Former President Donald Trump, who has complained about censorship by social media giants, plans to announce class action lawsuits today against Facebook CEO Mark Zuckerberg and Twitter CEO Jack Dorsey, Axios reported Wednesday. From the report: It's the latest escalation in Trump's yearslong battle with Twitter and Facebook over free speech and censorship. Trump is completely banned from Twitter and is banned from Facebook for another two years. Trump is scheduled to make an announcement at a press conference today at 11 am. Trump's legal effort is supported by the America First Policy Institute, a non-profit focused on perpetuating Trump's policies. The group's president and CEO and board chair, former Trump officials Linda McMahon and Brooke Rollins, will accompany him during the announcement. Class action lawsuits would enable him to sue the two tech CEOs on behalf of a broader group of people that he argues have been censored by biased policies. To date, Trump and other conservative critics have not presented any substantial evidence that either platform is biased against conservatives in its policies or implementation of them.

An anonymous reader quotes a report from Motherboard: The fintech company Greenlight says that its app and debit card for kids is a financial literacy tool that gives parents "superpowers" to set strict controls on their children's spending. Parents can use the app to pay allowances, choose which stores the connected debit cards work at, set spending limits, and receive instant notifications whenever their child makes a purchase. But there's one thing Greenlight makes it very hard for parents to control: What the company does with the mountains of sensitive data it collects about children. Greenlight reserves the right to share that personal information -- including names, birth dates, email addresses, GPS location history, purchase history, and behavioral profiles -- with "ad and marketing vendors," "insurance companies," "collection agencies," and the catch-all category of "other service providers," according to its privacy policy. Greenlight's policy also says that it can use the data it collects to deliver "tailored content" advertisements, a kind of marketing that youth privacy and education advocates say is particularly manipulative and damaging for children.

The Atlanta-based company told Motherboard that, despite what parents must agree to when they sign up for the app, Greenlight doesn't "monetize or sell customer data in any way." In an email, a company spokesperson said Greenlight inserted those permissions into its privacy policy "in case we ever decide to offer merchant-funded offers to parents in the future based on aggregated and anonymous information." The permissions listed in the policy do not just apply to aggregated and anonymous information, however. They appear under sections titled "Personal Information We Collect and How," "How we Use Personal Information," and "How We Share Personal Information." They also do not only apply to parents, because by signing up for the service, parents must sign away the data rights of their children as well.

President Joe Biden will direct the U.S. Federal Trade Commission to draft new rules aimed at stopping manufacturers from limiting consumers' ability to repair products at independent shops or on their own, Bloomberg reported Tuesday, citing a person familiar with the plan. From the report: While the agency will ultimately decide the size and scope of the order, the presidential right-to-repair directive is expected to mention mobile phone manufacturers and Department of Defense contractors as possible areas for regulation. Tech companies including Apple and Microsoft have imposed limits on who can repair broken consumer electronics like game consoles and mobile phones, which consumer advocates say increases repair costs. The order is also expected to benefit farmers, who face expensive repair costs from tractor manufacturers who use proprietary repair tools, software, and diagnostics to prevent third-parties from working on the equipment, according to the person, who requested anonymity to discuss the action ahead of its official announcement.

Anyone deciding to download the free and open-source audio editor Audacity is being warned that the software may now be classified as spyware due to recent updates to its privacy policy. From a report: Audacity has been around for over 21 years and classes as the world's most popular audio editing software. On April 30, the Muse Group acquired Audacity with the promise that the software would "remain forever free and open source." However, as FOSS Post reports, last week the Audacity privacy policy page was updated and introduced a number of personal data collection clauses. The data collected includes OS version and name, user country based on IP address, the CPU being used, data related to Audacity error codes and crash reports, and finally "Data necessary for law enforcement, litigation and authorities' requests (if any)." The personal data collected can be shared with Muse Group employees, auditors, advisors, legal representatives and "similar agents," potential company buyers, and "any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, or (ii) to exercise, establish or defend our legal rights."
UPDATE: Ars Technica's Jim Salter disagrees, pointing out that "neither the privacy policy nor the in-app telemetry in question are actually in effect yet," and that the company now plans to self-host its telemetry sessions rather than using third-party libraries and hosting.

