The RISKS Digest
Volume 31 Issue 69

Monday, 20th April 2020

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

A $1,300 smart crib was discovered to be vulnerable to a hack that would rapidly rock babies back and forth
Business Insider
Planned obsolescence: the outrage of our electronic waste mountain
The Guardian
ICANN delays .org sale again after scathing letter from California AG
Ars Technica
This Is No Time for an Internet Blackout
Slate
Zoom's Security Woes Were No Secret to Business Partners Like Dropbox
NYTimes
Anti-Asian Zoombombing at Newton South High School
Village14
Buyer beware—that 2TB-6TB “NAS” drive you've been eyeing might be SMR
Ars Technica
“ACM Reports Best Practices for Virtual Conferences”
HPCwire
Is BGP Safe Yet?
WiReD
COVID-19 Internet Usage Update
Jason Livingood
Raspberry Pi-Powered Ventilator to Be Tested in Colombia
BBC
Sipping from the Coronavirus Domain Firehose
Krebs on Security
Australian Government proposes to distribute Coronavirus App
John Colville
Rise in video conferencing use spells big trouble for ISPs
Lauren Weinstein
More states finally paying $600 extra in unemployment aide
apnews
More on COVID-19 Digital Rights Tracker
Lauren Weinstein
Capitalists or Cronyists?
Scott Galloway
The world after coronavirus
Yuval Noah Harari
Re: How Coronavirus Is Eroding Privacy
Amos Shapir
Re: New CDC Study Shows Coronavirus Can Survive For Hours On
Rex Sanders
Info on RISKS (comp.risks)

A $1,300 smart crib was discovered to be vulnerable to a hack that would rapidly rock babies back and forth (Business Insider)

geoff goodfellow <geoff@iconia.com>
Fri, 17 Apr 2020 09:12:00 -1000

Researchers with Red Balloon Security discovered several vulnerabilities with the Snoo last year after digging into its firmware, Red Balloon founder and CEO Ang Cui told Business Insider. By connecting to the crib using the same WiFi network, researchers were able to take control of its microphones, speaker, and motor. Red Balloon's findings were first reported by Wired on Thursday. <https://www.wired.com/story/snoo-smart-bassinet-vulnerabilities-shaking-loud-noise/>

https://www.businessinsider.com/snoo-smart-crib-hacked-security-researchers-shake-at-dangerous-speeds-2020-4


Planned obsolescence: the outrage of our electronic waste mountain (The Guardian)

geoff goodfellow <geoff@iconia.com>
Fri, 17 Apr 2020 09:14:00 -1000

Unrepairable phones and laptops are one of the scandals of our throwaway society. But the pushback is building—and the coronavirus crisis has added more pressure for change

EXCERPT:

Imagine you showed someone a smartphone 20 years ago. You said: “Here's this thing, it's going to be awesome, and it'll cost $1,000. But the manufacturers are going to glue the battery in, and you're supposed to get rid of it when the battery wears out.” You would have thought that notion was completely bananas.

Nathan Proctor is talking via Google Hangouts from Boston, Massachusetts, about an allegedly central feature of modern manufacturing known as planned obsolescence. This is the idea that some of the world's biggest companies have been selling us products either knowing full well that they will only last a couple of years, or having deliberately built a short lifespan into the item or its software. <https://www.theguardian.com/sustainable-business/2015/mar/23/were-are-all-losers-to-gadget-industry-built-on-planned-obsolescence>

It is a charge the companies would reject, but we all have everyday knowledge of what he is talking about—the suddenly dead or ‘bricked’ — made as useless as a brick—phone, discarded printer or broken laptop. Most of us dismiss the phenomenon as an irritating but unavoidable feature of modern life. But Proctor is the director of the Right to Repair campaign spawned by the U.S.'s Public Interest Research Group founded in 1971 by the celebrated activist Ralph Nader, and he wants us to see things very differently. <https://www.theguardian.com/world/2004/oct/22/uselections2004.usa>) <https://www.theguardian.com/world/2020/mar/11/eu-brings-in-right-to-repair-rules-for-phones-and-tablets> <https://uspirg.org/feature/usp/about-us>

As we throw away machines and devices damned as out of date, the result is a growing mountain of e-waste. Last year alone, it was reckoned that more than 50m tonnes of it were generated globally, with only around 20% of it officially recycled. Half of the 50m tonnes represented large household appliances, and heating and cooling equipment. The remainder was TVs, computers, smartphones and tablets. […]


ICANN delays .org sale again after scathing letter from California AG (Ars Technica)

geoff goodfellow <geoff@iconia.com>
April 19, 2020 at 9:47:58 AM GMT+9

The controversial deal would saddle the .org registry with $300 million in debt.

