Lawmakers argue Android phone data could be “weaponized against women” if the US Supreme Court officially overturns abortion protections.

More than 40 Democratic members of Congress called on Google to stop collecting and retaining customer location data that prosecutors could use to identify women who obtain abortions.

“We are concerned that, in a world in which abortion could be made illegal, Google’s current practice of collecting and retaining extensive records of cell phone location data will allow it to become a tool for far-right extremists looking to crack down on people seeking reproductive health care. That’s because Google stores historical location information about hundreds of millions of smartphone users, which it routinely shares with government agencies,” Democrats wrote May 24 in a letter led by Senator Ron Wyden (D-Ore.) and Rep. Anna Eshoo (D-Calif.). The letter was sent to Google CEO Sundar Pichai.

Specifically, Google should stop collecting “unnecessary customer location data” or “any non-aggregate location data about individual customers, whether in identifiable or anonymized form. Google cannot allow its online advertising-focused digital infrastructure to be weaponized against women,” lawmakers wrote. They also told Google that people who use iPhones “have greater privacy from government surveillance of their movements than the tens of millions of Americans using Android devices.”

The draft Supreme Court ruling overturning _Roe v. Wade_ could be followed by strict limits or bans on abortion in many states, and Democrats wrote that “Republicans in Congress are already discussing passing a law criminalizing abortion in all 50 states, putting the government in control of women’s bodies.”

Location Data From Android Phones

In their letter, Democrats told Pichai:

_While Google deserves credit for being one of the first companies in America to insist on a warrant before disclosing location data to law enforcement, that is not enough. If abortion is made illegal by the far-right Supreme Court and Republican lawmakers, it is inevitable that right-wing prosecutors will obtain legal warrants to hunt down, prosecute, and jail women for obtaining critical reproductive health care. The only way to protect your customers’ location data from such outrageous government surveillance is to not keep it in the first place._

Google obtains detailed information “from Android smartphones, which collect and transmit location information to Google, regardless of whether the phone is being used or which app a user has open,” they wrote. While Android users have to opt into this data collection, “Google has designed its Android operating system so that consumers can only enable third party apps to access location data if they also allow Google to receive their location data too. In contrast, Google is only able to collect location data from users of iPhones when they are using the Google Maps app,” the lawmakers wrote.

We contacted Google about the letter yesterday and will update this article if we get a response.

Exactly how Google’s location privacy settings work has been a matter of confusion, even for some Google employees. As we wrote in August 2020, documents from a consumer fraud suit the state of Arizona filed against Google “show that company employees knew and discussed among themselves that the company’s location privacy settings were confusing and potentially misleading.”

Democrats Say iPhone Users Have More Privacy

Because many of the cheaper smartphones use Android, the lawmakers warned of a “digital divide” affecting the privacy of people with low incomes:

_No law requires Google to collect and keep records of its customers’ every movement. Apple has shown that it is not necessary for smartphone companies to retain invasive tracking databases of their customers’ locations. Google’s intentional choice to do so is creating a new digital divide, in which privacy and security are made a luxury. Americans who can afford an iPhone have greater privacy from government surveillance of their movements than the tens of millions of Americans using Android devices._

While Google uses location data to target online ads, the company often turns over the data to law enforcement officials who obtain court orders, the Democrats wrote. “This includes dragnet ‘geofence’ orders demanding data about everyone who was near a particular location at a given time,” they wrote, adding that “Google received 11,554 geofence warrants in 2020.”

iPhones also use location services, though the lawmakers seem to be satisfied with Apple’s privacy promises. Among other things, Apple says that if location services are turned on, geo-tagged locations of nearby Wi-Fi hotspots and cell towers are sent “in an anonymous and encrypted form to Apple” to augment a “crowd-sourced database of Wi-Fi hotspot and cell tower locations.”

With the Find My feature that can locate lost devices, Apple says it “retains location information and makes it accessible to you for 24 hours, after which it is deleted” and that “device location services information is stored on each individual device and Apple cannot retrieve this information from any specific device.”

Post-_Roe_ State Abortion Laws

Assuming the Supreme Court overturns _Roe v. Wade_, there could be more state laws like the recently enacted Texas Heartbeat Act that bans abortions after it’s possible to detect a “fetal heartbeat.” The law defines that as “cardiac activity or the steady and repetitive rhythmic contraction of the fetal heart within the gestational sac.” This effectively bans abortions after six weeks, and the state law lets private citizens file lawsuits to obtain injunctions and damages of at least $10,000 per abortion.

These lawsuits could be filed against anyone who “performs or induces an abortion” that violates the Texas Heartbeat Act or anyone who “knowingly engages in conduct that aids or abets” an abortion after a fetal heartbeat is detected. Aiding or abetting includes “paying for or reimbursing the costs of an abortion through insurance or otherwise, if the abortion is performed or induced in violation of this subchapter.” Civil suits can also be filed against anyone who “intends to engage in the conduct” described in the law.

The Texas law doesn’t allow the exact scenario Democrats warned of in their letter, that prosecutors could jail women who obtain abortions. But states would have more leeway to enact stricter anti-abortion laws or bans after lifting _Roe v. Wade_.

The Guttmacher Institute, a pro-choice research group, says that “26 states are certain or likely to ban abortion without _Roe_.” Many of these states have laws that were enacted before the 1973 _Roe v. Wade_ decision and never removed, laws that were enacted after _Roe_ but currently blocked by court order, or “trigger” bans that would “take effect automatically or by quick state action if _Roe_ no longer applies.”

_This story originally appeared on_ _Ars Technica__._

Google Urged to Stop Tracking Location Data Ahead of Roe Reversal

The Chinese government recently began saber-rattling about American cyberespionage. The catch? It’s all old news.

