Tag Archive for: watchdog

Facebook used facial recognition without consent 200,000 times, says South Korea’s data watchdog • The Register


Facebook, Netflix and Google have all received reprimands or fines, and an order to make corrective action, from South Korea’s government data protection watchdog, the Personal Information Protection Commission (PIPC).

The PIPC announced a privacy audit last year and has revealed that three companies – Facebook, Netflix and Google – were in violations of laws and had insufficient privacy protection.

Facebook alone was ordered to pay 6.46 billion won (US$5.5M) for creating and storing facial recognition templates of 200,000 local users without proper consent between April 2018 and September 2019.

Another 26 million won (US$22B) penalty was issued for illegally collecting social security numbers, not issuing notifications regarding personal information management changes, and other missteps.

Facebook has been ordered to destroy facial information collected without consent or obtain consent, and was prohibited from processing identity numbers without legal basis. It was also ordered to destroy collected data and disclose contents related to foreign migration of personal information. Zuck’s brainchild was then told to make it easier for users to check legal notices regarding personal information.

The fine is the second-largest ever issued by the organization, the largest ever also going to Facebook. In November 2020 the Social Network™ was fined 6.7 billion won (US$5.7M) for passing on personal data to other operators without user permission.

Netflix’s fine was a paltry $220 million won (US$188,000), with that sum imposed for collecting data from five million people without their consent, plus another 3.2 million won (US$2,700) for not disclosing international transfer of the data.

Google got off the easiest, with just a “recommendation” to improve its personal data handling processes and make legal notices more precise.

The PPIC…

Source…

Activision Blizzard accused by California watchdog of fostering ‘frat boy’ culture, fatally toxic atmosphere • The Register


California’s Department of Fair Employment and Housing on Thursday sued Activision Blizzard and its subsidiaries, alleging the company fostered a “frat boy” culture that led to lower pay for female employees, sex and race discrimination, and sexual harassment.

According to the lawsuit, as an example of the effects of this toxic culture, a female worker killed herself on a company trip due to a sexual relationship she had with her male boss.

“All employers should ensure that their employees are being paid equally and take all steps to prevent discrimination, harassment, and retaliation,” said dept director Kevin Kish in a statement [PDF]. “This is especially important for employers in male-dominated industries, such as technology and gaming.”

Activision Blizzard, the gaming behemoth forged in 2008 and based in Santa Monica, California, makes popular computer games such as Diablo, Call of Duty, and World of Warcraft, and runs online gaming service Battle.net.

Accusations of sexism, sexual harassment, and pay inequality have dogged the gaming industry for decades, as demonstrated recently by “gamergate” in 2014 and 2015 and harassment claims at UbiSoft in 2020. But as the “#MeToo” movement has shown, workplace hostility toward women extends far beyond electronic entertainment.

An Activision Blizzard spokesperson told The Register in an emailed statement the gaming biz takes these issues seriously and the Department of Fair Employment and Housing (DFEH) allegations don’t reflect its current workplace.

We note that one Blizzard executive identified in the complaint, “so known to engage in harassment of females that his suite was nicknamed the ‘Crosby Suite’ after alleged rapist Bill Crosby,” appears to have quietly left the company around June 2020. A DFEH spokesperson tentatively confirmed that this is a misspelling of “Cosby,”…

Source…

DOE Watchdog Detailed Its Cybersecurity State Amid SolarWinds Hack


Recommendations the Energy Department’s Inspector General made for improving information security align with the focus of the Cybersecurity and Infrastructure Security Agency following a massive hacking campaign that leveraged software from government-contracted network management company SolarWinds.

The DOE IG report out March 25 in accordance with the Federal Information Security Modernization Act covers the period from March 2020—right after hackers deployed the malware—to January 2021, just after initial breaches were reported. The IG’s office didn’t draw any conclusions based on the timing but said it would track potential impacts from the event.