ICANN, the nonprofit that oversees the Internet's domain name system, has given itself another two weeks to decide whether to allow control of the .org domain to be sold to private equity firm Ethos Capital. The decision comes after ICANN received a blizzard of letters from people opposed to the transaction, including California Attorney General Xavier Becerra.

Becerra's letter was significant because ICANN is incorporated in California. That means it's Becerra's job to make sure that ICANN is living up to the commitments in its articles of incorporation, which promise that ICANN will operate “for the benefit of the Internet community as a whole.”

Becerra questioned whether ICANN was really doing that. “There is mounting concern that ICANN is no longer responsive to the needs of its stakeholders,” he wrote.

A secretive buyer and a lot of debt

California's attorney general pointed to several specific concerns about the transaction. One was the shadowy nature of the proposed buyer, Ethos Capital. “Little is known about Ethos Capital and its multiple proposed subsidiaries,” Becerra writes. Ethos Capital, he said, has “refused to produce responses to many critical questions posted by the public and Internet community.”

Ethos Capital's plan is to buy the Public Interest Registry (PIR) from its current parent organization, the nonprofit Internet Society. To help finance the sale, Ethos will saddle PIR with $300 million in debt—a common tactic in the world of leveraged buyouts. Becerra warns that this tactic could endanger the financial viability of the PIR—especially in light of the economic uncertainty created by the coronavirus.

“If the sale goes through and PIR's business model fails to meet expectations, it may have to make significant cuts in operations,” Becerra warns. “Such cuts would undoubtedly affect the stability of the .org registry.”

Becerra also blasts the Internet Society for considering the sale in the first place. “ISOC purports to support the Internet, yet its actions, from the secretive nature of the transaction, to actively seeking to transfer the .org registry to an unknown entity, are contrary to its mission and potentially disruptive to the same system it claims to champion and support,” he writes.

Becerra ends his letter with a warning: “This office will continue to evaluate this matter, and will take whatever action necessary to protect Californians and the nonprofit community.”

Totally inappropriate

Becerra is far from the only critic of the .org deal. On Monday, ICANN's first CEO, Michael Roberts, and original board chair Esther Dyson penned a letter blasting the transaction and their successors at ICANN. […] https://arstechnica.com/tech-policy/2020/04/icann-delays-org-sale-again-after-scathing-letter-from-california-ag/


This Is No Time for an Internet Blackout (Slate)

Lauren Weinstein <lauren@vortex.com>
Mon, 20 Apr 2020 09:57:49 -0700

https://slate.com/technology/2020/04/pandemic-internet-shutdown-danger.html


Zoom's Security Woes Were No Secret to Business Partners Like Dropbox (NYTimes)

Gabe Goldberg <gabe@gabegold.com>
Mon, 20 Apr 2020 13:10:02 -0400

Dropbox privately paid top hackers to find bugs in software by the

videoconferencing company Zoom, then pressed it to fix them.

https://www.nytimes.com/2020/04/20/technology/zoom-security-dropbox-hackers.html


Anti-Asian Zoombombing at Newton South High School (Village14)

“Peter G. Neumann” <neumann@csl.sri.com>
Mon, 20 Apr 2020 12:08:32 PDT

[From a colleague]

https://village14.com/2020/04/15/anti-asian-zoombombing-at-newton-south-high-school/>

Anti-Asian Zoombombing at Newton South High School

Guest post by Amy Xiao <https://village14.com/author/jerreilly/> This guest post submitted by Newton South senior Amy Xiao

On the morning of 15 Apr, nearly thirty unknown hackers infiltrated a Newton South AP Chinese class. Despite the school-mandated password protection on the meeting, these individuals subjected the class to a slew of racist insults for over five minutes. They were not simply being vulgar and offensive—they specifically targeted the students and the teacher through racial slurs and loud mock-Chinese.

