Category: News

There was no shortage of advice, updates and points to ponder for upwards of 200 attendees at a panel discussion held earlier this month at a virtual three-day conference called Quantum Days 2023.

The panel, moderated by Prof. Raymond Laflamme, a leading Canadian theoretical physicist who studied for his PhD under Stephen Hawking and currently teaches at the University of Waterloo, also contained an update and discussion on another panel of which he is chair of – The Expert Panel on Quantum Technologies.

In May, it was announced that, at the request of the National Research Council of Canada (NRC) and Innovation, Science and Economic Development Canada (ISED), the Council of Canadian Academies (CCA) had formed a panel to “examine the impacts, opportunities and challenges quantum technologies present for Canadian industry, governments and Canadians.”

Laflamme said at the time that “quantum technologies have the potential to transform computing, sensing, communications, healthcare, navigation and many other areas. But a close examination of the risks and vulnerabilities of these technologies is critical.”

At this month’s event, he was joined by Jeff Kinder, project director of quantum technologies with the CCA, an organization that says it evaluates the “best available evidence on complex issues where the science may be challenging to understand, contradictory, or difficult to assemble,” as well as Dr. Jacqueline Bartlett, an associate professor from Memorial University, and Prof. Mauritz Kop, both of whom are members of the Expert Panel.

Kinder said that in addition to answering “a fairly broad main question about the opportunities and challenges of quantum technologies, there are three sub questions that provide a tighter focus for the assessment. These ask about leading practices and enabling conditions for the adoption of quantum technologies, as well as the social, ethical, and legal challenges associated with their adoption.”

Panel members, said Bartlett, who has worked with entrepreneurs and small businesses in the technology sector for 25 years, are examining quantum from a number of different lenses.

Describing it as a “bird level view,” she said they are “looking at programs, initiatives, policies, all the things you can imagine. What collaborations would really help drive the different sectors that we’re looking at, but equally important, is there any low-hanging fruit that we can get some early wins and if so, where are they? What are the priorities and are there preconditions that we have to meet before we can actually set some of the programs in place?”

While Bartlett’s expertise revolves around entrepreneurship, Kop, who is a visiting scholar at Stanford Law School and whose current research includes the ethical, legal, social, and policy implications (ELSPI) of quantum, spoke at length about the importance of having guidelines in place.

“Raising quantum ELSPI awareness is really about building bridges between disciplines – hard science, humanities and social sciences – and it’s about learning to speak each other’s language,” he said.

“We should apply a comprehensive quantum ELSPI vision to the Canadian quantum sector. Therefore, it’s a promising sign that Canada’s National Quantum Strategy explicitly mentions, in its own words, the importance of ethical, legal, social, and policy issues, such as innovation, societal impacts, national security, and intellectual property.”

Some questions to consider, said Kop, whose work on regulating AI, machine learning training data, and quantum technology have been published in Stanford, Harvard, Berkeley, and Yale universities’ scholarly journals, revolve around how to “operationalize quantum ethics into real world actions. Should we use codes of conducts and guidelines for responsible quantum design? And how do you agree on ethics, which is, of course, culturally sensitive.

“For example, while Western ideologies often focus on winning and conquering, native Canadians’ world view might emphasize living in harmony with our planet. It is a big difference.”

One of the central goals in the quantum ELSPI is for everyone to benefit from the prosperity quantum will bring to society, said Kop, but he wonders how we ensure equitable access.

Another key question that needs to be answered, he added, is will ELSPI considerations stifle innovation? Kop’s view is they will not: “They enable innovation, they convey trust, which is crucial for the acceptance of this technology.

“And one of the central goals in the quantum ELSPI concept is for everyone to benefit from the prosperity quantum will bring to society. But how do we ensure equitable access to quantum technologies such as the Imminent Internet for the least advantaged, either via fiber or satellite?

“I mean, Canada is a huge country. And we have to carefully think about the logistics and practicalities of access, not just talking about it, but doing it.”

