I tutori della privacy hanno criticato l’acquisto annunciato da Amazon del produttore di aspirapolvere robot iRobot per che aprirebbe le porte a una “sorveglianza pervasiva”, mentre la Federal Trade Commission ha aperto un’indagine sull’acquisizione da 1,7 miliardi di dollari.

L’acquisizione prevista dal gigante tecnologico del produttore di aspirapolvere Roomba gli darà accesso al sistema operativo dell’apparecchio che utilizza una telecamera frontale per creare mappe complete dell’interno delle case delle persone, che potranno poi essere inserite nell’enorme patrimonio di dati di Amazon su centinaia di milioni di consumatori.

“Con questa acquisizione Amazon avrà accesso ad atti estremamente intimi nei nostri spazi più privati che non sono disponibili con altri mezzi o per altri concorrenti“, affermano oltre venti gruppi per la tutela della privacy e dei diritti civili in una lettera inviata venerdì alla FTC. “Le informazioni raccolte dai dispositivi di iRobot vanno oltre le planimetrie delle case e comprendono informazioni estremamente dettagliate sugli interni delle case dei consumatori e sugli orari e gli stili di vita degli abitanti”, si legge nella lettera, condivisa dall’associazione per i diritti digitali Fight for the Future. “Concedere ad Amazon l’accesso totale a questo tipo di informazioni private attraverso questa acquisizione danneggia i consumatori“.

Tra l’altro a questo punto i robot pulitori Roomba della iRobot entreranno a far parte degli strumenti controllati dal Alexa e facenti parte del suo sistema operativo, uno strumento che già raccoglie enormi quantità di informazioni degli utenti ascoltandone le voci. A questo punto Amazon avrà a propria disposizione anche una quantità enorme di informazioni di carattere fisico sulla abitazioni dei cittadini.

Siamo sicuri di voler veramente dare questo tipo di informazioni ad una singola multinazionale?

https://scenarieconomici.it/il-vostro-robot-roomba-vi-sta-spiando-vi-sono-dei-sospetti-sulla-societa-del-gruppo-amazon/

The Federal Trade Commission on Monday sued a data broker for allegedly selling location data culled from hundreds of millions of phones that can be used to track the movements of people visiting abortion clinics, domestic abuse shelters, places of worship, and other sensitive places.

In a complaint, the agency said that Idaho-based Kochava has promoted its marketplace as providing “rich geo data spanning billions of devices globally.” The data broker has also said it “delivers raw latitude/longitude data with volumes around 94B+ geo transactions per month, 125 million monthly active users, and 35 million daily active users, on average observing more than 90 daily transactions per device.”

The FTC said Kochava amassed the data by tracking the Mobile Advertising ID, or MAID, from phones and selling the data through Amazon Web Services or other outlets without first anonymizing the data. Anyone who purchases the data can then use it to track the comings and goings of many phone owners. Many of the allegations are based on the agency’s analysis of a data sample the company made available for free to promote sales of its data, which was available online with no restrictions on usage.

“In fact, in just the data Kochava made available in the Kochava Data Sample, it is possible to identify a mobile device that visited a women’s reproductive health clinic and trace that mobile device to a single-family residence,” the complaint alleged. “The data set also reveals that the same mobile device was at a particular location at least three evenings in the same week, suggesting the mobile device user’s routine. The data may also be used to identify medical professionals who perform, or assist in the performance, of abortion services.”

The FTC went on to allege: “In addition, because Kochava’s data allows its customers to track consumers over time, the data could be used to identify consumers’ past conditions, such as homelessness. In fact, the Kochava Data Sample identifies a mobile device that appears to have spent the night at a temporary shelter whose mission is to provide residence for at-risk, pregnant young women or new mothers.”

Kochava officials released a statement that read:

This lawsuit shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses. Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy.

Prior to the legal proceedings, Kochava took the proactive step of announcing a new capability to block geo data from sensitive locations via Privacy Block, effectively removing that data from the data marketplace, and is currently in the implementation process of adding that functionality. Absent specificity from the FTC, we are constantly monitoring and proactively adjusting our technology to block geo data from other sensitive locations. Kochava sources 100% of the geo data in our data marketplace from third party data brokers all of whom represent that the data comes from consenting consumers.

