Comm 151 Exam 3 Readings

High-Level Organizer of Notorious Hacking Group FIN7 Sentenced to Ten Years in Prison for Scheme That Compromised Tens of Millions of Debit and Credit Cards Langlie

- Fin7 (aka Carbanak Group and the Navigator Group) had more than 70 people working as hackers, malware developers, or crafting emails that duped victims. - "hacked into thousands of computer systems and stole millions of customer credit and debit card numbers which were used or sold for profit" (including Chipotle, Chili's, Arby's, Red Robin, Jason's Deli, etc.) - Sent customized legitimate-seeming email messages and bolstered with telephone calls - Hladyr: FIN7's systems administrator (aggregated stolen payment card information, supervised FIN7's hackers, maintained servers, and ran their encrypted channels of communication).

Fair Use In The Age Of Social Media. Herzfeld and Melzer

- "There Is No Blanket Right To Copy Others' Works, Even If Properly Attributed" (AFP sued by photograph over Haiti pics that someone else redistributed on Twitter. $1.2 million award, but AFP didn't defend as fair use). - "Using Someone Else's Copyrighted Image In Your Online Conversation Is Not Necessarily Transformative" Iwo Jima and Ground Zero juxtaposition was "me, too," not transformation. Copyright holder was known, and wasn't breaking news - "Adding 'Comments' To Appropriated Art May [NOT] Constitute Transformative Fair Use" (Instagram portraits exhibited [enlarged, with comments] and sold without permission of original photographer or subject of photos. (2017 update: Artist lost)

The Net Neutrality Battle Lives on: What You Need to Know after the Appeals Court Decision Reardon

- 2010 Court: Does FCC have authority to regulate how ISPs shape/block/price their network traffic? - Could impose common carrier regulation on "telecommunications services" (Title II) but NOT "information services." (Title III) FCC previously called ISPs info services. Reclassified as telecom utility under Obama; Pai's - FCC changed it back, but "ISPs will have to make public disclosures if they engage in blocking or throttling of Internet content, and they will have to disclose deals that prioritize content from affiliates or content from companies that pay ISPs for priority access." - Generally, no ISP "blocking or throttling traffic [or] paid prioritization." [But did allow traffic management, paid prioritization for "specialized services" and zero-rating data (T-Mobile "Binge On" promotion)]. - States passing own net neutrality regulations. FCC tried to preempt state/local regulation. 2019 Mozilla vs. FCC appeals court ruling: FCC overstepped in trying to preemptively ban state net neutrality laws (although they might still be able to challenge case-by-case). CA law passed, but not yet enforced.

Amazon Echo's Privacy Issues Go Way Beyond Voice Recordings Benjamin

- Amazon Alexa and Echo have been criticized for amount of data they collect and how pervasive/ private that data is. - As an assistant, more online activity is routed through these devices (including those related to one's home or health); - Arguably worse than Apple or Google because they store & process such info on the device; Amazon less transparent. - Terms of service or features might change later (opt out vs. opt in).

From the web to the streets: internet and protests under authoritarian regimes Ruijgrokg

- Argues CMC has increased access to information (especially in authoritarian states), increasing protest behavior (but maybe not democratization) by... - Reducing the costs of communication costs for movements - Fostering attitude changes (exposure to government failures, civic debates, and alternative ideas) - Spread of dramatic videos and images to help mobilize supporters (sparking event helps) - Notes regimes can respond with more censorship or punishment (adapt). - Looks at Tunisian revolution as case study; models effect of use vs. protests in democracies and authoritarian regimes; find stranger effect in latter.

The Political Power of Social Media: Technology, the Public Sphere, and Political Change Shirky

- Argues authoritarian governments face "conservative dilemma" -- want economic benefits of CMC, but risk giving the public greater awareness of problems (versus reliance on state-controlled mass media for info) - Common responses are censorship, propaganda, and ability to cut off internet. And uses of force - Non-political social uses of media can be politicized ("cute cat" theory of digital activism: non-political tools can be repurposed and are harder to shut down without blowback or harming economy) - Contra Gladwell: Social media powerful as coordination and documentary tool - Concerned about steps to weaken coordination role: real names, delayed posting, imprisonment, reduced freedom of assembly, licensing of text messges