In closing, he told the audience they can expect regulation on a federal level within the next three years, “so it might be good to start thinking about regulatory conformity and legal compliance today.”

The post Quantum Days 2023: CCA Expert Panel examining quantum through multitude of different lenses first appeared on IT World Canada.

Consumers and business leaders have different priorities when it comes to data privacy, according to recent studies by Cisco Systems.

The contrast was revealed in the latest version of Cisco’s annual Data Privacy Benchmark Study, released for Data Privacy Week. Done last summer, the survey of more than 4,700 security professionals from 26 geographies included more than 3,100 respondents who were familiar with the data privacy program at their organizations.

They listed compliance with privacy laws as the most important priority for building customer trust, followed by transparency about how customer data is used.

By comparison, the report notes, a Cisco study of consumer attitudes done at the same time listed transparency as the top priority, followed by not selling personal information, and compliance with privacy laws.

“Certainly organizations need to comply with privacy laws,” says the Privacy Benchmark report, “but when it comes to earning and building trust, compliance is not enough. Consumers consider legal compliance to be a “given,” with transparency more of a differentiator.”

Among other findings

— 95 per cent of officials surveyed said privacy is a business imperative, up from 90 per cent in the 2021 study;

— 94 per cent agreed customers would not buy from them if their data was not properly protected;

— 95 per cent said privacy is an integral part of their organization’s culture, up from 92 per cent last year.

— respondents estimated the average spend on privacy at their organization was US$2.7 million, up from US$1.3 million three years ago. The most significant growth from 2021 to 2022 occurred at smaller organizations. Privacy spending at organizations with 50-249 employees increased more than 17 per cent to US$2.0 million, from US$1.7 million;

— respondents also believe the estimated dollar value of benefits from privacy were up significantly. The average estimate rose more than 13 per cent, to US$3.4 million, from US$3.0 million in the 2021 survey.

The report recommends organizations continue to invest in privacy and build privacy capabilities throughout their firms, especially among security and IT professionals and those who are involved directly with personal data processing and protection.

Firms should also be more transparent with customers about how their personal data is being used. “While organizations need to comply with the law, compliance alone is not enough; transparency is key to trust,” the report says.

If using artificial intelligence (AI) in solutions, they should be designed with AI ethics principles in mind, it adds, providing preferred management options to reassure customers, delivering greater transparency to the automated decision, and ensuring that a human is involved in the process when the decision is consequential to a person.

The post Data Privacy Week: Consumers, companies differ on privacy priorities, says study first appeared on IT World Canada.

Tensions were running high in the House of Commons Wednesday, as the Standing Committee on Industry and Technology (INDU) conducted hearings examining the proposed Rogers-Shaw merger. Academics and representatives from independent internet service providers (ISPs) TekSavvy and Globalive lambasted the C$26 billion merger deal, while the merging parties attacked rivals and mechanically parroted their own ideas of public interest and competition.

Witnesses opposing the merger included Ben Klass, senior research associate at the Canadian Media Concentration Research Project, Anthony Lacavera, chairman of Globalive, and Andy Kaplan-Myrth, vice-president, regulatory and carrier affairs at TekSavvy.

From Klass’ point of view, the Rogers outage should have served as a wake-up call that ‘bigger is not always better,’ especially when it comes to essential services on which we depend everyday. He questioned whether the priority in Canada is to promote competition or to cater to big businesses who wish to control crucial markets.

“How do we get back to the basics of competition and good prices in this market? And one of the answers to that is removing the dominance of the original providers,” he said. “These are companies that have been in the market for 30 years – Rogers, Telus, Bell – and they are firmly in control of it. They’ve maintained a 90 per cent share over even the 10 years of the fourth carrier policy. So I think it’s very important that you have a competitor that’s not reliant in this way on one of the dominant providers.”

