Printer

FBI's Washington Post Investigation Shows How Your Printer Can Snitch On You (theintercept.com) 37

alternative_right quotes a report from The Intercept: Federal prosecutors on January 9 charged Aurelio Luis Perez-Lugones, an IT specialist for an unnamed government contractor, with "the offense of unlawful retention of national defense information," according to an FBI affidavit (PDF). The case attracted national attention after federal agents investigating Perez-Lugones searched the home of a Washington Post reporter. But overlooked so far in the media coverage is the fact that a surprising surveillance tool pointed investigators toward Perez-Lugones: an office printer with a photographic memory. News of the investigation broke when the Washington Post reported that investigators seized the work laptop, personal laptop, phone, and smartwatch of journalist Hannah Natanson, who has covered the Trump administration's impact on the federal government and recently wrote about developing more than 1,000 government sources. A Justice Department official told the Post that Perez-Lugones had been messaging Natanson to discuss classified information. The affidavit does not allege that Perez-Lugones disseminated national defense information, only that he unlawfully retained it.

The affidavit provides insight into how Perez-Lugones allegedly attempted to exfiltrate information from a Secure Compartmented Information Facility, or SCIF, and the unexpected way his employer took notice. According to the FBI, Perez-Lugones printed a classified intelligence report, albeit in a roundabout fashion. It's standard for workplace printers to log certain information, such as the names of files they print and the users who printed them. In an apparent attempt to avoid detection, Perez-Lugones, according to the affidavit, took screenshots of classified materials, cropped the screenshots, and pasted them into a Microsoft Word document. By using screenshots instead of text, there would be no record of a classified report printed from the specific workstation. (Depending on the employer's chosen data loss prevention monitoring software, access logs might show a specific user had opened the file and perhaps even tracked whether they took screenshots).

Perez-Lugones allegedly gave the file an innocuous name, "Microsoft Word - Document1," that might not stand out if printer logs were later audited. In this case, however, the affidavit reveals that Perez-Lugones's employer could see not only the typical metadata stored by printers, such as file names, file sizes, and time of printing, but it could also view the actual contents of the printed materials -- in this case, prosecutors say, the screenshots themselves. As the affidavit points out, "Perez-Lugones' employer can retrieve records of print activity on classified systems, including copies of printed documents." [...] Aside from attempting to surreptitiously print a document, Perez-Lugones, investigators say, was also seen allegedly opening a classified document and taking notes, looking "back and forth between the screen corresponding the classified system and the notepad, all the while writing on the notepad." The affidavit doesn't state how this observation was made, but it strongly suggests a video surveillance system was also in play.

Piracy

Spotify Lawsuit Triggered Anna's Archive Domain Name Suspensions (torrentfreak.com) 1

An anonymous reader quotes a report from TorrentFreak: Spotify and several major record labels, including UMG, Sony, and Warner, have taken legal action against the unknown operators of Anna's Archive. The action follows the shadow library's announcement that it would release hundreds of terabytes of scraped Spotify data. Unsealed documents reveal that the court already issued a broad preliminary injunction, ordering hosting companies, Cloudflare, and domain name services, to take action. [...] All these documents were filed under seal, as the shadow library might otherwise be tipped off and take countermeasures. These documents were filed ex-parte and kept away from Anna's Archive. According to Spotify and the labels, this is needed "so that Anna's Archive cannot pre-emptively frustrate" the countermeasures they seek.

The lawsuit (PDF), which was unsealed recently, explains directly why Anna's Archive lost several of its domain names over the past weeks. The .ORG domain was suspended by the U.S.-based Public Interest Registry (PIR) in early January, while a domain registrar took the .SE variant offline a few days later. "We don't believe this has to do with our Spotify backup," AnnaArchivist said at the time, but court records prove them wrong. The unsealed paperwork shows that the court granted a temporary restraining order (TRO) on January 2, which aimed to target Anna's Archive hosting and domain names. The sealed nature of this order also explains why the .ORG registry informed us that it could not comment on the suspension last week. While the .ORG and the .SE domains are suspended now, other domains remain operational. This suggests that the responsible registrars and registries do not automatically comply with U.S. court orders.

