Tech News and Issues

Artificial Intelligence & You: Don’t Take My Word For It…

by Major Major Major Major| January 7, 202012:39 pm| 69 Comments

This post is in: Media, Politics, Science & Technology, Tech News and Issues

This is part two of a series of posts on artificial intelligence.

A month ago, I wrote a post about our upcoming reckoning with AI-driven text generation. Today, computer security expert & cryptographer Bruce Schneier was kind enough to write a follow-up for the Atlantic, “The Future of Politics Is Robots Shouting at One Another“:

Presidential-campaign season is officially, officially, upon us now, which means it’s time to confront the weird and insidious ways in which technology is warping politics. One of the biggest threats on the horizon: Artificial personas are coming, and they’re poised to take over political debate. The risk arises from two separate threads coming together: artificial-intelligence-driven text generation and social-media chatbots. These computer-generated “people” will drown out actual human discussions on the internet.
[…]
Over the years, algorithmic bots have evolved to have personas. They have fake names, fake bios, and fake photos—sometimes generated by AI. Instead of endlessly spewing propaganda, they post only occasionally. Researchers can detect that these are bots and not people based on their patterns of posting, but the bot technology is getting better all the time, outpacing tracking attempts. Future groups won’t be so easily identified. They’ll embed themselves in human social groups better. Their propaganda will be subtle, and interwoven in tweets about topics relevant to those social groups.
Combine these two trends and you have the recipe for nonhuman chatter to overwhelm actual political speech.

It’s a short read, and I recommend clicking over.

Schneier provides many excellent links to AI-driven dis/misinformation campaigns that have already happened or are already underway. One of his examples is the public comments on the FCC’s proposal to end net neutrality, which were flooded by pro-Trump content. Around half the signatories were fake. Over a million comments were written by a shoddy AI from an easy-to-detect template. The FCC (which like many government bodies is organized to be controlled by the president’s party) did not care.

Schneier touches on an important discussion point: what will the effect of all this be on society? Nobody knows, and the technologies are going to improve significantly faster than our ability to study their effects.

The best analyses indicate that they did not affect the 2016 U.S. presidential election. More likely, they distort people’s sense of public sentiment and their faith in reasoned political debate. We are all in the middle of a novel social experiment.

That data, of course, is four years old.

We’re already at the point where it’s easier to generate passable garbage than it is to detect and remove it. This will only get worse as we go from ‘passable garbage’ to simply ‘passable content’. Already, “it’s just a Russian bot” is used to dismiss any number of arguments we see online. What happens when the Russian (and Saudi, Chinese, North Korean, Republican, Hindu nationalist, etc., etc.) bots reach whatever the tipping-point level of sophistication is? When anything written by a non-verified source is instantly suspect?

Barring a dramatic shift in user authentication standards, we may soon find that the majority of political content (by volume) is written by computers. What happens then?

Artificial Intelligence & You: Don’t Take My Word For It…Post + Comments (69)

Artificial Intelligence & You: Automated Fake News and Trolling

by Major Major Major Major| December 11, 20196:52 pm| 76 Comments

This post is in: Science & Technology, Tech News and Issues

As evidence continues to mount that we are living in a cyberpunk dystopia, I’ve decided to do a series of posts on artificial intelligence. This one is about text generation.

I’m something of an AI skeptic. While they’ve proven to be very effective in some areas, these are mostly tasks with a narrow scope and well-defined set of rules, such as playing chess and go, or determining whether something is a picture of a cat. More complex tasks like driving have proven to be a lot harder. Driving in particular has very ambiguous inputs that are highly context-dependent, two things that AIs have trouble with.

(Let’s please continue reading and not get hung up on the political and ethical roadblocks to self-driving cars.)

AIs have also historically had trouble generating text and images. Not because these are magical tasks that only humans can perform; it’s simply been difficult to make computers good at them. Well, much to my surprise, this may be coming to an end in the next few years. And I don’t mean that in the “self-driving cars are always five years away” sense.

In the last couple of years, computerized content generation has made some remarkable advances. Deepfakes–videos that believably replace one person with somebody else–are proliferating, and fairly easy to make. AIs are frighteningly good at generating faces now, too.

But what about text? Google Translate has gotten much more sophisticated lately as Alphabet has perfected the neural networks that power it. But is that more like writing, or more like playing go? I’d say it’s in between.

Which brings us to writing. Earlier this year, the nonprofit group OpenAI built a text-generation neural network that was, in their opinion, too frightening to release. I called malarkey, but now that they’ve been gradually releasing more sophisticated versions of their model, I call… less malarkey. What this means for you, and some examples, below the fold.

show full post on front page

This neural network, called GPT-2, was trained on 40GB of internet text (which is a lot). I downloaded and set up the newest version of their model to play with it, and the results were impressive. When given a prompt, it will output its best guess of what the next word should be, over and over, until you have something approaching prose. Here are some that I generated, with the seed text in italics.

Just moments ago, a ballistic missile was launched from the Tonghae Satellite Launching Ground in North Korea.
It was tracked as it made its way to its target in Japan.
Japan’s Defense Minister announced this morning that North Korea launched a ballistic missile that flew over Japan into the Sea of Japan.
The missile’s trajectory is the same as last time North Koreans fired a ballistic missile. The North Korean missile launch happened just hours after the UN Security Council voted unanimously to impose additional sanctions on the reclusive nation because of their nuclear and ballistic missile programs.
China, North Korea’s main ally, condemned the launch and called for “urgent efforts by the international community to properly implement the resolution,” according to a statement issued from the Foreign Ministry.
The missile launch followed the US strike on Syria, which came after four of its air strikes were launched in retaliation to an alleged chemical weapons attack in the Syrian city of Khan Sheikhoun last week.

Supreme Court Justice Ruth Bader Ginsburg has died, her family reports.She was 88.
Ginsburg suffered her latest bout of complications in early June, her brother-in-law Ron Sachdeva said Tuesday morning. She was in intensive care following her surgery to relieve the pain from her latest bout of pneumonia, Sachdeva said.
“It is with a very heavy heart and with great sorrow that we say goodbye to our beloved Ruth,” Sachdeva told CNN.
She was brought back to the hospital to begin physical therapy in late June after being “sore for quite a while.”
“The treatment included a series of lung functions over the course of several weeks,” Sachdeva said.
A physician who was not authorized to speak publicly and requested anonymity told CNN last month that she was in critical condition.

Are they perfect? No. Do they always come out this well? No. But, when they do: Are they good enough to trick people who only skim them? Good enough to rile up the gullible or already-convinced? Good enough to generate natural-sounding tweets and website comments? Good enough to run an ongoing confusion & disinformation campaign?