For the past several weeks, Kochava has worked to educate the FTC on the role of data, the process by which it is collected and the way it is used in digital advertising. We hoped to have productive conversations that led to effective solutions with the FTC about these complicated and important issues and are open to them in the future. Unfortunately the only outcome the FTC desired was a settlement that had no clear terms or resolutions and redefined the problem into a moving target. Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation. It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy.

Two weeks ago, the company sued the FTC in anticipation of Monday’s complaint, alleging its practices comply with all rules and laws and that the agency’s actions were an overreach.

Monday’s complaint said it was possible to access the Kochava data sample with minimal effort. “A purchaser could use an ordinary personal email address and describe the intended use simply as ‘business,'” FTC attorneys wrote. “The request would then be sent to Kochava for approval. Kochava has approved such requests in as little as 24 hours.”

The data sample consisted of a subset of the paid data feed that covered a rolling seven-day period. A single day’s worth of data contained more than 327,480,000 rows and 11 columns of data that pulled data from more than 61.8 million mobile devices.

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

Allegations like those in the complaint raise a larger question about reining in location tracking by mobile devices. People should carefully review iOS and Android privacy settings to limit the apps’ access to location data. Both OSes also allow users to turn off ad personalization, a measure that can limit the use of some identifiers such as MAIDs. iOS further enables users to bar one app from tracking their activity across other apps.

None of these measures guarantees that location data won’t get swept up and sold by companies such as Kochava, but it’s a good practice to follow them anyway.

https://arstechnica.com/?p=1876747

DuckDuckGo’s tracker-removing email service, which has been available in private beta for a year, is now open to anyone who uses a DuckDuckGo mobile app, browser extension, or Mac browser. It has also added a few more privacy tools.

The service provides you a duck.com email address, one intended to be given out for the kind of “Subscribe to our newsletter for 20 percent off” emails you know exist only to harvest data and target you for ads. Email sent to your duck.com address forwards to your chosen primary email—but with trackers removed.

Email Protection now also fixes up links, strips them of tracking modifiers, upgrades unencrypted HTTP URLs to HTTPS where possible, and, for the rare necessary reply, allows you to send directly from your duck address instead of exposing your primary email. During their closed beta, DuckDuckGo claims that 85 percent of the emails it processed contained hidden trackers.

To sign up for Email Protection, you’ll need to use either the DuckDuckGo mobile app for iOS or Android, use DuckDuckGo’s browser extension on Firefox, Chrome, Edge, or Brave, or use its beta Mac browser (the list for which must be joined in the DuckDuckGo mobile app).

In my experience, using the company’s apps, extensions, or browser isn’t necessary to keep the email forwarding service running, but they allow you to autofill your duck address and create more individual throwaway email addresses, which is handy for email filtering.

DuckDuckGo notes that the trackers tucked into email images and links can pass information back to the sender about when you opened a message, your geolocation when opening it, and which device you were using. Knowing your primary email address can also allow companies to connect it to Facebook and Google and target you for advertising across sites.

The company helpfully notes that it will not track you using its anti-tracking service. “When your Duck Addresses receive an email, we immediately apply our tracking protections and then forward it to you, never saving it on our systems. Sender information, subject lines…we don’t track any of it,” the company writes on its blog post. DuckDuckGo is also “committed to Email Protection for the long term,” and states that it worked during the closed beta to support millions of users.

Listing image by DuckDuckGo

https://arstechnica.com/?p=1876093

For some people, the term “Ring Nation” might evoke a warrantless surveillance dystopia overseen by an omnipotent megacorp. To Amazon-owned MGM, Ring Nation is a clip show hosted by comedian Wanda Sykes, featuring dancing delivery people and adorable pets.

Deadline reports that the show, due to debut on September 26, is “the latest example of corporate synergy at Amazon.” Amazon owns household video security brand Ring, Hollywood studio MGM, and Big Fish, the producer of Ring Nation

Viral videos captured by doorbell cameras have been hot for a while now. You can catch them on late-night talk shows, the r/CaughtOnRing subreddit, and on millions of TikTok users’ For You page. Amazon’s media properties, perhaps sensing an opportunity to capitalize and soften Ring’s image, are sallying forth with an officially branded offering.

Ring Nation will feature “neighbors saving neighbors, marriage proposals, military reunions and silly animals,” Deadline writes. But Ring Nation might be aiming even higher, according to Ring founder Jamie Siminoff—to something approaching a salve for our deeply divided nation.