[...] While the unsealed documents resolve the domain suspension mystery, it is only the start of the legal battle in court. It is expected that Spotify and the music companies will do everything in their power to take further action, if needed. Interestingly, however, it appears that the music industry lawsuit may have already reached its goal. A few days ago, the dedicated Spotify download section was removed by Anna's Archive. Whether this removal is linked to the legal troubles is unknown. However, it appears that Anna's Archive stopped the specific distribution of Spotify content alleged in the complaint, seemingly in partial compliance with the injunction's ban on 'making available' the scraped files.

Communications

HAM Radio Operators In Belarus Arrested, Face the Death Penalty (404media.co) 47

An anonymous reader quotes a report from 404 Media: The Belarusian government is threatening three HAM radio operators with the death penalty, detained at least seven people, and has accused them of "intercepting state secrets," according to Belarusian state media, independent media outside of Belarus, and the Belarusian human rights organization Viasna. The arrests are an extreme attack on what is most often a wholesome hobby that has a history of being vilified by authoritarian governments in part because the technology is quite censorship resistant.

The detentions were announced last week on Belarusian state TV, which claimed the men were part of a network of more than 50 people participating in the amateur radio hobby and have been accused of both "espionage" and "treason." Authorities there said they seized more than 500 pieces of radio equipment. The men were accused on state TV of using radio to spy on the movement of government planes, though no actual evidence of this has been produced. State TV claimed they were associated with the Belarusian Federation of Radioamateurs and Radiosportsmen (BFRR), a long-running amateur radio club and nonprofit that holds amateur radio competitions, meetups, trainings, and forums.
Siarhei Besarab, a Belarusian HAM radio operator, posted a plea for support from others in the r/amateurradio subreddit. "I am writing this because my local community is being systematically liquidated in what I can only describe as a targeted intellectual genocide," Besarab wrote. "I beg you to amplify this signal and help us spread this information. Please show this to any journalist you know, send it to human rights organizations, and share it with your local radio associations."
Businesses

AI Company Eightfold Sued For Helping Companies Secretly Score Job Seekers (reuters.com) 15

Eightfold AI, a venture capital-backed AI hiring platform used by Microsoft, PayPal and many other Fortune 500 companies, is being sued in California for allegedly compiling reports used to screen job applicants without their knowledge. From a report: The lawsuit, filed on Tuesday accusing Eightfold of violating the Fair Credit Reporting Act shows how consumer advocates are seeking to apply existing law to AI systems capable of drawing inferences about individuals based on vast amounts of data.

Santa Clara, California-based Eightfold provides tools that promise to speed up the hiring process by assessing job applicants and predicting whether they would be a good fit for a job using massive amounts of data from online resumes and job listings. But candidates who apply for jobs at companies that use those tools are not given notice and a chance to dispute errors, job applicants Erin Kistler and Sruti Bhaumik allege in their proposed class action. Because of that, they claim Eightfold violated the FCRA and a California law that gives consumers the right to view and challenge credit reports used in lending and hiring.

Encryption

Ireland Wants To Give Its Cops Spyware, Ability To Crack Encrypted Messages (theregister.com) 29

The Irish government is planning to bolster its police's ability to intercept communications, including encrypted messages, and provide a legal basis for spyware use. From a report: The Communications (Interception and Lawful Access) Bill is being framed as a replacement for the current legislation that governs digital communication interception. The Department of Justice, Home Affairs, and Migration said in an announcement this week the existing Postal Packets and Telecommunications Messages (Regulation) Act 1993 "predates the telecoms revolution of the last 20 years."

As well as updating laws passed more than two decades ago, the government was keen to emphasize that a key ambition for the bill is to empower law enforcement to intercept of all forms of communications. The Bill will bring communications from IoT devices, email services, and electronic messaging platforms into scope, "whether encrypted or not."