Modern Problems Require Modern Solutions: Internet Memes and Copyright. Matalon

- Argues that "memes, which bear no expectation of economic profit, neither require incentivization nor undercut the incentives of others" and thus should fall outside the normal copyright regime (no copyright protection, and no copyright liability) - Suggests three ways the Copyright Act might be modified: - A more consistent standard of fair use: (goal is to allow socially desirable conduct when it doesn't harm rights-holder's incentives), but meme-generator doesn't benefit financially and can't afford to negotiate rights (transaction costs or the license). "Inconsistency [in court decisions] is chilling and expensive." Need consistency. - Reforming statutory damages (which accrue even if the rights holder doesn't prove actual damages). Argues $750 minimum per infringement disproportionate to actual harm, or exception needed for internet behavior. - Revisit "formalities" (actions necessary before litigation is possible): Notice, registration, and deposit. Abandoned in late 20th Century, but could return?

What Digital Advertising Gets Wrong Aral

- Argues that online ad effectiveness is overstated because of confusion between causation and correlation - Can't easily tell "lift" from exposure to an ad unless you control for other factors - Ideal to test with controlled experiment; can sometimes test with "natural" experiment (draft lottery example) - Argue that companies could advertise better online by reaching narrow segments of under-touched consumers (vs. blanketing wider categories of likely consumers).

Why the Lean Start-Up Changes Everything Blank

- Business plans rarely survive first contact with customers - Foolish to make five-year plans to forecast complete unknowns - Successful startups "go quickly from failure to failure, all the while adapting, iterating on, and improving their initial ideas as they continually learn from customers." Less value to "stealth mode" rollout. - Distinguishes between executing a business model (traditional) vs. searching for one (lean startups). - Begin with hypotheses in a framework called a "business model canvas." - Then do customer development to test hypotheses quickly (MVP to immediately get feedback & iterate). Agile development of product, working with customer development. - Responsive development: short, repeated cycles of development & evaluation. - Startups previously constrained by: 1. The high cost of getting the first customer and the even higher cost of getting the product wrong (more customer input earlier now) 2. Long technology development cycles (shortened now) 3. The limited number of people with an appetite for the risks inherent in founding or working at a start-up. (less risky now) 4. The structure of the venture capital industry, in which a small number of firms each needed to invest big sums in a handful of start-ups to have a chance at significant returns. (Funding available far more widely, including crowdsourcing) 5. The concentration of real expertise in how to build start-ups, which in the United States was mostly found in pockets on the East and West coasts (spreading widely now, including adoption by traditional companies & universities)

500 Chrome extensions secretly uploaded private data from millions of users: Extensions were part of a long-running ad-fraud and malvertising network Goodin

- Combine trojan horse, malvertising, and ad fraud. - More than 500 extensions (with millions of installs) secretly uploaded private browsing data to attacker-controlled servers - Also redirected users through several sites (ad fraud) and updated user configurations. - Also sent users to malware and phishing domains - Similar to prior browser extensions that aggregated and sold data (Nacho Analytics) before shutting down.

Beyond Bitcoin: The Rise of Blockchain World Beck

- Defined: "tamper-resistant database of transactions consistent across a large number of nodes" - Argues it solves a problem of trust: "Permanent record-keeping that can be sequentially updated but not erased creates visible footprints of all activities conducted on the chain." Transparency of records allows anyone to examine the entire record of changes - Example: sending copies of assets allows them to be spent more than once (no longer rival and excludable). - Prior solution: Big, centralized (slow, expensive, exclusive, intrusive) intermediaries perform authentication, identification, clearing, settling, and record keeping. - New solution: Blockchain (public global ledger protected by encryption), which allows strangers to interact w/ trust. - Contracts and other forms of agreements can be electronically executed without trust- associated friction costs... transparent code. - Decentralized autonomous organizations (DAOs) can implement agreements and transactions without any central authority (can enforce rules transparently and autonomously). - Examples of broader use: Land titles; sharing platform; remittances; privacy management (and self-monetization), IP, tamper-proof communication on the IoT.

How Does Advertising Affect Culture Vigo

- Discussing the impact of television/media/advertising on prior cultural reference points - Internet ads haven't had the same cultural impact - "Everything today is so localized and subject-specific that in many respects remarketing tools, even though deemed a success by many experts, in my estimation, they fundamentally fail" at influencing (or uniting) the culture. - Similar to news concern re: common set of shared facts...