Unfortunately, yes. Add the fact that it’s trivial to generate an endless supply of these, and we can see the problem. It’s already creating content that’s better than some of what comes out of the Russian propaganda mills.

These models are only going to get more sophisticated as time goes on. (Indeed, this model already is more sophisticated; they just haven’t released the whole thing). Neural networks leave fingerprints all over the stuff they create, and it’s easy to detect GPT-2 text, but who’s really going to go out of their way to do so?

We aren’t in a world of endlessly-scalable automated propaganda yet… but we’re getting to the point where I can see it on the horizon.

(If you’d like to play with a smaller version of this model yourself, you can try it at this website.)

Artificial Intelligence & You: Automated Fake News and TrollingPost + Comments (76)

Andrew Yang’s Dangerous Idea

by Major Major Major Major| November 16, 20191:08 pm| 99 Comments

This post is in: Privacy, Tech News and Issues, I Can't Believe We're Still Talking About Fucking Nazis, Into the weeds

Andrew Yang has released a plan for Internet regulation. Some of it is good, some of it is anodyne, and some of it is terrible. You may wonder why I’ve chosen to write about this, since he’s not going to be the nominee. Two reasons: one, we should all be talking about this stuff more. Two, his plan is a great example of how Americans go astray when thinking about regulating tech companies.

From his website, we can start with the good:

Regulate the use of data and privacy by establishing data as a property right. The associated rights will enable individuals to retain ownership and share in the economic value generated by their data.

Wonderful! Big fan. I used to work at a startup that sought to enable customers to do this. Alas, it failed because investors thought that our user base would only be the Very Online™, and the sorts of people who want to hide things. Without widespread adoption (or government regulation), this doesn’t work.

Then we have the “sure, alright, I could see that working out”:

Minimize health impacts of modern tech on our people, particularly our children. I will create a Department of the Attention Economy that focuses on smartphones, social media, gaming, and apps, and how to responsibly design and use them, including age restrictions and guidelines.

He proposes things like “removing autoplay video for children under 16,” though personally I’d like to see that apply to children under 116. This one also contains stupider bullet points like “removing the queues that allow infinite scrolling,” which would be laughably easy to work around, if anybody can even figure out what it means.

And then we reach his dangerous ideas, which many politicians across the spectrum like, and which represent a particular failure mode in American regulatory thought.

show full post on front page

There are essentially two ideas united by the same fallacy:

Social media platforms have catalyzed mass disinformation campaigns over the past decade, threatening not just our wellbeing but our democracy… Algorithms driving recommendations towards conspiracy theory content or other types of disinformation need to be reined in…
We must address once and for all the publisher vs. platform grey area that tech companies have lived in for years. Facebook, Twitter, and other social media sites are using algorithms to make recommendations. These recommendations drive the majority of traffic, up to 70% for Google owned YouTube.
Section 230 of the Communications Decency Act absolves platforms from all responsibility for any content published on them. However, given the role of recommendation algorithms—which push negative, polarizing, and false content to maximize engagement—there needs to be some accountability.

I will leave aside the fact that Section 230 does no such thing and write instead about this inane focus on recommendation algorithms. (If you’re curious about my opinions on Section 230, there are upcoming EU regulations that touch on this, which I have written about here.)

Yang notes that large social networking sites are used to push massive amounts of misinformation. Further, such sites use recommendation algorithms that often reward bad-faith actors. Since these sites are so large and ubiquitous, this represents a threat to consumers and democracy. So far this is not controversial; even Facebook and Twitter acknowledge this.

However, Yang’s proposed remedy is to require said recommendation algorithms to be either posted in full online or pre-approved by the government. The former would needlessly stifle expression and innovation, and as for the latter, well, imagine Trump with that power.

So where is this faulty reasoning I’m talking about? It’s very simple. If there’s a tech company that’s so big and ubiquitous you feel it’s a danger to democracy, what you have isn’t a justification for an algorithm-policing bureaucracy—what you have is a company that’s too big. And the government already has the authority to address that.

Yang says some dumb shit about how antitrust won’t work in his proposal, which demonstrates a follow-up point: The concept of antitrust enforcement is so foreign to modern Americans that they often reach for bizarre & harmful over-regulation to mitigate the damages caused by huge companies instead of just banning huge companies.

While Yang is a sideshow, and I suspect he does not understand what a recommendation algorithm is, this mode of thinking is very common, so I wanted to start a conversation. I’m happy to get into more detail in the comments.

Andrew Yang’s Dangerous IdeaPost + Comments (99)

Panopticon Creep: UK Edition

by Major Major Major Major| September 10, 20193:45 pm| 94 Comments

This post is in: Privacy, Science & Technology, Tech News and Issues, United Kingdom

Once upon a time, London was the world’s most-surveilled city. This position has since been usurped by Chongqing, a city in the Sichuan province which boasts one hundred sixty-eight cameras per one thousand people. Perhaps upset over the loss of their title, Boris Johnson has decided it’s high time that the UK began compiling records of its citizens’ web traffic.

tl;dr: Here’s an executive summary based on my reading of the linked article.

Currently, the various parts of the government collect analytics on how people use their websites.
BoJo would like to combine all of this data, creating profiles of how each individual uses the whole government’s online offerings.
This is to be done ASAP and in secret. The rationale for this is mumble mumble Brexit.
This data will be “anonymized”, which is not particularly meaningful at this level of specificity. While an analyst armed with this database would not be able to find a person’s usage by searching for their name, the same analyst could easily derive a person’s name from their usage.

Drilling into some detail now:

Boris Johnson has secretly ordered the Cabinet Office to turn the government’s public internet service into a platform for “targeted and personalised information” to be gathered in the run-up to Brexit, BuzzFeed News has learned.
In a move that has alarmed Whitehall officials, the prime minister has instructed departments to share data they collect about usage of the GOV.UK portal so that it can feed into preparations for leaving the European Union at the end of next month.
show full post on front page

Panopticon Creep: UK EditionPost + Comments (94)

Trump all up in the tubes

by Betty Cracker| August 13, 20193:57 pm| 183 Comments

This post is in: Open Threads, Politics, Republican Stupidity, Tech News and Issues, Assholes, General Stupidity

This White House proposal to regulate social media moderation could be one of the bloated, mangy shitgibbon’s mock-charges (via MIT Technology Review):

The news: A draft executive order would give the FCC oversight over how social-media platforms like Facebook and Twitter moderate their sites, according to CNN, which obtained a copy. Dubbed “Protecting Americans from Online Censorship,” the order calls for the FCC to develop new rules to define when the law protects tech firms’ decisions to take down content—and when it doesn’t. It also demands that the Federal Trade Commission take those new rules into account when investigating potential malpractice by companies.
The politics: This represents a major escalation in the Trump administration’s campaign against social- media firms, which he claims are biased against conservatives (despite a lack of evidence), and would be a vast expansion of the FCC’s responsibilities.

