The RISKS Digest
Volume 32 Issue 86

Sunday, 5th September 2021

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

Whistleblower claims smart motorway system failure
Safer Highways
The U.S. Army Tried Portable Nuclear Power at Remote Bases 60 Years Ago
Atlas Obscura
Excel spreadsheet font gives evidence of fraud
The Economist
Digital Archives Meant to Be Permanent Seem to Be Lost on the Web
New Scientist
AI Matches Cardiologists' Expertise, While Explaining Its Decisions
UCSF News
Popular Smart Home Security System Can Be Remotely Disarmed
TechCrunch
New NSA FAQ on Quantum Computing and Post-Quantum Cryptography
Defense.gov
Apple backs down on CSAM launch, says it will collect input and make improvements before launching
Apple Insider
Insufficient evidence that AI breast cancer screening is accurate enough to replace human scrutiny
medicalxpress.com
GOP Election Reviews Create a New Kind of Security Threat
NYTimes
Re: Lying with statistics
Jonathan Levine
Re: Iceland has reported more cases in the past month than they had in the previous 9 months combined
Sheldon Andrew Douglass Amos Shamir
Re: Toyota suspends use of self-driving vehicle in Olympic Village
Steve Lamont
Re: Lights Flickered in New York City. Why Did the Subways Grind to a Halt?
Sheldon
Re: autonomous vehicles
Matthew Kruk
Biden Administration Establishes Program to Recruit Techo
Maggie Miller
Security, Privacy, and Innovation: Reshaping Law for the AI Era
noted by Gabe Goldberg
Info on RISKS (comp.risks)

Whistleblower claims smart motorway system failure (Safer Highways)

“George Sherwood” <sherwood@transedge.com>
Thu, 2 Sep 2021 10:25:37 -0400

A whistleblower has claimed staff operating England's smart motorways are ‘petrified’ of road users being killed following a string of computer crashes.

Three system failures in April meant that across hundreds of miles of motorway, the digital signs which inform drivers of speed limits or lane closures were left ‘unusable’.

The signs, also called gantries, could not be changed along parts of the M1, M4, M5 and M62, leading an insider at National Highways (formerly England Highways) to warn that ‘someone is going to get killed.’

https://www.saferhighways.co.uk/post/whistleblower-claims-smart-motorway-system-failure


The U.S. Army Tried Portable Nuclear Power at Remote Bases 60 Years Ago (Atlas Obscura)

“Gabe Goldberg” <gabe@gabegold.com>
Fri, 3 Sep 2021 22:53:35 -0400

It didn't go well.

https://www.atlasobscura.com/articles/camp-century-portable-nuclear-reactor


Excel spreadsheet font gives evidence of fraud (The Economist)

“Steve Golson” <sgolson@trilobyte.com>
Sat, 4 Sep 2021 11:31:20 -0400

A prominent paper on dishonesty relied on a fabricated dataset, and different fonts provide proof:

http://datacolada.org/98

Perhaps the most peculiar feature of the dataset is the fact that the baseline data for Car #1 in the posted Excel file appears in two different fonts. Specifically, half of the data in that column are printed in Calibri, and half are printed in Cambria.
The analyses we have performed on these two fonts provide evidence of a rather specific form of data tampering. We believe the dataset began with the observations in Calibri font. Those were then duplicated using Cambria font.

Also mentioned in The Economist:

https://www.economist.com/graphic-detail/2021/08/28/how-data-detectives-spotted-fake-numbers-in-a-widely-cited-paper

RISK: It's data, it's in Excel, therefore it must be correct.

not-a-RISK: Making your data publicly available is a good thing.


Digital Archives Meant to Be Permanent Seem to Be Lost on the Web (New Scientist)

ACM TechNews <technews-editor@acm.org>
Wed, 1 Sep 2021 11:39:18 -0400 (EDT)

Chris Stokel-Walker New Scientist, 30 Aug 2021, via ACM TechNews, 1 Sep 2021

Old Dominion University (ODU)'s Michael Nelson and colleagues found supposedly permanent digital Web archives could be lost. The team ran a Web crawler between November 2017 and January 2019 to access 16,627 pages preserved by 17 services in the U.S., Europe, and some serving the whole Internet. Four of the archives' uniform resource identifiers changed during that period, impacting the crawler's ability to find the archived pages. The four archives stored 1,981 Web pages, of which 537 were affected, including 20 that could not be retrieved at all. ODU's Michael Nelson said, “Being able to provide access to archives and demonstrate the integrity and authenticity of those archives are indeed issues that are very important to us and our members, and Web archives are no exception.” https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-2c9x22d585x074076&