For the best part of a decade, US officials and cybersecurity companies have been naming and shaming hackers they believe work for the Chinese government. These hackers have stolen terabytes of data from pharmaceutical companies to video game firms, compromised servers, stripped security protections, and highjacked hacking tools, according to security experts. And as China’s alleged hacking has grown in aggression, individual Chinese hackers face indictments. However, things may be changing.

Since the start of 2022, there has been a marked uptick in China’s Foreign Ministry and the country’s cybersecurity firms calling out alleged US cyberespionage. Until now, these allegations have been a rarity. But the disclosures come with a catch: They appear to rely on years-old technical details, which are already publicly known and don’t contain fresh information. The move may be a strategic change for China as the nation tussles to cement its position as a tech superpower.

“These are useful materials for China’s tit-for-tat propaganda campaigns when they faced US accusation and indictment of China’s cyberespionage activities,” says Che Chang, a cyber threat analyst at Taiwan-based cybersecurity firm TeamT5.

China’s accusations, which were noted by security journalist Catalin Cimpanu, all follow a very similar pattern. On February 23, Chinese security company Pangu Lab published allegations that the US National Security Agency’s elite Equation Group hackers used a backdoor, dubbed Bvp47, to monitor 45 countries. The _Global Times_, a tabloid newspaper that’s part of China’s state-controlled media, ran an exclusive report on the research. Weeks later, on March 14, the newspaper had a second exclusive story about another NSA tool, NOPEN, based on details from China’s National Computer Virus Emergency Response Center. A week later, Chinese cybersecurity firm Qihoo 360 alleged that US hackers had been attacking Chinese companies and organizations. And on April 19, the Global Times reported on further National Computer Virus Emergency Response Center findings around HIVE, malware developed by the CIA.

The reports are accompanied with a flurry of statements—often in response to questions from the media—by China’s Foreign Ministry spokespeople. “China is gravely concerned over the irresponsible malicious cyber activities of the US government,” Foreign Ministry spokesperson Wang Wenbin said in April after one of the announcements. “We urge the US side to explain itself and immediately stop such malicious activities.” Over the first nine days of May, Foreign Ministry spokespeople commented on US cyber activities at least three times. “One cannot whitewash himself by smearing others,” Zhao Lijian said in one instance.

While cyber activity undertaken by state actors is often wrapped in highly classified files, many hacking tools developed by the US are no longer a secret. In 2017, WikiLeaks published 9,000 documents in the Vault7 leaks, which detailed many of the CIA’s tools. A year earlier, the mysterious Shadow Brokers hacking group stole data from one of the NSA’s elite hacking teams and slowly dripped the data to the world. The Shadow Brokers leaks included dozens of exploits and new zero-days—including the Eternal Blue hacking tool, which has since been used repeatedly in some of the largest cyberattacks. Many of the details in the Shadow Brokers leaks match up with details about NSA which were disclosed by Edward Snowden in 2013. (An NSA spokesperson said it has “no comment” for this story; the agency routinely does not comment on its activity.)

Ben Read, director of cyberespionage analysis at US cybersecurity firm Mandiant, says China’s state media push of alleged US hacking seems to be consistent, but it mostly contains older information. “Everything that I've seen they've written about, they tie back to the US through either the Snowden leaks or Shadow Brokers,” Read says.

Pangu Lab’s February report on Bvp47—the only publication on its website—says it initially discovered the details in 2013 but pieced them together after the Shadow Brokers leaks in 2017. “The report was based on a decade-old malware, and the decryption key is the same” as in WikiLeaks, Che says. The details of HIVE and NOPEN have also been available for years. Neither Pangu Labs or Qihoo 360, which has been on the US government sanctions list since 2020, responded to requests for comment on their research or methodology. Although a Pangu spokesperson previously said it recently published the old details, and it had taken a long time to analyze the data.

Megha Pardhi, a China researcher at Takshashila Institution, an Indian think tank, says the publications and follow-up comments from officials can serve multiple purposes. Internally, China can use it for propaganda and to send a message to the US that it has the capability to attribute cyber activity. But beyond this, there is a warning to other countries, Pardhi says. “The message is that even though you're allied with the United States, they're still gonna come after you.”

“We oppose and crack down in accordance with law all forms of cyberespionage and attacks,” Liu Pengyu, a spokesperson for the Chinese Embassy in the US, says in a statement. Liu did not respond directly to questions around the apparent uptick in finger-pointing at the US this year, the evidence that was being used to do so, or why this may be happening years after details originally emerged. China is widely considered to be one of the most sophisticated and active state cyber actors—involved in spying, hacking for espionage, and gathering data. Western officials consider the country to be the biggest cyber threat, ahead of Russia, Iran, and North Korea.

“Recently, there have been many reports of US carrying cyber theft and attacks on China and the whole world,” Liu says in a statement that reflects comments made by China’s Foreign Ministry spokespeople this year. “The US should reflect on itself and join others to jointly safeguard peace and security in cyberspace with a responsible attitude.”

Many of the disclosures in 2022—there are only a handful of previous Chinese accusations against the US—stem from private cybersecurity companies. This is similar to how Western cybersecurity companies report their findings; they are not always incorporated into government talking points, however, and state-backed media is all but nonexistent.

The potential shift in tactics could play into wider policies around technology use and development. In recent years, China’s policies have focused on positioning itself as a dominant force in technology standards in everything from 5G to quantum computers. A raft of new cybersecurity and privacy laws have detailed how companies should handle data and protect national information—including the potential for hoarding previously unknown vulnerabilities.

“One explanation is, possibly, that we are engaged in a kind of ideological—or if you want to put it more prosaically, a marketing—battle with China,” says Suzanne Spaulding, a senior adviser at the Center for Strategic and International Studies and previously a senior cybersecurity official in the Obama administration. The US-China relationship has been fraught in recent years, with tensions rising over national security issues including concerns of telecom giant Huawei. “China is offering, around the world, a competing model to Western-style democracy,” Spaulding says, noting that China may be responding to Western countries coming together on multiple issues since Russia invaded Ukraine.

