[continued from previous message]

Media Relations: (202) 418-0500 / ASL: (844) 432-2275 / TTY: (888)
835-5322 / Twitter: @FCC / www.fcc.gov

This is an unofficial announcement of Commission action. Release of the
full text of a Commission order constitutes official action. See MCI v.
FCC, 515 F.2d 385 (D.C. Cir. 1974).

------------------------------

Date: Fri, 7 Jun 2019 00:15:44 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Privacy Fears Split German Government on Use of Alexa Data as
Evidence (Fortune)

Smart home devices such as Amazon's Echo and virtual assistants such as
Alexa or Apple's Siri can provide a lot of information about a person --
when they're at home, what they're interested in and potentially even what they're saying. So it's no surprise that criminal investigators are
interested in their potential.

In Germany, the issue is setting up a clash between the interior ministry -- the country's equivalent to the U.S. Department of Homeland Security -- and
the justice ministry, which keeps an eye on the constitutionality of what
other departments are up to.

The federal interior ministry is preparing to back a proposal from the state
of Schleswig-Holstein to make evidence from smart devices and virtual assistants admissible in court, the RND news organization reported
Wednesday. The idea is to make the information available to investigators of serious crimes and terrorist threats.

“Our view is that digital traces have become increasingly important. We are talking about traces that come from connected devices such as smart fridges
but also voice-controlled devices such as smart speakers,” a spokesman for the interior ministry told the Financial Times.

Unconstitutional?

However, the justice ministry does not appear to be on board. Gerd Billen,
the ministry's state secretary, said “law enforcement must be up-to-date,
but there are limits set by the protection of the most personal spaces, and
the freedom of accused people not to incriminate themselves. These limits
must not be circumvented by any technology.”

http://fortune.com/2019/06/06/germany-alexa-court-evidence/

------------------------------

Date: Fri, 7 Jun 2019 00:12:18 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Apple's 'Find My' Feature Uses Some Very Clever Cryptography (WiReD)

When Apple executive Craig Federighi described a new location-tracking
feature for Apple devices at the company's Worldwide Developer Conference keynote on Monday, it sounded -- to the sufficiently paranoid, at least—like -- both a physical security innovation and a potential privacy disaster. But while security experts immediately wondered whether Find My would also offer
a new opportunity to track unwitting users, Apple says it built the feature
on a unique encryption system carefully designed to prevent exactly that
sort of tracking -- even by Apple itself.

In upcoming versions of iOS and macOS, the new Find My feature will
broadcast Bluetooth signals from Apple devices even when they're offline, allowing nearby Apple devices to relay their location to the cloud. That
should help you locate your stolen laptop even when it's sleeping in a
thief's bag. And it turns out that Apple's elaborate encryption scheme is
also designed not only to prevent interlopers from identifying or tracking
an iDevice from its Bluetooth signal, but also to keep Apple itself from learning device locations, even as it allows you to pinpoint yours.

https://www.wired.com/story/apple-find-my-cryptography-bluetooth/

------------------------------

Date: Fri, 7 Jun 2019 00:14:08 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: 'Sign In With Apple' Protects You in Ways Google and Facebook Don't
(WiReD)

At Apple's Worldwide Developers Conference on Monday, the company debuted a slew of products and services, including a new Mac Pro that's part raw computing power, part cheese grater. But one new feature, mentioned in
passing, could have an outsized impact on user security and privacy for
years to come. Apple now has its own single-sign-on scheme -- and it's a
major reimagining of how such a mechanism can work.

You've seen single-sign-on before, even if you don't use it. It's the technology that lets you use your Google or Facebook login to access other third-party services, instead of needing to set a unique username and
password for each one. They centralize a group of accounts around a more
secure login that you're more likely to actively monitor and maintain,
rather than a one-off account that you set with a weak password, save a
credit card into, and then never think about again.