AI Matches Cardiologists' Expertise, While Explaining Its Decisions (UCSF News)

ACM TechNews <technews-editor@acm.org>
Wed, 1 Sep 2021 11:39:18 -0400 (EDT)

Elizabeth Fernandez, University of California, San Francisco News, 24 Aug 2021 via ACM TechNews, 1 Sep 2021

Scientists at the University of California, San Francisco and the University of California, Berkeley designed an artificial intelligence (AI) algorithm that diagnosed cardiovascular ailments as well as expert cardiologists, while explaining its reasoning. The researchers trained the convolutional neural network on commonly accessible electrocardiogram (ECG) data. The researchers said the algorithm performed strongly across 38 different diagnoses in five broad diagnostic categories. Because the researchers incorporated “explainability” into the algorithm, it highlighted ECG segments critical for each diagnosis, which may boost physicians' confidence in using it. The researchers said their results “offer strong support for AI algorithms like neural networks to be incorporated into existing commercial ECG algorithms, since they perform better for many diagnoses, can improve over time and provide additional insights through explainability.” https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-2c9x22d584x074076&


Popular Smart Home Security System Can Be Remotely Disarmed (TechCrunch)

ACM TechNews <technews-editor@acm.org>
Wed, 1 Sep 2021 11:39:18 -0400 (EDT)

Zack Whittaker, TechCrunch, 31 Aug 2021, via ACM TechNews, 1 Sep 2021

Researchers at cybersecurity company Rapid7 found vulnerabilities that can be used to remotely disarm the Fortress S03 smart home-security system. The Wi-Fi-based system allows owners to monitor their homes with a mobile application via Internet-linked cameras, motion sensors, and sirens, and to arm or disarm it with a radio-controlled key fob. The researchers said hackers can remotely query an unauthenticated application programming interface without the server checking the request's legitimacy; the server would return the device's unique International Mobile Equipment Identity number, which could be used to disarm the system. In addition, intercepting unencrypted radio signals between the S03 and the key fob could permit the “arm” and “disarm” signals to be captured and replayed. Rapid7 informed Fortress of the flaws, then publicly disclosed them when the company did not respond after three months; a law firm representing Fortress called the claims of vulnerabilities in the S03 system “false, purposely misleading, and defamatory,” without specifying why they are false, or that Fortress has fixed the vulnerabilities. https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-2c9x22d583x074076&


New NSA FAQ on Quantum Computing and Post-Quantum Cryptography (Defense.gov)

Lauren Weinstein <lauren@vortex.com>
Sat, 4 Sep 2021 15:47:53 -0700

https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF


Apple backs down on CSAM launch, says it will collect input and make improvements before launching

Lauren Weinstein <lauren@vortex.com>
Fri, 3 Sep 2021 08:20:39 -0700

https://appleinsider.com/articles/21/09/03/apple-backs-down-on-csam-features-postpones-launch


Insufficient evidence that AI breast cancer screening is accurate enough to replace human scrutiny (medicalxpress.com)

Richard Stein <rmstein@ieee.org>
Thu, 2 Sep 2021 09:43:24 +0800

https://medicalxpress.com/news/2021-09-insufficient-evidence-ai-breast-cancer.html

“Current evidence on the use of AI systems in breast cancer screening is a long way from having the quality and quantity required for its implementation into clinical practice.“

“Well designed comparative test accuracy studies, randomized controlled trials, and cohort studies in large screening populations are needed which evaluate commercially available AI systems in combination with radiologists in clinical practice.”

When the initial diagnosis originates from AI, a second opinions about medical diagnosis will remain essential. How many patients will ask their physicians to review the initial diagnosis for a false positive/negative?


GOP Election Reviews Create a New Kind of Security Threat (NYTimes)

Henry Baker <hbaker1@pipeline.com>
Wed, 01 Sep 2021 21:58:16 +0000
> Nick Corasaniti, NYTimes,  1 Sep 2021
> https://www.nytimes.com/2021/09/01/us/politics/gop-us-election-security.html

> As Republicans continue to challenge the 2020 results, voting equipment is
> being compromised when partisan insiders and unvetted operatives gain
> access.

> “that previously unknown technical vulnerabilities could be discovered by
> partisan malefactors and exploited in future elections.”

> “Security experts say that election hardware and software should be
> subjected to transparency and rigorous testing, but only by credentialed
> professionals.”