An anonymous reader shares a report: If you receive emails flagged as spam or see a warning that a message might be a phishing attempt, it's a sign that your email provider is scanning your emails. The company may do that just to protect you from danger, but in some situations it can delve into your communications for other purposes, as well. Google announced that it would stop scanning Gmail users' email messages for ad targeting in 2017 -- but that doesn't mean it stopped scanning them altogether. Verizon didn't respond to requests for comments about Yahoo and AOL's current practices, but in 2018 the Wall Street Journal reported that both email providers were scanning emails for advertising. And Microsoft scans its Outlook users' emails for malicious content. Here's what major email providers say about why they currently scan users' messages.

Email providers can scan for spam and malicious links and attachments, often looking for patterns. [...] You may see lots of ads in your email inbox, but that doesn't necessarily mean your email provider is using the content of your messages to target you with marketing messages. For instance, like Google, Microsoft says that it refrains from using your email content for ad targeting. But it does target ads to consumers in Outlook, along with MSN, and other websites and apps. The data to do that come from partnering with third-party providers, plus your browsing activity and search history on Bing and Microsoft Edge, as well as information you've given the company, such as your gender, country, and date of birth.

[...] If you're using an email account provided by your employer, an administrator with qualifying credentials can typically access all your incoming and outgoing emails on that account, as well as any documents you create using your work account or that you receive in your work account. This allows companies to review emails as part of internal investigations and access their materials after an employee leaves the company. [...] Law enforcement can request access to emails, though warrants, court orders, or subpoenas may be required. Email providers may reject requests that don't satisfy applicable laws, and may narrow requests that ask for too much information. They may also object to producing information altogether.

Long-time Slashdot reader BigVig209 shares a Chicago Tribune report "on how suburban police departments in the Chicago area use license plate cameras as a crime-fighting tool." Critics of the cameras note that only a tiny percentage of the billions of plates photographed lead to an arrest, and that the cameras generally haven't been shown to prevent crime. More importantly they say the devices are unregulated, track innocent people and can be misused to invade drivers' privacy. The controversy comes as suburban police departments continue to expand the use of the cameras to combat rising crime. Law enforcement officials say they are taking steps to safeguard the data. But privacy advocates say the state should pass a law to ensure against improper use of a nationwide surveillance system operated by private companies.

Across the Chicago area, one survey by the nonprofit watchdog group Muckrock found 88 cameras used by more than two dozen police agencies. In response to a surge in shootings, after much delay, state police are taking steps to add the cameras to area expressways. In the northwest suburbs, Vernon Hills and Niles are among several departments that have added license plate cameras recently. The city of Chicago has ordered more than 200 cameras for its squad cars. In Indiana, the city of Hammond has taken steps to record nearly every vehicle that comes into town.

Not all police like the devices. In the southwest suburbs, Darien and La Grange had issues in years past with the cameras making false readings, and some officers stopped using them...

Homeowner associations may also tie their cameras into the systems, which is what led to the arrest in Vernon Hills. One of the leading sellers of such cameras, Vigilant Solutions, a part of Chicago-based Motorola Solutions, has collected billions of license plate numbers in its National Vehicle Location Service. The database shares information from thousands of police agencies, and can be used to find cars across the country... Then there is the potential for abuse by police. One investigation found that officers nationwide misused agency databases hundreds of times, to check on ex-girlfriends, romantic rivals, or perceived enemies. To address those concerns, 16 states have passed laws restricting the use of the cameras.
The article cites an EFF survey which found 99.5% of scanned plates weren't under suspicion — "and that police shared their data with an average of 160 other agencies."

"Two big concerns the American Civil Liberties Union has always had about the cameras are that the information can be used to track the movements of the general population, and often is sold by operators to third parties like credit and insurance companies."