Sign In with Apple looks similar enough to those alternatives at a glance, giving the option to use your Apple ID as a unified login wherever
developers integrate it. But as part of its broader, years-long privacy
push, Apple has added some extra protections that distinguish its version.

https://www.wired.com/story/sign-in-with-apple-sso-google-facebook/

------------------------------

Date: Tue, 4 Jun 2019 16:56:17 PDT
From: "Peter G. Neumann" <neumann@csl.sri.com>
Subject: NSA warns Microsoft Windows users to update systems to protect
against cyber-vulnerability (The Hill)

https://thehill.com/policy/cybersecurity/446963-nsa-warns-microsoft-windows-users-to-update-systems-to-protect-against

------------------------------

Date: Tue, 4 Jun 2019 17:35:42 -0700
From: Rob Slade <rmslade@shaw.ca>
Subject: US visas now need five years of your social media ...

Well, I don't think it's any secret that I am of the opinion that social
media isn't exactly important. https://community.isc2.org/t5/Welcome/The-quot-Community-quot/m-p/10594

Which makes the US decision to require "five years" of social media account information when applying for a visa all the more bizarre. https://nakedsecurity.sophos.com/2019/06/04/us-visa-applicants-required-to-hand-over-social-media-info/

First: sorry, "five years"? What five years? Five years of postings?
(Given it's an online form, that's unlikely.) Accounts I've started in the past five years? (Does that mean my Twitter account is exempt because it's older than that?) Accounts I've used in the past five years? (Does that
mean that my Facebook account, which I haven't posted to in the past five years, is exempt?) Or do you want the Facebook account because I've had to
use it occasionally because people who posted what they thought was a public message couldn't figure out Facebook's byzantine aggregation of rights and permissions?

What's considered social media? The Facebook I don't use? The Twitter I
do? The extra Twitter account that I only use for posting notices for our local chapter? The extra, extra Twitter account that I use (professionally) for noting and researching spam, malware, and other unsavoury Twitter
accounts? The Whatsapp account that I created in order to test Whatsapp,
and now use, infrequently, to send update notices to Gloria because that
phone account has limited text messages?

Should I include the Instagram that's in my name, but which Gloria uses
because she likes to keep up with the kids, but she didn't want to create
her own account, and I only look at when she tells me about something worthwhile?

How about the Flickr account which I created more than five years ago, and
last posted anything on more than five years ago, but which I send
publishers to when they demand a photo to put next to something they are
going to publish?

Or should I create a number of new, sanitized social media accounts for applying for visas when I go the the States? (Don't tell me that all kinds
of people aren't going to be doing this ...) OK, so far they aren't
demanding passwords, so it's only public postings that they can look at,
but, after all, this is supposed to be "social" media ...

Do I get to tell whoever is processing my visa application that anything referring to "Friday" is not to be taken seriously? (Come to think of it,
that wouldn't do any good anyway, since anyone in a civil service job is
bound to have had their sense of humour surgically removed, and wouldn't get any of the infosec jokes anyway ...)

Is the ISC2 "community" a social media site?

Are the Amish forbidden from applying for visas?

Is this the thin edge of the wedge for "Total Information Awareness" again?

Do you really think terrorists are going to post their plans on the same
social media accounts that they are going to give the government? (Yeah,
yeah, but the really dumb ones can be caught in other ways, like adding a question to the form that says, "Are you planning on carrying out any
terrorist attacks while in the United States?") Do you think that DHS has people or AI skilled enough to identify fake accounts given on the forms and use forensic linguistics to link those to actual accounts really used by the applicant? (Honestly? You think that's likely?)

Oh, and everything I've said here is private, right?

------------------------------

Date: Wed, 5 Jun 2019 00:37:20 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: What He Learned Trying To Secure Congressional Campaigns
(Idle Words)

Author writes:

You know how it happens. You try to secure one Congressional campaign, and
then another, and pretty soon you can't stop. You'll fly across the country just to brief a Green Party candidate in a district the Republicans carried
by 60 points. You want more, more, always looking for that next fix.