There’s a sound argument that Big Tech needs regulation to prevent bad things, such as social media being weaponized to subvert democracy or platforms chewing up user data to become marketing panopticons. But that’s not what this is about.

The proposed oversight is theater in response to made-up conservative grievances, like Trump-supporting clowns Diamond & Silk’s claim that Facebook was shadow-censoring them, which a Congressional hearing revealed was based on the sister-grifter duo’s ignorance about how user settings work. And Trump’s own periodic squealing about Twitter interfering with his follower count, which happened to coincide with Twitter’s occasional purges of bot accounts.

Anyhoo, let’s hope this is much ado about nothing. The last thing we need is that moron all up in the tubes. Speaking of moronic, Trump staged a taxpayer-funded MAGA rally in Pittsburgh a while ago and said an appallingly stupid thing about wind power:

“Some day the environmentalists are going to tell us what’s going on with that. And then all of the sudden it stops — the wind and the televisions go off.”

Jesus take the wheel.

Trump all up in the tubesPost + Comments (183)

Liz Warren: Let’s Break Up Big Tech

by Major Major Major Major| March 9, 20197:05 am| 244 Comments

This post is in: Election Year, Free Markets Solve Everything, Science & Technology, Tech News and Issues

Senator Warren announced yesterday morning that she thinks we should break up the big tech monopolies. She focuses on Google, Facebook, and Amazon in particular, though there are obviously other companies that would also fit this description.

Today’s big tech companies have too much power — too much power over our economy, our society, and our democracy. They’ve bulldozed competition, used our private information for profit, and tilted the playing field against everyone else. And in the process, they have hurt small businesses and stifled innovation.

One focus is on how companies use mergers and acquisitions to limit competition, like how Facebook snaps up every available messaging company. This seems pretty self-explanatory. The other main focus of her Medium post, which I find more interesting, is that companies which own networks should not be allowed to participate in those networks. This one’s a little less clear to the layperson, so she lays on some history.

But where the value of the company came from its network, reformers recognized that ownership of a network and participating on the network caused a conflict of interest. Instead of nationalizing these industries — as other countries did — Americans in the Progressive Era decided to ensure that these networks would not abuse their power by charging higher prices, offering worse quality, reducing innovation, and favoring some over others. We required a structural separation between the network and other businesses, and also demanded that the network offer fair and non-discriminatory service.

Her plan:

My administration would restore competition to the tech sector by passing legislation that requires large tech platforms to be designated as “Platform Utilities” and broken apart from any participant on that platform.
[…] Amazon Marketplace, Google’s ad exchange, and Google Search would be platform utilities under this law. Therefore, Amazon Marketplace and Basics, and Google’s ad exchange and businesses on the exchange would be split apart. Google Search would have to be spun off as well.

This is an interesting idea! And it’s high time we had this conversation at a presidential-campaign level. (I’m sure this was eaten by various shitstorms in yesterday’s news, but still.)

She sort of talks about how we also need to deal with privacy, but it’s not included in this plan, which is fair. The post says the same about preventing foreign tampering. To me, the big thing that’s actually missing is how to handle the infrastructure platforms like Amazon Web Services and Google Cloud Platform. Those two service umbrellas undergird a great deal of the world’s technological infrastructure, including that of the American government. In the case of Amazon, they also provide most of the actual corporate profit, I believe. The cheapish, on-demand infrastructure they provide is actually pretty helpful to small innovators too.

Anyway, this, the co-determination bill, the CFPB, are all good examples of what I love about Warren. Her “making capitalism work for everybody” shtick just really resonates with this neoliberal shill.

I was originally going to post this yesterday afternoon, but my flight had terrible wifi, so now you’re getting it after dinner from Tokyo.

Liz Warren: Let’s Break Up Big TechPost + Comments (244)

Klobuchar Takes on Big Tech

by Betty Cracker| February 12, 201912:21 pm| 181 Comments

This post is in: Election Year, Open Threads, Politics, Tech News and Issues

Finally got an opportunity to watch Amy Klobuchar’s campaign launch speech yesterday. I thought it was a pretty good speech overall, and if she wanted to convey grit and toughness by talking for 25 minutes in a howling blizzard, mission accomplished. I was shivering all the way down here in Florida:

One thing that struck me about the speech was Klobuchar’s focus on Big Tech. The Post noticed that too:

Klobuchar’s decision to make privacy and Internet connectivity a central focus of her campaign could elevate tech policy issues during the Democratic primary. By touting these issues during her first major speech as a 2020 contender, Klobuchar is making a big bet that privacy and other digital concerns are increasingly important to American voters.
It’s especially striking since tech policy is not generally an issue that drives voters’ feet to the polls. In a survey about voter priorities ahead of the 2018 midterm elections, Gallup listed health care, the economy and immigration as the top concerns among voters. Technology wasn’t even included in the 12 issues on the list. Yet if Klobuchar shows Democratic voters — especially key demographics like millennials — are paying attention, other politicians may start to prioritize issues like privacy and net neutrality in campaigns.

I also saw a GMA clip from yesterday of Klobuchar talking to George Stephanopoulos, and she elaborated a bit on her approach to Big Tech when asked what she specifically brings to the 2020 race:

“I don’t think anyone is talking enough about the challenges of our day, like digital disruption and the changes it’s making to the workforce and the need for privacy laws. No one’s willing to take on the tech companies, and I am.”

Klobuchar was on Maddow last night, and she talked about the Russians using technology to fuck with our elections in refreshingly clear terms. She, Mark Warner and John McCain sponsored the sorely needed Honest Ads Act to bring online political advertising regulation in line with print, TV and radio ads.

Maddow asked about the reports from disgruntled employees. I thought Klobuchar handled that pretty well. She owned up that she could be “too tough” and push people “too hard” sometimes but also pointed out that there are people who’ve been with her for many years, including those who went on to work for President Obama and then returned to staff her office after his terms were up.

Maddow also asked about how Klobuchar is handling what Maddow characterized as the unusual circumstance of a run of negative press, and Klobuchar pointed out that she’d dealt with that before as a DA and senator and said she’s plenty tough enough to weather a presidential run. From what I’ve seen so far, I believe her.

I haven’t ruled out supporting any declared candidates for the Democratic nomination — except Gabbard, who is a kook and thankfully going nowhere. I don’t know who’s gonna catch fire in the primary or who has what it takes to win the general.

But I’m glad Elizabeth Warren is in the race elevating economic issues, and I’m happy Klobuchar is bringing workforce dislocation, online manipulation, data and privacy issues to the fore. I think people care about the issue more than the polling suggests. If they don’t, they damn well should.

