An analysis of 40 COVID-19 contact tracing applications for Android has led to the discovery of numerous security and privacy issues, according to a new research paper.

Contact tracing applications have been created to help authorities automate the process of identifying those who have been in close contact with infected individuals.

Using a newly developed tool called COVIDGuardian, which was designed for both static and dynamic program analysis, academic researchers with universities in Australia and the United Kingdom analyzed 40 worldwide Android contact tracing apps and discovered potential security risks in more than half of them.

COVIDGuardian, an automated security and privacy assessment tool, was used to assess the security performance of the analyzed applications against four categories, namely manifest weaknesses, general security vulnerabilities, data leaks (with a focus on personally identifiable information), and malware detection.

Identified issues, the researchers say, include the use of insecure cryptographic algorithms (72.5%), the storing of sensitive information in clear text (55%), insecure random values (55%), permissions to perform backups (roughly 42.5% of apps), and the inclusion of trackers (20 trackers were identified in approximately 75% of the apps).

The research has revealed that the security of these apps is only slightly influenced by the use of a decentralized architecture, but also the fact that users are more likely to install a contact tracing app that has stronger privacy settings.

After being contacted by the researchers, some of the application developers addressed identified issues, including the leak of information and the inclusion of trackers. Other apps, however, were found to include even more vulnerabilities and trackers after they were updated.

The researchers also conducted a survey of more than 370 people regarding the use of contact tracing apps, their concerns, and their preference on centralized or decentralized apps.

“Security and privacy concerns have been a big issue affecting the uptake of these apps,” said Dr Gareth Tyson, senior lecturer at Queen Mary University of London and one of the authors of the study. “We were surprised that the debate around decentralised vs centralised apps didn’t seem so important and, instead, users were more focused on the exact details of what private information is collected. This should encourage developers to offer stronger privacy guarantees for their apps.”

Related: Singapore Admits Police Can Access Contact-Tracing Data

Related: New Trials in England for Troubled Virus Tracing App

Related: COVID-19 Contact Tracing Apps: Effective Virus Risk Management Tools or Privacy Nightmare?

http://feedproxy.google.com/~r/Securityweek/~3/rdhVjzRFXYM/security-privacy-issues-found-tens-covid-19-contact-tracing-apps

TikTok’s Chinese parent company ByteDance has agreed to pay $92 million in a settlement to U.S. users who are part of a class-action lawsuit alleging that the video-sharing app failed to get their consent to collect data in violation of a strict Illinois privacy law.

The federal lawsuit alleged that TikTok broke the Illinois biometric privacy law, which allows suits against companies that harvest consumer data without consent, including via facial and fingerprint scanning. Illinois is the only state with a law that allows people to seek monetary damages for such unauthorized data collection.

“While we disagree with the assertions, rather than go through lengthy litigation, we’d like to focus our efforts on building a safe and joyful experience for the TikTok community,” TikTok said in an emailed statement.

Facebook agreed to a $550 million settlement under the same law last February. The TikTok settlement must still be approved by a federal judge.

Privacy advocates have praised the law as the nation’s strongest form of protection in the commercial use of such data, and it has survived ongoing efforts by the tech industry and other businesses to weaken it.

Illinois is one of three states that have laws governing the use of biometric data. But the other two, Texas and Washington, don’t permit individual lawsuits, instead delegating enforcement to their attorneys general.

Related: Biometrics – Dismantling the Myths Surrounding Facial Recognition

http://feedproxy.google.com/~r/Securityweek/~3/PDu8vOaEyo4/tiktok-owner-bytedance-pay-92m-us-privacy-settlement

Feb 25, 2021 Marco Schiaffino In evidenza, News, Privacy, RSS, Scenario, Vulnerabilità 0

---

Il sistema di interazione dell’assistente vocale di Amazon con altre applicazioni apre degli spazi che i pirati informatici potrebbero sfruttare per attaccare gli utenti.

Si chiamano “skill” e sono funzionalità che consentono all’assistente vocale Alexa di interagire con altre app. Un sistema che è stato pensato per espandere le funzionalità dell’ecosistema Amazon, ma che secondo gli esperti di sicurezza hanno caratteristiche ben poco rassicuranti sotto il profilo della sicurezza.