Unfortunately, while individuals in the class contacted the administration of this event, Newton South has yet to inform the greater school community of this hate crime. We are disappointed by Newton South's lack of transparency; just because this type of event is happening in other school settings across the country does not mean that we cannot be outraged.

This incidence of zoombombing is a reflection of a larger wave of Anti-Asian sentiment surging across the globe. As evidenced by everything from the physical assaults against Asian individuals to the popularization of the term China Virus, it is no longer an option to simply gloss over racism being directed toward Asians and Asian-Americans. People within our community have been viciously attacked for their race—and it is critical that we acknowledge that.

In the likely case we cannot track down these hackers, we as a community should take this opportunity to gain a better understanding of the scope and intensity of the hate pervading our society.


Buyer beware—that 2TB-6TB “NAS” drive you've been eyeing might be SMR (Ars Technica)

Lauren Weinstein <lauren@vortex.com>
Sun, 19 Apr 2020 20:35:08 -0700

https://arstechnica.com/gadgets/2020/04/caveat-emptor-smr-disks-are-being-submarined-into-unexpected-channels/

Here's more:

https://blocksandfiles.com/2020/04/15/shingled-drives-have-non-shingled-zones-for-caching-writes/

and this is more tutorial:

https://www.reddit.com/r/DataHoarder/comments/57eosc/smr_drives_aka_archive_drives_a_word_of_caution/


“ACM Reports Best Practices for Virtual Conferences” (HPCwire)

ACM TechNews <technews-editor@acm.org>
Mon, 20 Apr 2020 12:24:19 -0400 (EDT)

HPCwire, 16 Apr 2020 via ACM TechNews, Monday, April 20, 2020

A new report from ACM outlines best practices for replacing live science and technology conferences with virtual ones during the COVID-19 pandemic. The report is a practical guide covering a wide range of topics that conference organizers contend with, including required technology, high-level planning, accessibility, nurturing social interaction, navigation, and finances. The guide was created by a task force that included ACM members with experience organizing online conferences and conducting virtual planning sessions. The task force will periodically update and revise the report, and organizers are encouraged to share their own experiences, or make comments or queries. ACM president Cherri M. Pancake said, “Our hope is that the report will also encourage conference organizers to think about reducing their reliance on face-to-face meetings in the future.” https://orange.hosting.lsoft.com/trk/click?ref=3Dznwrbbrs9_6-24cf4x221ac3x069225&


Is BGP Safe Yet? (WiReD)

Gabe Goldberg <gabe@gabegold.com>
Mon, 20 Apr 2020 00:20:30 -0400

“Is BGP Safe Yet' is a new site that names and shames internet service providers that don't tend to their routing.

https://www.wired.com/story/cloudflare-bgp-routing-safe-yet/


COVID-19 Internet Usage Update

“Livingood, Jason” <Jason_Livingood@comcast.com>
April 17, 2020 at 4:47:37 AM GMT+9

[Via Dave Farber]

We (at Comcast) just updated our COVID19 network update page at https://corporate.comcast.com/covid-19/network. Some data points of note:

Network growth has slowed substantially and in many areas has plateaued, especially in the cities that started stay-at-home orders earlier. This is likely an indicator that, given currently available apps, all the people that can work/study from home are and they are at their maximum daily usage of screens/devices.

Peak has increased since March 1, +32% in upstream traffic & +18% in downstream.

Downstream peak used to start at 9 PM, now starts earlier - between 7 PM and 8 PM.

Upstream peak used to start 9 PM, now starts between 8 AM and 6 PM in most cities. (This is a significant change, driven by video conferencing and work VPN usage.)

