ users were unable to pass the address blocks.

However, as Galpin pointed out, this sort of attack depends on the assumption that the attacker knows SecuredWire is in use at the target site. In ‘stealth’ mode, with no IP address except that assigned to the ‘honeypot’ virtual server, finding the device wouldn’t be trivial. And the potential for such an attack, he said, is why the ‘time to live’ of the block is adjustable: an e-commerce site would set a comparatively short block time, to avoid the risk that genuine users might inherit an address that’s currently blocked.

SYS SOL GETS INTO IP TEL –

Business, Technology

22 November 2004 by Richard Chirgwin

Revamping Suite with HMP
System Solutions, a long-time supplier of telephony software, has taken the plunge and turned its attention to the world of IP telephony.

According to Ivor Livingstone, the company’s CEO, the move will open its MESSAGEmanager suite – which includes IVR, voice messaging, speech recognition, fax, SMS and other services – into the expanding world of business IP telephony.

Livingstone told CommsWorld that rather than redevelop the product set from scratch to support VoIP, the company decided to use Intel’s Host Media Processor as a gateway between its TDM-based heritage and the emerging IP telephony world.

Call control, he said, is very different in IP telephony, and would have demanded a considerable rewrite of software to support. While TDM switches are highly proprietary, the task of unravelling their behaviour is straightforward, if time-consuming. A third-party vendor like System Solutions would treat the switch as a state machine, and analyse the outputs it produced in response to different inputs.

The presence of competing standards also raised its head as a challenge.

Standards have “started to evolve – for example, SIP is very popular, but not a lot of the existing switch vendors support it. So we had to provide other flavours of IP telephony in our development project; the H.323 protocols, for example.”

Intel’s HMP had its feet in technology with which System Solutions was already familiar, having its own heritage in the acquisition of Dialogic some years ago. As a developer, he said, System Solutions found it relatively easy to use the HMP Global Call API to handle the integration to IP-based environments.

The developer, Livingstone said, uses Global Call to address the HMP hardware, and HMP provides the integration to the IP devices.

However, “validation against each of the switches – the Ciscos, the Alcatels, the Avayas – that’s challenging.”

While traditional TDM environments carry a lot of the features System Solutions is offering as software, Livingstone said by concentrating on its own capabilities, the company has been able to offer competitive features sets.

The more open world of IP telephony gives the company the opportunity to do things that don’t fit easily into traditional telephony systems, he said. “There’s a tremendous opportunity to develop productivity applications on top of telephony. These go beyond cost savings: you can embody IP telephony into all sorts of applications, far further than in traditional telephones.”

Livingstone said the expansion of System Solutions into the IP telephony space will expand its overseas opportunities, and also the scope of partners the company can work with. This is enhanced, he said, by the company’s work with presence servers and its ability to act as a media gateway.

Presence products, Livingstone said, create opportunities to work with companies whose traditional business is in data networking.

As for media gateways, he said, System Solutions is now in its third generation of product while he

TELSTRA VS CRAZY JOHN’S –

Communications, Technology

30 November 2004 by Richard Chirgwin

Are Wholesale Services `Up to Scratch’?

The lawsuit between Crazy John’s and Telstra is, in my mind, just as important to the privatisation debate as the ongoing and pointless discussion about whether services are ‘up to scratch’.

When Australians think of telecommunications services, they’re apt to think of what reaches the retail consumer. However, in a contestable market, with a wholesale-retail split, services are also what reaches the retailer from its upstream wholesaler.

What’s sold at wholesale is quite different from retail, and not just in volume.

The retailer buys a lot of things from wholesalers, but they all add up to this: retailers are buying the ability to make money. They’re buying the services themselves (mobile, fixed, or data); they’re sometimes buying a supply of physical products; they’re buying some level of tech support to keep the services running.

And most of all, they’re buying an income stream.

That income stream depends on accurate record-keeping – a point brought home years ago in the One.Tel collapse – but it’s still one of the most difficult and challenging parts of the wholesale-retail relationship.

In part, that’s because Australia is still relatively new to the wholesale-retail business. The Telecom of old had no need for the kind of wholesale business IT systems it now needs: there was no retail sector.