Open thread!

Klobuchar Takes on Big TechPost + Comments (181)

Secrecy Isn’t What It Used To Be

by Cheryl Rofer| December 2, 20184:35 pm| 78 Comments

This post is in: Election 2016, Election Year, Information Warfare, Tech News and Issues

Results of CIA investigations continue to be leaked. Concern was expressed at this norm-breaking. The norms exist for a reason, though. The CIA’s reason for existence is national security.

The President of the United States is acting in conflict with the recommendations of his national security agencies and in conflict with national security. Sending troops to the border for political effect. Sharing another nation’s highly classified intelligence with an adversary. Bragging about a plane that he believes is invisible. Failing to visit the troops in war zones. And more.

This is a conundrum for the national security agencies. The internet and the availability of information are changing their roles too.

Information once of limited availability is now on the internet. Some are free, some for sale. Overhead satellite photos, court documents, historical archives, social media that inadvertently shows significant features.

show full post on front page

Non-governmental organizations can check up on government claims. Here is a report analyzing overhead photos of a North Korean missile base. An interactive website tours the Russian nuclear test site on the Novaya Zemlya island chain, far above the Arctic Circle. A Twitter thread outlines the project.

So, @annemp13 and I built an annotated tour of Russia's Novaya Zemlya nuclear test site. I wanted to talk about what has been one of my favorite all-time projects.https://t.co/FoqU5H1iP0
— Jeffrey Lewis (@ArmsControlWonk) November 15, 2018

The Bellingcat group has investigated the two GRU agents who probably carried out the poisoning of Sergey and Yulia Skripal by nerve agents and the incident between Russian and Ukrainian ships in the Kerch Strait. Emptywheel has mined court and other documents to understand the Mueller investigation of Russian influence on the 2016 elections.

The nongovernmental organizations share their work, sometimes in progress, on the internet. Twitter is a particularly effective platform because others can easily critique the work. (Disclosure: I have worked with both the Middlebury Institute’s Center for Nonproliferation Studies and Bellingcat in this way. I’ve offered occasional comments to others.)

These investigations are of as high a quality as can be achieved by national intelligence organizations. But typically the national intelligence organizations would keep their investigations secret.

There are two major reasons for that secrecy: to keep others from knowing the information, and protection of sources and methods. The others from whom the information is kept may be other nations, but they may also be the citizens of the agency’s own nation. Both Lyndon Johnson and George W. Bush lied about bringing the United States into wars. That becomes more difficult with open-source intelligence to check the claims.

For example, Trump has claimed that North Korea has ended its nuclear weapons programs, but satellite photos show that missile emplacements are still operating and even expanding.

The intelligence agencies may well collect similar information and come to similar conclusions. They watch the open-source version make its way across the internet, independent of their actions. Inadvertent acquisition of this information on computers may require that the computers be scrubbed.

And then there’s the possibility that the open-source investigators will beat the agencies to a conclusion. The agencies have been reluctant to use open sources. I’m not sure how they feel about that these days.

Conversely, excessive requirements of secrecy can make governing harder. The nature of the Russian violation of the Intermediate Nuclear Forces Treaty has just been made public, after several years of American claims denied by the Russians. There is no obvious reason why the information on which the claims are based could not have been made public, and the impasse might have been solved.

Governments have always used declassification or leaks to make selected information public. Turkey is currently releasing information, a bit at a time, about the murder of Jamal Khashoggi to confound both the United States and Saudi Arabia. Turkey has managed to keep the story in the headlines in this way and can be expected to continue until President Recep Tayyip Erdoğan feels he has accomplished his goals or is dissuaded from them.

“Information conflict” might be a better descriptor of what is commonly called “cyberwar.” An analogy with dropping bombs and shooting is misleading. Cyberweapons have a liability that physical weapons do not: once they are used, the opponent can develop defenses against them.

On the one hand, that makes secrecy about capabilities and intentions in information conflict more important than in conventional warfare, and on the other, it makes those weapons much more transient. New ones must constantly be developed.

Breaking secrecy can become a counter. US Cyber Command is sending messages directly to known Russian operatives and is making their code public. This is as destructive as, say bombing a factory. It is also a tool that can be used more than once, so it is much more powerful than operations carried out purely with code.

Casting governance as an information system may give insight into better ways to defend from the social-media sabotage aimed at the 2016 US election.

The internet is changing intelligence gathering and information warfare. We need entirely new ways of thinking that are only beginning to develop.

Cross-posted to Nuclear Diner.

Secrecy Isn’t What It Used To BePost + Comments (78)

That NYTimes Facebook Bombshell: “Delay, Deny, Deflect..”

by Anne Laurie| November 15, 201810:34 pm| 119 Comments

This post is in: C.R.E.A.M., Excellent Links, Information Warfare, Tech News and Issues, Cybersecurity

A gentle reminder that you’ve handed sensitive data to Facebook, a profoundly unethical company. Everything we know about Facebook suggests you should delete your account as matter of self-defense. https://t.co/PORbAHywxe
— Franklin Foer (@FranklinFoer) November 15, 2018

Much as I hate to endorse any opinion of Franklin Foer’s, I have to admit I’m glad I never joined Facebook. (Not being on Facebook has sometimes felt like a minor luxury, because I don’t have an employer who demands it, or social networks that I can’t access via alternate routes. And, yes, I realize they’ve probably mined all my personal information anyways.) Props to the NYTimes reporters:

… In just over a decade, Facebook has connected more than 2.2 billion people, a global nation unto itself that reshaped political campaigns, the advertising business and daily life around the world. Along the way, Facebook accumulated one of the largest-ever repositories of personal data, a treasure trove of photos, messages and likes that propelled the company into the Fortune 500.
But as evidence accumulated that Facebook’s power could also be exploited to disrupt elections, broadcast viral propaganda and inspire deadly campaigns of hate around the globe, Mr. Zuckerberg and Ms. Sandberg stumbled. Bent on growth, the pair ignored warning signs and then sought to conceal them from public view. At critical moments over the last three years, they were distracted by personal projects, and passed off security and policy decisions to subordinates, according to current and former executives.
When Facebook users learned last spring that the company had compromised their privacy in its rush to expand, allowing access to the personal information of tens of millions of people to a political data firm linked to President Trump, Facebook sought to deflect blame and mask the extent of the problem.
And when that failed — as the company’s stock price plummeted and it faced a consumer backlash — Facebook went on the attack.
While Mr. Zuckerberg has conducted a public apology tour in the last year, Ms. Sandberg has overseen an aggressive lobbying campaign to combat Facebook’s critics, shift public anger toward rival companies and ward off damaging regulation. Facebook employed a Republican opposition-research firm to discredit activist protesters, in part by linking them to the liberal financier George Soros. It also tapped its business relationships, lobbying a Jewish civil rights group to cast some criticism of the company as anti-Semitic.…
…[T]rust in the social network has sunk, while its pell-mell growth has slowed. Regulators and law enforcement officials in the United States and Europe are investigating Facebook’s conduct with Cambridge Analytica, a political data firm that worked with Mr. Trump’s 2016 campaign, opening up the company to fines and other liability. Both the Trump administration and lawmakers have begun crafting proposals for a national privacy law, setting up a yearslong struggle over the future of Facebook’s data-hungry business model…
show full post on front page