Lacavera also pushed his own ambitions for a competitive wireless market, which he tried to re-enter with a bid to re-acquire Freedom Mobile (previously Globalive-owned WIND mobile, sold to Shaw in 2015) after the Rogers-Shaw announcement. He claimed that he offered C$900 million more than Rogers accepted from Videotron. “In no universe does it make sense for a company like Rogers to be able to select who their competitor is going to be, and then prop them up with a series of commercial agreements that now may actually be in violation of the Telecom Act.”

But Tony Staffieri, chief executive officer of Rogers, argued that the ‘lengthy judicial process’ is adequate to prove that the merger will not lessen competition, and in fact will increase competition. “It was far from a close case, this committee can feel satisfied that no stone was left unturned.”

‘Investments’ was equally a buzzword for the merging parties, and seemingly their way out to address every competition concerns brought up by community members. “We invest in networks. And in terms of affordability, we get up every day looking for more value add for our customers,” said Staffieri. He added that Rogers will be injecting C$6.5 to improve connectivity over the next five years: C$1 billion to connect rural and Indigenous communities, C$2.5 billion to expand its 5G network and C$3 billion in network services.

Staffieri also claimed that 3000 jobs will be created at Rogers, which a committee member questioned, having heard from company insiders that 4000-5000 people will be cut. Staffieri responded, “There will be areas that have overlap. And we will look to redeploy resources in areas that are growing.”

Furthermore, Paul McAleese, president of Shaw Communications, maintained that Rogers will never own Freedom Mobile and that there will continue to be four strong wireless competitors in each of British Columbia, Ontario and Alberta. “The dynamic, newly empowered Freedom-Vidéotron will have more than doubled the customer base with over three million subscribers and have all of the tools it requires to compete against the national carriers, including, critically, the 5G spectrum that Shaw does not possess.”

McAleese also proceeded to accuse Telus, along with Globalive, of undertaking a corporate campaign called Project Fox to “kill, shape and slow” the proposed transactions, and to replace Vidéotron with Globalive in the purchase of Freedom Mobile. He added that Telus does not in fact want competition in Western Canada, where it is the dominant provider.

“Project Fox is a blatant example of Telus’, shall we say, toxic and Machiavellian tactics, which include increased litigation, underhanded misinformation campaigns, and intensive lobbying to stoke opposition, while seeking, among other things, to alienate Western Canada from eastern Canada.” said McAleese.

McAleese also claimed that Lacavera, who he referred to as ‘Pinocchio’, has a dubious record in running a wireless company and that he inherited many challenges when Shaw purchased WIND mobile.

Lacavera probably saw the accusations coming and addressed the 2015 sale of WIND mobile to Shaw at the very outset of the hearings, noting, “We did not want to sell, we were dragged into a sale to Shaw. The business was doing fantastic as an independent pureplay. Our business model was validated, and Canadians were voting with their feet; we had almost a million subscribers. We voted against selling.” But he did not explain why and how the sale proceeded regardless.

Regarding allegations of conspiracy with Telus, Lacavera said; “I’m 50 years old, and I’ve never worked for anyone, yet. I’m not about to start working for anyone. So there’s no scenario where Globalive is in bed with Telus.”

Instead he claimed his association with Telus stops at a shared network agreement. “We’ve contributed spectrum that we own into the mix, and contribute to radio networks that we own on a shared basis with Telus.

Kaplan-Myrth detailed the difficulties of an independent ISP trying to survive in a telecom oligopoly. “TekSavvy is losing customers and has had to put investment plans on hold, including plans to purchase spectrum,” he said. “The wholesale regime is failing, and consumers have been paying the price. Internet prices in Canada continued to rise, including 13 per cent annual increases for some of the most popular speeds.”

The competitive power of Vidéotron was also put under scrutiny, as opposing witnesses alleged that the Québec-based carrier is receiving lower preferential rates and terms from Rogers to let it appear as a credible competitor. Without these favourable rates (likely illegal under the Telecommunications Act, witnesses noted), Vidéotron will be unable to support competition and hence fails as a remedy for the Roger-Shaw deal to proceed.