"Make America weird again," quipped CNBC, describing Mark Zuckerberg's Instagram post today commemorating America's national Independence Day holiday MarketWatch explains: Yes, that's the Facebook Inc. chief executive wakeboarding while holding an American flag to the tune of John Denver's "Take Me Home, Country Roads."

Because: America.

In fairness, Zuckerberg did have reason to celebrate, as the Federal Trade Commission's antitrust case against Facebook was shot down (at least temporarily) last Monday, and a similar suit by [a coalition of 48] state attorneys general was dismissed outright. Facebook's valuation shot above the $1 trillion mark for the first time following the dismissals, and its shares rose about 4% on the week.
"If the plaintiffs had prevailed in the antitrust lawsuits, Facebook might have been required to divest Instagram and WhatsApp," notes CNBC."

Instead, he's using it to post a picture of himself flying an American flag on a $12,000 electronic surfboard.

"A human rights group that attracted millions of views on YouTube to testimonies from people who say their families have disappeared in China's Xinjiang region is moving its videos to little-known service Odysee after some were taken down by the Google-owned streaming giant, two sources told Reuters."

Long-time Slashdot reader sinij shares their report: Atajurt Kazakh Human Rights' channel has published nearly 11,000 videos on YouTube totaling over 120 million views since 2017, thousands of which feature people speaking to camera about relatives they say have disappeared without a trace in China's Xinjiang region, where UN experts and rights groups estimate over a million people have been detained in recent years. On June 15, the channel was blocked for violating YouTube's guidelines, according to a screenshot seen by Reuters, after twelve of its videos had been reported for breaching its 'cyberbullying and harassment' policy. The channel's administrators had appealed the blocking of all twelve videos between April and June, with some reinstated — but YouTube did not provide an explanation as to why others were kept out of public view, the administrators told Reuters.

Following inquiries from Reuters as to why the channel was removed, YouTube restored it on June 18, explaining that it had received multiple so-called 'strikes' for videos which contained people holding up ID cards to prove they were related to the missing, violating a YouTube policy which prohibits personally identifiable information from appearing in its content... YouTube asked Atajurt to blur the IDs. But Atajurt is hesitant to comply, the channel's administrator said, concerned that doing so would jeopardize the trustworthiness of the videos. Fearing further blocking by YouTube, they decided to back up content to Odysee, a website built on a blockchain protocol called LBRY, designed to give creators more control. About 975 videos have been moved so far.

Even as administrators were moving content, they received another series of automated messages from YouTube stating that the videos in question had been removed from public view, this time because of concerns that they may promote violent criminal organizations... Atajurt representatives fear pro-China groups who deny that human rights abuses exist in Xinjiang are using YouTube's reporting features to remove their content by reporting it en masse, triggering an automatic block. Representatives shared videos on WhatsApp and Telegram with Reuters which they said described how to report Atajurt's YouTube videos.
An activist working with the group told Reuters he's also faced offline challenges — including having his hard disks and cellphones confiscated multiple times in Kazakhstan.

This meant that the only place where they'd stored their entire video collection was YouTube.

"A U.K. high court told Bitcoin.org it can no longer share the 2008 white paper that outlines what bitcoin is on its website," reports Business Insider, "delivering a victory to Craig Wright, a computer scientist who claimed he wrote the original document." Wright won the copyright-infringement case he brought by default, after the website's anonymous founder, known as Cobra, decided not to speak in his defense in the proceedings in London. The ruling on Monday means Bitcoin.org must take the document down from its website. It must also pay Wright £35,000 ($48,600) toward legal costs, as well as put a notice of the court's order on its website for six months, said Ontier, the law firm representing Wright...

"This is an important development in Dr Wright's quest to obtain judicial vindication of his copyright in his white paper," said Simon Cohen, a senior associate at London-based Ontier... The Australian computer scientist claimed to be the original author of the white paper that was published in 2008 and describes what bitcoin is and how it works. Ontier said Wright took Cobra to court in order to prevent supporters of assets such as Bitcoin Core from using the white paper to mis-represent those assets as bitcoin...