“Bringing the new community together is core to our mission at Ring, and Ring Nation gives friends and family a fun new way to enjoy time with one another,” Siminoff told Deadline. “We’re so excited to have Wanda Sykes join Ring Nation to share people’s memorable moments with viewers.”

Ring sharing its owners’ moments with other viewers has been a contentious issue. The surveillance company recently admitted giving police access to Ring recordings without user consent for “emergency” requests. Ring partnered with more than 600 law enforcement agencies to encourage Ring installations in communities and ease police access to footage. Ring has since made it easier to opt out of police requests.

Ring owners already had a lower-key way to share clips, mostly of crime or purported crime, through the Neighbors app. Doing so essentially reveals your location at a granular level. Responding to Congressional inquiries in the past, Ring cited users as being responsible for violating their neighbors’ privacy, noting that it includes stickers and signs that comply with some states’ public recording policies.

Ring Nation producer Big Fish is also, incidentally, the producer of Live PD, the police ride-along series canceled after the George Floyd killing and resulting protests, but the show was recently revived.

https://arstechnica.com/?p=1873311

The Federal Trade Commission has kicked off the rulemaking process for privacy regulations that could restrict online surveillance and punish bad data-security practices. It’s a move that some privacy advocates say is long overdue, as similar Congressional efforts face endless uncertainty.

The Advanced Notice of Proposed Rulemaking, approved on a 3-2 vote along partisan lines, was spurred by commercial data collection, which occurs at “a massive scale and in a stunning array of contexts,” FTC Chair Lina M. Khan said in a press release. Companies surveil online activity, friend networks, browsing and purchase history, location data, and other details; analyze it with opaque algorithms; and sell it through “the massive, opaque market for consumer data,” Khan said.

Companies can also fail to secure that data or use it to make services addictive to children. They can also potentially discriminate against customers based on legally protected statuses like race, gender, religion, and age, the FTC said. What’s more, the release said, some companies make taking part in their “commercial surveillance” required for service or charge a premium to avoid it, employing dark patterns to keep the systems in place.

One of the three votes for the rulemaking came from Alvaro Bedoya, the founding director of Georgetown Law’s Center on Privacy & Technology, who was appointed three months ago. Bedoya, who focused on unregulated facial recognition, has described privacy as a civil right.

This marks the first step in what could be a years-long, multi-administration effort by the FTC to act under its existing authority to regulate and enforce privacy protections. The Industry Association of Privacy Professionals said that, should the FTC work under its Magnuson-Moss, or “warranty,” authority, it faces “a lengthy process that can take several years to complete.” The FTC gave no indication of a timeline for enacting a final rule, though it’s unlikely to come before the end of this year.

Both critics and supporters want to see Congress act, too

The FTC is seeking input from stakeholders and the public, starting with a public forum on September 8. Before the announcement was a day old, however, many organizations issued statements on the move.

Consumer Reports (CR) had effusive praise for the regulatory agency seeking to do some regulating. “While we continue to support federal and state efforts to enact and enforce comprehensive privacy legislation, consumers can wait no longer to have their personal information protected,” Justin Brookman, director of technology policy at CR, said in a release. “The FTC has the authority to issue clear rules to safeguard personal data by holding companies accountable for unwanted data collection, use, and disclosure.”

CR was one of more than 40 organizations that urged the FTC to act on data privacy in 2021, including the American Civil Liberties Union, the Electronic Frontier Foundation, and Public Knowledge.

Energy and Commerce Chairman Frank Pallone, Jr. (D-NJ) said in a release that while the lack of online privacy in the US is “completely unacceptable,” the FTC shouldn’t be stuck with only its existing authority to deal with it. Pallone pushed his American Data Privacy and Protection Act, which would broaden the FTC’s authority to create and enforce data protections. That bill has cleared a key House committee, but it awaits an uncertain floor vote and even tougher Senate future.

Senator Edward J. Markey (D-Mass.), meanwhile, believes that his own Children and Teens’ Online Privacy Protection Act is the best, if narrowest, way forward. The bill would create a Youth Privacy and Marketing Division at the FTC that focuses on protections for those 16 and younger.

Both Republican commissioners on the FTC would be fine with deferring privacy to Congress. Christine Wilson and Noah Phillips cited privacy laws that are seemingly moving ahead and the vast implications of any FTC action. Phillips said an FTC privacy action “will impact many thousands of companies, millions of citizens, and billions upon billions of dollars in commerce.”

https://arstechnica.com/?p=1873142

DuckDuckGo, the privacy-minded search company, says it will block trackers from Microsoft in its desktop web browser, following revelations in May that certain scripts from Bing and LinkedIn were getting a pass.