“Vidéotron is going to need those preferred rates in order to compete outside of its core cable footprint. They have the benefit of network in Quebec, they don’t have the benefit of any brand equity or any network outside of Quebec,” stated Kaplan-Myrth.

This question of illegal preferential rates warrants the interference of the CRTC before  Industry Minister François-Philippe Champagne makes his decision, TekSavvy believes.

Minister Champagne said in an interview with the Toronto Star that he is in no hurry to give the merger the green light, and that he has no deadline as a regulator. He added that he wants assurances that Vidéotron will in fact will offer lower-cost services over a 10-year period.

“I’m a lawyer, so we will make sure that these undertakings are binding, and that there would be consequences” for failures to meet them,” said Champagne.

The post Critics face ‘scripted answers’ and conspiracy allegations from Rogers, Shaw and Québecor at House of Commons hearings first appeared on IT World Canada.

Over 800,000 victims in a hack, Dutch hacker allegedly pedaled data of everyone in Austria and more.

Welcome to Cyber Security Today. It’s Friday, January 27th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

A Chicago company called Zacks Investment Research is notifying 820,000 customers that their information may be at risk. According to a copy of a letter sent to customers and filed with the state of Maine, in late December the company learned it had been hacked. Access was gained sometime several months before that. A database of customers who signed up for a product between the end of 1999 and February 2005 was stolen. The data included customers’ names, addresses, phone numbers, email addresses, and passwords used for Zacks.com. Affected customers have to reset their passwords.

The Russian cyberwar over Ukraine continues. A number of denial-of-service attacks on Thursday hit German government, banking and airport websites. Some websites were knocked offline. It is believed to be retaliation against Germany for allowing tanks it builds to be sent to Ukraine,

A Dutch hacker arrested in November obtained and offered for sale the full name, addresses and dates of birth of virtually everyone in Austria. That’s about nine million people. Reuters says news is only now being released because other police forces are investigating the person. That’s because they were also selling similar data sets from Italy, the Netherlands and Columbia.

Researchers at Trellix say they recently patched over 61,000 open source Python projects on GitHub through an automated system. The effort was to fix a 15-year-old vulnerability some developers had unintentionally added to their projects. It took several months to find the impacted projects and install the patches. Trellix warned developers to have proper checks and evaluation methods when deciding to import code libraries and frameworks into their applications.

Is your company thinking about creating non-fungible tokens to boost customer loyalty? The recent experience of Porsche should make you think twice. Non-fungible tokens, or NFTs are digital assets on a blockchain that may or may not have value. Porsche has created NFTs for enthusiasts to acquire digital replicas of its cars. However, according to The Cyber Express crooks latched onto the Porsche name and have created fraudulent domains to dupe many into buying fake tokens with cryptocurrency. Any organization wanting to get into the non-fungible token game better have cybersecurity and blockchain expertise or their brand may be damaged.

Someone is leveraging the Google Ads invitation capability to send email messages promoting spam and sex websites. According to a news report, the invites are being sent from Google Ads accounts so they seem to be legitimate. They also avoid spam filters. Google Ads is a service for advertisers to create marketing campaigns.

Finally, New York State is asking the operators of Madison Square Garden and Radio City Music Hall about the alleged use of facial recognition software to keep certain dangerous people out of its venues: Lawyers. According to Engadget, the technology is being used to keep out lawyers representing people suing the company. It quotes the Garden CEO saying to goal is to prevent evidence from being collected outside proper lawsuit procedures. New York State’s attorney general says what’s allegedly going on may violate civil and human rights laws.

That’s it for this morning’s podcast. But later today the Week in Review will be available. Guest commentator Terry Cutler of Montreal’s Cyology Labs will give advice for Data Privacy Week and comment on other news items.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. U.S. listeners can also find my stories on TechNewsDay.com.