Privacy and Information Technology Hoven et al.

- Distinguishes between constitutional/decisional ("freedom to make one's own decisions without interference by others in regard to matters seen as intimate and personal") and informational/tort ("interest of individuals in exercising control over access to information about themselves") privacy. - Also discuss descriptive vs. normative approaches (and also whether privacy is a goal or a means to other goals) and data protection (EU approach) vs. privacy (U.S. approach) - Personal information/data: "information or data that is linked or can be linked to individual persons." - Moral reasons for protecting personal info: Prevention of harm (see hacking section); Informational inequality; Informational injustice and discrimination (ProPublica investigation into housing discrimination); Encroachment on moral autonomy. - Argue most countries regulate collection of personal info; "requires that its purpose be specified, its use be limited, individuals be notified and allowed to correct inaccuracies, and the holder of the data be accountable to oversight authorities." - How does InfoTech affect privacy? Connectivity has increased everyone's access to info (for good or ill) - Internet has made it much easier to track behavior (cookies, social network tracking, cloud storage, and ISPs); often operating at system level with little user awareness of risks. - Social networking sites increase temptation to share personal info - Big data includes info not necessarily shared by user (metadata on browsing, search terms, links clicked, etc.; potentially merged across different data sources, like Ralph's Club) IoT devices and RFID devices are huge data source - Solutions? "Privacy by design," privacy-enhancing tech (Tor or encryption); identity management ("unlinkable" users)

Artificial Intelligence, Automation, and the Economy Executive Office of the President

- Economic effects of prior technological changes (notes differential impact based on worker skill). - 1800s: tech raised productivity of unskilled workers (displaced skilled workers, even though average living standards went up b/c of greater productivity) - Late 20th century: high-skill workers advantaged by tech; much routine & manual work replaced by automation. - Expect that AI-driven automation will be another wave (worried about lasting, unequal impact). - Hard to predict effects of AI since it's "not a single technology, but rather a collection of technologies that are applied to specific tasks" but try to give a framework for general predictions. - Expect changes to continue bias toward skilled workers. Disagreement on details (replacing occupations vs. tasks), but expecting millions of jobs to be affected negatively (mostly low-wage, low-skill jobs) - AI weaknesses: social or general intelligence, creativity, or human judgment (school bus driver less replaceable than truck driver). Not clear whether all such jobs will be replaced or transformed - More jobs? Expect growth in "...areas where humans engage with existing AI technologies, develop new AI technologies, supervise AI technologies in practice, and facilitate societal shifts that accompany new AI technologies;" indirect benefits of greater productivity. - The end of (human) work? Comparative human advantage likely to erode; inequality driven by "superstar-biased" tech change as a concern. Hope is that things will play out like prior waves.

Note, Intellectual Property In Stand-Up Comedy: When #********Jerry Is Not Enough Pham

- Examines joke theft on social media as an interesting copyright case. - Easy for anyone to aggregate and distribute others' jokes (many prominent social media accounts do this). - Copyright status: 1- or 2-liner jokes aren't really protected (standard is "virtual identity") - Longer ones might be if they have "a certain minimum amount of original expression in tangible form" but comedians are generally unwilling to sue (vs. use norms to punish within community) and altering the joke is often enough to undercut claim. - Verbatim (or near) copying is most common online; copyright applies (and norms are weaker outside of community) - Damage of redistribution greater than music b/c of surprise.

How the Chinese Government Fabricates Social Media Posts for Strategic Distraction, not Engaged Argument King et. al

- Examines pro-governmental commenters online (50c). Find millions of commenters (mostly gov't employees) post approx. 450 million posts per year (majority on government sites; others on social media). - Conventional wisdom: 50c commenters attack/argue; instead, they find they distract and promote (mainly to help reduce collective action potential). - Notes President Xi's 2014 call for Chinese government officials to "have a good grasp of the timing, degree, and efficacy of online public opinion guidance so that online spaces are clear and unclouded" - includes "traditional" propaganda/control of press, and also "newer types of opinion guidance for social media such as 50c party activity, censorship, the Great Firewall, etc."