In a blog post, DuckDuckGo founder Gabriel Weinberg says that he’s heard users’ concerns since security researcher Zach Edwards’ thread that “we didn’t meet their expectations around one of our browser’s web tracking protections.” Weinberg says that, over the next week, the company’s browser will add Microsoft to the list of third-party tracking scripts blocked by its mobile and desktop browsers, as well as extensions for other browsers.

“Previously, we were limited in how we could apply our 3rd-Party Tracker Loading Protection on Microsoft tracking scripts due to a policy requirement related to our use of Bing as a source for our private search results,” Weinberg writes. “We’re glad this is no longer the case. We have not had, and do not have, any similar limitation with any other company.”

There are a lot of pervasive, identifying things that load up on most modern webpages. At issue in DuckDuckGo’s apps was its default blocking of scripts from companies like Facebook and Google loading on third-party websites. DuckDuckGo, which uses Microsoft’s Bing as one of its sources for search results, had to allow some of Microsoft’s trackers to load “due to a policy requirement.” In a Reddit response at the time of the revelation, Weinberg noted that Microsoft’s trackers were still blocked in most ways, like utilizing third-party cookies for fingerprinting visitors.

There’s more to the delicate dance between DuckDuckGo and Microsoft than just trackers, however. Microsoft also provides ads that run on DuckDuckGo’s search results. To allow advertisers to see when someone has clicked an ad on DuckDuckGo and arrived at their page, the DuckDuckGo apps won’t block requests from bat.bing.com. Weinberg notes that you can avoid this by turning off ads in DuckDuckGo search entirely. The company is working on validating ads in ways that can be non-tracking, Weinberg writes, akin to similar efforts by Safari and Firefox.

Finally, DuckDuckGo aims to be more open about its tracker blocking. The company committed its tracker blocklist to a public GitHub repository yesterday and published a new help doc on its tracking protections.

It can look like a lot of work over two scripts, but then DuckDuckGo lives inside the tricky balance of trying to make its search product convenient and relevant while offering its users as much privacy as websites can stand before breaking. And the 15-year-old company from Paoli, Pennsylvania, can’t just leave Bing behind entirely. Weinberg noted in his May Reddit response that most of its traditional search results and images come from Bing. “Really only two companies (Google and Microsoft) have a high-quality global web link index” due to the billion-dollar cost, Weinberg wrote. Every company that wants to provide search to the world faces either a duopoly or a very long journey.

Microsoft, meanwhile, continues to expand its advertising markets, most recently to Netflix, and, potentially, into its own operating system. Its advertising revenue was $3 billion for the quarter ending June 30, an increase of 15 percent year over year but the lowest growth rate in more than a year.

https://arstechnica.com/?p=1871913

Pieno rispetto delle norme poste a protezione dei dati dei pazienti europei. È quanto il Comitato europeo per la protezione dei dati (Edpb) e il Garante europeo della protezione dei dati (Edps) raccomandano nel parere congiunto sulla proposta della Commissione europea per lo Spazio europeo dei dati sanitari (Ehds -European Health Data Space).

La proposta mira a facilitare la creazione di un’ Unione sanitaria europea e a consentire all’Ue di sfruttare appieno il potenziale offerto dallo scambio, dall’uso e dal riutilizzo sicuro e protetto dei dati sanitari elettronici, sia per fornire una migliore assistenza sanitaria, anche transfrontaliera, al soggetto i cui i dati sono stati raccolti (“uso primario”), sia a fini di  ricerca scientifica, medicina personalizzata, statistica, applicazioni digitali per la salute (“uso secondario”).

<!-- TIESSE -->
<!-- LPA CORSO IPEM 3 - 300x250 -->

Nell’accogliere con favore l’impegno a rafforzare i diritti delle persone rispetto ai propri dati elettronici sanitari l’Edpb e l’Edps esprimono, tuttavia, una serie di preoccupazioni generali. Innanzitutto, riguardo al disallineamento tra le previsioni della proposta sui diritti degli interessati e il Gdpr. Inoltre, pur riconoscendo che le previsioni della proposta volte a facilitare l’uso secondario di dati sanitari elettronici possono generare benefici per il bene pubblico, il Comitato e il Garante europeo mettono in luce i rischi per i diritti e le libertà delle persone interessate derivanti da queste ulteriori attività di trattamento, rispetto alle quali, diversamente dall’”uso primario”, non è garantito all’interessato il diritto di limitare l’accesso di terzi ai propri dati.