Video/voice conferencing +228% VPN +40% Video streaming +77% For our MVNO: -19% LTE usage, +49% WiFi usage

Also NCTA (cable-based ISPs) updated their page at https://www.ncta.com/whats-new/peak-broadband-traffic-continues-remain-steady

Network Augmentation: Once engineers identify areas that need attention, technicians install additional hardware, extend fiber and more to ensure the network is performing well. For some cable providers, these efforts are up as much as 300% in a given week.

Downstream & upstream peak growth flat for 2nd consecutive week.


Raspberry Pi-Powered Ventilator to Be Tested in Colombia (BBC)

ACM TechNews <technews-editor@acm.org>
Mon, 20 Apr 2020 12:24:19 -0400 (EDT)

Zoe Thomas, BBC News, 13 Apr 2020, via ACM TechNews, 20 Apr 2020

Marco Mascorro, a robotics engineer with no prior experience creating medical equipment, developed and posted online plans for a ventilator made from a Raspberry Pi computer and easy-to-source parts. Now, researchers at Columbia's University Hospital of the Pontifical Xavierian University and Los Andes University are preparing to put the machine through a fast-tracked round of tests so that it may be used to help combat the COVID-19 pandemic. The Raspberry Pi computer is critical to the control of the ventilator; it regulates air pressure, opens and closes valves, and can determine whether a patient needs full or partial breathing assistance. Said Mascorro, “The beauty of developing a software-centric system is we can make changes to the processes without doing much to the hardware.” https://orange.hosting.lsoft.com/trk/click?ref=3Dznwrbbrs9_6-24cf4x221ac4x069225&


Sipping from the Coronavirus Domain Firehose (Krebs on Security)

Gabe Goldberg <gabe@gabegold.com>
Fri, 17 Apr 2020 00:59:49 -0400

Security experts are poring over thousands of new Coronavirus-themed domain names registered each day, but this often manual effort struggles to keep pace with the flood of domains invoking the virus to promote malware and phishing sites, as well as non-existent healthcare products and charities. As a result, domain name registrars are under increasing pressure to do more to combat scams and misinformation during the COVID-19 pandemic.

By most measures, the volume of new domain registrations that include the words Coronavirus or Covid has closely tracked the spread of the deadly virus. The Cyber Threat Coalition (CTC), a group of several thousand security experts volunteering their time to fight COVID-related criminal activity online, recently published data showing the rapid rise in new domains began in the last week of February, around the same time the Centers for Disease Control began publicly warning that a severe global pandemic was probably inevitable.

https://krebsonsecurity.com/2020/04/sipping-from-the-coronavirus-domain-firehose/


Australian Government proposes to distribute Coronavirus App

John Colville <John.Colville@uts.edu.au>
Sun, 19 Apr 2020 04:30:08 +0000

Within two weeks, the Australian Government proposes to distribute a App which uses Bluetooth to help identify contacts of people who have been identified as having novel Coronavirus (COVID-19).

Conditions about its distribution are changing rapidly. Initially the Government said that it was going to be based on the Singapore App. There it is based on centralised collection of the data.

In Singapore, it was taken up by 20% of the population. In Australia it would not be considered successful unless 40% of the population added it to their mobile phones i.e. cell phones. It was also said that if uptake was not sufficient it might be made compulsory to load the App. Since then, the prime Minister, Scott Morrison, has ruled out compulsory loading.

https://www.abc.net.au/news/2020-04-18/prime-minister-rules-out-making-coronavirus-app-mandatory/12161126

Also the Minister responsible for the legislation, Stuart Roberts, has now said that the code will be open to scrutiny. He has also described a model which is similar to what has been proposed by Apple and Google, where the information is stored on the local phone. It will then only be swapped with neighboring phones when a COVID-19 positive person is within 1.5m of another phone for more than 15 minutes.


Rise in video conferencing use spells big trouble for ISPs

Lauren Weinstein <lauren@vortex.com>
Sat, 18 Apr 2020 09:02:11 -0700

With the exception of persons on symmetric fiber connections, most Internet last-mile connections (including mobile) are highly asymmetric. This is especially true for cable and other typical consumer, small-business grade wireline circuits. Cable systems can be the worst of the bunch, since they have been routinely designed to vastly favor downstream traffic toward users (e.g., typical web browsing, watching videos, etc.)