Something Old, Something New, and Something Moot: The Privacy Crisis Under the Cloud Act Bilgic

- Gives unlimited access to qualifying foreign governments (currently only UK) without much of a check on AG determining foreign gov't "affords robust substantive and procedural protections for privacy and civil liberties" (Congress can override agreement, but pres. can veto) - Concern that US might use UK to go around US constraints (and not notify citizens) and is vague on things like free speech protections. Also concerned about undisclosed PRISM-like programs. - Excluding non-qualifying foreign governments "creates an unwelcoming U.S. exceptionalism to foreign governments, which will likely lead to an increase in other countries' efforts to enact data localization laws (which also threaten the digital privacy of foreign citizens). [Apple China example] - Frustrates efforts by other countries to protect their citizens' data from surveillance by the U.S. - Wants a new "multilateral treaty would not only overcome the slowness of the MLAT system, but would also limit the overbroad access of the CLOUD Act "

The Fight Against Ad Blocking: Why Blocking the Blockers Is Not Enough Broughton

- Google controls a huge chunk of the advertising market, and also dominates browser marketshare (Chrome and Android) - Potential conflict of interest with third-party ad blockers (article notes that Google pays some not to block its ads; not limiting those blockers in new changes) - Changes to Chrome (Manifest V3) limit many third-party ad-blocker's ability to block content before it is sent to the browser or rules-based blocking (limiting the total number of rules) - Fallback of relying on built-in adblocking doesn't block 99% of ads - Most (74%) consumers will leave site rather than turn off blocker - Broughton argues better-quality ads will decrease pressure to block.

he Impact of Media Censorship: 1984 or Brave New World? Chen and Yang

- Measure effects of providing uncensored internet in China in 2015-2017. - Experiment: Tracked 1,800 university students' media consumption & attitudes, economic beliefs, political attitudes, and behaviors over 18 months (randomly assigned to control and treatment groups. Treatment group got free VPN; subset were encouraged (news quizzes with rewards) to visit foreign news sites blocked by the Great Firewall] - Main results (based on directly observing all of their (anonymized) online activities on sites hosted outside of China) - free access alone does not induce subjects to acquire politically sensitive information (about half never activated the VPN; about a quarter who activated later uninstalled); - temporary encouragement leads to a persistent increase in acquisition, indicating that demand is not permanently low (find peaks during sensitive news shocks, too). Suggest that this stems from initial low valuation of foreign news quality (increased upon exposure) - acquisition brings broad, substantial, and persistent changes to knowledge, beliefs, attitudes, and intended behaviors; and - social transmission of information is statistically significant but small in magnitude.

Automation and Anxiety The Economist

- Microeconomics: "Analysis of the forces of supply and demand that affect the prices and output of a single commodity, or firm, or possibly a single industry; or the behavior of single individual or household consumers." - Significance of a market economy: Every individual pursues their individual interest, but ends up (unintentionally) promoting the overall welfare of society as the "invisible hand" of the market turns individual greed into societal benefits.

How Your Digital Trails Wind Up in the Police's Hands Fussell

- More and more data is being collected about us as more activities shift to CMC. - Increasingly tapped for new purposes (including investigations) - Sometimes purchased from data brokers, not through the legal process - Consent to collect data for one purpose (weather, prayer, exercise) and then sold for another (problems with consent). - can also issue warrants based on keywords or geofence - Concerns about violating 4th Amendment protections against invasive searches - Example: arson suspect exposed by searching Google for the address of the event around the time of the arson, then pulled the search history for two of his accounts (detonation of diesel; extradition, and video of the victim/witness speaking out).

Behind the Great Firewall, the Chinese Internet is Booming Yuan

- Response to perception that "without freedom of expression you can't innovate ...[and that] American companies would be successful if it weren't for Chinese protectionism ...[and] Chinese people would really want to see American websites if they could." - Thinks restricted content offset by local content (more relevant to daily lives) Network effects and utility of products like WeChat make them indispensable - "Micro-innovation" copies existing idea and adapts/extends it (usually cheaper) - Rapid adoption of tech like mobile payments are spurring innovations - Argues that copying is now reversing (messaging-based payments/ commerce, lunch delivery, etc).