A mettere in fila tutti i problemi legati alle “attività collaterali” di Alexa ci hanno pensato i ricercatori dell’Università di Bochum. Christopher Lentzsch e Martin Degeling, che firmano un report sul tema, snocciolando una serie di problematiche legate all’uso di Alexa in questa modalità.

Il primo problema, spiegano i ricercatori, riguarda il fatto che chiunque possa rendere disponibili skill utilizzando nomi di aziende ben conosciute che, in realtà, non hanno nulla a che fare con gli sviluppatori dell’applicazione. In altre parole, sarebbe possibile per chiunque fare leva sulla reputazione di aziende conosciute per garantirsi quel livello di “fiducia” che potrebbe esporre gli utenti a violazioni della privacy.

Non solo: il sistema che ha implementato Amazon per proteggere l’accesso a dati sensibili sarebbe, stando a quanto si legge nel report, facilmente aggirabile. In questo modo, uno sviluppatore potrebbe accedere a determinate informazioni senza che il proprietario del dispositivo possa saperlo.

Un ulteriore problema, poi, sarebbe rappresentato dalla possibilità di eseguire attacchi basati su tecniche di “skill squatting”, cioè l’uso di nomi e denominazioni simili a quelle di altre skill considerate molto popolari. Uno stratagemma, questo, cui non si ricorre necessariamente per scopi malevoli, ma che spesso viene utilizzato semplicemente per ottenere un po’ di visibilità facendo leva sull’equivoco.

Insomma: il bilancio del livello di sicurezza garantito da Alexa non è propriamente positivo e alle rivelazioni dei ricercatori tedeschi si aggiunge il carico da novanta di un altro report, che riassume una serie di problematiche a livello di security che affliggono l’assistente vocale.

Lo studio, a firma di ricercatori statunitensi, elenca una serie di criticità già note (qui il link per consultarlo) emerse negli ultimi anni e che evidenziano tutti i rischi legati all’uso di Alexa.

Molti dei problemi, si legge, sarebbero stati riconosciuti da Amazon, che si sarebbe impegnata ad avviare un percorso di revisione del funzionamento del suo assistente vocale per correggere le problematiche indicate dai ricercatori.

---

---

---

https://www.securityinfo.it/2021/02/25/tutti-i-problemi-di-sicurezza-di-alexa/?utm_source=rss&utm_medium=rss&utm_campaign=tutti-i-problemi-di-sicurezza-di-alexa

Mozilla released Firefox 86 yesterday, and the browser is now available for download and installation for all major operating systems, including Android. Along with the usual round of bug fixes and under-the-hood updates, the new build offers a couple of high-profile features—multiple Picture-in-Picture video-watching support, and (optional) stricter cookie separation, which Mozilla is branding Total Cookie Protection.

Taking Firefox 86 for a spin

Firefox 86 became the default download at mozilla.org on Tuesday—but as an Ubuntu 20.04 user, I didn’t want to leave the Canonical-managed repositories just to test the new version. This is one scenario in which snaps truly excel—providing you with a containerized version of an application, easily installed but guaranteed not to mess with your “real” operating system.

As it turns out, Firefox’s snap channel didn’t get the message about build 86 being the new default—the latest/default snap is still on build 85. In order to get the new version, I needed to snap refresh firefox --channel=latest/candidate.

With the new version installed as a snap, the next step was actually running it—which could be a lot easier. The snap produces a separate Firefox icon in Ubuntu’s launcher, but there’s no way I know of to readily distinguish between the icon for the system firefox and the new snap-installed firefox. After some hit-and-miss frustration, I finally dropped to the terminal and ran it directly by issuing the fully pathed command /snap/firefox/current/firefox.

Multi Picture-in-Picture Mode

In December 2019, Firefox introduced Picture-in-Picture mode—an additional overlay control on in-browser embedded videos that allows the user to detach the video from the browser. Once detached, the video has no window dressing whatsoever—no title bar, min/max/close, etc.

PiP mode allows users who tile their windows—automatically or manually—to watch said video while consuming a bare minimum of screen real estate.

Firefox 86 introduces the concept of multiple simultaneous Picture-in-Picture instances. Prior to build 86, hitting the PiP control on a second video would simply reattach the first video to its parent tab and detach the second. Now, you can have as many floating, detached video windows as you’d like—potentially turning any monitor into something reminiscent of a security DVR display.