… [A]s Facebook grew, so did the hate speech, bullying and other toxic content on the platform. When researchers and activists in Myanmar, India, Germany and elsewhere warned that Facebook had become an instrument of government propaganda and ethnic cleansing, the company largely ignored them. Facebook had positioned itself as a platform, not a publisher. Taking responsibility for what users posted, or acting to censor it, was expensive and complicated. Many Facebook executives worried that any such efforts would backfire.

Then Donald J. Trump ran for president. He described Muslim immigrants and refugees as a danger to America, and in December 2015 posted a statement on Facebook calling for a “total and complete shutdown” on Muslims entering the United States. Mr. Trump’s call to arms — widely condemned by Democrats and some prominent Republicans — was shared more than 15,000 times on Facebook, an illustration of the site’s power to spread racist sentiment…

Some at Facebook viewed Mr. Trump’s 2015 attack on Muslims as an opportunity to finally take a stand against the hate speech coursing through its platform. But Ms. Sandberg, who was edging back to work after the death of her husband several months earlier, delegated the matter to Mr. Schrage and Monika Bickert, a former prosecutor whom Ms. Sandberg had recruited as the company’s head of global policy management. Ms. Sandberg also turned to the Washington office — particularly to Mr. Kaplan, said people who participated in or were briefed on the discussions…

TL, DR: “Damage Control at Facebook: 6 Takeaways From The Times’s Investigation”

‘Both sides’ cameo by the ineffable Chuck Shumer, because of course:

NYT says Chuck Schumer directly interceded on Facebook's behalf to get Mark Warner to soften his critiques of the company.
Oh — and Schumer's campaign received more $ from Facebook in 2016 than anyone else in Congress. And his daughter works there. https://t.co/5szZLWLRsX pic.twitter.com/sCLnSR5GpI
— Zack Stanton (@zackstanton) November 14, 2018

So Facebook contracted with a company that was literally writing fake news. By which I mean, "stories" that pretended to be from a news org but were in fact from a corporate PR/propaganda shop. https://t.co/jxG3YQX4rk pic.twitter.com/cryDO0KTnr
— Eric Umansky (@ericuman) November 15, 2018

FAKEBOOK DELETES 1.6 BILLION ACCOUNTS… https://t.co/tXqJnS3XpN
— DRUDGE REPORT (@DRUDGE_REPORT) November 16, 2018

That <em>NYTimes</em> Facebook Bombshell: “Delay, Deny, Deflect..”Post + Comments (119)

The Deadline That Wasn’t

by Alain| November 15, 201810:00 am| 41 Comments

This post is in: Anderson On Health Insurance, Open Threads, Tech News and Issues

Folks,

The deadline to renew your health insurance coverage via Healthcare.gov is NOT today, as I had in my head the past couple of days. But it IS one month from today. There’s no time like the present to get ‘er done, especially if you find some unfilled time. The site is improved and worked quite well.

I spent part of yesterday signing up – I’m all done, and happy to see a new competitive offering in my marketplace. I went ahead and added VSP to my 2019 plans because I will need some new glasses and I prefer the bells-and-whistles, and those options add up, now don’t they! Without David’s advice from over the months and years, I know I would have made poorer choices, so thanks David!

I also spent some time early Christmas shopping (research and online purchases) and took advantage of the early Thanksgiving Dell pricing to get a new 15″ laptop and docking station. It’s not the greatest computer for all needs, but it should suit me well. It will be nice moving on from my 7 year old, 17″, 8 pound monster laptop. Even though I just upgraded the memory and hard drives early this year, it made sense to buy new, now, before the new anti-Chinese tariffs kick in January 1st (10% goes to 25%).

I will now have a smaller, faster, better machine and can add dual 4k monitors when the time is right (i.e., when the price is right). Coupled with my other new machine (an Intel NUC and associated parts arrived today, getting it working later and tomorrow), I expect to have a much better future with technology. I expect I’ll be using approximately 30% of the power to do the same things, so it’s not just replacing older hardware, it’s wasting less money on electricity bled as heat and then paying more to cool my house in warmer months. My desktop tower – from 2010 – puts out as much heat as a person, even when just sitting on and doing nothing except awaiting an incoming network connection and otherwise being on. You can feel it in the summer months when it has been on for a few hours versus off; the room temperature in this top-floor office is much warmer. The new NUC sips power, and will do what I need performance-wise. It doesn’t have a gaming-class graphics card, but it’s sufficient to do what I need, and it takes up the space of three stacked packs of Dunhills (my old smoke, back when I was a nicotine junkie).

On that note, I hope you find good deals and neat stuff in your insurance, tech, and non-tech shopping over the next few weeks. I believe this is the first Christmas where I’m far ahead of the game. That’s a good thing as I hope to get outdoors and play a bit in December as I try to develop some better lifestyle and activity habits.

Open Thread!

oh – don’t forget, if you play Fallout 76, drop me a line (I play on Xbox) so we can connect in-game. If you play on PC, let me know so I can put you in contact with other jackal Fallout 76 PC players. Use the Contact a Frontpager form. We need to hang together, there are nasty folks out there. Having my power armor already helps a bit, but since I’m not a high-enough-level, I can’t wear anything but the frame. Ok I lied, I have two sets, but they don’t provide the protection I need, so I’m LFG.

The Deadline That Wasn’tPost + Comments (41)

New EU Internet Copyright Bill, Articles 11 and 13

by Major Major Major Major| September 10, 20185:21 pm| 84 Comments

This post is in: Science & Technology, Tech News and Issues

The infosphere is aflame with a new battle in an old war: how copyright should be handled on the Internet.

The Guardian has background:

It is an argument that has drawn in the likes of Paul McCartney, Plácido Domingo and the Vienna Philharmonic, as well as pioneers of the internet from Tim Berners-Lee to the founder of Wikipedia, Jimmy Wales.
Fought with hashtags, mailshots, open letters and celebrity endorsements, the battle over the European Union’s draft directive on copyright heads for a showdown this week.
After two years of debate, members of the European parliament will vote on Wednesday on the legislation, which could change the balance of power between producers of music, news and film and the dominant websites that host their work.
[…]
Critics claim the proposal will destroy the internet, spelling the end of sharing holiday snaps or memes on Facebook. Proponents are exasperated by such claims, described by German Christian Democrat Axel Voss as “totally wrong” and “fake news”.