In a similar way to how certain other governments want to compel encrypted messaging services to unscramble packets of interest, Ireland's announcement also failed to explain exactly how it plans to do this. However, it promised to implement a robust legal framework, alongside all necessary privacy and security safeguards, if these proposals do ultimately become law. It also vowed to establish structures to ensure "the maximum possible degree of technical cooperation between state agencies and communication service providers."/i

The Courts

Snap Settles Social media Addiction Lawsuit Ahead of Landmark Trial (bbc.com) 26

Snap has settled a social media addiction lawsuit just days before trial, while Meta, TikTok, and Alphabet remain defendants and are headed to court. "Terms of the deal were not announced as it was revealed by lawyers at a California Superior Court hearing, after which Snap told the BBC the parties were 'pleased to have been able to resolve this matter in an amicable manner.'" From the report: The plaintiff, a 19-year old woman identified by the initials K.G.M., alleged that the algorithmic design of the platforms left her addicted and affected her mental health. In the absence of a settlement with the other parties, the trial is scheduled to go forward against the remaining three defendants, with jury selection due to begin on January 27. Meta boss Mark Zuckerberg is expected to testify, and until Tuesday's settlement, Snap CEO Evan Spiegel was also set to take the stand.

Snap is still a defendant in other social media addiction cases that have been consolidated in the court. The closely watched cases could challenge a legal theory that social media companies have used to shield themselves. They have long argued that Section 230 of the Communications Decency Act of 1996 protects them from liability for what third parties post on their platforms. But plaintiffs argue that the platforms are designed in a way that leaves users addicted through choices that affect their algorithms and notifications. The social media companies have said the plaintiffs' evidence falls short of proving that they are responsible for alleged harms such as depression and eating disorders.

Cellphones

HHS Announces New Study of Cellphone Radiation and Health (usnews.com) 58

An anonymous reader quotes a report from U.S. News & World Report: U.S. health officials plan a new study investigating whether radiation from cellphones may affect human health. A spokesperson for the U.S. Department of Health and Human Services (HHS) said the research will examine electromagnetic radiation and possible gaps in current science. The initiative stems from numerous concerns raised by Health Secretary Robert F. Kennedy Jr., who has linked cellphone use to neurological damage and cancer.

"The [U.S. Food and Drug Administration] removed webpages with old conclusions about cell phone radiation while HHS undertakes a study on electromagnetic radiation and health research to identify gaps in knowledge, including on new technologies, to ensure safety and efficacy," HHS spokesman Andrew Nixon said. He added that the study was directed in a strategy report from the president's Make America Healthy Again Commission.

Some webpages from the FDA and the U.S. Centers for Disease Control and Prevention say current research does not show clear harm from cellphone radiation. The National Cancer Institute, which is part of the National Institutes of Health, says that "evidence to date suggests that cellphone use does not cause brain or other kinds of cancer in humans."
.
Sci-Fi

Bank of England 'Must Plan For a Financial Crisis Triggered By Aliens' (msn.com) 78

A former Bank of England analyst has urged contingency planning for a potential financial shock if the U.S. government were to confirm the existence of extraterrestrial intelligence. The argument is that "ontological shock" alone could destabilize confidence and trigger crisis dynamics. The Independent reports: [Helen McCaw, who served as a senior analyst in financial security at the UK's central bank and worked for the Bank of England for 10 years until 2012] said politicians and bankers can no longer afford to dismiss talk of alien life, and warned a declaration of this nature could trigger bank collapses. She reportedly said: "The United States government appears to be partway through a multi-year process to declassify and disclose information on the existence of a technologically advanced non-human intelligence responsible for Unidentified Anomalous Phenomena (UAPs)."

"If the UAP proves to be of non-human origin, we may have to acknowledge the existence of a power or intelligence greater than any government and with potentially unknown intentions." Her warning comes as senior American officials have recently indicated their belief in the possibility of alien life. [...] Ms McCaw said: "UAP disclosure is likely to induce ontological shock and provoke psychological responses with material consequences ... There might be extreme price volatility in financial markets due to catastrophising or euphoria, and a collapse in confidence if market participants feel uncertain on how to price assets using any of the familiar methods."