This is the situation I found myself in from late 2017 to 2018, when I was
part of an effort that delivered a basic, hour-long campaign security
training to 41 Democratic Congressional campaigns. It was exciting! I
traveled the country like Johnny Yubikey, distributing little blue security tokens from a sack. The campaigns ranged from beyond-long-shot candidates running from their den, all the way up to some nationally prominent
figures. I took a selfie with Bernie! I wrote an opinion piece in the Washington Post!

https://idlewords.com/2019/05/what_i_learned_trying_to_secure_congressional_campaigns.htm

------------------------------

Date: Mon, 3 Jun 2019 16:07:18 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Trump urges customers to drop AT&T to punish CNN over its coverage
of him (WashPost)

Trump urges customers to drop AT&T to punish CNN over its coverage of him

The president has been vocal in his opposition to a AT&T-Time Warner merger, which critics contend is motivated by his ire toward CNN.

https://www.washingtonpost.com/business/2019/06/03/trump-urges-customers-drop-att-punish-cnn-over-its-coverage-him/

------------------------------

Date: Wed, 5 Jun 2019 17:53:17 +0800
From: Richard Stein <rmstein@ieee.org>
Subject: How Limbic Capitalism Preys on Our Addicted Brains (Quillette)

https://quillette.com/2019/05/31/how-limbic-capitalism-preys-on-our-addicted-brains/

Limbic capitalism, a neologism, "refers to a technologically advanced but socially regressive business system in which global industries, often with
the help of complicit governments and criminal organizations, encourage excessive consumption and addiction. They do so by targeting the limbic
system, the part of the brain responsible for feeling and for quick
reaction, as distinct from dispassionate thinking."

Limbic capitalism monetizes and exploits the brain's reservoir of dopamine
to build dependence. Mobile apps prey upon unsuspecting or vulnerable populations by over-stimulating dopamine dependency.

I wonder if governments will eventually begin to rank and regulate mobile
apps dopamine delivery on minute-by-minute basis, or per app event, and use this information to build another MSA? A mobile app "rationing" system (or
tax) might materialize to forcibly curtail dopamine addiction.

A cold-turkey solution might be most effective to cut addition. With
antitrust drums beating louder in Congress, the call to regulate screen time might be on the horizon.

https://www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2019/06/04/the-technology-202-apple-may-not-be-able-to-escape-political-peril-in-washington-anymore

https://www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2019/06/03/the-technology-202-silicon-valley-braces-for-potential-antitrust-battle-with-washington/

Risk: Regulatory capture by dopamine addicted politicians dilutes
legislative efforts to reign in limbic capitalism.

------------------------------

Date: Thu, 6 Jun 2019 23:33:01 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: This ID Scanner Company is Collecting Sensitive Data on Millions of
Bar-goers (Medium)

https://onezero.medium.com/id-at-the-door-meet-the-security-company-building-an-international-database-of-banned-bar-patrons-7c6d4b236fc3

------------------------------

Date: Wed, 5 Jun 2019 12:17:17 -0700
From: "Peter G. Neumann" <peter.neumann@sri.com>
Subject: VR Systems remotely accessed Durham county computer before 2016
election (Kim Zetter)

https://twitter.com/KimZetter/status/1136329187340374017

------------------------------

Date: Thu, 6 Jun 2019 16:00:37 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Election Rules Are an Obstacle to Cybersecurity of Presidential
Campaigns (NYTimes)

One year out from the 2020 elections, presidential candidates face legal roadblocks to acquiring the tools and assistance necessary to defend against the cyberattacks and disinformation campaigns that plagued the 2016 presidential campaign.

Federal laws prohibit corporations from offering free or discounted cybersecurity services to federal candidates. The same law also blocks political parties from offering candidates cybersecurity assistance because
it is considered an “in-kind donation.”