"I didn't turn up because I didn't want to expose my identity," Cobra told Insider in a tweet.
Cobra shared more philosophical thoughts on Twitter: All your fiat based assets are ultimately secured by the same legal system that today made it illegal for me to host the Bitcoin whitepaper because a notorious liar swore before a judge that he's Satoshi. A system where 'justice' depends on who's got the bigger wallet. I don't think you could get a better advertisement of *why* Bitcoin is necessary than what happened today. Rules enforced through cryptography are far more superior than rules based on whoever can spend hundreds of thousands of dollars in court.
In later tweets he added: Sucks when you have billionaires determined to bury you in endless frivolous litigation... Normally it's the person who owes money who runs and hides, but I've repeatedly reached out to CSW to pay him his court ordered costs, and he doesn't seem to want to receive it. Perhaps he is running away from his money so he can make me in "contempt of court"?

"Thousands of disabled and elderly people in more than a dozen states have had to fight against decisions made by an algorithm to get the support services they need to remain in their homes instead of being institutionalized," reports the U.S. edition of the Guardian: The cuts have hit low-income seniors and people with disabilities in Pennsylvania, Iowa, New York, Maryland, New Jersey, Arkansas and other states, after algorithms became the arbiters of how their home health care was allocated — replacing judgments that used to be primarily made by nurses and social workers.

In Washington D.C., "on the worst end, we've had clients who actually died, because their services were cut and they were not receiving the care that they needed" Tina Smith Nelson, supervising attorney with AARP Legal Counsel for the Elderly, said about the effects of a new algorithmic system introduced in 2018. Over 300 seniors have had to file administrative appeals after their home care was cut by a new algorithmic system. "I think as a society we move into unsettling territory when we rely solely upon algorithms and data to make determinations about health care needs," Nelson said. "We reduce a person's humanity to a number...."

The situation is reflective of a reality increasingly affecting all users of American healthcare: algorithms — ranging from crude if-then charts to sophisticated artificial intelligence systems — are being deployed to make all sorts of decisions about who gets care. Government officials have touted algorithmic decision-making systems as a way to make sure that benefits are allocated even-handedly, eliminate human bias and root out fraud. But advocates say having computer programs decide how much help vulnerable people can get is often arbitrary — and in some cases downright cruel. The underlying problem, experts say, is that neither states nor the federal government provide enough funding to allow people needing health assistance to remain safely in their homes — even though these programs usually end up being much less costly than putting people in institutions. The algorithms resort to divvying up what crumbs are available...

Kevin De Liban, an attorney with Legal Aid of Arkansas, began fighting the cuts after severely disabled patients started calling "en masse" in 2016.... De Liban's legal team revealed flaws with the algorithm in court. It turned out, De Liban said, that the calculations had failed to factor in things like whether a patient had cerebral palsy or diabetes. A single point in the scoring system — for instance a point added because the patient had had a fever in the last three days or had open pressure sores — could make a huge difference in how many hours they received for the entire year... "As the algorithm worked, it was, to our eyes, pretty wildly irrational," said De Liban...

After years of court battles, Arkansas' use of the algorithmic system was finally thrown out in 2018... But across the nation, the battle continues. In Washington D.C., Pennsylvania and Iowa, legal services attorneys are plagued with calls from seniors complaining they have lost their care because of the algorithms recently adopted in those states.
The Guardian ultimately tracked down the designer of the algorithm, University of Michigan Professor Emeritus Brant Fries, who acknowledged that the system isn't even designed to calculate how many hours of care people actually need, but to try to allocate whatever scarce resources are available in the most equitable way.

"We're not saying that the size of the pie is correct... But whatever the money is there, I'm dividing it more equally!"

U.S. Senate Finance Committee Chairman Ron Wyden said last week "he is revisiting proposed legislation that would crack down on the giant tax-free retirement accounts amassed by the ultrawealthy," reports ProPublica, "after a ProPublica story exposed that billionaires were shielding fortunes inside them."