The former Bank of England worker explained there might be a rush towards assets such as gold or other precious metals, and government bonds, which are perceived as "safe." Alternatively, she said precious metals might lose their status as perceived safe assets if people speculate that new space-faring technologies will soon increase the supply of precious metals.
The article cites a recent UFO documentary, The Age of Disclosure, where 34 U.S. government insiders, including those from the military and intelligence community officials, share insights about the governments work with UAP. Per the film's description, the documentary "reveals an 80-year global cover-up of non-human intelligent life and a secret war among major nations to reverse-engineer advanced technology of non-human origin."
Books

Nvidia Contacted Anna's Archive To Secure Access To Millions of Pirated Books (torrentfreak.com) 32

An anonymous reader quotes a report from TorrentFreak: NVIDIA executives allegedly authorized the use of millions of pirated books from Anna's Archive to fuel its AI training. In an expanded class-action lawsuit that cites internal NVIDIA documents, several book authors claim (PDF) that the trillion-dollar company directly reached out to Anna's Archive, seeking high-speed access to the shadow library data. [...] Last Friday, the authors filed an amended complaint that significantly expands the scope of the lawsuit. In addition to adding more books, authors, and AI models, it also includes broader "shadow library" claims and allegations. The authors, including Abdi Nazemian, now cite various internal Nvidia emails and documents, suggesting that the company willingly downloaded millions of copyrighted books. The new complaint alleges that "competitive pressures drove NVIDIA to piracy," which allegedly included collaborating with the controversial Anna's Archive library.

According to the amended complaint, a member of Nvidia's data strategy team reached out to Anna's Archive to find out what the pirate library could offer the trillion-dollar company "Desperate for books, NVIDIA contacted Anna's Archive -- the largest and most brazen of the remaining shadow libraries -- about acquiring its millions of pirated materials and 'including Anna's Archive in pre-training data for our LLMs,'" the complaint notes. "Because Anna's Archive charged tens of thousands of dollars for 'high-speed access' to its pirated collections [] NVIDIA sought to find out what "high-speed access" to the data would look like."

According to the complaint, Anna's Archive then warned Nvidia that its library was illegally acquired and maintained. Because the site previously wasted time on other AI companies, the pirate library asked NVIDIA executives if they had internal permission to move forward. This permission was allegedly granted within a week, after which Anna's Archive provided the chip giant with access to its pirated books. "Within a week of contacting Anna's Archive, and days after being warned by Anna's Archive of the illegal nature of their collections, NVIDIA management gave 'the green light' to proceed with the piracy. Anna's Archive offered NVIDIA millions of pirated copyrighted books." The complaint states that Anna's Archive promised to provide NVIDIA with access to roughly 500 terabytes of data. This included millions of books that are usually only accessible through Internet Archive's digital lending system, which itself has been targeted in court. The complaint does not explicitly mention whether NVIDIA ended up paying Anna's Archive for access to the data.

Additionally, it's worth mentioning that NVIDIA also stands accused of using other pirated sources. In addition to the previously included Books3 database, the new complaint also alleges that the company downloaded books from LibGen, Sci-Hub, and Z-Library. In addition to downloading and using pirated books for its own AI training, the authors allege NVIDIA distributed scripts and tools that allowed its corporate customers to automatically download "The Pile", which contains the Books3 pirated dataset.

Electronic Frontier Foundation

Congress Wants To Hand Your Parenting To Big Tech 40

An anonymous reader quotes a report from the Electronic Frontier Foundation (EFF): Lawmakers in Washington are once again focusing on kids, screens, and mental health. But according to Congress, Big Tech is somehow both the problem and the solution. The Senate Commerce Committee held a hearing [Friday] on "examining the effect of technology on America's youth." Witnesses warned about "addictive" online content, mental health, and kids spending too much time buried in screen. At the center of the debate is a bill from Sens. Ted Cruz (R-TX) and Brian Schatz (D-HI) called the Kids Off Social Media Act (KOSMA), which they say will protect children and "empower parents."