Now with the rise of videoconferencing for schools and work at home, the impact on many cable systems is dramatic, with upstream speeds (usually anemic compared with downstream even under normal conditions) being massively negatively impacted in many cases, since videoconferencing uses similar bandwidth in both directions.

For many years ISPs have neglected upstream speeds, now this neglect is coming home to roost, big time.


More states finally paying $600 extra in unemployment aide (apnews.com)

Richard Stein <rmstein@ieee.org>
Mon, 20 Apr 2020 11:03:09 +0800

https://apnews.com/827d97d1facdaadea86902f0cf11683b via Doug Hosking

“Connecticut's labor officials are scrambling to reprogram their computers to handle the additional unemployment payouts. Its decades-old system can process weekly payments only in the hundreds of dollars, or three digits. Problem is, the additional $600 from the federal government extends the payments into four digits.”

“…the slow and fitful distribution of payments points to the antiquated information technology that many states still rely upon for unemployment payments. Roughly two-thirds use a near-obsolete programming language, COBOL, that dates to the 1970s.”

Jurassic-age technical debt interferes with change management revision and solution deployment.


More on COVID-19 Digital Rights Tracker

Lauren Weinstein <lauren@vortex.com>
Sat, 18 Apr 2020 08:50:49 -0700

ALL HAPPENING RIGHT NOW IN VARIOUS COUNTRIES:

License plate tracking! Credit card and bank card tracking! Smartphone tracking! Wrist and ankle tracking bracelets! Government access to smartphone cameras. The creation of a global surveillance juggernaut that governments will never willingly give up or restrict solely to public health situations! -LW

https://www.top10vpn.com/news/surveillance/covid-19-digital-rights-tracker/


Capitalists or Cronyists? (Scott Galloway)

Dewayne Hendricks <dewayne@warpspeed.com>
April 18, 2020 19:38:39 JST

[Note: This item comes from friend David Rosenthal. DLH]

Scott Galloway, Capitalists or Cronyists?, 10 Apr 2020 <https://www.profgalloway.com/capitalists-or-cronyists>

Lenin said nothing can happen for decades, and then decades can happen in weeks. Yes, a pandemic pulls the future forward, and there's a lot to learn. Another phenomenon that forms rain clouds of perspective is, wait for it … death. Or, specifically, being close to it.

My father is approaching 90, recently divorced (for the fourth time), and spends his days watching replays of Maple Leafs games and abusing Xanax. His affinity for Xanies is a feature, not a bug, since at the end of your life long-term effects lose meaning. He's near the end, exceptionally intelligent, and high. In sum, he's my Yoda.

Our calls are mostly me yelling short questions (HOW ARE THE LEAFS LOOKING FOR NEXT YEAR?) and waiting for something profound in return. Occasionally he delivers.

You must unlearn what you have learned!

Just kidding, Yoda did actually say that. But when I asked him what he thinks makes America different, he said:

America is a terrible place to be stupid.

That's why he immigrated here. A pillar of capitalism is you can't reward the winners without punishing the losers. I worry our government has been co-opted by the wealthy and is focused on protecting the previous generation of winners, even if it means reducing future generations' ability to win. Aren't we borrowing against our children's prosperity to protect the wealth of the top 10, if not 1, percent

In Depression-era Scotland, my dad was physically abused by his father. His mother spent the money he sent home from the Royal Navy on whiskey and cigarettes. He took a huge risk and came to America. My mom took a similar risk, leaving her two youngest siblings in an orphanage (her mom and dad had both died in their early fifties), and bought a ticket on a steamship. She had a small suitcase and 110 quid that she hid in both socks. Why? Because they wanted to work their asses off and be rewarded for the risks they were willing to take. This is capitalism, a beacon of hope for people who are smart, hard working, and comfortable with risk, promising a greater share of the spoils than those who are not.

However, no more. Modern-day capitalism in America is to flatten the risk curve for people who already have money, by borrowing from future generations with debt-fueled bailouts for companies. We have consciously decided to reduce the downside for the wealthy, thereby limiting the upside for future generations.