The key thing to realize about multi-PiP is that the parent tabs must remain open—if you navigate away from the parent tab of an existing PiP window, the PiP window itself closes as well. Once I realized this, I had no difficulty surrounding my Firefox 86 window with five detached, simultaneously playing video windows.

Total Cookie Protection

In December, we reported on Firefox 85’s introduction of cache partitioning—a scheme which makes it more difficult for third parties to figure out where you have and have not been on the Internet. Firefox 86 ups the ante again, with a scheme Mozilla is calling “Total Cookie Protection.”

In a nutshell, Total Cookie Protection restricts the ability of third parties to monitor your movement around the Web using embedded elements such as scripts or iframes. This prevents tracking cookies from Facebook, Amazon, et al. from “following you around the web.”

In theory, cookies were already strictly per-site—so contoso.com cannot set or read cookies belonging to facebook.com, and vice versa. But in practice, if contoso.com willingly embeds active Facebook elements in its site, the user’s browser treats those elements as belonging to Facebook itself. That means Facebook can set the value of a cookie while you’re browsing contoso.com, then read that value again later when you’re actually on Facebook (or when you’re on other, entirely unrelated sites which also embed Facebook content).

Total Cookie Protection nerfs this misfeature by creating separate “cookie jars” based on the identity of the URL actually present in the address bar. With this feature enabled, a Facebook script running at contoso.com can still set and read a Facebook cookie—but that cookie lives within the contoso.com cookie jar only. When the same user browses facebook.com directly, later, Facebook cannot read, write, or even detect the presence of a Facebook cookie within the contoso.com cookie jar, or vice versa.

This isn’t a panacea against tracking, by any means—for example, it does nothing to prevent scripts from Facebook, Amazon, et al. from uploading data about your Web travels to their own servers to profile you there. But it at least keeps them from using your own computer’s storage to do the dirty work for them.

No, the other TCP

If you want to enable Total Cookie Protection (and we really, really wish Mozilla had picked a name that didn’t initialize to TCP), you’ll first need to set your Enhanced Tracking Protection to the Strict profile. To do so, click the shield icon to the left of the address bar (visible when browsing any actual website, not visible on the blank New Tab screen) and click Protection Settings. From there, you can change your ETP profile from Standard to Strict.

Total Cookie Protection has a few (apparently hard-coded) exemptions for third-party login providers—for example, logging into YouTube with a personal Gmail account still allowed a visit to Gmail.com in another tab to instantly load the correct inbox without the need to log in again separately.

Mozilla warns that the Strict Enhanced Tracking Profile may break some sites entirely—and we believe Mozilla—but in our own cursory testing, we didn’t encounter any problems. We had no difficulty loading and logging in to Gmail, YouTube, Facebook, Twitter, and several other major sites.

Listing image by Airwolfhound / Flickr

https://arstechnica.com/?p=1744857

I cyber criminali non vanno in vacanza, non dormono e non si ammalano, sono sempre in agguato dietro ad ogni mail che ci arriva, ad ogni device connesso in rete, ad ogni transazione finanziaria e dietro ad ogni acquisto di prodotto o servizio.

Il 2020 è stato un anno terribile, che ricorderemo per il resto della nostra vita a causa della pandemia globale di Covid-19, delle sue conseguenze sulle nostre vite, dei costi umani, sociali ed economici che ha determinato.

<!-- LARGE RECTANGLE POST - CORPO TESTO

-->

Ricorderemo questo anno anche per l’impennata dei cyber attacchi e dei reati informatici nel nostro Paese.

Il nuovo Report Exprivia sul cybercrime

Secondo un nuovo Rapporto dell’Osservatorio Cybersecurity di Exprivia, nel periodo ottobre-dicembre 2020 si sono registrati 237 crimini informatici, in crescita del +60% sul trimestre precedente e quasi del +400% rispetto al periodo gennaio-marzo, quando furono solo 49.

Per i ricercatori, è il mese di marzo il vero spartiacque in termini di crescita degli attacchi: con l’iniziò della pandemia e, con essa, della diffusione dello smart working, si è assistito a un’impennata tra attacchi informatici, violazioni della privacy e incidenti in tutti i settori dell’economia e della pubblica amministrazione.