That's a reasonable goal, especially at a time when many parents feel overwhelmed and nervous about how much time their kids spend on screens. But while the bill's press release contains soothing language, KOSMA doesn't actually give parents more control. Instead of respecting how most parents guide their kids towards healthy and educational content, KOSMA hands the control panel to Big Tech. That's right -- this bill would take power away from parents, and hand it over to the companies that lawmakers say are the problem. [...] This bill doesn't just set an age rule. It creates a legal duty for platforms to police families. Section 103(b) of the bill is blunt: if a platform knows a user is under 13, it "shall terminate any existing account or profile" belonging to that user. And "knows" doesn't just mean someone admits their age. The bill defines knowledge to include what is "fairly implied on the basis of objective circumstances" -- in other words, what a reasonable person would conclude from how the account is being used. The reality of how services would comply with KOSMA is clear: rather than risk liability for how they should have known a user was under 13, they will require all users to prove their age to ensure that they block anyone under 13.

KOSMA contains no exceptions for parental consent, for family accounts, or for educational or supervised use. The vast majority of people policed by this bill won't be kids sneaking around -- it will be minors who are following their parents' guidance, and the parents themselves. Imagine a child using their parent's YouTube account to watch science videos about how a volcano works. If they were to leave a comment saying, "Cool video -- I'll show this to my 6th grade teacher!" and YouTube becomes aware of the comment, the platform now has clear signals that a child is using that account. It doesn't matter whether the parent gave permission. Under KOSMA, the company is legally required to act. To avoid violating KOSMA, it would likely lock, suspend, or terminate the account, or demand proof it belongs to an adult. That proof would likely mean asking for a scan of a government ID, biometric data, or some other form of intrusive verification, all to keep what is essentially a "family" account from being shut down.

Violations of KOSMA are enforced by the FTC and state attorneys general. That's more than enough legal risk to make platforms err on the side of cutting people off. Platforms have no way to remove "just the kid" from a shared account. Their tools are blunt: freeze it, verify it, or delete it. Which means that even when a parent has explicitly approved and supervised their child's use, KOSMA forces Big Tech to override that family decision. [...] These companies don't know your family or your rules. They only know what their algorithms infer. Under KOSMA, those inferences carry the force of law. Rather than parents or teachers, decisions about who can be online, and for what purpose, will be made by corporate compliance teams and automated detection systems.
The Courts

WhatsApp Texts Are Not Contracts, Judge Rules in $2M Divorce Row (thetimes.com) 46

A British painter who argued that her ex-husband had signed over their $2 million north London home through WhatsApp messages has lost her High Court appeal after the judge ruled that the sender's name appearing in a chat header does not constitute a legal signature.

Hsiao-mei Lin, 54, presented messages from her former husband Audun Mar Gudmundsson, a financier, in which he stated he would transfer his share of their Tufnell Park property to her. Lin's lawyers argued that because Gudmundsson's name appeared in the message header on her phone, the messages should be considered signed.

Mr Justice Cawson disagreed, finding that the header identifying a sender is analogous to an email address added by a service provider -- a mechanism for identification rather than part of the message itself. The judge also found the content of the messages did not actually amount to Gudmundsson relinquishing his share.
Bitcoin

More US States are Putting Bitcoin on Public Balance Sheets (cnbc.com) 36

An anonymous reader shared this report from CNBC: Led by Texas and New Hampshire, U.S. states across the national map, both red and blue in political stripes, are developing bitcoin strategic reserves and bringing cryptocurrencies onto their books through additional state finance and budgeting measures. Texas recently became the first state to purchase bitcoin after a legislative effort that began in 2024, but numerous states have joined the "Reserve Race" to pass legislation that will allow them to ultimately buy cryptocurrencies. New Hampshire passed its crypto strategic reserve law last May, even before Texas, giving the state treasurer the authority to invest up to 5% of the state funds in crypto ETFs, though precious metals such as gold are also authorized for purchase. Arizona passed similar legislation, while Massachusetts, Ohio, and South Dakota have legislation at various stages of committee review...