In July 2021, China’s Ministry of Industry and Information Technology published plans to boost the private security industry by 2023. Companies based in China should spend more on their defenses against cyberattacks, the government department said at the time. It also said the whole cybersecurity industry within China should look to grow in size in the coming years, as well as bolster the development of network monitoring systems and threat detection techniques. “What we've started to see over the last couple of years, increasingly, is that companies in China are building their own capabilities,” says Adam Meyers, vice president of intelligence at US cybersecurity firm CrowdStrike. “There's been a few that have waded into the threat intelligence space.”

But publicizing details of the long-known incidents still raises plenty of questions. Mandiant’s Read says he wonders exactly how many cyberespionage cases Chinese companies and authorities are finding. The answer would provide significant clues about their true capabilities. Read says: “Is this 50 percent of what they're finding? Is this 1 percent of what they're finding? Is this 90 percent of what they're finding?”

The move appears to be strategic, says TeamT5’s Che. “Considering the close relationship between China's cybersecurity firms and the Chinese government, our team surmises that these reports could be a part of China’s strategic distraction when they are accused of massive surveillance systems and espionage operations.”

The Mystery of China’s Sudden Warnings About US Hackers

For the best part of a decade, US officials and cybersecurity companies have been naming and shaming hackers they believe work for the Chinese government. These hackers have stolen terabytes of data from companies like pharmaceutical and video game firms, compromised servers, stripped security protections, and highjacked hacking tools, according to security experts. And as China’s alleged hacking has grown more brazen, individual Chinese hackers face indictments. However, things may be changing.

Since the start of 2022, China’s Foreign Ministry and the country’s cybersecurity firms have increasingly been calling out alleged US cyberespionage. Until now, these allegations have been a rarity. But the disclosures come with a catch: They appear to rely on years-old technical details, which are already publicly known and don’t contain fresh information. The move may be a strategic change for China as the nation tussles to cement its position as a tech superpower.

“These are useful materials for China’s tit-for-tat propaganda campaigns when they faced US accusation and indictment of China’s cyberespionage activities,” says Che Chang, a cyber threat analyst at the Taiwan-based cybersecurity firm TeamT5.

China’s accusations, which were noted by security journalist Catalin Cimpanu, all follow a very similar pattern. On February 23, Chinese security company Pangu Lab published allegations that the US National Security Agency’s elite Equation Group hackers used a backdoor, dubbed Bvp47, to monitor 45 countries. The _Global Times_, a tabloid newspaper that’s part of China’s state-controlled media, ran an exclusive report on the research. Weeks later, on March 14, the newspaper had a second exclusive story about another NSA tool, NOPEN, based on details from China’s National Computer Virus Emergency Response Center. A week later, Chinese cybersecurity firm Qihoo 360 alleged that US hackers had been attacking Chinese companies and organizations. And on April 19, the _Global Times_ reported on further National Computer Virus Emergency Response Center findings about HIVE, malware developed by the CIA.

The reports are accompanied with a flurry of statements—often in response to questions from the media—by China’s Foreign Ministry spokespeople. “China is gravely concerned over the irresponsible malicious cyber activities of the US government,” Foreign Ministry spokesperson Wang Wenbin said in April after one of the announcements. “We urge the US side to explain itself and immediately stop such malicious activities.” Over the first nine days of May, Foreign Ministry spokespeople commented on US cyber activities at least three times. “One cannot whitewash himself by smearing others,” Zhao Lijian said in one instance.

While cyber activity undertaken by state actors is often wrapped in highly classified files, many hacking tools developed by the US are no longer secret. In 2017, WikiLeaks published 9,000 documents in the Vault7 leaks, which detailed many of the CIA’s tools. A year earlier, the mysterious Shadow Brokers hacking group stole data from one of the NSA’s elite hacking teams and slowly dripped the data to the world. The Shadow Brokers leaks included dozens of exploits and new zero-days—including the Eternal Blue hacking tool, which has since been used repeatedly in some of the largest cyberattacks. Many of the details in the Shadow Brokers leaks match up with details about NSA which were disclosed by Edward Snowden in 2013. (An NSA spokesperson said it has “no comment” for this story; the agency routinely does not comment on its activities.)

Ben Read, director of cyberespionage analysis at the US cybersecurity firm Mandiant, says China’s state media push of alleged US hacking seems to be consistent, but it mostly contains older information. “Everything that I've seen they've written about, they tie back to the US through either the Snowden leaks or Shadow Brokers,” Read says.

Pangu Lab’s February report on Bvp47—the only publication on its website—says it initially discovered the details in 2013 but pieced them together after the Shadow Brokers leaks in 2017. “The report was based on a decade-old malware, and the decryption key is the same” as in WikiLeaks, Che says. The details of HIVE and NOPEN have also been available for years. Neither Pangu Labs or Qihoo 360, which has been on the US government sanctions list since 2020, responded to requests for comment on their research or methodology. A Pangu spokesperson previously said it recently published the old details, and it had taken a long time to analyze the data.

Megha Pardhi, a China researcher at Takshashila Institution, an Indian think tank, says the publications and follow-up comments from officials can serve multiple purposes. Internally, China can use it for propaganda and to send a message to the US that it has the capability to attribute cyber activity. But beyond this, there is a warning to other countries, Pardhi says. “The message is that even though you're allied with the United States, they're still gonna come after you.”