The post Cyber Security Today, Jan. 27, 2023 – Over 800,000 victims in a hack, Dutch hacker allegedly pedaled data of everyone in Austria and more. first appeared on IT World Canada.

Layoffs hit IBM and SAP, smartphone shipments decline and Google shuts down more than 50,000 pro-People’s Republic of China (PRC) disinformation channels.

That’s all the tech news that’s trending right now. Welcome to Hashtag Trending. It’s Friday, January 27th and I am your host, Ashee Pamma.

IBM announced it is cutting 3,900 jobs as part of asset divestments and after it missed its annual cash target. The layoffs, related to the spinoff of its Kyndryl business and a part of AI unit Watson Health – will cause a $300 million charge in the January-March period, IBM said. Meanwhile, SAP also announced it is laying off 3000 workers. The German software giant said it planned to carry out a “targeted restructuring program” to “strengthen its core business” and improve efficiency. IBM and SAP add to layoffs by major tech companies, including Amazon, Google and Meta who have reportedly shed 48,000 workers since the start of this year.

Source: Yahoo Finance and TechXplore

Worldwide smartphone shipments declined 18.3 per cent year over year to 300 million units in the fourth quarter of 2022 (4Q22), according to preliminary data from the International Data Corporation (IDC) Worldwide Quarterly Mobile Phone Tracker. The drop marks the largest-ever decline in a single quarter. Heavy sales and promotions during the quarter helped deplete existing inventory rather than drive shipment growth. Vendors are increasingly prudent with their shipments and planning while realigning their focus on profitability, said Nabila Popal, research director with IDC. Even Apple that seemed immune, suffered a setback in its supply chain with unforeseen lockdowns at its key factories in China.

Source: IDC

Google says it shut down more than 50,000 accounts to combat a campaign called Dragonbridge, promoting pro-People’s Republic of China (PRC) disinformation in 2022 that focused on Taiwan, COVID-19 and U.S. politics. While most of the content pushed out by the disinformation network is “low quality and without a political message”, there was a higher volume of content released last year that was critical of the governments of Taiwan and the U.S. The group typically published content supportive of China’s response to COVID-19 and critical of how the U.S. handled the pandemic as well as the Russian invasion of Ukraine. While much of the content is targeted toward Chinese speakers, some of it is in English and other languages, Google says. Since 2019, has shut down more than 100,000 accounts on YouTube, Blogger and AdSense connected to Dragonbridge actors.

Source: The Record

A British man who planned to have a “robot lawyer” help a defendant fight a traffic ticket has given up the effort after receiving threats of possible prosecution and jail time. Joshua Browder, the owner of AI startup DoNotPay created a platform for people contesting traffic tickets to use arguments in court generated by artificial intelligence. The person challenging a speeding ticket would wear smart glasses that both, record court proceedings and dictate responses into the defendant’s ear from a small speaker. The system relied on a few leading AI text generators, including ChatGPT and DaVinci. Browder said he was threatened with Multiple state bar associations after he offered one million dollars to anyone willing to adopt his technology during a court fight.

Source: NPR

An AI-written speech was read for the first time in Congress. The brief two-paragraph speech read by the Massachusetts Democrat on the floor of the U.S. House on Wednesday was generated by the online AI chatbot ChatGPT, AP News reported. The congress member said part of the decision to read a ChatGPT-generated text was to help spark debate on AI and the challenges and opportunities created by it. He said he doesn’t want to see a repeat of the advent of social media, which started small and ballooned faster than Congress could react.The text generated from his prompt included sentences like: “We must collaborate with international partners like the Israeli government to ensure that the United States maintains a leadership role in AI research and development and responsibly explores the many possibilities evolving technologies provide.”

