Welcome to Cyber Security Today. This is the Week in Review edition for the week ending Friday, January 26th 2024. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes Terry Cutler, head of Montreal’s Cyology Labs will be here to discuss recent headlines. That includes looking at recommendations from the Network Resilience Coalition on how hardware and software manufacturers can help beef up the security of IT networks, a U.K. report predicting the impact artificial intelligence will have on cyber threats, a Canadian hospital’s response to a ransomware attack and Microsoft’s admission about a hacking incident.

But before we get to the discussion a quick review of other news from the past seven days:

Another tech company has admitted to being hit by a Russian threat actor. Hewlett Packard Enterprise says a group dubbed Midnight Blizzard by some researchers, and Cozy Bear by others, was able to access the company’s cloud-based email system last year. The attack started last May but HPE was notified only in December. The attack on the email system is likely related to the theft of company SharePoint files. This attack has similarities to the Microsoft attack that Terry and I will talk about later.

Cybersecurity researcher Bob Dyachenko, who specializes in finding unsecured databases on the internet, has scored a big one. According to Cybernews, he recently found a cache of 26 billion records with over 3,800 folders. Each folder corresponded to a data breach, with information including login credentials collected from LinkedIn, Twitter, Weibo, Tencent and other platforms. They include previously stolen data that researchers know about as well as privately sold databases. It isn’t known who the cache belongs to.

Separately the staff at Cybernews say they discovered a database late last year with millions of corporate chat messages belonging to an American IT services provider. It isn’t known if threat actors also came across this database.

Hundreds of GitLab instances in the U.S. and thousands of others around the world still haven’t been patched to close a vulnerability. That’s according to a tweet from the Shadowserver Foundation. The patch was released two weeks ago for those running their own instances of GitLab.

More on patching: Jenkins has discovered a critical vulnerability in its automation server. The problem is in a library that allows the parsing of command arguments. An attacker leveraging the hole could read files on the Jenkins controller file system. Install a security update fast.

Finally, hackers are taking advantage of unpatched versions of Apache ActiveMQ servers. That’s according to researchers at Trustwave. Administrators were warned last October to upgrade their servers when the vulnerability was discovered.

(The following transcript covers the first part of the conversation. To hear the full discussion play the podcast)

Howard: We’ll start with the report from the Network Resilience Coalition, a group of hardware and software manufacturers and corporate buyers who want to strengthen the security of the backbone of IT networks — routers, switches, firewalls, gateways. One of the big concerns is that some network administrators aren’t patching vulnerabilities fast enough. In fact some aren’t patching at all because they can’t afford network downtime. So the coalition recommends manufacturers separate security patches from security feature updates. Second, manufacturers should make it clear how long products will be supported so IT departments know when they are end of life. Third manufacturers should build their software better with more security. As for buyers, the coalition says they should give preference to products that are built better and make sure products are using the best security configurations.

What did you think when you read the recommendations? Are they achievable, and if so, how long will it take to have a meaningful impact?

Terry Cutler: Security patches are often delayed because they’re bundled with security updates, which will require more extensive testing. So by separating them network administrators can quickly apply the critical security patches without worrying about the potential instability of other things that are produced — like, for example, new security features. But this is going to require a change in the software development and release strategy from manufacturers. So focusing more on a modular, independent type of update system. But this is to have a real impact on short-term and long-term timelines. Once it’s implemented the benefits will be ‘Hey, we’ll have faster and more focused security updates.’ But at the same time you know manufacturers have to also adjust their development processes and we’re going to need better clarity on product support lifespans. Knowing the end-of-life timeline of a product is going to be critical for IT planning, but it also allows better budgeting and risk management, especially in terms of security vulnerabilities that won’t be patched after a certain date.

Software developers are [also] going to need to improve their security from the ground up. Here’s a real story: We’re actually training folks who are seasoned developers in healthcare who don’t even know what Nmap is. [For those who don’t know, it’s a network scanner for discovering hosts and services] Because of that they don’t know how to find flaws in their own application. So by building software stronger, focus on security is going to be essential in today’s landscape — especially with today’s cyber threats. This is going to include better security coding practices, rigorous testing and of course a commitment to ongoing security assessments.

Going back to your last point about encouraging buyers to prioritize security products in their purchasing decisions, that’s very powerful. But one of the problems is they’re not subject matter experts. So they don’t necessarily know what they’re buying.

