Archives for May 2021

US pipelines ordered to increase cyber defenses after hack

WASHINGTON (AP) — U.S. pipeline operators will be required for the first time to conduct a cybersecurity assessment under a Biden administration directive in response to the ransomware hack that disrupted gas supplies in several states this month.

The Transportation Security Administration directive being issued Thursday will also mandate that the owners and operators of the nation’s pipelines report any cyber incidents to the federal government and have a cybersecurity coordinator available at all times to work with authorities in the event of an attack like the one that shut down Colonial Pipeline.

Pipeline companies, which until now operated under voluntary guidelines, could face financial penalties that start at $7,000 per day if they fail to comply with a security directive that reflects an administration focus on cybersecurity that predates the May attack on Colonial, senior Department of Homeland Security officials said.

“The evolution of ransomware attacks in the last 12-18 months has gotten to a point that it poses a national security risk and that we are concerned about the impact on national critical functions,” one of the officials said, speaking on the condition of anonymity to discuss details of the regulation ahead of the formal release.

Criminal syndicates, often based in Russia or elsewhere in Eastern Europe, have unleashed a wave of ransomware attacks in which they scramble a target’s data with encryption and demand a ransom. Victims have included state and local governments, hospitals and medical researchers and businesses large and small, leaving some victims unable to perform even routine operations.

The hack that targeted Colonial Pipeline prompted the company to shut down a system that delivers about 45% of the gasoline consumed on the East Coast for about a week. It led to panic-buying and shortages at gas stations from Washington, D.C., to Florida.

It came up in Congress on Wednesday as DHS Secretary Alejandro Mayorkas outlined the agency’s budget next year to the House Appropriations Committee’s subcommittee for homeland security.

“The Colonial Pipeline breach, in particular, was a wake-up call to many Americans about how malicious cyber actors, often backed by foreign states, can disrupt the U.S. economy and all of our lives,” said Rep. Lucille Roybal-Allard, D-Calif., the panel’s chair.

Colonial Pipeline, based in Alpharetta, Georgia, later disclosed it paid a ransom of $4.4 million to retrieve access to its data from the gang of hackers, linked by the FBI to a Russian-speaking criminal syndicate known as DarkSide.

The episode exposed the threat to the more than 2.7 million miles (4.4 million kilometers) of pipeline used to transport oil, other liquids and natural gas around the U.S.

The TSA is responsible for the physical security and cybersecurity of this network and has worked with the owners and operators, about 100 companies in all, to develop the voluntary guidelines and conducts on-site assessments. Lawmakers and experts have been critical of industry security standards.

DHS, under Mayorkas, launched a “60-day sprint” to focus the agency on the ransomware threat weeks before the Colonial Pipeline hack became publicly known on May 7. The directive is intended to address issues that emerged in the response and may have enabled the hack to occur in the first place.

Pipeline owners will be required to do the assessment within 30 days. They will have to show how their processes line up with the voluntary guidelines, identify any gaps and provide a plan for addressing them, the officials said.

Operators will be required for the first time to report any cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency, another DHS component. Companies have been reluctant to report breaches in the past for a variety of reasons, including embarrassment and concern that they could expose themselves to legal liability.

Pipeline companies will also have to designate a cybersecurity coordinator who would be on duty 24 hours a day, seven days a week to work with TSA and CISA in case of a breach like the one at Colonial Pipeline.

Twitter urges Indian gov’t to respect freedom of expression

NEW DELHI (AP) — Twitter on Thursday said it is worried about the safety of its staff in India and called for the government to respect freedom of expression, days after Indian police visited its office in New Delhi over its labeling of a tweet by a governing party spokesman as “manipulated media.”

Twitter has been involved in a tense battle with the Indian government, which has often asked it to restrict content alleging Prime Minister Narendra Modi’s administration is trying to silence criticism, including of its handling of the coronavirus pandemic.

Twitter said it has “concerns with regards to the use of intimidation tactics by the police” and “the potential threat to freedom of expression for the people we serve.”

On Monday, Indian police visited the Twitter office in New Delhi to serve a notice directing it to answer questions about its tagging of the tweet as manipulated.