Earlier ProPublica had reported that PayPal founder Peter Thiel turned his retirement account "into a $5 billion tax-free piggy bank." Wyden said ProPublica's stories have shifted the debate about taxes at the grassroots level, underscoring a "double standard" that would have a nurse in Medford, Oregon, dutifully paying taxes "with every single paycheck" while the wealthiest Americans "just defer, defer, defer paying their taxes almost until perpetuity..."

Wyden's proposal also targeted the stuffing of undervalued assets into Roths, which congressional investigators had flagged as the foundation of many large accounts. Under the Wyden draft bill, purchasing an asset for less than fair market value would strip the tax benefits from the entire IRA. ProPublica's investigation showed that Thiel purchased founder's shares of the company that would become PayPal at $0.001 per share in 1999. At that price, he was able to buy 1.7 million shares and still fall below the $2,000 maximum contribution limit Congress had set at the time for Roth IRAs. PayPal later disclosed in an SEC filing that those shares, and others issued that year, were sold at "below fair value...." Daniel Hemel, a tax law professor at the University of Chicago who has been researching large Roths, said that Congress should simply prohibit IRAs from purchasing assets that are not bought and sold on the public market...

He added that lawmakers should go beyond reforms targeting the accounts directly and address a potential estate tax dodge related to Roths. If the holder of a large Roth dies, the retirement account is considered part of the taxable estate, and a significant tax is due. But, Hemel said, there's nothing to stop an American who has amassed a giant Roth from renouncing their citizenship and moving abroad to a country with no estate taxes. It's rare, but not unheard of, for the ultrawealthy to renounce their U.S. citizenship to avoid taxes. Under federal law, U.S. citizens who renounce their citizenship are taxed that day on assets that have risen in value but are not yet sold. But there's an exception for certain kinds of assets, Hemel said, including Roth retirement accounts.

Thiel acquired citizenship in New Zealand in 2011. Unlike the United States, New Zealand has no estate tax. It's not clear whether estate taxes figured into Thiel's decision... Patching the hole in the expatriation law, Hemel said, "should be a top policy priority because we're talking about, with Thiel alone, billions of dollars of taxes."
Wyden's proposed legislation to regulate Roth IRA accounts was excoriated in at least one 2016 editorial that complained everything in it was "opposed to capitalism and economic freedom."

"A federal judge on Wednesday blocked for the time being a new Florida law that sought to punish large social media businesses like Facebook and Twitter if they remove content or ban politicians," reports the Associated Press: U.S. District Judge Robert Hinkle granted a preliminary injunction stopping the new law from being enforced. The law — which was supposed to take effect on Thursday — enabled the state to fine large social media companies $250,000 a day if they remove an account of a statewide political candidate, and $25,000 a day if they remove an account of someone running for a local office. The legislation was challenged in federal court in Tallahassee by NetChoice, a lobbying firm that represents Twitter, Facebook and other online companies, and the Computer and Communications Industry Association. Both said the new law was unconstitutional and violated federal law.

The plaintiffs were likely to prevail on their claim that the new law violated the First Amendment if the case went to trial, the judge said.

Hinkle said the new law was aimed at only large social media businesses, not smaller ones that provide the same services, and made exceptions for Disney and their apps by including that theme park owners wouldn't be subject to the law.
The judge also argued that the law "compels providers to host speech that violates their standards."

Thelasko shares a report from the BBC: A US police officer played a Taylor Swift song on his phone in a bid to prevent activists who were filming him uploading the video to YouTube. The video platform regularly removes videos that break music copyright rules. However, the officer's efforts were in vain as the clip of the encounter in Oakland, California promptly went viral. Alameda County police told the BBC it was not "approved behavior."