Source:  AP News 

That’s all the tech news that’s trending right now. Hashtag Trending is a part of the ITWC Podcast network. Add us to your Alexa Flash briefings or your Google Home daily briefing. Make sure to sign up for our Daily IT Wire newsletter to get all the news that matters directly in your inbox every day. Also, catch the next episode of Hashtag Tendances, our weekly Hashtag Trending episode in French, which drops every Thursday morning. If you have a suggestion or a tip, drop us a line in the comments or via email. Thank you for listening, I’m Ashee Pamma.

The post Hashtag Trending January 26th- Layoffs hit IBM and SAP, smartphone shipments decline, Google shuts down pro-PRC channels first appeared on IT World Canada.

Continuing their expansion in Canada, Québecor and its subsidiary Vidéotron have just invested nearly $10 million to acquire new 5G wireless spectrum licenses, in Manitoba in the 600 MHz band and in Québec in the 3,500 MHz band.

This is “again demonstrating their determination to deliver on their promise to build out a reliable wireless network for the benefit of Canadian consumers,” the companies said in a press release.

The acquisition was completed following the auction of the residual spectrum licenses, which concluded yesterday, with Innovation, Science and Economic Development Canada announcing the provisionally successful bidders. Vidéotron is thus increasing its wireless service capacity and paving the way to an expansion of its wireless infrastructure outside Québec. In 2021, the company acquired, at a cost of $830 million, 294 blocks of spectrum in the 3500 MHz band in Ontario, Manitoba, Alberta, British Columbia and Québec.

“We have a clear objective: to bring healthy competition to the Canadian wireless market by breaking the oligopoly,” said Pierre Karl Péladeau, president and chief executive officer of Québecor. “Buying additional spectrum to follow up on the potential acquisition of Freedom Mobile is a key element of our business plan for extending our robust, powerful wireless network outside Québec and offering Canadian consumers better services at better prices, as we have been doing in Québec for more than 15 years.”

According to Vidéotron, as a result of its competitive pricing, Québec was the first region of the country to see lower wireless prices. Vidéotron reduced the cost of mobile plans in Québec to 35-40 per cent less than elsewhere in Canada. Québecor now wants to replicate this success in other provinces by becoming the fourth major wireless service provider.

The post Québecor acquires 5G spectrum licenses in Manitoba and Quebec first appeared on IT World Canada.

A British Columbia community college says personal information of some students and employees may have been copied by a cyber attacker earlier this month.

Okanagan College, which has 17,000 students and 1,100 employees across several campuses in southern B.C., said an “unauthorized entity gained access to certain Okanagan College technology systems” around Jan. 9.

As a result, certain information about students and employees “may have been subject to risk,” the college said. Free credit monitoring services are being offered.

Meanwhile, the Vice Society ransomware gang has published notice of an attack against an unnamed Canadian organization, claiming to have exfiltrated more than 850 GB of data. A  blurred photo accompanying that notice appears to be one of an Okanagan College building on the Kelowna campus.

The campuses are in Penticton, Kelowna, Vernon and Salmon Arm. There are also several smaller centres in Revelstoke and Oliver where communities can access educational services like tutoring, English as a Second Language, and Continuing Studies programs

The college has notified the B.C. Office of the Information and Privacy Commissioner and is in the process of notifying students and staff.

On discovering the attack, the college immediately shut down, and disabled network access across all of the campuses, and has hired external cyber-security experts to assist in its response and investigation.

Restoration of IT services continues, with many systems back online. However, when an ITWorldCanada reporter called the Kelowna campus on Thursday afternoon, a receptionist said that not all phones were working.

For certain IT services, temporary solutions have been implemented. Access to the online Moodle learning platform is available, as well as the ClassFinder app.

The college has extended its fee payment deadline for the winter semester to Jan. 31, 2023.

However, it is currently unable to produce properly formatted official student transcripts for proof of completion of courses. For the time being, graduates and students who request a transcript will be provided with an unofficial transcript that reflects their academic record and a letter of authenticity from the college. An official transcript will be mailed once systems are restored.