Two sections in particular are controversial: Articles 11 and 13. Both sides (both sides!) are being very hyperbolic about these. The gist is that groups like the Electronic Frontier Foundation and people like Cory Doctorow say these are “internet-destroying regulations,” and the proponents’ response (from what I’ve seen on Twitter) is to paint all opponents as paid industry shills who hate artists. I’ve attempted here to come up with what I hope is an even-handed summary. I Am Not A Lawyer, so please tell me what I’ve gotten wrong.

This is a bit long, so click through if you’re interested. Note of course that these are EU laws, but so is the GDPR, and we’ve all experienced the effects of that.

show full post on front page

Article 11

In brief, Article 11 would give news organizations copyrights over ‘snippets’ of their articles, including the headline, lede, and thumbnail presentation. For example, the Guardian would have the right to charge Google News for this aggregation:

Supporters say (perhaps naively) that this would help news producers get paid for their content. Opponents deride it (definitely disingenuously) as a “link tax” that will destroy sites like Wikipedia. I found what seems like a decent analysis from anti-plagiarism activist/expert Jonathan Bailey, who says:

Paragraph 1 of Article 11 simply reads as follows:
Member States shall provide publishers of press publications with the rights provided for in Article 2 and Article 3(2) of Directive 2001/29/EC so that they may obtain fair and proportionate remuneration for the digital use of their press publications by information society service providers.
Article 2 and 3 referred to in the paragraph are simply the reproduction right and the right to communicate a work to the public.
However, the definition of “information society service providers” is a bit thornier to get through. That definition is found in this directive, which describes it as “any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.”
What is and is not considered such a service gets extremely complex quickly (with many exceptions carved out). However, key examples include “Web shops and marketplaces, search engines, online advertising, video sharing sites, blogs, hosting, video-on-demand, online consultancy, online marketplaces, social networking, etc.”
[…] exemptions do not include a fair use or fair dealing.

Such laws have been tried in Spain and Germany. In Germany, Google made News opt-in: if you wanted to be included in their aggregations, you had to let them do it, and for free. The result was that most sites opted in. This wasn’t an option under the Spanish law, so Google simply shut down their Spanish news site. According to a study commissioned by Spanish publishers,

[I]n the short-term, the study found, the law will cost publishers €10 million, or about $10.9 million, which would fall disproportionately on smaller publishers. Consumers would experience a smaller variety of content, and the law “impedes the ability of innovation to enter the market.”
The study concludes that there’s no “theoretical or empirical justification” for the fee.

It might also make links and excerpts such as the ones I’ve provided here illegal without licenses.

Article 13

Currently, the burden of not posting something copyrighted on a platform like YouTube falls on the user. If a user does publish such a thing, they can be penalized under laws like the still-controversial Digital Millennium Copyright Act and forced to take the content down. (Obviously this is an American law, but that’s the context I’m familiar with.) Article 13 would shift that burden to the platform. YouTube and sites like it would become responsible for any copyrighted material published by their users.

You may be familiar with the debate over what, exactly, a ‘platform’ like YouTube or Twitter is. Are they more like a newspaper or a community bulletin board? Article 13 gets right to the heart of this, with a clear answer: they’re responsible for their users’ content; they’re definitely not a corkboard in the quad. Bailey again has a good summary of this, but it’s fairly complex stuff with a lot of carve-outs, and I’d recommend reading through that link. (Notably, it excludes things like blog comment sections, which is good, since sometimes people excerpt entire articles.)

It really comes down to this:

The larger impact is the shift from filtering as a tool of expediency to an obligation.

Sites like YouTube already use automated filters to find and report/remove copyrighted content. (This can have hilarious effects like removing video lectures on fair use.) However, they use these filters voluntarily, to reduce the volume of incoming complaints. Article 13 would, most likely, result in pre-filtering of user content. Opponents deride this as a “censorship machine” and “meme-killer,” saying that it would automatically tag remixes, or things like not-sure-if Fry, as copyrighted material, and prevent them from going up.

This is probably not true! But any filter, automated or not, is going to have false positives; making such filters obligations will increase the false-positive rate, since suddenly a false negative would have a penalty, and that is how filters generally work. So really, it’s a question of what kind of filters we want, when we want them used, by whom, and at what cost.

Tricky stuff! But I thought I’d bring it to everybody’s attention. Anybody care to weigh in? I usually fall on the same side as the EFF but it seems like they’re being very over-the-top here. Article 13 may just be a proxy war between big production studios and Google.

New EU Internet Copyright Bill, Articles 11 and 13Post + Comments (84)

Who Wrote the Op-Ed: Text-Mining Edition

by Major Major Major Major| September 6, 20181:08 pm| 254 Comments

This post is in: Goddamned Traitors, Repubs in Disarray!, Tech News and Issues, Looks Like I Picked the Wrong Week to Stop Sniffing Glue, Not Normal

When the cowardly “Resistance” op-ed came out, my first thought was, Gee, I bet we could get some insights on authorship by doing an automated textual analysis. Because of course that was my first thought. Well, somebody was kind enough to do one for us. Specifically, Michael W. Kearney, a journalism and informatics professor at the University of Missouri. Here is the result; I’ll do a layperson’s explanation below, and then some technical links for those so inclined.

https://twitter.com/kearneymw/status/1037700388617629696

Executive summary: This analysis suggests that it was somebody from the office of the Vice President, the State Department, or the Department of Commerce.

What is this?

The y-axis is various Twitter accounts, labeled on the left.
The x-axis is the textual correlation.
Kearney took up to 3,200 tweets from each of the accounts listed, and ran an analysis on those corpuses. He then compared the resulting numbers to the results of the same analysis run on the text of the op-ed.
The line at the top shows, of course, a 1.0 correlation with the op-ed itself. The next-highest are the Twitter accounts for the Vice President, Trump (who we can discount), Secretary Pompeo, Secretary Ross, and the State Department.
The analysis includes figures for things like comma usage, sentiment, politeness, word choice, first- and second-person preference, and so on.
It probably wasn’t somebody at the Department of Transportation.

Caveats

Update: I assumed this went without saying, but obviously tweets are not an ideal data source; just most-readily usable with what Kearney had laying around, and within a very short time period.
We know from reporting on the Wolff book that anonymous sources sometimes intentionally steal other staffers’ phrasing when providing quotes.
- This could explain the use of ‘lodestar,’ a strongly Pence-affiliated word.
- However, it is harder to fake things like comma usage.
Higher-ranking officials are likely, in their Twitter communications, to try to sound more like Trump, or in general use more homogenous language.
- This could explain the ~0.7 cluster of the most important officials and departments.
These are not huge volumes of text, and thus the figures are potentially not representative.

