Imposters Around Virtually Every Corner
Technology presents a double-edged sword where personal identity is concerned.
On the one hand, we have a plethora of authentication tools to help us determine if someone is who they say they are. On the other, clever crooks have gotten really good at using digital technology and social engineering to fool even the most advanced identify verification, not to mention human senses. Today, what we see with our own eyes and hear with our own ears often can't be trusted.
The proliferation of biometric-gathering surveillance technology is partly to blame. Our faces, irises, voices, fingerprints -- even the unique patterns made by the veins in our palms -- are collected, stored and shared digitally. This puts them at an increased risk of being intercepted by criminals looking to impersonate us for any number of nefarious reasons.
Add to that the long-standing problems with passwords.
Read on to discover a few of the more concerning issues related to overreaching personal data collection, the explosion of surveillance technologies and scams related to digital disguises.
|
|
Data Security & Privacy Beacons
|
People and places making a difference**
Have you seen an organization or individual taking actions to improve privacy? Send me a note to nominate a privacy beacon of your own!
Sen. Edward J. Markey
(D-Mass.) is asking some tough questions of doorbell-camera firm Ring. He is rightly concerned about the company's hundreds of video-sharing partnerships with U.S. police agencies. Citing " serious privacy and civil liberties concerns," the senator said he believes people are potentially at risk and wants to learn more. It's g
ood to see these types of tech companies put on the hot seat by legislators. Hopefully they will provide honest and straightforward answers, and Sen. Markey and other lawmakers will push back if they don't. See my comments on the risks of Ring to the Wall Street Journal.
The Portland, Oregon, City Council
is having meaningful discussions about the risks of facial technology use in their city. Council members are even considering a ban on such technology. It's good to see elected officials considering the privacy risks of technology and associated practices
before
something bad actually happens. Perhaps this will motivate law enforcement to sort through and mitigate all privacy risks and be able to answer all privacy questions, before launching such programs.
Alastair Mactaggart, the founder and board chair of Californians for Consumer Privacy wants to amend the not yet enforced California Consumer Privacy Act (CCPA) through a ballot initiatives in 2020. Whether or not you agree with his initiative, he certainly is dedicated to promoting and protecting people's privacy.
Lawmakers in Montana have passed legislation that "aims to protect student data from educational software companies that may collect information, including the names of students and their dates of birth, educational records, disciplinary records, test results, special education data, Social Security numbers and addresses and even criminal and medical records." Will other states start enacting similar laws to protect student privacy? We'll let you know.
**P
rivacy beacon shout-outs do not necessarily indicate an organization or person is addressing every privacy protection perfectly throughout their organization (no one is). It simply highlights a noteworthy example that is, in most cases, worth emulating.
|
|
Artificial Intelligence Mimics CEO's Voice
|
|
Cybercrooks can impersonate executives to force financial transfers
Imagine the surprise when a European executive discovered it had not actually been his boss on the phone asking for that wire transfer of 222,000 euros. In fact, it was a cybercriminal who had used
artificial intelligence (AI) to mimic the CEO's voice to order the transfer.
The executive who took the voice-spoofing call said he recognized attributes of his boss's voice, including his slight accent, when he took the phone call.
Voice-spoofing attacks are just one of several AI-enabled cybercrimes expected to increase in the coming months and years. As the technology becomes more accessible, it takes fewer resources to deploy, opening the door for all kinds of crooks to pull off high-tech masquerades.
With digital impersonation on the rise, it's more important than ever to have good controls in place. Written policies and procedures, on which employees are frequently trained, sent reminders and held accountable, are crucial for maintaining a cyber safe environment.
|
|
 |
Homeland Security requesting five years worth of social usernames
Anyone coming to the U.S. will now have to share their social media usernames from the past five years. The Department of Homeland Security (DHS) says the agency will use the information to help determine if people can enter the country or receive immigration-related benefits.
The initial list of social media platforms featured on the updated DHS forms will include Facebook, Flickr, Instagram, LinkedIn, Myspace, Reddit, Tumbler, Twitter and YouTube.
Over-reaching? Absolutely. Effective? Not likely. Plus, how many people will forget they even signed up for some of these sites then simply stopped using them? That could lead to other problems for them if the DHS finds old, unused accounts the person didn't list.
Ethical, appropriate, privacy-aware use of this personal data will depend on a large number of factors, not the least of which is how many people share their actual usernames. It doesn't take an experienced terrorism or social justice expert to anticipate the use of fabricated or borrowed usernames. H
ow many people will use the accounts of others to throw off an investigation into their identity or association with others?
And, how will DHS protect, share and use the data it's collecting around social media usernames? For instance, will the agency analyze posts made by the applicant alone, or will they also be looking into posts of the applicant's connections? As we learned in the Cambridge Analytica / Facebook scandal, inappropriate use of data often extends beyond the primary target.
|
|
Cybercrooks mess up heating, play rude songs
A Wisconsin couple's Nest smart home system was the recent target of an attack. After discovering a pathway into the home network, the hackers turned the thermostat up to 90 degrees Farenheit.
What's more, the crooks found a way to communicate with the homeowners through the Nest camera, first speaking and then playing what's being described as "rude songs."
Unplugging the camera and resetting the passwords was not enough to stop the invasion, according to the homeowners.
It's likely the hackers gained access to the entire home network, exposing potentially thousands of personal data files, live video / audio feeds and who knows what other kind of information on each of their connected devices.
Keep incidents like this in mind as you shop for smart devices this upcoming holiday season. That dream gift you give may turn into a nightmare.
WHAT ABOUT SMART TVS? Researchers discovered several smart TVs that are leaking private user information to Google, Facebook, Netflix and potentially others. Of the 34,586 controlled experiments the researchers ran, they found 71 out of 81 devices send information to destinations other than the device manufacturer. Read more.
WHO ELSE IS LISTENING? Smart devices are getting a lot of negative attention for listening in and recording our conversations, which is disguising some other well-know brands that have been doing the same for years. It was recently revealed that Skype contractors working for Microsoft have been listening to personal, sometimes very intimate, conversations. Read more.
WHAT CAN WE DO? Smart-home data security and privacy is just one of the many areas we hope to impact with the roll out of the NIST Privacy Framework... which I'm so excited to announce is steps away from completion. The team, of which I'm proud to be a part, has just released the preliminary framework, created and revised after gathering 45-days worth of feedback. Have a look and let us know what you think!
|
|
|
What You Post Online Will Come Back to Haunt You
|
Valuable lesson about the indelible existence of social posts
| | | |