Everything You Need to Know about Section 230 Newton

- Section 230 of the Communications Decency Act prevents people from suing providers of an "interactive computer service" for libel if users post defamatory messages on their platforms. - Social media companies not liable for user-generated content (not considered the publisher), or for making good-faith decisions to restrict/remove content they deem "obscene, lewd, lascivious, filthy, excessively violent, harassing or otherwise objectionable, whether or not such material is constitutionally protected" - Called the "most important law protecting internet speech," but frequently misrepresented and attacked. Doesn't prevent companies from creating rules that restrict speech (moderation rules protected by first Amendment)

Watch Out: This Verizon Smishing Scam Is Crazy Realistic Hoffman

- Sends a text message that directs to a fairly realistic (other than the URL) Verizon account login page; - Follows up with more info (pitched as a security challenge), then sends you to Verizon's real page. - Acct. info lets hackers order items on your account, but also potentially intercept 2- factor authentication.

The U.S. Patent System Is Broken, Says The Inventor Of The Hoverboard Shepard

- Shane Chen invented the hoverboard in 2013 and patented it; ran Kickstarter campaign to fund it. - By 2015, his version had been copied by more than 600 Chinese businesses. More than 1k Chinese factories building them by 2016. He received no royalties. Companies don't stand behind their product. - Previously invented the Solowheel and tried (unsuccessfully) to sue infringers (alleges political pressure on local judges). In some cases, Judges ruled in his favor but required he give permission for counterfeiters to continue manufacturing. - U.S. IP protection circumvented by ecommerce (including huge American companies like Walmart, eBay, Amazon) enabling U.S. consumers to buy from infringing factories located overseas. Not liable for third-party infringement. - Injured company has to sue thousands of infringers overseas (impossible)

Building a Startup That Will Last Taneja and Chenault

- Startups that last? Identified "foundational elements that have contributed to these companies' tenures." - Society-first principles (profitability is important, but need broader purpose and values to motivate) [but be skeptical of what companies say motivates them] - Adaptable long-term strategies (not just a one-shot). American Express (shipping company, traveler's cheques, credit cards), Microsoft. - Scalable leadership (enable delegation and distribution of decision-making aligned with core values)

Inside the NSA's Secret Tool for Mapping Your Social Network Gellman

- Talks about Stellarwind (frantic post 9/11 plan to track domestic American phone calls) and Mainway (the database the NSA created to do that). Negotiated the secret bulk purchase of metadata from ATT and Verizon. - Program was classified as "exceptionally controlled info" and concealed from FISA judges and Congress. - Used the program to "identify, track, store, manipulate and update relationships," but also to "identify targets in email or location databases, and vice versa"; goal was the "Big Awesome Graph" (BAG), which would "allow the NSA to display nearly anyone's movements and communications on a global scale" - Calculated these relationships in its database continuously (precalculated, vs on demand) (billions of records added and purged per day to stay within 5-year limit on retention) - Boston bomber example: ready to show Tsarnaev graph the moment he was ID'd. But yours, too. Only 22 U.S. officials could order a contact chain be built, but worries that rules change.

6 Things You Need to Do to Stop Yourself Getting Hacked in 2021 Burgess

- Use multi-factor authentication (Duo is your friend) - Get a password manager (major trusted one) - Be wary of phishing attacks and learn to recognize them - Keep your devices updated - Encrypt everything (messaging, email, files on devices) - Delete "digital footprint" (old accounts, Google search history) - Also good to back up your files regularly

The Single Biggest Reason Why Startups Succeed Gross

- What five things matter most for startup success (and why do so many fail) - Timing: Accounted for 42% of difference between success and failure. - Team and execution: #2 - The idea (uniqueness): #3 - Business model (can add later in response to customer feedback) - Funding (pretty easy to get if you have traction)

Malware Tip Card Cybersecurity and Infrastructure Security Agency

Malware, short for "malicious software," includes any software (such as a virus, Trojan, or spyware) that is installed on your computer or mobile device. The software is then used, usually covertly, to compromise the integrity of your device. Most commonly, malware is designed to give attackers access to your infected computer. That access may allow others to monitor and control your online activity or steal your personal information or other sensitive data.

Internet Regulation vs. Freedom of Speech: A Cyberlaw Case Study of Section 230 Raynor et al.

Trump and Biden both called for Section 230 to be modified (carveouts or bargaining chips); 2018 FOSTA legislation created an exception to 230 for civil and criminal charges of sex trafficking or to conduct that "promotes or facilitates prostitution." (arguably increased harm to sex workers)