CNBC guest: Equity holders deserve to get wiped out. CNBC host: Why does anybody deserve to get wiped out in a crisis like this? This is a natural disaster, why does anybody deserve to get wiped out? Wouldn't that be immoral in and of itself?

Immoral, here we go. Morality for CNBC, and the current administration, is not capitalism but the worst type of socialism, cronyism. Rugged individualism and capitalism on the way up, privatizing the gains—and then socialism/cronyism on the way down as we socialize the losses with bailouts.

Red Envelope

In 1999, the firm I co-founded, Red Envelope, was drafting an S-1 in anticipation of an IPO. At 31, I stood to register $30-60 million on the IPO. The bursting of the bubble damaged us, but the injuries weren't fatal, and we were the only retail IPO of 2002. In 2008, a longshoreman strike left all our holiday merchandise hostage on a cargo ship 8 miles off the shores of the port of Long Beach. Then, as the credit crisis began to take hold, a prescient analyst at Wells Fargo decided to pull our credit facility. Within 90 days we were Chapter 11. That event, combined with divorce, reduced my net worth 97%.

I didn't deserve to lose near-everything. What happened wasn't my fault — ok, maybe the divorce. Regardless, was this fair or (im)moral? Just as there's no crying in baseball, there's no fairness in shareholder accretion or destruction. Looking at jets at 31 wasn't moral or fair either. So, what happened? Exactly what's supposed to happen in a market economy—downside registered against commensurate upside.

Red Envelope went through something also uniquely American—and productive — bankruptcy. The equity holders (e.g., yours truly) were wiped out (#bummer). However, we did our duty as board members and found a buyer, Liberty Media, who paid our vendors and kept the employees. No job loss, all debtors paid. When a 31-year-old is shopping for jets in November, part of the agreement with the invisible hand is he may lose most/all of it by March. There's a word for that: capitalism.

The capital structure of private firms is meant to balance upside and downside. CNBC/Trump want to protect current equity holders at the expense of future generations with rescue packages that explode the deficit. They also want to protect airlines, who spent $45 billion on buybacks and now want a $54 billion bailout, disincentivizing other firms (e.g., Berkshire Hathaway) that have built huge cash piles foregoing current returns.

The rescue package should protect people, not businesses. From 2017 to 2019, the CEOs of Delta, American, United, and Carnival Cruises earned over $150 million in compensation. But, now, “We're in this together” (i.e., bail our asses out).

And what happens if they (gasp!), go out of business? Simple, the equity holders, and unsecured debt holders, get wiped out. These are the cohorts who, despite the recent meltdown, have registered a 3.3x increase in the Dow since the lows of 2008.

As long as they keep making old people, and younger people want to take their kids to Disney's Galaxy's Edge, there will be cruise lines and airlines. Since 2000, US airlines have declared bankruptcy 66 times. Despite the obvious vulnerability of the sector, boards/CEOs of the six largest airlines have spent 96% of their free cash flow on share buybacks, bolstering the share price and compensation of management—who now want a bailout. They should be allowed to fail. Bondholders will own the firms. Ships and planes will continue to float and fly, and there will still be a steel tube with recirculated air waiting for you post molestation by Roy from TSA.

The Lie

Trump/CNBC have adopted a narrative that this is about protecting the most vulnerable. No, it's about buttressing the most wealthy. Pandemics typically result in higher wages over the next several decades as we recognize that essential workers (the gal/guy delivering your Greek yogurt and placing your Indian food in the backseat of your car) should be paid more. A good thing. […]


The world after coronavirus (Yuval Noah Harari)

Dewayne Hendricks <dewayne@warpspeed.com>
April 19, 2020 18:39:21 JST

Yuval Noah Harari, 20 Mar 2020 This storm will pass. But the choices we make now could change our lives for years to come <https://www.ft.com/content/19d90308-6858-11ea-a3c9-1fe6fedcca75>

Humankind is now facing a global crisis. Perhaps the biggest crisis of our generation. The decisions people and governments take in the next few weeks will probably shape the world for years to come. They will shape not just our healthcare systems but also our economy, politics and culture. We must act quickly and decisively. We should also take into account the long-term consequences of our actions. When choosing between alternatives, we should ask ourselves not only how to overcome the immediate threat, but also what kind of world we will inhabit once the storm passes. Yes, the storm will pass, humankind will survive, most of us will still be alive—but we will inhabit a different world.