Technical Details

show full post on front page

Who Wrote the Op-Ed: Text-Mining EditionPost + Comments (254)

California Bans Cash Bail… But Did they Do It Correctly?

by Major Major Major Major| August 28, 201811:39 pm| 66 Comments

This post is in: Criminal Justice, Tech News and Issues

Governor Brown’s signature made it official today: beginning in October 2019, if you are arrested and charged with a crime in California, your pretrial level of freedom will not be determined by your level of wealth. …In theory.

California will become the first state in the nation to completely end cash bail after Gov. Jerry Brown signed a sweeping reform bill Tuesday. It will give judges far more power over who gets released from jail as they await trial.
“Today, California reforms its bail system so that rich and poor alike are treated fairly,” Brown said[…]

It’s certainly removing money as an official part of the equation.

Under Senate Bill 10, Californians arrested and charged with a crime won’t be given the option of putting up money or borrowing it from a bail bond agent. Instead, county courts will use risk assessment tools to help judges determine if a defendant can be safety released before trial.
[…]
It’s a huge shift, and one that gives judges far more power over pretrial release decisions.
While nearly everyone involved in the bail fight in California, save for the bail industry, agreed that the current system is unfair and often punishes poor defendants while releasing wealthy defendants even if they pose a public safety, not everyone who supported bail reform is on board with the bill. Some civil rights groups that had championed the issue of bail reform [including the California ACLU] oppose the bill, saying it now gives too much power to judges who may have their own biases.

And not just power to judges. The use of ‘risk assessment tools’ brings to mind ProPublica’s controversial 2016 report on apparent racial bias in COMPAS recidivism-risk software.* And just like the judges, these tools, whether software or some other standardized rubric, are being given a lot of power.

My own internal scorecard sees: a good cause, Republicans opposed, Democrats in favor, and law enforcement officially neutral. That’s something I would usually support. But then, I also usually like the ACLU’s opinions, and such scorecards aren’t always right. What do you folks think?

*Good article on that reporting and the ensuing dispute, plus the overall topic of algorithm bias, at the MIT Technology Review. tl;dr: Impartial systems are by their nature biased. One must take care to make sure the included biases are the intended ones, and that the intended ones are just.

California Bans Cash Bail… But Did they Do It Correctly?Post + Comments (66)

Followup on Yesterday’s Post About the Ransomware Attacks, More Oceanography, Mobile Site

by Alain| June 29, 201711:15 am| 49 Comments

This post is in: Open Threads, Site Maintenance, Tech News and Issues

Folks,

Mea culpa. It looks more and more like the “ransomware” attacks were not after money, but destruction. That, coupled with the timing in Ukraine right before their Constitution Day, would tend to indicate it was Russian operatives that did this. At first, I assumed that a major attack in Ukraine was Russian-sourced, but as the day unfolded with reports from around the world, I surmised that it was actually NK hackers, making it look like an anti-Ukraine operation, and after even more Bitcoin like the previous wave of ransomware. The fact that there was a major dip in Bitcoin value right before the attack started seemed like an echo from a previous attack.

Well, it looks like I was wrong – the attacks had a poorly-designed ransom function that didn’t work, and in reality, the payload destroyed files of certain types without recording the encryption key used. In other words, it was irreversible – the payload was destructive and not ransomware, it was just built to resemble one. So in this case, paying or not paying had the same result – if you contracted it, your files were toast.

Still, the suggestions I made about updating current systems, using good security software, backups, not clicking on ANY link in email, etc. hold. And, should you be running a dead Windows operating system, do plan to upgrade soon – either get a newer pc, upgrade to Windows 10, or install something like Linux Mint or Ubuntu. Right now, you’re a sitting target with adversaries that are evolving while your old machine likely doesn’t have functional anti-virus software, much less modern defenses built into operating systems.

And now an overdue announcement – tomorrow at noon Eastern, we’ll have part 2 of Boussinesque’s Intro to Oceanography, this time on Ocean Acidification. As a huge fan of all forms of seafood, learning of the effects of this trend on plankton, the root source of all life in the sea, has me quite concerned.

It will be interesting, and he’ll be ~~manning~~ ~~staffing~~ in the comments to answer questions, etc. – thanks to both for nudges

A brief note to mobile site users – expect some changes over the next day or three. I intend to bring a lot of the tweaks and tools from the desktop site to the mobile site, where appropriate. I’m sure some will complain, feel free to do so and I’ll adjust it like always! Should you have any mobile site complaints or suggestions, this is the thread for them; I’ll come back here a few times to see if any late readers have added their 2 cents.

Finally, about 3:30 today I will do some backend tweaking and that may make the site boogered for a few seconds. Should this happen, comments you just submitted might get eaten, so if it’s important, around that time, copy comments to notepad or something in case it doesn’t go through. I’ll comment right before and after the change.

Open thread!

Followup on Yesterday’s Post About the Ransomware Attacks, More Oceanography, Mobile SitePost + Comments (49)

Site Maintenance and Tech Suggestion: You Have Been Warned

by Alain| June 28, 201711:47 am| 93 Comments

This post is in: Site Maintenance, Tech News and Issues

Folks,

Item the first: small site changes

The blogroll
This was a classic case of “no good options”. Currently, and for months, the Blogroll opens in the same window. This causes some users to complain and ask that it open in a new page. I finally caved, knowing that in doing so, I would cause IOS users a headache as it blocks pop-ups by default. After making that change, I began to receive emails complaining that for them, Blogroll was no longer working. One report was from a FireFox user, so this is no longer just an IOS issue.
That got me thinking – one choice means inconvenience, the other means it doesn’t work. So the choice became clear: the blogroll will open in the current page. I’m sorry for the hassle this causes some, but hassle for some is better than not working for some!
Later this afternoon, I’ll be making a few small back-end tweaks related to security. This may make the site hiccup for a moment as the changes take hold. If you have an issue, count to 10 and reload the page and all should be well. It is possible during this brief time that comments-being-submitted may disappear into the aether. If so, my apologies, and please re-submit it/them.

Now, a brief comment on the current wave of hacking going on:

I’m sure you’ve heard about the wave of ransomware/hacking that began yesterday morning in Ukraine and has now spread around the world. In my opinion, this is another effort by North Korean-affiliated hackers to generate a huge amount of Bitcoin that will likely be used to purchase more tech and hacking exploits. I bet that a significant chunk of the proceeds from these hacks goes back to NK’s coffers, but these likely foreign-based operations need funding, and I think that they likely resort to these types of hacking to keep the electricity on, as it were. I don’t think it coincident that NK re-commenced their numerical code broadcasts about 2 weeks before the last big hack happened.