The post B.C. college says info of students, employees at risk following cyber attack first appeared on IT World Canada.

In honour of this year’s Data Privacy Day, which takes place Saturday, Apple has unveiled new educational resources to help customers learn how to retain control of their data.

Available now is an entertaining set of four videos, launched Tuesday, entitled A Day in the Life of an Average Person’s Data, which feature Apple TV+ Ted Lasso star Nick Mohammed. In the episodes, an Apple Store specialist accompanies Mohammed as he goes through his day, and explains iPhone privacy features including Mail Privacy Protection, Intelligent Tracking Prevention, App Tracking Transparency, and Wallet and Apple Pay.

The company is also launching a new 30 minute Today at Apple training session on Saturday. Called Taking Charge of Your Privacy on iPhone, it walks customers through iOS features including Mail Privacy Protection, Safety Check, Location Services, and passkeys.

“We created Today at Apple to spark creativity and enable our customers to get the most out of their Apple products and features,” said Tracey Hannelly, Apple’s senior director of retail engagement and marketing.

Customers can register online for a session at their local Apple store.

The post Apple unveils new resources for Data Privacy Day first appeared on IT World Canada.

The U.S. Federal Bureau of Investigation (FBI) has seized the website of the Hive ransomware gang after penetrating the group’s computer networks.

The agency said Thursday it penetrated the networks in July, 2022, leading to the capture of decryption keys. Since then it has quietly offered those keys to 300 victims. In addition, the FBI distributed over 1,000 additional decryption keys to previous Hive victims.

In co-ordination with German law enforcement (the German Federal Criminal Police and Reutlingen Police Headquarters-CID Esslingen) and the Netherlands National High Tech Crime Unit, yesterday it seized control of the Hive website.

In making the announcement, the FBI thanked a number of polices forces, including the RCMP and Peel Regional Police in Ontario.

Related content: Hive takes responsibility for Bell attack

“Last night the Justice Department dismantled an international ransomware network responsible for extorting and attempting to extort hundreds of millions of dollars from victims in the United States and around the world,” U.S. Attorney General Merrick Garland said in a statement this morning.

“Cybercrime is a constantly evolving threat. But as I have said before, the Justice Department will spare no resource to identify and bring to justice anyone, anywhere, who targets the United States with a ransomware attack. We will continue to work both to prevent these attacks and to provide support to victims who have been targeted. And together with our international partners, we will continue to disrupt the criminal networks that deploy these attacks.”

Since June 2021, the Hive ransomware group has targeted more than 1,500 victims around the world and received over US$100 million in ransom payments.

Hive ransomware attacks have caused major disruptions in victims’ daily operations around the world and affected responses to the COVID-19 pandemic, said the FBI. In one case, a hospital attacked by Hive ransomware had to resort to analog methods to treat existing patients and was unable to accept new patients immediately following the attack.

According to a background paper on the group by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Hive’s affiliates often get initial access to victim networks by using single factor logins via Windows Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols.

In some cases, Hive actors bypassed multifactor authentication and gained access to  Fortinet FortiOS servers by exploiting a known and unpatched vulnerability, CVE-2020-12812. This vulnerability enables a malicious cyber actor to log in without a prompt for the user’s second authentication factor (FortiToken) when the actor changes the case of the username.

Hive actors have also gained initial access to victim networks by distributing phishing emails with malicious attachments.

Separately, today Cyberint released a report on ransomware trends in 2022. Among the conclusions:

The U.S. is still the most targeted area of the world, with 1060 victims, a decline of almost 300 victims since last year, followed by the UK, Canada, and Germany.

While Q2 and Q3 saw major drops in ransomware activity (with 708 and 666 incidents, respectively, down from 763 in Q1), Q4 saw a slight rise to 672. Cyberint analysts describe the Q4 increase as indicative of the new and promising groups established in Q3 and Q4, such as Royal and BlackBasta, gaining ground.