Many short-term emergency measures will become a fixture of life. That is the nature of emergencies. They fast-forward historical processes. Decisions that in normal times could take years of deliberation are passed in a matter of hours. Immature and even dangerous technologies are pressed into service, because the risks of doing nothing are bigger. Entire countries serve as guinea-pigs in large-scale social experiments. What happens when everybody works from home and communicates only at a distance? What happens when entire schools and universities go online? In normal times, governments, businesses and educational boards would never agree to conduct such experiments. But these aren't normal times.

In this time of crisis, we face two particularly important choices. The first is between totalitarian surveillance and citizen empowerment. The second is between nationalist isolation and global solidarity.

Under-the-skin surveillance

In order to stop the epidemic, entire populations need to comply with certain guidelines. There are two main ways of achieving this. One method is for the government to monitor people, and punish those who break the rules. Today, for the first time in human history, technology makes it possible to monitor everyone all the time. Fifty years ago, the KGB couldn't follow 240m Soviet citizens 24 hours a day, nor could the KGB hope to effectively process all the information gathered. The KGB relied on human agents and analysts, and it just couldn't place a human agent to follow every citizen. But now governments can rely on ubiquitous sensors and powerful algorithms instead of flesh-and-blood spooks.

In their battle against the coronavirus epidemic several governments have already deployed the new surveillance tools. The most notable case is China. By closely monitoring people's smartphones, making use of hundreds of millions of face-recognising cameras, and obliging people to check and report their body temperature and medical condition, the Chinese authorities can not only quickly identify suspected coronavirus carriers, but also track their movements and identify anyone they came into contact with. A range of mobile apps warn citizens about their proximity to infected patients.

This kind of technology is not limited to east Asia. Prime Minister Benjamin Netanyahu of Israel recently authorised the Israel Security Agency to deploy surveillance technology normally reserved for battling terrorists to track coronavirus patients. When the relevant parliamentary subcommittee refused to authorise the measure, Netanyahu rammed it through with an emergency decree.

You might argue that there is nothing new about all this. In recent years both governments and corporations have been using ever more sophisticated technologies to track, monitor and manipulate people. Yet if we are not careful, the epidemic might nevertheless mark an important watershed in the history of surveillance. Not only because it might normalise the deployment of mass surveillance tools in countries that have so far rejected them, but even more so because it signifies a dramatic transition from over the skin to under the skin surveillance.

Hitherto, when your finger touched the screen of your smartphone and clicked on a link, the government wanted to know what exactly your finger was clicking on. But with coronavirus, the focus of interest shifts. Now the government wants to know the temperature of your finger and the blood-pressure under its skin.

The emergency pudding

One of the problems we face in working out where we stand on surveillance is that none of us know exactly how we are being surveilled, and what the coming years might bring. Surveillance technology is developing at breakneck speed, and what seemed science-fiction 10 years ago is today old news. As a thought experiment, consider a hypothetical government that demands that every citizen wears a biometric bracelet that monitors body temperature and heart-rate 24 hours a day. The resulting data is hoarded and analysed by government algorithms. The algorithms will know that you are sick even before you know it, and they will also know where you have been, and who you have met. The chains of infection could be drastically shortened, and even cut altogether. Such a system could arguably stop the epidemic in its tracks within days. Sounds wonderful, right?

The downside is, of course, that this would give legitimacy to a terrifying new surveillance system. If you know, for example, that I clicked on a Fox News link rather than a CNN link, that can teach you something about my political views and perhaps even my personality. But if you can monitor what happens to my body temperature, blood pressure and heart-rate as I watch the video clip, you can learn what makes me laugh, what makes me cry, and what makes me really, really angry.