“It appears that Twitter has some information which is not known to us on the basis of which they have classified it as such,” police said in a statement.

On Wednesday, the messaging app WhatsApp filed a lawsuit in Delhi High Court arguing that new government rules that require it to make messages “traceable” to external parties are unconstitutional and undermine the fundamental right to privacy.

WhatsApp currently uses end-to-end encryption for its messaging service, which encrypts messages in such a way that no one apart from the sender and receiver are able to read the messages sent between them.

Sweeping new regulations for technology companies were announced in February that hold them more accountable for content shared on their platforms. A 90-day grace period for complying with the rules ended Wednesday.

Leaders from Modi’s party last week tweeted portions of a document they said was created by the main opposition Congress party to make the government look bad over its handling of the pandemic. Some Congress leaders complained to Twitter, saying the document was forged. In response, Twitter marked some posts as “manipulated media.”

Under Twitter rules, it applies “manipulated media” tags to posts that have been “deceptively altered or fabricated.”

Twitter said in its statement Thursday that “to keep our service available, we will strive to comply with applicable law in India.”

“But, just as we do around the world, we will continue to be strictly guided by principles of transparency, a commitment to empowering every voice on the service, and protecting freedom of expression and privacy under the rule of law,” it said.

Critics accuse Modi’s government of silencing criticism on social media, particularly Twitter, a charge senior leaders of the governing party have denied.

The new social media regulations give the government more power to police online content. They require internet platforms such as Facebook and Twitter to erase content that authorities deem to be unlawful and to help with police investigations, including identifying the originators of “mischievous information.”

Social media sites, including Twitter, Facebook and WhatsApp, were given three months to comply.

European privacy groups challenge facial scan firm Clearview

LONDON (AP) — Privacy campaign groups filed legal complaints Thursday with European regulators against Clearview AI, alleging the facial recognition technology it provides to law enforcement agencies and businesses breaches stringent European Union privacy rules.

Four groups complained to data protection authorities in France, Austria, Greece, Italy and the U.K. about Clearview’s practices. They say the company stockpiled biometric data on more than 3 billion people without their knowledge or permission by “scraping” their images from websites.

The complaints say Clearview didn’t have any legal basis to collect and process this data under the European Union’s General Data Protection Regulation, which covers facial image data. Britain adopted its own version of the EU privacy rules after it left the bloc.

“Clearview AI has never had any contracts with any EU customer and is not currently available to EU customers,” CEO Hoan Ton-That said in a statement.

News of Clearview’s stockpile, first reported by The New York Times, raised concerns that the type of surveillance seen in China could happen in Western democracies.

Privacy International said European data protection laws clearly outline the purposes for which companies can use personal data.

“Extracting our unique facial features or even sharing them with the police and other companies goes far beyond what we could ever expect as online users,” said Ioannis Kouvakas, London-based Privacy International’s legal officer.

Italy’s Hermes Center for Transparency and Digital Human Rights, Greece’s Homo Digitalis and Austria’s noyb were also part of the challenge. The complaints are partly based on requests individuals can file to see what data a company holds on them. Ton-That said Clearview “voluntarily processed” the requests, which “only contain publicly available information, just like thousands of others we have processed.”

Clearview is already facing global scrutiny.

American civil liberties activists filed a similar legal challenge in March that sought to bar Clearview from collecting biometric information in California and force it to delete data on Californians collected from sites including Facebook, Twitter, Google and Venmo.

Meanwhile, privacy watchdogs in Britain, Australia and Canada have opened investigations into the company.

___

For all of AP’s tech coverage, visit https://apnews.com/apf-technology

___

Follow Kelvin Chan at https://www.twitter.com/chanman

January COLA? Up, up and away!

Federal, military and Social Security retirees are in line for a cost of living adjustment (COLA) that could be their biggest in more than a decade. Current projections of the size of the inflation catchup range from 3% to as much as 4.7%.

The higher 4.7% estimate comes from the Senior Citizens League, which says it would be the highest COLA since 2009 when retirees got 5.8%, reflecting price increases as the nation climbed out of the Great Recession.

The final amount of the 2022 COLA won’t be determined until living costs for July, August and September are tallied. That final figure won’t be announced until early October.