Il mese di dicembre, invece, con 96 eventi criminali, è stato quello che ha registrato il numero record di cyber attacchi nel 2020.

“Se da un lato la pandemia ha accelerato la digitalizzazione nel nostro Paese, dall’altro la sicurezza della rete è stata messa a dura prova. A stupirci maggiormente è che la vulnerabilità più sfruttata dagli attaccanti sia il fattore umano”, ha affermato Domenico Raguseo, direttore Cybersecurity Exprivia.

“È necessario quindi per tutti noi – ha aggiunto Raguseo – prendere consapevolezza dei rischi che si corrono in rete, iniziando a diffidare delle anomalie”.

“Ad esempio – ha concluso il direttore – dai video o dalle gif inattesi che riceviamo sulle app di messaggistica istantanea, dagli errori di sintassi contenuti nelle email sospette, dai domini non veritieri degli indirizzi di posta o dall’improvvisa velocità con cui navighiamo sul pc. Siamo noi i primi a poterci proteggere dagli attaccanti”.

Obiettivi e tipologia di attacco

In gran parte, i cyber attacchi hanno riguardato il furto di dati in Italia, con oltre il 60% degli eventi criminali.

Segue la violazione della privacy, con il 13% dei casi, dato praticamente triplicato rispetto all’inizio del 2020, e la perdita di denaro nel 10% degli attacchi.

In termini di tecniche informatiche più utilizzate dai criminali della rete, al primo posto c’è il “phishing-social Engineering”, con il 43% dei casi.

Questa soluzione colpisce in maniera particolare utenti distratti o con poca conoscenza delle modalità di adescamento tramite email o social network.

Seguono, gli attacchi “unknown” (24% sul totale degli eventi), ossia nuove metodologie sperimentate dagli hacker per non essere rilevati dai meccanismi di difesa tradizionali.

Non sono da meno i classici malware (23%), il cui utilizzo è quadruplicato nel corso dell’anno.

I settori più colpiti dai cyber attacchi

I settori, invece, più presi di mira sono stati la Pubblica Amministrazione, con 91 eventi, e il settore finanziario, con 81 eventi,.

E’ il risultato questo dei rapidi cambiamenti intercorsi nella digitalizzazione delle amministrazioni pubbliche e nella diffusione di applicazioni bancarie e di numerose soluzioni per i pagamenti digitali.

Particolare attenzione va infine rivolta al settore sanitario, al centro di rilevanti piani di investimento pubblici per potenziare il sistema nella lotta alla pandemia.

Se anche non è risultato un numero alto di attacchi ed eventi di cyber crime, comunque merita attenzione soprattutto per la criticità degli stessi, se si pensa al valore dei dati sanitari rubati e utilizzati nel dark web.

Dall’analisi degli esperti Exprivia, è emerso che nell’ultimo anno i dispositivi medicali sono stati esposti a molteplici vulnerabilità, a partire da quelli personali utilizzati da medici e pazienti per l’assistenza a distanza.

I cyber criminali, infatti, si impossessano del controllo di un dispositivo bloccando il servizio o manomettendo le funzionalità, con il fine di acquisire informazioni sensibili.

https://www.key4biz.it/report-exprivia-cyber-reati-in-aumento-in-italia-colpiti-pa-finanza-e-sanita/347093/

Mozilla this week announced improved user privacy in Firefox 86, with the introduction of a new feature aimed at preventing the tracking of users from site to site.

Called Total Cookie Protection and built into Enhanced Tracking Protection (ETP) Strict Mode, the new feature was designed to confine cookies to the websites that created them, and complements the Supercookie Protections that Mozilla introduced in Firefox 85 last month.

“Cookies, those well-known morsels of data that web browsers store on a website’s behalf, are a useful technology, but also a serious privacy vulnerability. That’s because the prevailing behavior of web browsers allows cookies to be shared between websites,” Mozilla notes.

The browser maker underlines that, with cookies shared between sites, tracking companies can tag a user’s browser and follow their browsing activity. Such cookie-based tracking is used for mass commercial tracking, allowing advertising companies to create detailed personal profiles of users.