The video was filmed by members of the Anti Police-Terror Project (APTP), which says it is a coalition that seeks to "eradicate police terror in communities of color." Some of them were protesting outside the courthouse at the pre-trial hearing of a San Leandro officer charged with the manslaughter of a black man. In the video, the officer says: "You can record all you want, I just know it can't be posted to YouTube." When asked if playing music in this way is procedure, the officer responds: "It's not specifically outlined." Later in the video, he confirms: "I'm playing music so that you can't post on YouTube." The sheriff's department said: "We have seen the video and referred it to our internal affairs bureau. This is not approved behavior. It will not happen again." Earlier this year, Motherboard reported on cases of other California-based officers starting to play Beatles songs while being filmed so that the clips would be removed for copyright issues when uploaded to social media sites.

Legislators in Norway have passed new regulations requiring influencers and advertisers to label retouched photos in a bid to fight unrealistic beauty standards. Motherboard reports: The new regulations were passed as an amendment to the nation's Marketing Act via a landslide 72 to 15 vote on June 2. The King of Norway will later decide when it will go into effect. Under the recently-passed rules, advertisements where a body's shape, size, or skin has been retouched -- even through a filter before a photo is taken -- will need a standardized label designed by the Norwegian Ministry of Children and Family Affairs. Examples of manipulations requiring labeling include enlarged lips, narrowed waists, and exaggerated muscles, but it's not clear if the same will apply to adjustments of lighting or saturation.

The law also covers images from influencers and celebrities if they "receive any payment or other benefit" in relation to the post, including on social media platforms Facebook, Instagram, Snapchat, TikTok, and Twitter. Any violations are punishable with escalating fines and, in extreme cases, even imprisonment. The move comes amidst continued public debate in Norway surrounding "kroppspress" (literally "body pressure"), which very roughly translates to beauty standards. In its proposal to the Norwegian parliament, the Ministry of Children and Family cites studies that found what it calls "body pressure," or beauty standards, to be pervasive and a contributing factor to low self-esteem in young people. The ministry conceded, however, that the requirement could be difficult to enforce because it's not always easy to determine if a photo has been edited. It also noted that an unintended consequence of the law could be that influencers feel more pressure to undergo cosmetic surgery "in order to live up to beauty ideals."

An anonymous reader quotes a report from Ars Technica: Like most Internet-of-things (IoT) devices these days, Amazon's Echo Dot gives users a way to perform a factory reset so, as the corporate behemoth says, users can "remove any... personal content from the applicable device(s)" before selling or discarding them. But researchers have recently found that the digital bits that remain on these reset devices can be reassembled to retrieve a wealth of sensitive data, including passwords, locations, authentication tokens, and other sensitive data. Most IoT devices, the Echo Dot included, use NAND-based flash memory to store data. Like traditional hard drives, NAND -- which is short for the boolean operator "NOT AND" -- stores bits of data so they can be recalled later, but whereas hard drives write data to magnetic platters, NAND uses silicon chips. NAND is also less stable than hard drives because reading and writing to it produces bit errors that must be corrected using error-correcting code.

Researchers from Northeastern University bought 86 used devices on eBay and at flea markets over a span of 16 months. They first examined the purchased devices to see which ones had been factory reset and which hadn't. Their first surprise: 61 percent of them had not been reset. Without a reset, recovering the previous owners' Wi-Fi passwords, router MAC addresses, Amazon account credentials, and information about connected devices was a relatively easy process. The next surprise came when the researchers disassembled the devices and forensically examined the contents stored in their memory. "An adversary with physical access to such devices (e.g., purchasing a used one) can retrieve sensitive information such as Wi-Fi credentials, the physical location of (previous) owners, and cyber-physical devices (e.g., cameras, door locks)," the researchers wrote in a research paper. "We show that such information, including all previous passwords and tokens, remains on the flash memory, even after a factory reset."