LockBit 3.0’s rise to power and gaining notoriety without the use of Twitter for “PR” like other groups have increasingly done.

Talent for hire in the ransomware world is changing the game: Lockbit’s ‘Bug Bounty Program,’ which demonstrated the group’s arrogance and strength, offered rewards for anyone who found vulnerabilities in their servers.

The rise of Royal in the last months of 2022 saw them achieve a victim count rate already higher than LockBit’s, suggesting competition between the two can be expected in 2023.

The post Breaking news: FBI shuts down Hive ransomware gang’s IT infrastructure first appeared on IT World Canada.

Many boards don’t make put privacy as one of their organization’s priorities, a survey of professionals suggests.

According to the annual state of privacy survey of members of ISACA (formerly known as the Information Systems Audit and Control Association) — released in conjunction with Data Privacy Week — 22 per cent feel their boards don’t put a priority on privacy, A further 20 per cent said they don’t know if their boards adequately prioritize privacy. Fifty-five per cent believe privacy is a priority with their boards.

“It’s not entirely surprising,” Safia Kazi, ISACA principal for privacy practices, said in an interview. “I think a lot of people view privacy as a cost centre. Its something that maybe slows down a project. You acquire a new program or resource and you go ‘Is it GDPR compliant? Do we have to start over again [with a new privacy assessment]?’ I think that’s where some of that comes from. The other thing I found is that 20 per cent of our respondents said they don’t know if their board prioritizes privacy. That could speak to a board that maybe isn’t communicative about it (privacy).”

The 55 per cent who believe their boards do prioritize privacy is slightly higher than the 2021 survey, she added. “I think in general we’re moving in the right direction, but there is some way to go.”

The survey, conducted in the fourth quarter of 2022, saw responses from 1,890 ISACA members who currently work in data privacy or have detailed knowledge of the data privacy function within their organization. Questions were asked on privacy staffing, budgets, program trends, awareness training and breaches, and the use of privacy by design.

Among the results, Kazi noted, is that organizations that practice privacy by design are more likely to have a board that adequately prioritizes privacy and have larger numbers of employees dedicated to setting and enforcing privacy policies.

“The tone really can start at the top,” she said. “When you don’t have that support, it can be really hard to get the resources you need.”

Another noteworthy finding is that 31 per cent of respondents said their organization doesn’t separate privacy and security training for employees. “That was a little disappointing,” Kazi said. “I think the problem is a lot of people [in management] have security training and think, ‘Privacy is close enough. What’s the difference?’ My concern is that, if you are just teaching people security and not privacy, you’re not really building trust with customers. If the organization is collecting too much of someone’s personal information, that’s not necessarily a security issue but it would be a privacy issue.”

“But I also want to point out that organizations have so much they have to do. You can’t be taking up everybody’s time with a thousand security training and privacy training meetings. My hope is that organizations that combine privacy and security training have a specific call-out to privacy and give it the attention and time it needs.”

“One trend that makes me optimistic is it looks like privacy is faring a little bit better than it has in previous years,” she said of other survey results. “Privacy teams are a little bit larger than they were last year and the year before. Also, we’re seeing that members are less likely to say they were understaffed this year compared to last year. That said, understaffing is still a challenge, filling open privacy positions is a big challenge.”

Overall survey results suggest that, “for the most part”, enterprises realize privacy isn’t going away, she said, with many organizations trying to ensure privacy teams have the resources they need.

Among other survey results, 42 percent of respondents said their privacy budget is underfunded, and only 36 percent believe it is appropriately funded. Just over a third of respondents (34 percent) indicate their privacy budgets will increase in 2023.

ISACA offers certifications for information systems governance, control, risk, security, audit/assurance and business and cybersecurity professionals.

To read the survey, click here. Registration required.

The post Many boards don’t see privacy as a priority: Survey first appeared on IT World Canada.