Il Comitato e il Garante europeo ritengono che le finalità dell’uso secondario dei dati sanitari elettronici non siano adeguatamente definite dalla proposta e chiedono quindi ai co-legislatori di delimitare ulteriormente tali finalità, circoscrivendole a quelle collegate al perseguimento di un bene pubblico nel settore sanitario e/o previdenziale.

Riguardo ai dati sanitari generati dalle app per il benessere e da altre applicazioni digitali per la salute, Edpb e Edps chiedono che tal informazioni personali non vengano messe a disposizione per l’ “uso secondario”, perché producono un’enorme quantità di dati, che non sono della stessa qualità di quelli generati dai dispositivi medici e che possono essere trattati insieme ad ulteriori informazioni diverse da quelle sanitarie.

Per quanto l’obiettivo dell’infrastruttura per lo scambio di dati sanitari elettronici prevista nella proposta  sia quello di facilitare lo scambio dei dati sanitari, la grande quantità di dati che verrebbero trattati, la loro natura altamente sensibile, il rischio di accesso illegale e la necessità di garantire un controllo efficace da parte di autorità indipendenti per la protezione dei dati richiedono, secondo l’Edpb e l’Edps, che Parlamento europeo e Consiglio impongano l’obbligo di conservare i dati sanitari elettronici esclusivamente all’interno Spazio economico europeo (fatti salvi ulteriori trasferimenti in conformità con le garanzie approntate Gdpr).

Infine, per quanto riguarda il modello di governance introdotto dalla proposta, l’Edpb e l’Edps sottolineano che le Autorità per la protezione dei dati sono le uniche autorità competenti per le questioni relative al trattamento dei dati personali e dovrebbero rimanere l’unico punto di contatto per le persone in merito a tali questioni. Pertanto, dovrebbe essere evitata ogni sovrapposizione tra tali Autorità e i nuovi enti introdotti dalla proposta e dovrebbero essere specificate le rispettive competenze e previsti chiari obblighi di cooperazione.

https://www.key4biz.it/dati-sanitari-i-garanti-ue-chiedono-il-rispetto-delle-norme-sulla-privacy/411797/

Si è conclusa giovedì l’indagine che ha visto al centro dell’attenzione la Didi Global Inc che rappresenta una delle più grandi piattaforme tecnologiche per la mobilità al mondo. L’Autorità per la regolamentazione della sicurezza informatica cinese (CAC) ha multato per 1,2 miliardi di dollari l’azienda per aver violato alcune delle principali leggi in ambito data protection.

La società con sede in Cina offre un’ampia gamma di servizi tramite le sue app in tutto il mondo (America Latina, Asia-Pacifico e Africa) arrivando ad affermarsi leader del mercato di ride-hailing. La decisione arriva proprio nel momento in cui l’azienda si affacciava al mercato azionario americano mettendo così in guardia milioni di investitori.

Secondo la Cyberspace Administration of China (CAC) la Didi avrebbe violato pesantemente la privacy dei suoi utenti. Il colosso avrebbe raccolto illegalmente negli ultimi sette anni, quindi a partire dal 2015, milioni di informazioni sui suoi clienti danneggiando così la sicurezza nazionale.

La multa inflitta corrisponde a 8,026 miliardi di yuan, corrispondenti a 1,2 miliardi di dollari, e le violazioni sono costate 1 milione di yuan al fondatore ed amministratore delegato Cheng Wei ed altrettanto al presidente Jean Liu.

La società Didi, sostenuta dall’azienda americana Uber Technologies Inc e dalla giapponese SoftBank Group Corp, tramite una dichiarazione rilasciata dal proprio account Weibo, ha dichiarato di accettare la decisione del CAC e di aver già cominciato la procedura di verifica delle violazioni.

Didi Chuxing, dopo esser entrata nel mercato azionario americano, puntava alla borsa di Hong Kong cercando di quotarsi, secondo i piani iniziali, proprio nei mesi estivi. Tuttavia, ha dovuto sospendere questi progetti a tempo indeterminato a causa della decisione delle autorità cinesi.