After extracting the flash contents from their six new devices, the researchers used the Autospy forensic tool to search embedded multimedia card images. The researchers analyzed NAND dumps manually. They found the name of the Amazon account owner multiple times, along with the complete contents of the wpa_supplicant.conf file, which stores a list of networks the devices have previously connected to, along with the encryption key they used. Recovered log files also provided lots of personal information. After dumping and analyzing the recovered data, the researchers reassembled the devices. The researchers wrote: "Our assumption was, that the device would not require an additional setup when connected at a different location and Wi-Fi access point with a different MAC address. We confirmed that the device connected successfully, and we were able to issue voice commands to the device. When asked 'Alexa, Who am I?', the device would return the previous owner's name. The re-connection to the spoofed access point did not produce a notice in the Alexa app nor a notification by email. The requests are logged under 'Activity' in the Alexa app, but they can be deleted via voice commands. We were able to control smart home devices, query package delivery dates, create orders, get music lists and use the 'drop-in' feature. If a calendar or contact list was linked to the Amazon account, it was also possible to access it. The exact amount of functionality depends on the features and skills the previous owner had used." Furthermore, the researchers were able to find the rough location of the previous owner's address by asking questions about nearby restaurants, grocery stores, and public libraries. "In a few of the experiments, locations were accurate up to 150 meters," reports Ars.

An Amazon spokeswoman said: "The security of our devices is a top priority. We recommend customers deregister and factory reset their devices before reselling, recycling, or disposing of them. It is not possible to access Amazon account passwords or payment card information because that data is not stored on the device." The threats most likely apply to Fire TV, Fire Tablets, and other Amazon devices, as well as many other NAND-based devices that don't encrypt user data, including the Google Home Mini.

Russian spies accused of interfering in the 2016 U.S. presidential election have spent much of the past two years abusing virtual private networks (VPNs) to target hundreds of organizations worldwide, U.S. and British authorities said on Thursday. Reuters reports: The governments said in a joint advisory that Unit 26165, the arm of Russia's military spy agency whose officers were indicted for allegedly breaking into Democratic Party emails, had been using VPNs and Tor - a privacy-focused network - to conduct "widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets." The advisory did not identify any of the targets by name, saying only that they were mainly in the United States and Europe and included government offices, political parties, energy companies, law firms and media organizations. The National Security Agency (NSA) today also disclosed details of "brute force" methods they say have been used by Russian intelligence to try to break into the cloud services of hundreds of government agencies, energy companies and other organizations.

Earlier this week, law enforcement seized the servers and customer logs for DoubleVPN, a Russian-based VPN service that was reportedly used by cyber criminals to hide their activities while conducting ransomware attacks, phishing campaigns and other malicious hacking operations.

Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by the end of this month. Krebs On Security reports: Intuit says the change is tied to an "exciting" and "free" new service that will let millions of small business employees get easy access to employment and income verification services when they wish to apply for a loan or line of credit. "In early fall 2021, your QuickBooks Online Payroll subscription will include an automated income and employment verification service powered by The Work Number from Equifax," reads the Intuit email, which includes a link to the new Terms of Service. "Your employees may need to verify their income and employment info when applying for things like loans, credit, or public aid. Before, you likely had to manually provide this info to lenders, creditors or government agencies. These verifications will be automated by The Work Number, which helps employees get faster approvals and saves you time." An Intuit spokesperson clarified that the new service is not available through QuickBooks Online or to QuickBooks Online users as a whole. Intuit's FAQ on the changes is here.

"The way I read the terms, Equifax gets to proactively collect all payroll data just in case they need to share it later -- similar to how they already handle credit reporting," said Citrano, who is founder and CEO of Acquicent, a company that issues non-fungible tokens (NFTs). "And that feels like a disaster waiting to happen, especially given Equifax's history." In selling payroll data to Equifax, Intuit will be joining some of the world's largest payroll providers. For example, ADP -- the largest payroll software provider in the United States -- has long shared payroll data with Equifax. But Citrano said this move by Intuit will incorporate a large number of fairly small businesses. "ADP participates in some way already, but QuickBooks Online jumping on the bandwagon means a lot of employees of small to mid-sized businesses are going to be affected," he said. Why might small businesses want to think twice before entrusting Equifax with their payroll data? The answer is the company doesn't have a great track record of protecting that information. In 2017, Equifax had a massive data breach that exposed the personal and financial details of 145.5 million Americans.