I was incredibly offended by the supercilious tone of this NYTimes article, especially as it indicated a complete disregard for the dubious history of ‘Security through Obscurity’:

https://en.wikipedia.org/wiki/Security_through_obscurity

The 2020 election wasn't ‘stolen’, but that doesn't imply that our election systems are in good shape—they aren't, and can't be, so long as we disregard Kerckhoffs's Principle:

https://en.wikipedia.org/wiki/Kerckhoffs's_principle

“Secrecy, in other words, is a prime cause of brittleness—and therefore something likely to make a system prone to catastrophic collapse. Conversely, openness provides ductility.” Bruce Schneier

Since elections and voting are the fundamental aspects of a democracy, these processes deserve the highest level of scrutiny by the largest number of eyes. By definition, all of these processes—both hardware and software—should be OPEN SOURCE, and significant efforts in the computer science and crypto communities should be made to render these processes as transparent and auditable as possible.

“I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this—who will count the votes, and how.“ said in 1923; Boris Bazhanov The Memoirs of Stalin's Former Secretary (1992);

Re: Lying with statistics (RISKS-32.85)

“Jonathan Levine” <jonathan.canuck.levine@gmail.com>
Wed, 1 Sep 2021 16:17:50 -0600
> Risk: Blithely quoting a company's statistics without questioning them.

Well, the broader problem is the public's uncritical acceptance of just about all numbers thrown at us. The one that had me yelling at the (CBC) radio recently was a local geothermal energy promoter's claim that here in Alberta we could pull 10 terawatts (no puns please, PGN…) out of the ground, a number that demands some explanation if one bothers to correlate it with the world's electricity consumption, presently between 15 and 20 terawatts.


Re: Iceland has reported more cases in the past month than they had in the previous 9 months combined (RISKS-32.85)

Sheldon <sheldon10101@gmail.com>
Wed, 1 Sep 2021 18:41:02 -0400

People don't understand what vaccines do.

Vaccines are tested and approved based upon their preventing disease, not upon their preventing infection. Of all the human vaccines, only the HPV vaccine prevents infection. For example, children get infected with the two serotypes of polio that exist, even if they are vaccinated. That the SARS-COV-2 vaccines prevent infection is a bonus that will decline over time. However, the vaccines are still great at preventing hospitalization and death. That's because the protection of the immune system goes beyond antibodies. For example, people who cannot produce antibodies and are vaccinated have similar levels of protection against hospitalization and death as people with a normal immune system.

A booster shot will likely increase the antibody levels and cut down on the infection rate and the hospitalization rate. But that will only be for a few months until we once again have these SARS-COV-2 vaccines operating as every other human vaccine. A booster is a protection for those who are vaccinated and probably even more so for the idiots who are not.

The only long-term answer is to get every fool vaccinated ASAP.

The above paragraphs are based upon /This Week in Virology/. probably the best technical podcast in the world on viruses and vaccines.


Re: Iceland has reported more cases in the past month than they had in the previous 9 months combined (RISKS-32.85)

“Andrew Douglass” <andr3wdouglass@gmail.com>
Thu, 2 Sep 2021 19:03:43 -0400

Something came up today that surprised me. Perhaps this was worked out in the newsgroup”I can't seem to get into it at the moment.

The digest reported uncritically:

> … 91.2% of their adult population is at least partially vaccinated,
> 86.5% are fully vaccinated Fauci said with 50% vaccinated, we wouldn't see
> surges like those in the past. Whoops!

https://twitter.com/ianmSC/status/1428407830093041664

A certain crowd, if you read the Twitter thread, is taking this to mean that precautions don't work. This is a faulty conclusion for a bunch of reasons.

  1. the two-dose vaccination % in Iceland is about 74%, not 87%
  2. infections and related data should be evaluated per capita;
  3. the United States has three times the per capita infection rate as Iceland;
  4. an increase in infection rate from very very good to very good looks ominous with the Y-access access scaled up;
  5. hospitalization/death post-vax are the crucial numbers. Vaxed people rarely get very sick or die;
  6. If Dr Fauci's “fairly certain” was wrong—and that was pre-Delta explosion—it reflects on Dr Fauci, not the statistically proven effectiveness of vaccines;
  7. The data suggests actually that Iceland let off its restrictions in June at the wrong time.
  8. The RISK: relying on a cherry-picked context-free graph and annotating it cleverly to make a political point.
  9. I'm sure there's more… Public health is complicated.

More: https://www.reuters.com/article/factcheck-iceland-vaccines/fact-check-covid-19-cases-in-iceland-are-not-proof-that-vaccines-are-ineffective-idUSL1N2P918F


Re: Iceland has reported more cases in the past month than they had in the previous 9 months combined (RISKS-32.85)

“Amos Shapir” <amos083@gmail.com>
Sat, 4 Sep 2021 17:20:07 +0300

How to Lie with Statistics, part 2:

Iceland had more infections, but the number of people hospitalized—which is the main cause of potential overwhelming health services—has been less than half than in previous waves, and is already declining fast.