Il provvedimento preso dall’autorità cinese si incastra perfettamente all’interno di un quadro normativo in continua evoluzione per quanto riguarda la tutela dei cittadini rispetto alle violazioni di cyber sicurezza. Sembra, così, solo uno dei tanti segnali forti che il governo cinese dà alle sue aziende intimandole di rispettare la privacy dei cittadini.

https://www.ictsecuritymagazine.com/articoli/protezione-dei-dati-la-cina-multa-la-didi-global-per-12-miliardi-di-dollari/

Federal Communications Commission Chairwoman Jessica Rosenworcel has ordered mobile carriers to explain what geolocation data they collect from customers and how they use it. Rosenworcel’s probe could be the first step toward stronger action—but the agency’s authority in this area is in peril because Congress is debating a data privacy law that could preempt the FCC from regulating carriers’ privacy practices.

Rosenworcel sent letters of inquiry Tuesday “to the top 15 mobile providers,” the FCC announced. The chairwoman’s letters asked carriers “about their policies around geolocation data, such as how long geolocation data is retained and why and what the current safeguards are to protect this sensitive information,” the FCC said.

The letters also “probe carriers about their processes for sharing subscriber geolocation data with law enforcement and other third parties’ data-sharing agreements. Finally, the letters ask whether and how consumers are notified when their geolocation information is shared with third parties,” the FCC said.

“Mobile Internet service providers are uniquely situated to capture a trove of data about their own subscribers, including the subscriber’s actual identity and personal characteristics, geolocation data, app usage, and web browsing data and habits,” the letters say. Under US communications law, carriers are prohibited from using or sharing private information except under specific circumstances.

Rosenworcel told carriers to answer the questions by August 3. Letter recipients included the big three carriers AT&T, T-Mobile, and Verizon; cable companies Comcast and Charter, which resell mobile service; mobile operators Consumer Cellular, C-Spire, Dish, Google, H2O Wireless, Lycamobile, Mint Mobile, Red Pocket, and US Cellular; and Best Buy Health, which operates the medical-focused Lively mobile service.

FCC has authority over phone privacy… for now

The FCC letters pointed out that in February 2020, it proposed fines totaling $208 million after AT&T, Sprint, T-Mobile, and Verizon were caught “selling access to their customers’ location information without taking reasonable measures to protect against unauthorized access to that information.” While that practice is believed to have been stopped, this week’s FCC letters said there’s still reason to worry about the data collected by carriers:

These carriers voluntarily determined to end the sale of real-time location information to location aggregation services However, last year, a report by the Federal Trade Commission that studied ISPs representing 98 percent of the mobile Internet market observed that ISPs collect more data than is necessary to provide services and more data than consumers expect.

The $208 million in proposed fines is apparently still pending, but the FCC said it “has ensured that these carriers are no longer monetizing their consumers’ real-time location in this way, and the agency is continuing its investigation into these practices.”

The FCC inquiry is important “in light of the long history of abuses by carriers selling this kind of detailed and hyper-accurate information to law enforcement, bounty hunters, and even stalkers,” said Harold Feld, senior VP of consumer advocacy group Public Knowledge. Mobile carriers “have unique access to highly accurate geolocation information—known as A-GPS—designed so that 911 responders can find a caller with pinpoint accuracy,” and have “access to other information that can be combined with geolocation to produce a detailed picture of a person’s activities far beyond what applications on the handset can provide,” Feld said.

Although the FCC gave up its Title II authority over broadband under former Chairman Ajit Pai, Feld noted that the agency still has substantial authority over phone service. “The FCC has specialized power to force carriers to respond,” Feld wrote. “It has the power to impose transparency requirements to reveal when law enforcement abuses the legal process to obtain deeply personal phone information. It has the power to require specific data minimization and data protection obligations if necessary. The FCC has used this power in the past to create new rules in response to revelations that stalkers had access to carrier information, and should not hesitate to use its regulatory powers again if necessary.”

https://arstechnica.com/?p=1868529

Strutturati o destrutturati, archiviati, in movimento o in uso: qualunque sia la tipologia o la condizione d’uso dei dati le soluzioni Voltage di CyberRes, business unit di Micro Focus dedicata alla cyber resilienza, permettono di esercitare una protezione completa che si estende attraverso l’intero ciclo di vita

L’aumento esponenziale nella diffusione incontrollata di file sensibili rappresenta uno dei più grossi problemi che i professionisti della sicurezza si trovano a dover affrontare. Nel corso degli ultimi anni i dati critici aziendali non solo sono aumentati enormemente in volume, ma hanno drasticamente cambiato natura uscendo dalle celle dei database relazionali per diffondersi all’interno di mail, report, presentazioni, immagini, registrazioni audio e video.