The issue of concern from my perspective is that this is the second wave of ransomware-hacking on a global scale. I suspect that many of you have read about how a bunch of NSA exploits and hacking tools were stolen, likely from a contractor, and are being released. If a nation state’s hackers were behind the theft, then perhaps they are using these exploits to generate money before systems are all patched. If this is the case, then these first ransomware attacks are probably using the least-valuable exploits, ones that have already been patched in most systems. I fear that, in the coming weeks, we’ll see more and more of these attacks, and that they will be much more effective, when they begin to use 0-day exploits that no one except the NSA knows about. (On a side note, is the NSA/US Government financially liable for the effects of their stolen cyber weapons?)

So the question is, what can you do/not do?

These important things:

Ensure that your computer(s) are fully up-to-date. This means Windows, Mac, Linux, phones/tablets. Automatic updates are a requirement in this era, embrace them. As soon as an update is released, bad guys analyze it to see what was fixed. Then they target that issue in hopes of catching machines that aren’t yet patched.
Ensure you are running quality Anti-Malware/Anti-Virus software on all appropriate machines. I don’t like to recommend certain brands, but I’d stay away from Russian brands (bye-bye Kaspersky, I cannot trust your great products ever again) and avoid the cheap/free/no-name options.
I buy an annual 5 computer license via Amazon, use the digital download option, and it’s like $25 a year. DO IT NOW if you do not have such software. Although I use Norton Security, McAfee is another trustworthy name. Neither product is ideal, and I know many of you hate them with a passion for their performance, but for many lay-users, they are sufficient. They are not better than other options, but I prefer them to any free or no-name solution.
Please try to start your Amazon purchases using the link here or in the sidebar on the desktop site, or in the comment area or top of a post on the mobile site. Every purchase made using these links generates a bit of $ for the site!
Ensure that all important files are backed up. I love cloud storage/backup because it means there’s a copy off-site, so if my local copy gets screwed up, I can get a good copy. I also like a local backup of my files, so I use a on old Raspberry PI with a hard drive as a Samba-powered backup server. It’s simple, effective, and silent.
For my most important machine, I backup the entire hard drive (I use CloneZilla to copy the entire disk to an external USB drive) every week. That way, worst-case scenario, I can restore my Windows and programs, downloading my files from local or cloud backup.
If you have an old PC or two on your home network, say for the kids to use or for guests, take them off the network if they are running the following operating systems: Windows 95/98/ME/2000/XP/Vista. All of these are no longer supported which means that any exploit that comes out that targets them will be successful. Email and website are the most likely vectors, and, especially with teens, website visits include some gnarly, crap-ridden sites. Ideally, update old computers to a modern version of Windows, or replace the operating system with a more-secure, free option. Linux Mint is a great operating system that works on almost any old machines. I’m quite partial to Ubuntu, both the GUI version and the “headless” server version that I use for my home media server.
I love the idea of a Chrome Book and similar paradigms – they do seem to have a very good security model.
If you are running an Android tablet or phone, ensure that you’ve got good security software installed. In IOS, we’re ok because of Apple’s walled-garden approach, but with Android, things are much more dangerous. Related to my suggestion of Norton or McAfee, both include options for installing on your devices.
Never click on a link in any email about any account. Always use a new tab in your browser and type in the site’s address yourself and login as you normally do. Often, well-crafted emails purporting to be from a bank or other financial institution will contain links to sites that look and behave much like the real one, but record your username, password, secret questions/answers, etc. and then use that data to steal your money from the real site. Such emails are also often ways that trojans and other nasties get loaded onto your machine.
NEVER put a found USB stick into a connected, important machine. Bad guys are clever – they know people love to find free stuff, and when they do, they hope that there’s something valuable or neat. So bad guys will drop a few poisoned USB sticks in areas where people will find them, then rush home/to the office to see what’s on it, how much room it has, etc. Such a technique will often infect a machine and perhaps other machines on the network faster than you can believe.
I use a Linux machine to investigate such things, since I’m sure that Windows is the real target, though these days I just break them and dispose of them without even looking – better safe than sorry, and hopefully if it’s legit, I’ve saved someone’s important data from being found by someone not-so-benign.
Don’t leave machines running all the time if you’re not using them daily – an unattended machine is a sitting target. Always check machines at least once a day or so to ensure all looks ok. Nothing like checking your machine after ignoring it for two weeks, only to realize that the deadline for paying ransom expired last week!

To conclude, let me explain briefly what a ransomware attack looks like.

The Basic Mechanism

Basically, these things get into your machine and then use high-grade encryption to encrypt all the files on your computer. This means that instead of your resume, that Word doc is a scramble of characters that makes the file unusable and unreadable. You are often given a short-term deadline (3 days) to pay $300 in Bitcoin to undo this, or can take up to 7 days to pay $600. During that period, if the payload on your machine receives a “they’ve paid” signal, it will unscramble your files. If the 7 day limit is passed, your files are re-scrambled with a random encryption key which is never saved, so your files are permanently scrambled. Or at least for the next few years until tech and decryption breakthroughs mean it will take days not decades to decrypt your files. By then, you’ll likely not care.

Signs of a Compromised System

Basically, you’re using your computer and it gets slower, and you might get errors running programs you use routinely, or messages about corrupted files. This is the infected stage – the payload is on your machine and is in the process of encrypting your files. Turning off the computer or shutting down won’t necessarily stop things, but it might. It also might result in your already-encrypted files being permanently scrambled as the tool didn’t get a chance to complete the process and present a ransom demand. If the files are important, it’s almost better to let the encryption process finish so that you can pay them off, confidant that your files are recoverable.

Once the payload has determined that its encrypting-files job is complete, it will present a screen that you cannot dismiss. It will contain instructions, links to tech help, often even live chat-based support, believe it or not. Once you see the screen, it’s time to go buy $300 of Bitcoin and send it to the file-nappers. There are no other options, sadly – the FBI, NSA, etc. cannot help.

So when you hear about a hospital or a company dealing with this, we’re talking about many-to-most-to-all computers being infected. Imagine how much a company has to pay to release all their computers! In a home user situation, having to pay for one machine is bad enough, but having to pay for multiples can quickly get very expensive. Hence the utility of having your files backed up – as long as you have them, you can pay to release the important computer or two, and for the rest, you can reformat, re-install the Operating System, and all your programs.

These truly are scary times – take precautions and be safe!

Site Maintenance and Tech Suggestion: You Have Been WarnedPost + Comments (93)