The issue took on added urgency this week after lawyers for the Federal Election Commission advised the commission to block a request by a Silicon Valley company, Area 1 Security, which sought to provide services to 2020 presidential candidates at a discount. The commission is expected to decide
on Area 1's request at a public meeting on Thursday.

Cybersecurity and election experts say time is running out for campaigns to develop tough protections.

https://www.nytimes.com/2019/06/06/technology/ftc-rules-cyberattacks.html

What He Learned Trying To Secure Congressional Campaigns (Idle Words)

https://idlewords.com/2019/05/what_i_learned_trying_to_secure_congressional_campaigns.htm

------------------------------

Date: Mon, 3 Jun 2019 11:33:05 PDT
From: "Peter G. Neumann" <neumann@csl.sri.com>
Subject: More on Mueller and Interference (Time)

http://time.com/5597514/robert-mueller-statement/

"I will close by reiterating the central allegation of our indictments --
that there were multiple, systematic efforts to interfere in our election.

2. Intrusions Targeting the Administration of U.S. Elections

In addition to targeting individuals involved in the Clinton Campaign, GRU
officers also targeted individuals and entities involved in the
administration of the elections. Victims included U.S. state and local
entities, such as state boards of elections (SBOEs), secretaries of state,
and county governments, as well as individuals who worked for those
entities. The GRU also targeted private technology firms responsible for
manufacturing and administering election-related software and hardware,
such as voter registration software and electronic polling stations.

------------------------------

Date: Wed, 5 Jun 2019 12:10:41 -0700
From: Rob Slade <rmslade@shaw.ca>
Subject: Phishing calls

I was awakened by a phone call this morning. Obviously recorded, probably computer generated.

Telling me that there were spurious charges on my Visa card.

Right off there were indications that this was a fraud. First off, it
didn't identify the issuing bank, and identified the card by saying the
number started with 45. (*All* Visa cards start with 45 ...) Also, while
the message was recorded or generated, there was no change in tone when the message got to identifying the charges. Recorded calls using something out
of a database usually have a slight change in tone at that point. (I
figured it was a bit of a gamble telling me that I had a charge from Amazon
for $300 and one from Google Play for $1,000, since I might deal with those entities, but I suppose the risk is small.)

I was supposed to stay on the line for a security agent, but I didn't feel
like playing games with them. I assume someone would have been trying to
get info that they could then use to actually perpetrate a fraud on my card.

A bit later I went to the bank. They obviously knew about the calls and the
script. (And confirmed that there were no charges or flags on our card.)

------------------------------

Date: Sat, 1 Jun 2019 17:04:51 -0700
From: Lauren Weinstein <lauren@vortex.com>
Subject: Boeing Built Deadly Assumptions Into 737 Max, Blind to a Late
Design Change (NYTimes)

https://www.nytimes.com/2019/06/01/business/boeing-737-max-crash.html

------------------------------

Date: Sat, 1 Jun 2019 10:36:03 +0200
From: Peter Bernard Ladkin <ladkin@causalis.com>
Subject: Re: 737 MAX AoA Indications (Karish, RISKS-31.27)

Chuck Karish opines in RISKS-31.27 that Boeing's statement, that angle-of-attack (AoA) indicator and the "AOA Disagree" alert are not
necessary for the safe operation of the Boeing 737 MAX, "misrepresents the situation". Karish opines "the AOA Disagree alert is a vital indication to
the pilots that MCAS is malfunctioning and that corrective action is
needed."

One can ask the operators themselves, the pilots. When the Boeing statement
was released, I asked some senior pilots for major airlines, with whom I
have been corresponding for some decades, what they thought. There are two components to the Boeing statement, which it is useful to separate:

1). AoA indication is not necessary for the safe operation of the Boeing 737 MAX.

2). The "AOA Disagree" alert on the Primary Flight Display (PFD) is not necessary for the safe operation of the Boeing 737 MAX.