For more than two years, courtesy of ETP, Firefox has been blocking cookies from companies identified as trackers, but the new feature is meant to take the protections to the next level, and ensure that no cookie can be used to track a user from site to site.

For that, Total Cookie Protection separates cookies by the sites that created them. Thus, when a site or the third-party content on the site stores a cookie in the browser, it is sent to a “cookie jar” assigned to that site, and never shared with other websites.

However, exceptions are made for cross-site cookies needed for non-tracking purposes, such as the cookies used by third-party login providers.

“Only when Total Cookie Protection detects that you intend to use a provider, will it give that provider permission to use a cross-site cookie specifically for the site you’re currently visiting. Such momentary exceptions allow for strong privacy protection without affecting your browsing experience,” Mozilla says.

Related: Google Moves Away From Diet of ‘Cookies’ to Track Users

Related: Google Says Chrome Cookie Replacement Plan Making Progress

Related: Firefox Cracks Down on Supercookies to Improve User Privacy

http://feedproxy.google.com/~r/Securityweek/~3/pg1jhplDVqc/new-firefox-feature-ups-ante-against-cookie-based-tracking

Nonostante la recente introduzione del cosiddetto “Codice Rosso”, ovvero una legge a tutela del genere femminile e dei soggetti deboli che subiscono maltrattamenti, vi è un importante aumento statistico sui casi di revenge porn

È notizia di poche ore fa la sentenza che ha condannato a tredici mesi di reclusione la dirigente scolastica che aveva costretto alle dimissioni la maestra che era stata vittima di revenge porn da parte del suo ex compagno e della sua attuale moglie. Quest’ultimo, infatti, con la fondamentale complicità della moglie, aveva diffuso tramite WhatsApp foto intime della maestra in un gruppo utilizzato per giocare a calcetto.

<!-- LARGE RECTANGLE POST - CORPO TESTO

-->

La dirigente scolastica, venuta a conoscenza dei fatti, aveva intimato alla maestra di dimettersi, altrimenti avrebbe agito lei personalmente. Da qui è partito un vero e proprio processo di gogna mediatica che difficilmente potrà essere dimenticato dalla vittima.

Oltre alla dirigente scolastica è stata condannata ad un anno di reclusione l’attuale moglie dell’ex compagno della vittima, “per aver divulgato le immagini osè”. L’ex compagno alla fine è stato assolto, poiché l’attività di divulgazione è risultata essere partita dalla moglie di quest’ultimo. È stata, infine, condannata anche un’altra maestra per violazione della privacy.

Insomma un video hot che si è diffuso a macchia d’olio nelle chat degli abitanti di un piccolo paesino della provincia di Torino e che ha scatenato un vero e proprio tsunami mediatico, coinvolgendo parecchie persone da un punto di vista penale.

Ma cosa è in concreto il Revenge porn? Quanti sanno che si tratta di un reato riconosciuto penalmente?

Il Revenge porn rientra tra i cosiddetti reati informatici e, tradotto letteralmente, vuol dire “vendetta pornografica”. Il sistema è tutto sommato semplice, dal momento in cui si è in possesso di video intimi del proprio partner, o più spesso, ex partner, questi vengono utilizzati o come ricatto per ottenere in cambio qualcosa, o semplicemente divulgandone il contenuto, vendicandosi con l’umiliazione inflitta.

Si riportano nella tabella di seguito alcuni preoccupanti dati pubblicati lo scorso anno dalla rivista Cyber Civil Rights:

Soggetti intervistati	1606
Individui che hanno condiviso foto o video di loro stessi nudi	61%
Vittime revenge porn	23%
Donne vittime di revenge porn	90%
Under 30	68%
Individui con risvolti psicologici negativi	93%

Dai dati appena elencati emergono numeri abbastanza inquietanti. Il dato relativo al 61% di soggetti che hanno condiviso immagini o video intimi con altra gente, lascia pensare che, ad oggi, non vi è ancora una adeguata informazione sui rischi a cui si va incontro; lascia presagire altresì che alla stregua di tali numeri, appare statisticamente più probabile la verificazione di casi di revenge porn.

Ecco, ma per il nostro ordinamento penale cosa vuol dire revenge porn?