“We oppose and crack down in accordance with law all forms of cyberespionage and attacks,” Liu Pengyu, a spokesperson for the Chinese Embassy in the US, says in a statement. Liu did not respond directly to questions around the apparent uptick in finger-pointing at the US this year, the evidence that was being used to do so, or why this may be happening years after details originally emerged. China is widely considered to be one of the most sophisticated and active state cyber actors—involved in spying, hacking for espionage, and gathering data. Western officials consider the country to be the biggest cyber threat, ahead of Russia, Iran, and North Korea.

“Recently, there have been many reports of US carrying cybertheft and attacks on China and the whole world,” Liu says in a statement that reflects comments made by China’s Foreign Ministry spokespeople this year. “The US should reflect on itself and join others to jointly safeguard peace and security in cyberspace with a responsible attitude.”

Many of the disclosures in 2022—there are only a handful of previous Chinese accusations against the US—stem from private cybersecurity companies. This is similar to how Western cybersecurity companies report their findings; they are not always incorporated into government talking points, however, and state-backed media is all but nonexistent.

The potential shift in tactics could play into wider policies around technology use and development. In recent years, China’s policies have focused on positioning itself as a dominant force in technology standards in everything from 5G to quantum computers. A raft of new cybersecurity and privacy laws have detailed how companies should handle data and protect national information—including the potential for hoarding previously unknown vulnerabilities.

“One explanation is, possibly, that we are engaged in a kind of ideological—or if you want to put it more prosaically, a marketing—battle with China,” says Suzanne Spaulding, a senior adviser at the Center for Strategic and International Studies and previously a senior cybersecurity official in the Obama administration. The US-China relationship has been fraught in recent years, with tensions rising over national security issues, including concerns about the telecom giant Huawei. “China is offering, around the world, a competing model to Western-style democracy,” Spaulding says, noting that China may be responding to Western countries coming together on multiple issues since Russia invaded Ukraine.

In July 2021, China’s Ministry of Industry and Information Technology published plans to boost the private security industry by 2023. Companies based in China should spend more on their defenses against cyberattacks, the government department said at the time. It also said the whole cybersecurity industry within China should look to grow in size in the coming years, as well as bolster the development of network monitoring systems and threat detection techniques. “What we've started to see over the last couple of years, increasingly, is that companies in China are building their own capabilities,” says Adam Meyers, head of intelligence at the US cybersecurity firm CrowdStrike. “There's been a few that have waded into the threat intelligence space.”

But publicizing details of the long-known incidents still raises plenty of questions. Mandiant’s Read says he wonders exactly how many cyberespionage cases Chinese companies and authorities are finding. The answer would provide significant clues about their true capabilities. Read says: “Is this 50 percent of what they're finding? Is this 1 percent of what they're finding? Is this 90 percent of what they're finding?”

The move appears to be strategic, says TeamT5’s Che. “Considering the close relationship between China's cybersecurity firms and the Chinese government, our team surmises that these reports could be a part of China’s strategic distraction when they are accused of massive surveillance systems and espionage operations.”

During the protests in Hong Kong, young people carried laser pointers, umbrellas, and plastic ties—objects that sometimes led to their arrest, and years of legal limbo.

‘How Are They Weapons? That’s Only a Flashlight!’

Researchers found a litany of security flaws that allow simple, quick, and cheap forgeries in Australia.

In late 2019, the government of New South Wales in Australia rolled out digital driver’s licenses. The new licenses allowed people to use their iPhone or Android device to show proof of identity and age during roadside police checks or at bars, stores, hotels, and other venues. ServiceNSW, as the government body is usually referred to, promised it would “provide additional levels of security and protection against identity fraud, compared to the plastic driver's license” citizens had used for decades.

Now, 30 months later, security researchers have shown that it’s trivial for just about anyone to forge fake identities using the digital driver's licenses, or DDLs. The technique allows people under drinking age to change their date of birth and for fraudsters to forge fake identities. The process takes well under an hour, doesn’t require any special hardware or expensive software, and will generate fake IDs that pass inspection by the electronic verification system used by police and participating venues. All of this, despite assurances that security was a key priority for the newly created DDL system.

“To be clear, we do believe that if the Digital Driver's Licence was improved by implementing a more secure design, then the above statement made on behalf of ServiceNSW would indeed be true, and we would agree that the Digital Driver's Licence would provide additional levels of security against fraud compared to the plastic driver's licence,” Noah Farmer, the researcher who identified the flaws, wrote in a post published last week.

A Better Mousetrap Hacked With Minimal Effort

“When an unsuspecting victim scans the fraudster’s QR code, everything will check out, and the victim won't know that the fraudster has combined their own identification photo with someone’s stolen driver's licence details,” he continued. As things have stood for the past 30 months, however, DDLs make it “possible for malicious users to generate \[a\] fraudulent Digital Driver's Licence with minimal effort on both jailbroken and non-jailbroken devices without the need to modify or repackage the mobile application itself.”

DDLs require an iOS or Android app that displays each person’s credentials. The same app allows police and venues to verify that the credentials are authentic. Features designed to confirm the ID is authentic and current include:

*   Animated NSW Government logo.
*   Display of the last refreshed date and time.
*   A QR code expires and reloads.
*   A hologram that moves when the phone is tilted.
*   A watermark that matches the license photo.
*   Address details that don’t require scrolling.

Simple Technique

The technique for overcoming these safeguards is surprisingly simple. The key is the ability to brute-force the PIN that encrypts the data. Since it’s only four digits long, there are only 10,000 possible combinations. Using publicly available scripts and a commodity computer, someone can learn the correct combination in a matter of a few minutes, as demonstrated in this video showing the process on an iPhone.

Once a fraudster gets access to someone’s encrypted DDL license data—either with permission, by stealing a copy stored in an iPhone backup, or through remote compromise—the brute force gives them the ability to read and modify any of the data stored on the file.