Concerning 1), the pilots who responded generally agree that AoA indication
is not necessary, and does not help much if at all, when flying commercial transport aircraft.

JT 610 and ET-302 are not the first accidents concerning which the question
of AoA indication in commercial transports has arisen. In their final report
on the 2009 accident to AF 447, an Air France A330 lost over the South
Atlantic during a flight from Brazil to France, the BEA recommended "that
EASA and the FAA evaluate the relevance of requiring the presence of an
angle of attack indicator directly accessible to pilots on board aeroplanes". (See Section 4.2.2 of the Final Report at https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf)

AoA indication on commercial transports has been debated for far longer than this. For example, there was an article about it nearly twenty years ago in Boeing Aero magazine #12, March 2000: http://www.boeing.com/commercial/aeromagazine/aero_12/attack.html

Given the decades of such engineering and operational debate about it
amongst all stakeholders, it would have surprised me had Boeing said
something misleading about 1).

Concerning 2), a senior pilot, qualified on the Boeing 737 (all varieties)
and undergoing the required recurrent training, pointed out that having an
"AoA disagree" indication does not change flight crew response to the aerodynamic situation at all. The Boeing 737 MAX checklist for an "AoA disagree" indication warns that AS and altitude information might disagree
or be unreliable. That's it (I am told). That information is already present
on the PFDs, in rather more prominent form than the "AoA disagree"
alert. And the stick shaker might also activate, as it did during the
accidents to JT-610 and ET-302. The stick shaker is a very tactile warning
of being in an approach-to-stall regime and that crew should pay immediate attention to AS. He concluded that an "AoA disagree" alert indeed counts as supplementary information, and not as necessary information. That directly contradicts Karish's opinion that it is "vital".

Boeing's statement seems completely consistent with their, and other
experts', long-standing engineering and operational judgment about AoA indications and alerting on commercial transport aircraft. One may disagree with those engineering and operational judgments. But the trope of
"regulatory capture", suggested by Karish, doesn't enter into it at all.

------------------------------

Date: Sat, 1 Jun 2019 03:38:32 -0700
From: Chuck Karish <chuck.karish@gmail.com>
Subject: Re: 737 MAX AoA Indications (Karish, RISKS-31.28)

In his response to my post in RISKS.31-27, Prof. Ladkin does not address the clause that gives that post its meaning: "Once the MCAS takes control of the airplane away from the pilots". Boeing built the MCAS because they
anticipated that pilots would not be able to safely operate the 737 MAX airplane manually in certain flight conditions. While an experienced pilot might not need a working AOA indicator to fly the airplane, the MCAS does
need it. Installation of the MCAS made the AOA indicators safety critical.

------------------------------

Date: Sat, 1 Jun 2019 18:20:06 +0200
From: Peter Bernard Ladkin <ladkin@causalis.com>
Subject: Re: 737 MAX AoA Indications (Karish, RISKS-31.28)

That assertion is incorrect. Both crews were theoretically able to control their aircraft until comparatively late in the development of each
upset. Indeed, this is illustrated by the flight of PK-LQP immediately preceding JT 610, where the selfsame phenomenon manifested and the crew completed the flight safely.

I add the caveat "until comparatively late" because there is some question whether, during the development of the upset situation in both flights, the aircraft entered a regime in which they could not be manually retrimmed
because of aerodynamic forces inhibiting pilot movement of the trim
wheel. That is not a fault in itself - such regimes are "a fact of [aerodynamic] life", according to a distinguished aerodynamicist
colleague. However, there is continued discussion as to how and why the
crews could have got into that regime, if indeed they did.

These accidents were not deterministic. It is not as if, when MCAS cut in because of the sensor malfunction, the crew became powerless and the flights were doomed. There has been extensive discussion in pilot forums as to what went on, why it went on, and how and why the respective crews might have reacted differently. And presumably there is considerable discussion of this matter within the accident investigations themselves.