Come accennato all’inizio, l’introduzione di questa circostanza di reato è avvenuta tramite il c.d. codice rosso, ovvero tramite la legge n. 69 del 2019. Il caso specifico del revenge porn è stato rubricato attraverso l’inserimento dell’art. 612 ter del codice penale. Il predetto articolo prevede che chiunque diffonde immagini o video a contenuto sessualmente esplicito, senza il consenso delle persone interessate, è punito con una reclusione fino a sei anni e una multa fino a 15.000 euro. È addirittura previsto che la pena sia assoggettata ad un aumento se la diffusione è avvenuta dal coniuge, o ex, o comunque da persona legata affettivamente.

Un aumento è previsto anche se la parte lesa consiste in una persona affetta da condizione di inferiorità fisica o psichica.

A ben vedere, quindi, la disciplina vigente è anche abbastanza pesante. Si possono rischiare fino a 9 anni di carcere. Eppure la divulgazione massiccia di contenuti privati a sfondo sessuale procede in maniera dilagante.

Ma in che modo il colpevole riesce a reperire il materiale oggetto di vendetta?

Per il sistema penale le modalità attraverso le quali reperire il materiale pornografico possono essere diverse e si riassumono nella misura che segue:

– è la stessa vittima, che riponendo fiducia nell’interlocutore, invia materiale sessualmente esplicito;

– vittima e colpevole registrano di comune accordo immagini durante la commissione di un atto di natura sessuale;

– la vittima viene ripresa inconsapevolmente con l’ausilio delle cosiddette spycam, ovvero delle telecamere nascoste;

– il colpevole riesce ad acquisire il materiale attraverso l’hacking dello spazio cloud dell’ignara vittima o impossessandosi di uno dei suoi dispositivi.

Nell’ultimo dei casi elencati entrano in gioco anche altri reati di natura penale, ovvero il furto.

Da un punto di visto prettamente giuridico, il legislatore è intervenuto in maniera pesante, ora la “palla” va nelle mani degli organi statali preposti alla sensibilizzazione e alle numerose associazioni nate a difesa delle vittime di questi abusi. Sono in agenda prossime ad avviare importanti campagne di informazione a scopo preventivo.

Come indicato dai dati statistici, particolare attenzione dovrà essere prestata nei confronti delle donne, che risultano essere vittime di questo reato nel 90% dei casi. Ma la prevenzione è necessaria anche per far comprendere al meglio anche i rischi a cui si va incontro; infondere maggiore consapevolezza sulla severità delle pene a cui si va incontro quando si decide con leggerezza diffondere una foto o un video.

https://www.key4biz.it/revenge-porn-la-prevenzione-e-lunico-modo-per-arginare-un-fenomeno-in-preoccupante-espansione/346862/

People returning to work following the long pandemic will find an array of tech-infused gadgetry to improve workplace safety but which could pose risks for long-term personal and medical privacy.

Temperature checks, distance monitors, digital “passports,” wellness surveys and robotic cleaning and disinfection systems are being deployed in many workplaces seeking to reopen.

Tech giants and startups are offering solutions which include computer vision detection of vital signs to wearables which can offer early indications of the onset of Covid-19 and apps that keep track of health metrics.

Salesforce and IBM have partnered on a “digital health pass” to let people share their vaccination and health status on their smartphone.

Clear, a tech startup known for airport screening, has created its own health pass which is being used by organizations such as the National Hockey League and MGM Resorts.

Fitbit, the wearable tech maker recently acquired by Google, has its own “Ready for Work” program that includes daily check-ins using data from its devices.

Fitbit is equipping some 1,000 NASA employees with wearables as part of a pilot program which requires a daily log-in using various health metrics which will be tracked by the space agency.

Microsoft and insurance giant United HealthCare have deployed a ProtectWell app which includes a daily symptom screener, and Amazon has deployed a “distance assistant” in its warehouses to help employees maintain safe distances.

And a large coalition of technology firms and health organizations are working on a digital vaccination certificate, which can be used on smartphones to show evidence of inoculation for Covid-19.

– ‘Blurs the lines’ –

With these systems, employees may face screenings even as they enter a building lobby, and monitoring in elevators, hallways and throughout the workplace.

The monitoring “blurs the line between people’s workplace and personal lives,” said Darrell West, a Brookings Institution vice president with the think tank’s Center for Technology Innovation.