From there, it's a matter of using simple brute-force software and standard smartphone and computer functions to extract the file storing the credential, decrypting it, changing the text, re-encrypting it, and copying it back to the device. The precise steps on an iPhone are:

*   Use iTunes backup to copy the contents of the iPhone storing the credential the fraudster wants to modify
*   Extract the encrypted file from the backup stored on the computer
*   Use brute-force software to decrypt the file
*   Open the file in a text editor and modify the birth date, address, or other data they want to fake
*   Re-encrypt the file
*   Copy the re-encrypted file to the backup folder and
*   Restore the backup to the iPhone

With that, the ServiceNSW app will display the fake ID and present it as genuine.

The following video shows the entire process from start to finish.

Death by 1,000 Flaws

A variety of design flaws make this simple hack possible.

The first is a lack of adequate encryption. A key based on a four-digit PIN is woefully inadequate. Apple provides a function named SecRandomCopyBytes for producing random bytes that can be used to generate secure keys. “If this was used to encrypt the Digital Driver's Licence rather than the 4 digit PIN, it would make the task of brute-forcing much harder if not completely infeasible for attackers,” Farmer wrote.

The next major flaw is that, astonishingly, DDL data is never validated against the back-end database to make sure that what’s stored on the iPhone matches records maintained by the government department. With no means to natively validate the data, there’s no way to tell when information has been tampered with. As a result, attackers are able to display the falsified data on the Service NSW application without any means to prevent or detect the fraud.

The third shortcoming is that using the “pull-to-refresh” function—a cornerstone of the DDL verification scheme intended to ensure the most current information is showing—fails to refresh any of the data stored in the electronic credential. Instead, it updates only the QR code. A better response would be for the pull-to-refresh function to download the latest copy of the DDL from the ServiceNSW database.

Fourth, the QR code transmits only the DDL holder’s name and status as either over or under the age of 18. The QR code is supposed to allow the person checking the ID to scan it with their own ServiceNSW app to validate that the data presented is authentic. To bypass the check, a fraudster only needs to obtain the driver's license details from a stolen or otherwise-obtained DDL and replace it locally on their phone.

“When an unsuspecting victim scans the fraudster’s QR code, everything will check out, and the victim won't know that the fraudster has combined their own identification photo with someone's stolen Driver's Licence details,” Farmer explained. Had the system returned the legitimate image data, the scanning party would easily see that the fraudster had forged the DDL, since the face returned by Service NSW wouldn’t match the face displayed on the app.

The last flaw the researcher identified was that the app allows the data it stores to be backed up and restored at all. While all files stored in the Documents and Library/Application Support/ folders are backed up by default, iOS allows developers to easily exclude certain files from backup by calling NSURL setResourceValue:forKey:error: with the NSURLIsExcludedFromBackupKey key.

With a reported 4 million NSW residents using the DDLs, the gaffe could have serious consequences for anyone who relies on DDLs to verify identities, ages, addresses, or other personal information. It's not clear how or even if Service NSW plans to respond. Given time differences between San Francisco and New South Wales, officials with the department weren't immediately available for comment.

Farmer noted this tweet, which called out a hotel bar for refusing service to someone who had only physical ID and instead accepting only DDLs. “I know 10 kids that you let in regularly with fake digital licenses because they are easy to make,” the person claimed.

While the veracity of that claim can’t be verified, it certainly sounds plausible, given the ease and effectiveness of the hack shown here.

_This story originally appeared on_ _Ars Technica__._

‘Tough to Forge’ Digital Driver’s Licenses Are—Yep—Easy to Forge

The encrypted-email company, popular with security-conscious users, has a plan to go mainstream.

Since its founding in 2014, ProtonMail has become synonymous with user-friendly encrypted email. Now the company is trying to be synonymous with a whole lot more. On Wednesday morning, it announced that it’s changing its name to, simply, Proton—a nod at its broader ambitions within the universe of online privacy. The company will now offer an “ecosystem” of linked products, all accessed via one paid subscription. Proton subscribers will have access not just to encrypted email, but also an encrypted calendar, file storage platform, and VPN.

This is all part of CEO Andy Yen’s master plan to give Proton something close to a fighting chance against tech giants like Google. A Taiwanese-born former particle physicist, Yen moved to Geneva, Switzerland, after grad school to work at CERN, the nuclear research facility. Geneva proved a natural place to pivot to a privacy-focused startup, thanks to both Switzerland’s privacy-friendly legal regime and to a steady crop of poachable physicists. Today, Yen presides over a company with more than 400 employees and nearly 70 million users. He recently spoke to WIRED about the enduring need for greater privacy, the dangers of Apple's and Google's dominance, and how today’s attacks on encryption recall the rhetorical tactics of the War on Terror.

This interview has been condensed and lightly edited.

**WIRED: You're in the online privacy business. To start super broadly, how do you define privacy?**

**Andy Yen**: These days, all Google and Apple and Big Tech talk about is privacy, so the best way to give our definition is to give the contrast. The way Google defines privacy is, “Nobody can exploit your data, except for us.” Our definition is cleaner, more simple, and more authentic: Nobody can exploit your data—period. We literally want to build things that give us access to as little data as possible. The use of end-to-end encryption and zero-access encryption allows that. Because fundamentally, we believe the best way to protect user data is to not have it in the first place.

**If you ask someone, “Would you like more privacy or less?” they always say more. But if you watch how people actually behave, for most people, data privacy is not a very high priority. Why do you think that is?**

Privacy is inherent to being human. We have curtains on the windows, we have locks on our doors. But we tend to disconnect the digital world from the physical world. So if you take the analogy of Google, it's someone that's following you around every single day, recording everything that you say and every place you visit. In real life, we would never tolerate that. On the internet, somehow, because it's not visible, we tend to think that it's not there. But the surveillance that you don't notice tends to be far more insidious than the one that you do.