It is crucial to remember that anger, joy, boredom and love are biological phenomena just like fever and a cough. The same technology that identifies coughs could also identify laughs. If corporations and governments start harvesting our biometric data en masse, they can get to know us far better than we know ourselves, and they can then not just predict our feelings but also manipulate our feelings and sell us anything they want—be it a product or a politician. Biometric monitoring would make Cambridge Analytica's data hacking tactics look like something from the Stone Age. Imagine North Korea in 2030, when every citizen has to wear a biometric bracelet 24 hours a day. If you listen to a speech by the Great Leader and the bracelet picks up the tell-tale signs of anger, you are done for.

You could, of course, make the case for biometric surveillance as a temporary measure taken during a state of emergency. It would go away once the emergency is over. But temporary measures have a nasty habit of outlasting emergencies, especially as there is always a new emergency lurking on the horizon. My home country of Israel, for example, declared a state of emergency during its 1948 War of Independence, which justified a range of temporary measures from press censorship and land confiscation to special regulations for making pudding (I kid you not). The War of Independence has long been won, but Israel never declared the emergency over, and has failed to abolish many of the temporary measures of 1948 (the emergency pudding decree was mercifully abolished in 2011).

Even when infections from coronavirus are down to zero, some data-hungry governments could argue they needed to keep the biometric surveillance systems in place because they fear a second wave of coronavirus, or because there is a new Ebola strain evolving in central Africa, or because …, you get the idea. A big battle has been raging in recent years over our privacy. The coronavirus crisis could be the battle's tipping point. For when people are given a choice between privacy and health, they will usually choose health.

The soap police

Asking people to choose between privacy and health is, in fact, the very root of the problem. Because this is a false choice. We can and should enjoy both privacy and health. We can choose to protect our health and stop the coronavirus epidemic not by instituting totalitarian surveillance regimes, but rather by empowering citizens. In recent weeks, some of the most successful efforts to contain the coronavirus epidemic were orchestrated by South Korea, Taiwan and Singapore. While these countries have made some use of tracking applications, they have relied far more on extensive testing, on honest reporting, and on the willing co-operation of a well-informed public.

Centralised monitoring and harsh punishments aren't the only way to make people comply with beneficial guidelines. When people are told the scientific facts, and when people trust public authorities to tell them these facts, citizens can do the right thing even without a Big Brother watching over their shoulders. A self-motivated and well-informed population is usually far more powerful and effective than a policed, ignorant population.

Consider, for example, washing your hands with soap. This has been one of the greatest advances ever in human hygiene. This simple action saves millions of lives every year. While we take it for granted, it was only in the 19th century that scientists discovered the importance of washing hands with soap. Previously, even doctors and nurses proceeded from one surgical operation to the next without washing their hands. Today billions of people daily wash their hands, not because they are afraid of the soap police, but rather because they understand the facts. I wash my hands with soap because I have heard of viruses and bacteria, I understand that these tiny organisms cause diseases, and I know that soap can remove them.


Re: How Coronavirus Is Eroding Privacy (RISKS-31.68)

<Amos Shapir <amos083@gmail.com>
Sat, 18 Apr 2020 13:41:10 +0300

So now it's official knowledge: Advertising companies are following us around and know where we are and what we are doing, all the time (as if we had any doubts). What privacy? We never had that on the net, and never will.


Re: New CDC Study Shows Coronavirus Can Survive For Hours On … (RISKS-31.68)

“Rex Sanders” <rex.sanders@usa.net>
Sat, 18 Apr 2020 13:09:12 -0700

Quoting the CDC article:

“Our study has 2 limitations. First, the results of the nucleic acid test do not indicate the amount of viable virus. Second, for the unknown minimal infectious dose, the aerosol transmission distance cannot be strictly determined.”

I like to use this analogy with friends and family: Someone gets murdered in a home. Police find a suspect's fingerprints everywhere inside the home, but haven't actually looked for the murderer.

Is the home still dangerous? We don't know. All we have are fingerprints.

In the CDC study, the researchers found genetic fingerprints of the virus, but have no idea if what they found could infect people. They even said so in the article!

Unfortunately I see this fingerprint/murderer confusion in far too many coronavirus news reports - including this one.

Please report problems with the web pages to the maintainer

x
Top