So yes, anti-vaxers, Iceland had hammered the Coronavirus with science. Again.

https://ourworldindata.org/explorers/coronavirus-data-explorer


Re: Toyota suspends use of self-driving vehicle in Olympic Village (CNN)

“Steve Lamont” <spl@tirebiter.org>
Wed, 1 Sep 2021 16:08:59 -0700

It helps to read to the bottom of stories, to wit:

https://www.cnn.com/2021/08/27/cars/toyota-self-driving-vehicle-paralympics-accident/index.html

“Kitazono was crossing a crosswalk in the athlete's village when an e-Palette made a right turn and struck him at a very slow speed, according to a report from Japanese news organization Asahi Shimbun. At the time, the vehicle was under manual control of an operator, who told police they ‘were aware that a person was there but thought (the person) would (realize that a bus was coming) and stop crossing the (street),’ the Asahi reported.”

In other words, this was driver error, not an error by the e-Palette self-driving system.


Re: Lights Flickered in New York City. Why Did the Subways Grind to a Halt? (NYTimes, RISKS-32.85)

Sheldon <sheldon10101@gmail.com>
Wed, 1 Sep 2021 18:23:13 -0400

In my experience, Toronto's subway just stops when there is a power outage. I did a bit of poking around and power is supposed to come from two independent substations so that power can be switched over. There is battery backup, but it isn't for traction. In case of longer term outage at a station, generators can be brought onsite. But again, these generators aren't intended to supply traction power.

The New York subways system operates under different rules and different expectations, running 24 hours a day. And it operates tunnels under water. Not only does the Toronto subway shut down every night but periodically it partly shuts down on a weekend for maintenance or upgrades. The risk here is that because of the opposition to shutting down for maintenance, the maintenance and upgrades take years and years longer than they would elsewhere.


Re: autonomous vehicles

“Matthew Kruk” <mkrukg@gmail.com>
Fri, 3 Sep 2021 23:53:38 -0600

My $.25. It amazes me that we let a tech mongrel like Elon Musk to run free. It's an example of where too much money makes an idiot feel like a god. He is polluting space with his Internet satellites and his autonomous vehicles are dangerous and in some cases killing innocent people.

As a first start, somebody please slap his face and say, “wake up and join reality”.


Biden Administration Establishes Program to Recruit Tech Professionals to Serve in Government (The Hill)

ACM TechNews <technews-editor@acm.org>
Wed, 1 Sep 2021 11:39:18 -0400 (EDT)

Maggie Miller, The Hill, 30 Aug 2021, via ACM TechNews, 1 Sep 2021

The Biden administration has established the U.S. Digital Corps to enlist and train technology professionals to serve in digital positions within the federal government and tackle major challenges like COVID-19 and cybersecurity. The program will launch later this year as a two-year fellowship for 30 initial participants, who could serve at initial host agencies like the General Services Administration (GSA), the Department of Veterans Affairs, and the Consumer Financial Protection Bureau. GSA's Robin Carnahan said, “The Digital Corps fellowship offers technologists just starting out in their career the opportunity to work on some of the most pressing challenges that we face and develop innovative solutions that make government work better for the American people.” https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-2c9x22d57dx074076&


Security, Privacy, and Innovation: Reshaping Law for the AI Era

“Gabe Goldberg” <gabe@gabegold.com>
Fri, 3 Sep 2021 18:15:01 -0400

17/24 Sep 2021 to 1 Oct 2021 (Save the Date)

Security, Privacy, and Innovation: Reshaping Law for the AI Era Virtual Symposium, Fall 2021

Artificial intelligence (AI) is having profound effects on all aspects of our society, the human experience, and national security. AI offers the potential to expand knowledge, increase prosperity, and provide solutions to global challenges. At the same time, public and private actors have harnessed AI to supercharge cyber attacks and disinformation campaigns, weaken social cohesion, and subvert individual rights. And legal frameworks have yet to grapple with serious questions around algorithmic bias and privacy.

In partnership with the National Security Commission on Artificial Intelligence, the Berkman Klein Center, and Just Security, the Reiss Center on Law and Security is convening a virtual symposium of experts to debate critical legal issues around AI. The symposium will explore how the law must adapt to promote innovation while addressing serious questions around the development and use of AI in the United States and globally.

https://mailchi.mp/5ed5636e6c78/4r6psihvze-10296873?e=37de312147

Please report problems with the web pages to the maintainer

x
Top