**Your company has come out in support of reforms to strengthen antitrust enforcement. But a lot of people argue that privacy and competition are in conflict. Apple will say, “If you force us to allow more competition on the platform that we run, then that will reduce our control over the security and the privacy of the user. So if you make us increase competition, that will bring privacy down.” And then you see the flip side of the argument, which is when Apple or Google implements some new privacy feature that may hurt competitors. How do you think about these potential conflicts?**

What Apple is basically claiming is, you need to let us continue our use of app store practices because we're the only company in the world that can get privacy right. It’s an attempt to monopolize privacy, which I don’t think makes any sense.

If you look at the FTC lawsuit against Facebook, the theory is that privacy and competition are two sides of the same coin. If you're not happy with Facebook's privacy practices, what is the alternative social media that you can go to other than Facebook and Instagram? You don't really have that many options. We need more players out there. If they had to compete, then competition would force privacy to be a selling point.

The same is true for other services that we offer. Today, Google controls the Android operating system, which is used by the majority of people, and they can preload all their applications as a default on your user devices. So they have a massive advantage already because users don't change the defaults. So even though their privacy practices are quite terrible for most people, there's no real pressure to change it because the alternatives don't really exist. And if they do exist, Google's able to hide them, because they set the defaults on their devices. So if you want to fix the privacy issue, the best way to do it is to have more competition, because then there will be user choice, and users tend to choose what is more private, because, as you said, everybody wants more privacy.

**Europe’s new Digital Market Act has a controversial section requiring the biggest messaging platforms to let competitors interoperate with them, while still preserving end-to-end encryption. But quite a lot of people** **argue** **that you can't actually do both of those things. So here's a place where privacy and competition really do seem to be conflicting with each other technologically.**

I have to say, this has been around since the early '90s. PGP is basically interoperable encryption, based on the email standard. So it may not be technologically the easiest to do. But to say it’s technologically impossible is also not correct.

**Another EU proposal** **would require companies to implement methods of detecting child sex abuse material, or CSAM, on their platforms. People are very alarmed about the implications of that for encryption.**

We're still in the process of analyzing it, so I can’t comment specifically on the details of the proposal. But these proposals are not new. In fact, they've been coming up in various forms over the past decade. What is novel and different this time is that these proposals used to be packaged under “terrorism.” Now, they’re packaged under CSAM. It was very clever to repackage this idea into a topic that is even more toxic, which makes informed debate difficult. Obviously, CSAM is a horrible problem, something that the world is better without. But a wholesale attack on encryption can have unforeseeable consequences that are not always completely understood or considered by the drafters of these proposals.

**Do you think that this** _**is**_ **a wholesale attack on encryption, though? The people making these proposals say, “We're not attacking encryption. You just have to figure out a way to monitor for CSAM.”**

Well, there is really no practical way in today's technology to do that in a way that doesn't weaken encryption.

**The analogy to terrorism is interesting because, during the Bush-era War on Terror, there was a sense of literally anything being justified in the name of stopping terrorism. The US government was secretly spying on its own citizens. It was really hard to argue that we have to accept that some terrorism is going to happen. It's even harder to say, look, we've got to accept that some amount of child exploitation is going to happen and people are going to use digital tools to spread it. But at some point, I think you do have to defend the principle that we have to tolerate a certain amount of even the very worst things if we want to have meaningful civil liberties.**

If there was no privacy in the world, that world would be more “secure.” But that world does exist; it's called North Korea. And the people that live there probably don't feel very secure. As a democracy, you have to strike the right balance. The balance is not total mass surveillance of everybody, because we know that there are serious consequences to democracy and freedom as a result of that. It's not easy to find the right balance. But during the Bush years, with terrorism, I think they went to an extreme that really was a backsliding on democracy. And this is something that we need to avoid.

**But then on the flip side,** **you read stories** **about law enforcement catching really bad criminals, and in a lot of those stories, if that person had used a Tor browser and a ProtonMail account and a VPN, and so on, they might not have been caught. Do you ever worry about a future where all the bad guys get smart enough to use the best privacy tools, and it becomes too easy to evade the legal system entirely?**

Well, encryption and privacy technologies are what I would call dual-use. What is law enforcement also concerned about these days? People’s information being stolen, sensitive communications being hacked, emails of political campaigns being stolen by state actors and disseminated to shift the political balance. In order to prevent all of those potential ills, you need privacy, encryption, and good security. So, the same tools that people in law enforcement criticize are actually the same things that are shielding a lot of the internet ecosystem and the economy from a disastrous outcome. If you were to weaken or prohibit all of these security tools and privacy tools, then you would open the floodgate to a massive amount of cybercrime and data breaches.

**Proton has grown a lot over the years, but it’s still basically a rounding error compared to something like Google. We’ve talked about competition from a regulatory perspective, but on a practical level, how do you even try to compete with your massive rivals?**

The current plan is the launch of the Proton ecosystem. It's one account that gives you access to four privacy services: Proton Mail, Proton Calendar, Proton Drive, and Proton VPN. One subscription that gives you access to all those services. It's the first time anybody has taken a series of privacy services and combined them to form a consolidated ecosystem. That doesn't match all of Big Tech’s offerings, of course. But I think it provides, for the first time, a viable alternative that lets people say, “If I really want to get off of Google, I can now do it, because I have enough components to live a lot of my daily life.” For the first time, you’ll have a privacy option that’s not fully competitive with Google, but reasonably competitive, and that will start to break the dam. I don't know how it will go, but I think this is the future of privacy, and that’s why we're doing it.

**This is probably the first time I have ever thought about having an encrypted calendar.**

A calendar is essentially a record of your life: everybody you've met, everywhere you’ve been, everything that you have done. It's extremely sensitive. So you don't intuitively think about protecting that, but actually, it's essential.