If customers do not want this new service, they must update their preferences and opt-out by July 31, 2021. Otherwise, they'll be automatically opted in. You can opt out by signing in to QuickBooks Online Payroll, navigating to Payroll Settings, selecting the pencil and unchecking the box in the Shared data section, and saving your changes.

An anonymous reader quotes a report from PC Gamer: An oversight in accounts used to test Microsoft's payment systems let one engineer swindle his way into over $10 million after selling Xbox Gift Cards for Bitcoin over two years, a new report from Bloomberg revealed this week. In order to make sure its payment systems work, Microsoft employs engineers to "simulate" purchases on its stores. But soon after joining the company in 2017, Volodymyr Kvashuk discovered that there was a flaw in the accounts used to test purchases. See, these simulated accounts are usually flagged as such by the system, and won't send you physical goods if you tried to buy, say, a new gamepad from its site. But if you tested a purchase of Xbox Gift Cards, you'd still receive a completely valid 25-digit code. Kvashuk could've easily reported this to his bosses. But with unlimited free codes at his fingertips, he chose a different option instead.

At first, Kvashuk generated himself a handful of codes -- a cheeky $5 or $10 here or there. But there was the opportunity to make massive, life-changing sums of money off this exploit. He began cycling through mock profiles belonging to his colleagues to hide his tracks, automating the process with a bespoke piece of software prosecutors would later describe as "created for one purpose, and one purpose only: to automate embezzlement and allow fraud and theft on a massive scale." After acquiring these codes, Kvashuk would head to crypto marketplaces like Paxful to find prospective sellers. He'd sell them in bulk at a relative discount, which buyers would then go on to sell to folks who wanted to use the codes. Money laundering sites like ChipMixer would let him hide his trail, and the proceeds went towards facilitating an increasingly lavish lifestyle. [...] Microsoft was eventually clued in to Kvashuk's antics after noticing a sharp spike in gift card transactions, with federal agents eventually raiding his home in July 2019. In court, Kvashuk tried to argue that the mass theft was simply an experiment to increase store spending. Obviously, it didn't fly. Kvashuk was sentenced to 9 years in prison, likely deported back to his home country of Ukraine, and will be charged restitution of $8.3 million.

Robinhood, the stock trading app that was subject to a record fine Wednesday, announced it intends to go public Thursday. From a report: In its filing documents, the company admits that many of its customers are furious about how it handled January's GameStop stock bonanza and that it is currently subject of at least 49 class action lawsuits related to trading restrictions it placed on the stock in January. The company also said it is under investigation by a series of regulators, state attorneys general, the SEC, and the U.S. Department of Justice in proceedings associated with the trading restrictions; the company said its CEO Vladimir Tenev has also had his cell phone seized by federal attorneys.

In January, Robinhood restricted the purchase of GameStop, AMC, and other "meme" stocks because the app literally did not have enough money to comply with regulations that require a certain amount of liquidity from companies that allow for stock trading. This restriction correlated with a days-long dive in the stock prices of GameStop, which skyrocketed in January and February and led to widespread calls from lawmakers, traders, and Redditors on the WallStreetBets subreddit to investigate Robinhood. Those investigations are ongoing, according to Robinhood's S-1 filing with the SEC. In its filing, Robinhood states that the fallout from these restrictions still have the potential to be disastrous for the company. âoeWe have become aware of approximately 50 putative class actions ... relating to the Early 2021 Trading Restrictions."

Primary care company One Medical has apologized after it sent out an email that exposed hundreds of customers' email addresses. From a report: The email sent out by One Medical on Wednesday asked to "verify your email," but one email seen by TechCrunch had more than 980 email addresses copied on the email. The cause: One Medical did not use the blind carbon copy (bcc:) field to mass email its customers, which would have hidden their email addresses from each other. Several customers took to Twitter to complain, but also express sympathy for what was quickly chalked up to an obvious mistake. Some users reported varying numbers of email addresses on the email that they received.