Boeing built the MCAS because they anticipated that pilots would not be
able to safely operate the 737 MAX airplane manually in certain flight conditions.

That is not so. See https://abnormaldistribution.org/index.php/2019/04/30/ieee-spectrum-on-possible-software-involvement-in-two-recent-airliner-crashes/
for the reason I was given as to why the MCAS function was added to the STS.

While an experienced pilot might not need a working AOA indicator to fly
the airplane, the MCAS does need it.

The MCAS function needs a working AoA sensor.

Installation of the MCAS made the AOA
indicators safety critical.

No, not cockpit indications such as AoA display or "AOA Disagree" alert.

The correct operation of the AoA sensor itself is "safety-critical" in
informal terms. Formally, the AoA sensor is, on the Boeing 737 MAX, a non-redundant causal component of a subsystem with a malfunction severity of "hazardous". (Whether the classification as "hazardous" was/is appropriate
is another question arising from the accidents.)

------------------------------

Date: Sat, 1 Jun 2019 14:08:06 -0700
From: Chuck Karish <chuck.karish@gmail.com>
Subject: Re: 737 MAX: Boeing dodges responsibility, with help from the FAA
(Ladkin, RISKS-31.28)

In my submission to RISKS-31.27 I was a bit too critical of Boeing's May 5 press release. The MCAS doesn't depend on the "angle of attack indicator"
for safety, it depends directly on the angle of attack sensor. In the
context of the then-current uproar the press release was misdirection
rather than mischaracterization.

------------------------------

Date: Sun, 2 Jun 2019 12:25:09 -0600
From: jared gottlieb <jared@netspace.net.au>
Subject: Re: GM Gives All Its Vehicles a New Soul (RISKS-31.27)

Are over-the-air (OTA) updates new functionality? Link to Consumer's Reports article from April 2018 is https://www.consumerreports.org/automotive-technology/automakers-embrace-over-the-air-updates-can-we-trust-digital-car-repair/
with a brief mention of security. Link to GM Canada, at least a year old, is https://www.onstar.com/ca/en/software_terms/ is informative.

One question reading the T&C is whether the vehicle pulls the updates or the more risky push from a central server. Doesn't negate the risk of buggy new software (as compared to buggy old software) nor the annoyance of unwanted features updates.

------------------------------

Date: Mon, 14 Jan 2019 11:11:11 -0800
From: RISKS-request@csl.sri.com
Subject: Abridged info on RISKS (comp.risks)

The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is
comp.risks, the feed for which is donated by panix.com as of June 2011.

SUBSCRIPTIONS: The mailman Web interface can be used directly to

subscribe and unsubscribe:
http://mls.csl.sri.com/mailman/listinfo/risks

SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line that

includes the string `notsp'. Otherwise your message may not be read.
*** This attention-string has never changed, but might if spammers use it.

SPAM challenge-responses will not be honored. Instead, use an alternative

address from which you never send mail where the address becomes public!

The complete INFO file (submissions, default disclaimers, archive sites,

copyright policy, etc.) is online.
<http://www.CSL.sri.com/risksinfo.html>
*** Contributors are assumed to have read the full info file for guidelines!

OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's

searchable html archive at newcastle:
http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue.
Also, ftp://ftp.sri.com/risks for the current volume
or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume
If none of those work for you, the most recent issue is always at
http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-31.00
Lindsay has also added to the Newcastle catless site a palmtop version
of the most recent RISKS issue and a WAP version that works for many but
not all telephones: http://catless.ncl.ac.uk/w/r
ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001)
*** NOTE: If a cited URL fails, we do not try to update them. Try
browsing on the keywords in the subject line or cited article leads.
Apologies for what Office365 and SafeLinks may have done to URLs.

Special Offer to Join ACM for readers of the ACM RISKS Forum:

<http://www.acm.org/joinacm1>

------------------------------

End of RISKS-FORUM Digest 31.28
************************

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)