**And by making that encrypted, who am I protecting that information from?**

Maybe it's the government requesting information on you. Maybe it's a data leak. Maybe it's a change in business model of your cloud provider at some point in the future that decides that they want to monetize user data in a different way. Your data is just one acquisition away from going across the border to a country that you didn't expect when you signed up for the service.

**Right. Elon Musk is about to own all my Twitter DMs.**

Exactly right. And with end-to-end encryption, no matter what happens, it's your data; you control it. It's just a mathematical guarantee.

**But what if I move all my stuff to the Proton ecosystem, and then like four years from now, you go out of business? What happens to my stuff?**

Proton has been around for eight years now. In the tech space, that's a long time. I think an indicator of what is sustainable in the long term is alignment between the business and the customers. Our business model is simple: Premium users pay us to keep theie data private, and our only incentive is to keep it private. Sometimes the easiest and simplest models are the ones that are the most durable. I strongly believe that Proton will be a company that outlives us.

Proton Is Trying to Become Google—Without Your Data

Intelligence collected from public information online could be impacting traditional warfare and altering the calculus between large and small powers.

An open source panopticon—from commercial big data aggregation to information infrastructure across mobile, smart devices, and social media—is reshaping the way intelligence is collected and used in conventional war.

Open source intelligence is information that can be readily and legally accessed by the general public. It was used in war and diplomacy long before the internet—alongside information stolen or otherwise secretly obtained and closely held. But its prevalence today means what was once cost-prohibitive to many is now affordable to myriad actors, whether North Korea, the CIA, journalists, terrorists, or cybercriminals.

One consequence of widely available open source information is that anonymity is eroding, not only for ordinary civilians, but also for members of law enforcement, military, and the intelligence community. Even missing information can alert an adversarial spy service, says a former US intelligence official who spoke on background. When the US State Department unfolded a public diplomacy strategy in 2008 that emphasized the use of social media, a foreign counterpart joked to the former US intelligence official that CIA officers, working under nonofficial cover at US embassies, were easily deduced because they lacked Facebook profiles. The US government has a gargantuan effort underway to address similar issues brought on by an absence or expectation of digital exhaust associated with intelligence officers’ cover identities.

When it comes to modern intelligence collection, closed societies like North Korea, Russia, and Iran have an advantage against open ones. Both secrecy and transparency—or the control of information, whether by individuals or governments—are integral to the freedom and security of those individuals and societies. Closed societies can collect an open one’s information with ease, all the while preventing access to similar information from domestic political opponents or hostile foreign actors.

But too much secrecy on the part of governments and militaries—including those of Russia’s Vladimir Putin—can also prevent them from knowing themselves, which may contribute to strategic blunders. Information technology, by its nature, disintegrates boundaries. It erodes barriers to markets across sectors and societies: from journalism to intelligence, crime to terrorism—and now it seems, with Russia’s invasion of Ukraine, conventional war.

Intelligence isn’t just information, says Jeff Rogg, a historian of US intelligence whose work focuses on civil-intelligence relations. The objective of intelligence, compared to just information, is obtaining or maintaining an advantage over one’s adversaries—whether that intelligence is secret or open source. This principle is at play when the Biden administration declassifies intelligence in an unprecedented manner in order to counter Russian misinformation or shares secret intelligence with Ukrainian counterparts.

“Given the emphasis placed on open sources in the war in Ukraine, it’s easy to forget how successful intelligence outcomes can also depend on secrecy, and even a bit of deception. Attributing successes in Ukraine to open sources can also offer a cover of sorts for more closely held sources and methods,” says Rogg.

British scholar Matthew Ford, coauthor of an upcoming book on the impact information infrastructure and connected devices have on conventional military conflicts, calls the phenomenon “radical war.”

Ford says that the high level of mobile connectivity among Ukrainians and a notable absence of combat footage from smartphones and headcams, especially in the early phases of the war, suggest an effective information operation may be underway. “No doubt the Ukrainians fear such images will reveal their tactics, techniques, and procedures,” says Ford. So Ukrainians may simply be censoring themselves.

Social media platforms and cell phones are also a force multiplier for traditionally weaker military powers, like Ukraine, especially when it comes to coordinating intelligence collection for targeting activities. “Targeting information is now being exchanged online,” Ford says. “Successful kills have been celebrated on Telegram. Chatbots have been established, helping Ukrainians share target coordinates with their smartphones. Identifying targets doesn’t involve complex military systems; it works from civilian information infrastructures.”

“The problem with crowdsourced intelligence in a war like Ukraine is standardizing the reporting,” Ford says. For example: “You want to be able to identify the vehicle, geo-locate it, then map against any available signals or satellite imagery, or other collection disciplines, fusing it into actionable target information.”

The Russian invasion of Ukraine is not only the 21st century’s first conventional war in Europe, it is the “most digitally connected in history,” according to Ford. “If the Ukrainians can make that intelligence actionable quicker than the Russians, they can use their limited remote fires, artillery, drones, and maybe even missiles or air power effectively. The objective, therefore, is to find, fix, and finish Russian forces more quickly than the Russians can do this themselves.”

When Russia launched its full-scale invasion in late February, the US, its allies, and Russia concluded that Ukraine’s forces were asymmetrically disadvantaged against Putin’s endowed and historically brutal counterpart. US officials expected the country to fall in days. Yet despite the US’s monumental success predicting Russia’s intentions and plans and offering warnings, American intelligence agencies incorrectly assessed Ukraine’s prospects—the current subject of an internal review.

Facing the full onslaught of Russia's armed forces, Ukraine’s military resilience may even have come as a bit of a surprise to Ukrainians themselves, Ford suspects. Yet mistaken judgments about the expected balance between strong and weak powers, accompanied by strategic surprise, may be a common occurrence in the information age. Before the acknowledged role of social media in fueling the Arab Spring, or the reported significance of thumb drives in more recent counterintelligence failures—telecommunications, open source infrastructure, and cheap and accessible consumer technology have impacted the parity calculus for state and non-state actors alike.