Similarities in the actions taken across states to date include include authorizing the state treasurer or other investment official to allow the investment of a limited amount of public funds in crypto and building out the governance structure needed to invest in crypto... [New Hampshire] became the first state to approve the issuance of a bitcoin-backed municipal bond last November, a $100 million issuance that would mark the first time cryptocurrency is used as collateral in the U.S. municipal bond market. The deal has not taken place yet, though plans are for the issuance to occur this year... "What's different here is it's bitcoin rather than taxpayer dollars as the collateral," [said University of Chicago public policy professor Justin Marlowe]. In numerous states, including, Colorada, Utah, and Louisiana,crypto is now accepted as payment for taxes and other state business...

"For many in the state/local investing industry, crypto-backed assets are still far too speculative and volatile for public money," Marlowe said. "But others, and I think there's a sort of generational shift in the works, see it as a reasonable store of value that is actually stronger on many other public sector values like transparency and asset integrity," he added.

Public policy professor Marlowe "sees the state-level trend as largely one of signaling at present," according to the article. (Marlowe says "If you're a governor and you want to broadcast that you are amenable to innovative business development in the digital economy, these are relatively low-cost, low-risk ways to send that signal.") But the bigger steps may reflect how crypto advocates have increasing political power in the states. The article notes that the cryptocurrency industry was the largest corporate donor in a U.S. election cycle in 2024, "with support given to candidates on both sides."

"It is already amassing a war chest for the 2026 midterms."
Patents

Acer Sues Verizon, AT&T, and T-Mobile, Alleging Infringment on Acer's Cellular Networking Patents (nerds.xyz) 32

Slashdot reader BrianFagioli writes: Acer has filed three separate patent infringement lawsuits against AT&T, Verizon, and T-Mobile, taking the unusual step of hauling the nation's largest wireless carriers into federal court. The suits, filed in the Eastern District of Texas, claim the companies are using Acer-developed cellular networking technology without paying for the privilege. Acer says it tried to negotiate licenses for years but reached a dead end, arguing it was left with no option except litigation. The case centers on six U.S. patents Acer asserts are core to modern wireless networks, rather than anything tied to PCs or laptops.

The company describes itself as reluctant to pursue courtroom battles, but it has been quietly building a large global patent portfolio after pouring hundreds of millions of dollars into R&D. Acer also notes that some of its patents count as standard-essential, hinting the carriers may be required to license them. All three companies are expected to push back, and the dispute could become another long-running telecom patent saga. Consumers will not notice any immediate changes, but if Acer wins or settles, it may find a new revenue stream far beyond its traditional hardware business.

Further coverage from Hot Hardware
United States

Two More Offshore Wind Projects in the US Allowed to Continue Construction (reuters.com) 74

Friday a federal judge "cleared U.S. power company Dominion Energy to resume work on its Virginia offshore wind project." But a U.S. federal judge also ruled Thursday that another major offshore wind farm is allowed to resume construction, reports the Hill. "The project, which would supply power to New York, was one of five that were halted by the Trump administration in December...."

In fact, there were three different court rulings this week each allowing construction to continue on a U.S. wind project: Judge Carl Nichols, a Trump appointee, granted a preliminary injunction allowing Empire Wind to keep building... Another, Revolution Wind, was also allowed to move forward in court this week... The project would provide enough power for up to 500,000 homes, according to its website. The court's decision allows construction to resume while the underlying case against the Trump order plays out.
Meanwhile, power company Orsted "is also suing over the pause of its Sunrise Wind project for New York," reports the Associated Press, "with a hearing still to be set." The fifth paused project is Vineyard Wind, under construction in Massachusetts. Vineyard Wind LLC, a joint venture between Avangrid and Copenhagen Infrastructure Partners, joined the rest of the developers in challenging the administration on Thursday.
CNN points out that the Vineyard Wind project "has been allowed to send power to the grid even amid Trump's suspension, a spokesperson for regional grid operator ISO-New England told CNN in an email." Residential customers in the mid-Atlantic region, including Virginia, desperately need more energy to service the skyrocketing demand from data centers â" and many are seeing spiking energy bills while they wait for new power to be brought online.
CNN notes that president Trump said last week "My goal is to not let any windmill be built; they're losers."