Le aziende devono, di conseguenza, confrontarsi con la nuova esigenza di analizzare e proteggere i dati destrutturati con il medesimo livello di attenzione dedicato finora alle informazioni strutturate.

Anche per i dati strutturati, però, la situazione è mutata. Le informazioni sensibili non sono più saldamente archiviate all’interno del perimetro aziendale, ma disperse nel cloud e, spesso, inserite nei sistemi di clienti e fornitori con poche o nessuna possibilità di controllo.

Protezione dei dati critici sempre, durante il ciclo di vita

Il punto di partenza per ogni corretta strategia di resilienza e gestione del rischio è il processo di Data Discovery, che consente di comprendere e contestualizzare i propri dati, fornendo una maggiore visibilità sulla loro natura (strutturata e destrutturata), identificando le informazioni sensibili, mappando la loro collocazione ed eliminando i duplicati inutili.

Una volta assolto questo compito, è essenziale che i dati importanti per le aziende, qualunque sia la loro tipologia, siano protetti sempre, ovunque e in qualsiasi condizione (a riposo, in movimento e persino in uso), dal momento della loro creazione fino al termine del loro ciclo di vita.

Impresa impossibile?

No secondo quanto sostiene Pierpaolo Alì, Director Southern Europe, Russia, CIS, CEE & Israel di CyberRes, la business unit di Micro Focus dedicata alle soluzioni software per abilitare la cyber resilienza.

“Per rispondere a questa esigenza CyberRes ha sviluppato la famiglia Voltage, una suite completa di soluzioni software per la privacy e la protezione dei dati che permette di cifrare, mascherare e anonimizzare i dati sensibili per fornire una piena sicurezza in ambienti IT ibridi e multi-cloud. Le soluzioni software CyberRes Voltage intervengono nel momento della creazione di dati e file effettuandone in modo trasparente la cifratura e incorporando controlli di accesso e utilizzo che li proteggono per sempre”.

CyberRes, tramite la propria tecnologia brevettata Hyper Format-Preserving Encryption (Hyper FPE), consente di cifrare i dati persino durante l’uso preservandone il formato originale ovvero la loro integrità referenziale in modo da consentirne l’analisi senza renderli visibili in chiaro neppure all’operatore che li sta trattando.

Protezione e controllo dei file destrutturati

Per la protezione dei dati destrutturati CyberRes ha sviluppato una soluzione specifica denominata Voltage SmartCipher che permette di effettuare una cifratura trasparente persistente dei file al momento della loro creazione e di associargli anche una serie di regole e permessi che definiscono chi ci può accedere a quello specifico file e quali operazioni può eseguire.

Attraverso un sistema centralizzato le aziende possono gestire da remoto l’accesso ai loro file critici, monitorare il loro utilizzo, modificare le policy e prevenire l’accesso non autorizzato.

Questo permette di esercitare un livello di protezione che si estende durante l’intero ciclo di vita, indipendentemente dalla tipologia di file, dalla sua collocazione, dal suo trasferimento (a una persona, un’applicazione o un dispositivo) e attraverso qualsiasi tipo di piattaforma.

“La protezione dei dati aziendali critici è uno degli aspetti centrali per garantire la compliance e abilitare la resilienza aziendale – conclude Alì -. Tramite le soluzioni Voltage di CyberRes questo obiettivo è facilmente ottenibile sia per i dati strutturati sia per quelli non strutturati, anche quando si dovessero perdere le tracce sulla loro collocazione o in caso di furto e diffusione non autorizzata”.

Scopri perché la Data Discovery è un requisito essenziale per migliorare la resilienza aziendale e gestire efficacemente i dati critici, partecipa al webinar gratuito “Data Discovery: il primo passo verso la protezione dei dati sensibili” che si terrà Martedì 19 Luglio 2022 ore 10.00

Registrati QUI al Webinar

https://www.ictsecuritymagazine.com/notizie/cyberres-voltage-dati-critici-protetti-sempre-e-ovunque/