Indeed, it was the worldwide growth of telecommunications in the 1990s that empowered Al-Qaeda to conduct its successful covert military attacks on US soil on September 11, 2001. But in the run-up to those attacks, the US Department of Defense hadn’t drafted a net assessment on the military or intelligence capabilities of what was later described by the 9/11 Commission as America’s “most dangerous foreign enemy.” The concept was unimaginable then, but it shouldn’t be now.

Similarly, the intelligence community had not authored a national estimate that comprehensively evaluated or articulated the strategic threat posed by Al-Qaeda before its 2001 attack. This category of cognitive bias is called the “paradox of expertise.” Genuine experts may communicate incredible nuance and understanding of a subject but overlook indicators of seismic changes within the domains of their knowledge.

It’s also possible to make analytical errors by overstating or inflating the impact or outcomes of technology and information on civil society—or any domain—including conventional war. The internet, which promised us a techno-utopian commune of open source information, has arguably turned large swaths of civil society into psychedelic hellscapes, much like the Charles Manson murders after the Summer of Love.

Civilian noncombatants’ use of open source platforms and consumer devices in support of hostile military actions raise serious questions about blurred lines between civilian and combatant—lawful or otherwise—leading to the same subjects becoming legitimate targets or tried for espionage under the laws of war. Civilians are legally protected under international humanitarian law, as long as they are not party to military conflicts.

According to recent reports, US intelligence support led to the successful targeting of Russian generals and the _Moskva_, Russia’s flagship in the Black Sea. “One of the intelligence concerns people have voiced is that these leaks unnecessarily raise the risks of escalation,” Rogg says. “But consider the Javelins, Stingers, and military hardware we are publicly providing. The US and its allies are fighting an overt—as compared to covert—proxy war against Russia. That’s one of the key distinctions in this conflict from, for example, US support to the mujahideen in Afghanistan in the 1980s, which is one of the popular comparisons you read about today: The US is taking a risk by abandoning some of the hallmarks of intelligence and advantages of covert action, like plausible deniability. That being said, there is still plenty that we do not know. Putting aside all the reporting, leaks, and official disclosures, the exact role and impact of US intelligence in Ukraine will be a source of study and debate for years to come.”

Open Source Intelligence May Be Changing Old-School War

A new report lays out existing US police surveillance capabilities that can easily be repurposed to monitor pregnant people.

In the three weeks since a draft opinion leaked from the United States Supreme Court promising to roll back the federal constitutional right to abortion in the United States, reproductive rights activists and privacy advocates have been working to understand the reality of how such a shift will impact Americans. And a new report from the Surveillance Technology Oversight Project, published on Tuesday, lays out the ways in which police, prosecutors, and private litigants will be able to lean on existing data-access mechanisms and tracking tools to enforce state abortion bans.

The research underscores what privacy advocates have been warning about for decades: A surveillance state built to track certain types of behavior can easily, and inevitably, be adapted to other ends.

“None of the tactics we will see used to target pregnant people will be new,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project. “We’ve seen these same surveillance techniques developed in the name of immigration enforcement, national security, combatting drugs, and so many other law enforcement priorities. And the truth is that when you develop those techniques, you are at the whim of those in power and whatever they next decide to call a crime.”

Without a federally recognized right to abortion in the United States, massive quantities of data generated and collected about consumers, web users, and anyone who interacts with digital systems can be tapped by investigators seeking information about pregnant people. And tech companies will face law enforcement requests for user data related to abortion investigations. STOP emphasizes that geofence warrants—the investigative technique in which law enforcement requests data from devices used in a set area during a specified time range—are a prime example of a controversial surveillance mechanism that can, and likely will, be easily repurposed to investigate people who may be seeking or may have gotten abortions. Similarly, investigators could use keyword search warrants to identify and track people who use search engines to find information about abortion, providers, or abortifacients.

STOP, which is based in New York, is advocating that the state pass proposed legislation to ban keyword and geofence warrants, a law which would be the first of its kind in the US and could offer a template for other states to follow.

The research also points out that pro-choice states will need to reexamine local, inter-state, and federal data-sharing initiatives—including participation in “fusion centers” that allow multiple law enforcement groups to share information. These and other controversial policing initiatives to combat terrorism and track undocumented Americans could quickly be expanded to investigate pregnant people, reproductive healthcare workers, and others. A recent investigation by Georgetown Law's Center on Privacy & Technology showed just how far the US Immigration and Customs Enforcement agency has been able to expand its surveillance powers by partnering with local and state agencies and combining numerous data sources into what the researchers dubbed the “American Dragnet.”

STOP also warns that the law enforcement tactic of creating fake social media accounts to trick people into revealing their interests or intentions will slot into abortion investigations easily. 

“In digital security and data privacy, we always say that it's all about how motivated your adversary is,” says Andrea Downing, founder of the nonprofit Light Collective and a security and privacy researcher focused on patient populations and social media. “And in this case, so much of our data as individuals is already out there. Some kind of combination of your fertility data, your dating app history, your location data, your shopping—you can see how that can paint a picture without you realizing it. And that's not any one person's fault.”

The STOP research echoes the idea that while individuals can take steps to protect themselves and their data from prying eyes, ultimately structural change and legislation is needed to shield individuals.

“Just because we’ve had years of this seemingly endless government surveillance, it doesn’t mean it’s inevitable. It’s not the technology that makes the choice, it’s the lawmakers," STOP's Fox Cahn says. "But for now, what we keep saying to each other in the office is that after _Roe_, things won’t look like 1973. It'll look like _1984_.”

Source

Wired