“Subsequent to our test work, it was reported that Federal agencies, including the Department and the National Nuclear Security Administration, encountered a serious and sophisticated cybersecurity attack,” the report reads. “Due to the timing of our review, we did not evaluate the circumstances surrounding any potential impact to the Department or the National Nuclear Security Administration, or how such an attack could have impacted our results, if at all. We will continue to follow developments related to any potential impact as we continue our future test work.”

But the report’s findings and recommendations echoed many of the pitfalls highlighted by the Cybersecurity and Infrastructure Security Agency in alerts and directives following the SolarWinds hack and subsequent breaches of on-premises servers for Microsoft Exchange. 

The inclusion of the National Nuclear Security Administration among the list of impacted entities alarmed many due to its role in managing the nation’s stockpile of nuclear weapons. The IG’s report does not name specific locations where it identified issues but noted that the report was based on 28 department locations under the purview of the NNSA, the Under Secretary for Science and Energy, the Energy Information Administration, and certain staff offices. 

In all, the IG’s office made 83 recommendations regarding access controls, the management of configurations and vulnerabilities and the system integrity of web applications. And while the report noted that the department closed…

Source…

LAPD Watchdog Says Department’s Data-Based Policing Is Producing Nothing But Wasted Time And Rights Violations

The Los Angeles Police Department has just received some bad news from its oversight. It’s probably good news for the policed — many of whom are being disproportionately targeted thanks to biased input data — but the LAPD can’t be pleased that its reliance on expensive, mostly-automated tools hasn’t produced worthwhile results.

The department relies on a handful of tech tools to aid in its policing, but it doesn’t appear to be helping. It has CompStat — a holdover from the early 2000’s when Bill Bratton still ran the department. To that framework, it has added LASER — a nifty acronym that stands for “Los Angeles’ Strategic Extraction and Restoration.” The program with the reverse engineered nickname actually relies on input from human analysts to determine where officers should be deployed. But this reliance on data-driven policing isn’t making the city any safer, despite LASER’s focus on violent crime.

Here’s what the LAPD’s human analysts put together for the department’s patrol officers.

In perhaps the most contentious strategy, each of the department’s 21 geographic areas used data to compile lists or “bulletins” of people calculated to be among the top 12 “chronic offenders.”

The program assigns people points based on prior criminal histories, such as arrest records, gang affiliation, probation and parole status and recent police contacts.

This strategy received some public blow-back, resulting in the department abandoning it last August. Nothing of value was lost.

[Inspector General Mark] Smith examined data collected prior to the suspension.

He found 44 percent of chronic offenders had either zero or one arrest for violent crimes. About half had no arrest for gun-related crimes.

So much for curbing violent crime. All it did was create a loop where cops targeted nonviolent offenders, resulting in another arrest/detention that added more points to the person’s LASER record, resulting in even more targeting and, inevitably, more interactions with police officers. It’s a feedback loop no one can escape.

To make things worse, officers had the power to place people into this damaging loop by “nominating” them for targeting with LASER. The point-based system that was supposed to limit this targeting to just the worst of worst street criminals could be bypassed. Nominated citizens would find themselves rising up the ranks on the LASER lists, racking up points simply by officers performing stops based on faulty inputs.

And while the tech is supposedly improving, the quality of policing isn’t. CompStat has had nearly a 20-year run in LA, but its results are negligible. Predictive policing — which has its own bias issues — isn’t doing any better.

Like the other program, Smith found discrepancies with the data collection and could not draw conclusions to “meaningfully evaluate” the program’s overall effectiveness to reduce crime, the report said.

Unfortunately, the report recommends the LAPD stay the course. The LAPD is supposed to spend more time “reviewing” the data that isn’t producing results and tailor its outputs with an eye on Constitutional rights. As it stands now, the LAPD is allowing databases to conjure up reasonable suspicion for stops. That can’t keep happening. But the way forward can’t be more of the same, only at a slightly slower pace.

Permalink | Comments | Email This Story

Techdirt.