The Associated Press adds that "In contrast to the halted action in the US, the global offshore wind market is growing, with China leading the world in new installations. Nearly all of the new electricity added to the grid in 2024 was renewable. The British government said on Wednesday it had secured a record 8.4 gigawatts of offshore wind in Europe's largest offshore wind auction, enough clean electricity to power more than 12m homes."
Privacy

What Happened After Security Researchers Found 60 Flock Cameras Livestreaming to the Internet (youtube.com) 50

A couple months ago, YouTuber Benn Jordan "found vulnerabilities in some of Flock's license plate reader cameras," reports 404 Media's Jason Koebler. "He reached out to me to tell me he had learned that some of Flock's Condor cameras were left live-streaming to the open internet."

This led to a remarkable article where Koebler confirmed the breach by visiting a Flock surveillance camera mounted on a California traffic signal. ("On my phone, I am watching myself in real time as the camera records and livestreams me — without any password or login — to the open internet... Hundreds of miles away, my colleagues are remotely watching me too through the exposed feed.") Flock left livestreams and administrator control panels for at least 60 of its AI-enabled Condor cameras around the country exposed to the open internet, where anyone could watch them, download 30 days worth of video archive, and change settings, see log files, and run diagnostics. Unlike many of Flock's cameras, which are designed to capture license plates as people drive by, Flock's Condor cameras are pan-tilt-zoom (PTZ) cameras designed to record and track people, not vehicles. Condor cameras can be set to automatically zoom in on people's faces... The exposure was initially discovered by YouTuber and technologist Benn Jordan and was shared with security researcher Jon "GainSec" Gaines, who recently found numerous vulnerabilities in several other models of Flock's automated license plate reader (ALPR) cameras.
Jordan appeared this week as a guest on Koebler's own YouTube channel, while Jordan released a video of his own about the experience. titled "We Hacked Flock Safety Cameras in under 30 Seconds." (Thanks to Slashdot reader beadon for sharing the link.) But together Jordan and 404 Media also created another video three weeks ago titled "The Flock Camera Leak is Like Netflix for Stalkers" which includes footage he says was "completely accessible at the time Flock Safety was telling cities that the devices are secure after they're deployed."

The video decries cities "too lazy to conduct their own security audit or research the efficacy versus risk," but also calls weak security "an industry-wide problem." Jordan explains in the video how he "very easily found the administration interfaces for dozens of Flock safety cameras..." — but also what happened next: None of the data or video footage was encrypted. There was no username or password required. These were all completely public-facing, for the world to see.... Making any modification to the cameras is illegal, so I didn't do this. But I had the ability to delete any of the video footage or evidence by simply pressing a button. I could see the paths where all of the evidence files were located on the file system...

During and after the process of conducting that research and making that video, I was visited by the police and had what I believed to be private investigators outside my home photographing me and my property and bothering my neighbors. John Gaines or GainSec, the brains behind most of this research, lost employment within 48 hours of the video being released. And the sad reality is that I don't view these things as consequences or punishment for researching security vulnerabilities. I view these as consequences and punishment for doing it ethically and transparently.

I've been contacted by people on or communicating with civic councils who found my videos concerning, and they shared Flock Safety's response with me. The company claimed that the devices in my video did not reflect the security standards of the ones being publicly deployed. The CEO even posted on LinkedIn and boasted about Flock Safety's security policies. So, I formally and publicly offered to personally fund security research into Flock Safety's deployed ecosystem. But the law prevents me from touching their live devices. So, all I needed was their permission so I wouldn't get arrested. And I was even willing to let them supervise this research.

I got no response.

So instead, he read Flock's official response to a security/surveillance industry research group — while standing in front of one of their security cameras, streaming his reading to the public internet.

"Might as well. It's my tax dollars that paid for it."

" 'Flock is committed to continuously improving security...'"

Slashdot Top Deals