“It erodes longstanding medical privacy protections for many different workers.”

A report last year by the consumer activist group Public Citizen identified at least 50 apps and technologies released during the pandemic “marketed as workplace surveillance tools to combat Covid-19.”

The report said some systems go so far as identifying people who may not spend enough time in front of a sink to note inadequate hand-washing.

“The invasion of privacy that workers face is alarming, especially considering that the effectiveness of these technologies in mitigating the spread of Covid-19 has not yet been established,” the report said.

The group said there should be clear rules on collection and storage of data, with better disclosure to employees.

– A delicate balance –

Employers face a delicate balance as they try to ensure workplace safety without intruding on privacy, said Forrest Briscoe, professor of management and organization at Penn State University.

Briscoe said there are legitimate reasons and precedents for requiring proof of vaccination. But these sometimes conflict with medical privacy regulations which limit a company’s access to employee health data.

“You don’t want the employer accessing that information for work-related decisions,” Briscoe said.

Biscoe said many employers are relying on third-party tech vendors to handle the monitoring, but that has its risks as well.

“Using third-party vendors will keep the data separate,” he said.

“But for some companies their business model involves gathering data and using it for some monetizable purpose and that poses a risk to privacy.”

The global health crisis has inspired startups around the world to seek innovative ways to limit virus transmission, with some of those products shown at the 2021 Consumer Electronics Show.

Taiwan-based FaceHeart demonstrated software which can be installed in cameras for contactless measurement of vital signs to screen for shortness of breath, high fever, dehydration, elevated heart rate and other symptoms which are early indicators of Covid-19.

Drone maker Draganfly showcased camera technology which can be used to offer alerts on social distancing, and also detect changes in people’s vital signs which may be early indicators of Covid-19 infection.

A programmable robot from Misty Robotics, also shown at CES, can be adapted as a health check monitor and can also be designed to disinfect frequently used surfaces like door handles, according to the company.

But there are risks in relying too much on technologies which may be unproven or inaccurate, such as trying to detect fevers with thermal cameras among moving people, said Jay Stanley, a privacy researcher and analyst with the American Civil Liberties Union.

“Employers have a legitimate interest in safeguarding workplaces and keeping employees healthy in the context of the pandemic,” Stanley said.

“But what I would worry about is employers using the pandemic to pluck and store information in a systematic way beyond what is necessary to protect health.”

http://feedproxy.google.com/~r/Securityweek/~3/K3VHyyNmBhc/privacy-faces-risks-tech-infused-post-covid-workplace

The European Commission lifted the threat of crucial data flows between Europe and Britain being blocked in a move that would have crippled business activity as it said Friday that privacy safeguards in the UK met European standards.

In a key post-Brexit decision, the EU executive said that British authorities had sufficient measures in place to protect European users’ personal data, freeing up data transfers for businesses as well as for police.

The adequacy decision, to be formally adopted by the 27 member states, would ensure that data protection will “never be compromised when personal data travel across the Channel,” said EU Justice Commissioner Didier Reynders.

Businesses will breath a sigh of relief at the decision, with more and more companies relying on cross-border cloud computing and other technology to function everyday.

This was made especially clear during the Covid-19 pandemic as companies, schools and governments increasingly went online, counting on big tech’s networks to operate.

A negative decision would have blocked the transfer of data from EU-based companies to the UK, crippling activity.

– Sensitive issue –

Britain is seeking similar adequacy decisions for its financial services, but this is proving far more contentious, with Brussels giving no clear indication of when a decision will be made.

The EU currently has data adequacy agreements with 12 countries, including Japan, Switzerland and Canada and negotiations are underway with South Korea.

Once approved, personal data transferring through Britain will be treated as if it was moving within the EU.

Oliver Dowden, Britain’s Secretary of State for Digital, said he welcomed the move “although the EU’s progress in this area has been slower than we would have wished.”   

“I am glad we have now reached this significant milestone following months of constructive talks in which we have set out our robust data protection framework,” he added.

The security of personal data has become a sensitive issue, with the EU’s top court having struck down a similar arrangement between the EU and United States.

The European Court of Justice has decided on several occasions that national security laws in the United States are in violation of European privacy standards making the deal illegal.