Most recipients of Civil Service Retirement System (CSRS) and military and social security benefits will get the full COLA. Their benefits are linked to the official increase in inflation from the third quarter of this year over the third quarter of the previous year. And they are automatic. Most current federal retirees are under the CSRS program and will get the full amount of the 2022 COLA. But those who are under the newer Federal Employees Retirement System (FERS) plan — the majority of current workers and of future retirees — aren’t guaranteed full inflation protection. COLAs for them don’t kick in until they are 62 or older, and the amount of the COLA is 1% less than the full inflation rate if it is 2% or higher. So if the COLA is 3%, they would get 2% in January. If it is higher, like the 4.7% estimate, they would get 3.7%. This year all retirees got a 1% COLA.

When Congress created the FERS program, it put civil servants under Social Security for the first time. And it gave they a more generous 401k plan option which includes a matching government contribution of up to 5%. CSRS employees do not get any government match to their Thrift Savings Plan accounts. In addition to getting a smaller federal annuity based on their contributions, cost of living adjustments for FERS retirees don’t begin until age 62.

Arthur Stein, a Washington area financial planner specializing in federal investors estimates, says that thanks to reverse compounding, the diet COLA can over an extended period of time reduce FERS retirees total income by as much as 30%. For more on what inflation over time can do to a FERS annuity, and what you can do to minimize the damage, click here.

The January federal pay raise is a different animal. The amount each year is set by Congress and the White House based on political and fiscal conditions. This year, active duty civil servants got a 1% raise. President Biden has proposed a 2.7% pay raise while some House Democrats are pushing for a 3.2% increase. Under the House plan, 1% of the raise would be allocated to locality pay, meaning that feds in areas like Washington D.C., San Jose-San Francisco, Houston, New York City and Chicago would get bigger raises than their counterparts in Louisville, Salt Lake City or Fargo.

Although often confused, there can and usually are major differences between a federal pay raise and a COLA for retirees. When Congress gets a raise, many members refer to it as a cost of living catch-up, even though the final amount is often a political call with little or no relation to the rate of inflation as measured by the Bureau of Labor Statistics Consumer Price Index-W. That’s a city-by-city pulse check by the Labor Department on prices for a market basket of goods. Groups representing retirees, such as the National Active and Retired Federal Employees (NARFE), say the government should be using the CPI-E — for elderly — that takes into account higher costs for retirees for things like health care and prescriptions. While both CPI indexes measure food, drink, housing, clothing, transportation and costs for education and recreation, the CPI-E gives greater weight to medical costs. That would benefit most retirees in the form of higher COLAs.

Nearly Useless Factoid

By Alazar Moges

RSVP, while commonly known to most non-French speakers simply to signal a reservation response to an invitation, actually stands for “répondez s’il vous plaît,” French for “please reply.”

Source: Cambridge Dictionary

Oprah, Prince Harry host discussion with Gaga, Glenn Close

LOS ANGELES (AP) — Oprah Winfrey and Prince Harry are continuing their mental health series with a virtual town hall featuring Lady Gaga, Glenn Close and others.

Apple TV+ announced Wednesday that it will release on Friday “The Me You Can’t See: A Path Forward.” The free town hall arrives a week after the mental health series co-created by Winfrey and the Duke of Sussex, “The Me You Can’t See,” was released on the streaming platform.

The series features a mix of stories of celebrities and everyday people and their mental health struggles and breakthroughs. In one episode, Gaga revealed the trauma of a rape she said left her pregnant at age 19.

Harry discussed his own anxiety, therapy and coping techniques for the series, which debuted last week. The duke and his wife Meghan are living in California while they await the birth of their second child.

Harry told The Associated Press he felt compelled to discuss his struggles in the hopes it will help other people. “I see it as a responsibility. I don’t find it hard to open up,” he told the AP last week. “Knowing the impacts and the positive reaction that it has for so many people that also suffer, I do believe it’s a responsibility.”

Other notable participants include NBA players DeMar DeRozan and Langston Galloway, boxer Virginia “Ginny” Fuchs, and celebrity chef Rashad Armstead.

Archives for May 2021

Nearly Useless Factoid

Footer