That changed throughout the 1990s, but we’re still only into perhaps the second or third generation of wholesale business process in this country.

The retail business, however, continues to change much faster than the systems which support it. This is partly because the wholesale market has become so contestable. When Telstra was the only source of wholesale business, products were available in ‘any colour, so long as it’s black’. Wholesale competition has brought with it the need to differentiate products; this, in turn, makes the products and the relationships more complex.

Herein lies the importance of the Telstra-Crazy John’s court case.

It’s possible that Australia’s telecommunications market is too monolithic for true contestability, at least for another decade to come.

Whether or not that’s true, a contestable market demands that the wholesale-retail relationship functions properly.

In trying to determine whether or not Telstra’s services are ‘up to scratch’, the federal government is gazing with a fixed stare at rural and regional services – not even the whole of the carrier’s retail business.

As a result, the government is ignoring whether or not the carrier’s wholesale services – upon which the storefront retailers depend – are also ‘up to scratch’. This seems strange, because most retailers (by number if not by value) are the kind of business which is supposed to be the Liberal Party’s core constituency: the owner-operated, probably franchise-based SME.

The Crazy John’s lawsuit is more important than the industry thinks.

IN DEFENCE OF ZIGGY

Business, Communications

02 December 2004 by Richard Chirgwin

The Low Share Price is Structural, Not Personal

If nobody’s listening, I’ll tell you a secret: it’s not Ziggy’s fault.

Some things were Ziggy’s fault – the Asian expeditions, the Fairfax follies, the conviction that Telstra should become a dotcom.

But the share price? Only a brain donor blames the share price on Ziggy. A brain donor – and an institutional investor.

For a while now, a rumour that Ziggy was going to leave Telstra would send the share price upwards; this was the institutions’ signal that they wanted Ziggy gone. The reasoning, instantly seized upon by the business pages that the institutions were blaming Ziggy for the low share price.

They wanted to send that signal, but they were lying through their teeth, and worse still, they’re lying as a cartel. With the lie endorsed by all the institutions (whose representatives can be relied to ask the most clue-free questions any journalist can ever hope to hear), all they need do is act in concert and cast their vote.

The reason Telstra’s share price is between $4.50 and $5.00 is because that’s what the company is worth . The reason it was sold for a much higher price is that the government fudged its value, because the buyers were captive to the stupid idea that a utility stock was somehow magically transformed into a growth stock by the Internet; because the world believed that ‘Internet traffic is doubling every 180 days/three months/six months’. All of this was endorsed by the same goons who now play with the share price to punish an individual.

Three lies, put together, inflated the share price, which the government liked because it let them pay down government debt.

Back to Ziggy. He went along for the ride, and therefore deserves his share of the criticism, but for the institutions to personalise the share price in this way is reprehensible; particularly because it lets the institutional fee-farmers continue pretending they had nothing to do with the whole Telstra share debacle.

Why are the instututions lying to us?

First, because they don’t want the blame sheeted home to the government. They’ve eaten well at the hands of Canberra, and don’t want to ever close a door in Parliament.

Second, because blaming the CEO lets them divert attention away from their own role. The institutions were just as enthusiastic at priming the “Telstra is worth $10” as anyone else. They were either suckers or knaves.

Third, because most of all they want the Telstra privatisation to keep yielding fees for the financial industry.

Hence the share price rose on the news of rumours.

Strangely, when the reality came the first response was a fall in the share price.

My bet is that the institutions knew damn well that a change at the top is not going to help any of the things they want. It’s not going to roll back the competitive market, which caps Telstra’s growth capacity. It’s not going to materially affect the schedule of the privatisation fee-fest. It’s not going to change the economy of telecommunications, or the need to spend money on network upgrades, or the fact that there’s only so much fat you can cut from the carrier before you cut services.

In other words, with Ziggy’s departure, the truth becomes clear: it was personal. On rumours of his imminent resignation, the institutions gave the world their view of Ziggy the person, and pumped up the share price. When the rumour became fact, the real view became clear, and the share price went down.

Ziggy is responsible for some things. But the depressed Telstra share price? The institutions are far more responsible – and they don’t resign.