For the UK, the commission assessed that country’s Investigatory Powers Act of 2016 which contains extensive powers including the ability to carry out bulk data surveillance. 

The EU, however, found those powers were satisfactorily controlled by UK law and Britain’s adherence to the European Convention of Human Rights.

The Business Software Alliance, a lobby group for big tech companies including Microsoft, Oracle and IBM said it was “delighted” by the decision. 

“This will provide long-term confidence that data will continue to flow between the two partners post-Brexit,” said BSA’s Thomas Boue, policy chief for Europe.

Max Schrems, an Austrian lawyer and activist who led the fight against the EU’s data arrangements with the US, tweeted that there were issues with the UK proposal on security that will require “deep analysis”. 

http://feedproxy.google.com/~r/Securityweek/~3/uReob8qQ7yg/brussels-okays-eu-uk-personal-data-flows

The General Assembly is advancing legislation that allows Virginia consumers more protection with their online data, though opponents say the measure does not include the ability for people to file private lawsuits against companies that breach the proposed law.

The measure is known as the Consumer Data Protection Act in both chambers of the state legislature. The Senate version, sponsored by Sen. David Marsden, D-Fairfax, passed the House 89-9 on Thursday. The House version, sponsored by Del. Cliff Hayes, D-Chesapeake, is awaiting a final vote but was passed by for the day Thursday.

“The consumers should have the right to know what is being collected about them,” Hayes said when introducing the bill.

The data protection act allows consumers to retrieve a copy of their online data, amend or delete this data and opt out of allowing large businesses to sell the data.

Hayes wants businesses to responsibly handle consumer information.

“The bottom line is, we want the controllers to know what their role is when it comes to the protection of individual’s data,” Hayes said during a House committee meeting. “We believe that no matter who you are as an organization, you need to be responsible when it comes to handling of data of consumers.”

The bills apply to businesses that control or process personal data of at least 100,000 consumers per year. It also impacts businesses that handle data of at least 25,000 consumers per year and make more than half of their gross revenue from selling personal data. The businesses must be located in Virginia or serve Virginians.

Under the Consumer Data Protection Act, the attorney general’s office would handle the enforcement of this legislation. The office would handle anything from consumer complaints to the enforcement of fines.

“The attorney general’s office will have the depth and breadth, experience, the investigative tools necessary to know and to follow trends of companies and to make sure that they bring the muscle of that office to the table,” Hayes said.

Microsoft’s Senior Director of Public Policy Ryan Harkins testified in favor of the proposed law.

“We’ve seen dramatic changes in technology over the past couple of decades and U.S. law has failed to keep pace,” Harkins said. “It’s fallen behind much of the rest of the world and failed to address growing challenges of privacy.”

Harkins said that Microsoft has advocated for data protection laws since 2005. He said that the public has lost trust in technology, and passing comprehensive data protection legislation can help win the public’s trust back.

Harkins said that the measure stands alongside leading data protection legislation such as California’s Consumer Privacy Act and aspects of the European Union’s General Data Protection Regulation.

“In some respects, it would go further and provide the most comprehensive and robust privacy laws in the United States,” Harkins said.

Attorney Mark Dix spoke in opposition of the bill on behalf of the Virginia Trial Lawyers Association. He said the measure would hurt Virginians because it is “going to close the courthouse doors.”

“It provides no cause of action whatsoever for the consumer, the person who is actually hurt,” Dix said. “It provides no remedy whatsoever for the consumer.”

Dix argued that having the attorney general’s office handle the enforcement of this legislation limits the consumer.Using a hypothetical scenario, Dix asked what would happen to Virginians if there was an administration change and the Attorney General did not prioritize data protection.

The Consumer Data Protection Act would take effect in January 2023. Marsden told a Senate subcommittee that allows time to “deal and field any other tweaks to the bill or difficulties that someone figures out.”

Related: With No Unifying U.S. Federal Privacy Law, States Are Implementing Their Own

Related: Tech Giants Hope for US Data Privacy Law

Related: California Voters Expand Data Privacy Law

Related: Unique Illinois Privacy Law Leads to $550M Facebook Deal

http://feedproxy.google.com/~r/Securityweek/~3/OwXr3WRMjWI/virginia-lawmakers-advance-consumer-data-protection-act