Here’s another real situation that we just ran into recently: We went to assess a retail company and one of the things they asked me to do while I was there was to assess what an MSP [managed service provider] was selling them. I look it over and it’s merely a simple upgrade. ‘You’re gonna need a new firewall, here’s some managed switches and new access points,’ [the MSP said]. So I asked them what are you doing for endpoint protection network security and cloud security? They had nothing. The MSP was able to convince management that all they needed to do was buy these upgrades and the customer would be totally safe. So they did. I couldn’t believe they went for it.

Howard: At a press conference accompanying the release of the report an official from Cisco Systems said it may be hard to separate security updates from new features. His worry is that what may happen is two departments with identical equipment from a manufacturer will end up having different networks — one with a new feature, one without and that could screw up patches that are being released by vendors. Is this a ah realistic worry?

Terry: He’s right, because this could lead to product development problems. There could be features that are intertwined with new security updates and now all of that would break. So now the vendor would be developing and managing two separate products that now have to interlink with each other if a client has a basic version or has to upgrade to the new full version. It doesn’t make sense. Think about this for a second: Each new security feature potentially requires testing for compatibility and integration and that’s going to add layers of complexity to the patch management process [of the customer]. If the primary goal is to separate patching from the security updates this will definitely lead to extensive testing and a lot of things are going to break. This can lead to a tradeoff where uniformity and predictability of the network environments could be compromised, impacting the efficiency and effectiveness of IT operations.

We’re going to need to look at a balanced approach where manufacturers will offer the option to separate security patches [from features] but also provide guidance on how to manage these security features in a way that can minimize disruption.

As someone who’s worked for a large software company this is just going to add so much more development complexity it’s going to put a real strain on both the software developers and the IT staff, who will be trying to figure out what broke once an update gets applied.

Howard: Well, there’s there’s pressure on manufacturers to to ship shiny new buttons — ‘Look at what we’ve added to version 8.2.3!!’ — to compete with a competitor who announced a new feature. That can lead to shoddy development. Now, one of the report’s recommendations is that manufacturers adhere to the NIST Secure Software Development Framework is aimed at blunting that, but are vendors going to be able to resist shipping code fast with added features to compete with competitors?

Terry: It really comes down to two things: Innovation and marketing. If you have a really great product but no one’s heard of you it’s not going to work, and if you have a really crappy product and you’re really great at marketing your product reviews are really going to go down. So there needs to be a balance. As you know, when we start shipping products that haven’t been properly tested or coded properly it’s going to lead to really inadequate testing and really bad application development, especially on the security side. But the following Framework manufacturers can at least build more secure software and it’ll help reduce the risk of vulnerabilities that will be exploited.

Howard: And will IT buyers put security ahead of price when they’re buying network equipment?

Terry: I don’t think things are going to change because IT buyers are not subject matter experts. They’re going to require more education. The more we educate and update IT buyers about the potential costs and impacts of security breaches the more I think they’re going to prioritize security in their purchasing decisions. And I think that the reputation of network equipment vendors are also going to matter. They want to know, ‘Are you in the Gartner Magic Quadrant? Are you on television? Are you doing all these things?’ Those external things are going to sway the IT buyers.

The post Cyber Security Today, Week in Review for the week ending Friday, Jan. 26, 2024 first appeared on IT World Canada.

US government employees slammed for backing forbidden videocam purchases, and more

Welcome to Cyber Security Today. It’s Friday, January 26th, 2024. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

U.S. government technology employees misled a contracting officer with what an investigation called “egregiously flawed” information so 150 Chinese-made video conference cameras could be purchased two years ago. That’s the finding of the Office of the Inspector General in a report released this week sparked by a whistleblower. The employees worked for the General Services Administration, which purchases products and office space for federal employees. The cameras, which have security vulnerabilities, didn’t comply with government rules forbidding the purchase of equipment from China. The employees didn’t tell the contracting officer that compliant cameras from other sources were available. In fact, the GSA CIO agreed with the staff recommendation, even admitting the cameras ran afoul of the spirit of a Presidential executive order forbidding the purchase of Chinese equipment. But, the CIO said, based on what he was told by his staff there were no available comparable products. That wasn’t true. The staff told investigators that employees at the department wanting the gear preferred the non-compliant cameras.

The Inspector General recommends the cameras either be disposed of or returned and that appropriate action be taken against the digital infrastructure staff behind the misleading camera information. The head of the GSA thinks the security vulnerabilities in the remaining cameras in use can be mitigated.

There were a record 3,200 data breaches last year in the U.S. That’s according to the Identity Theft Resource Centre. By comparison there were 1,800 in the year before. Of those 3,200 incidents, the vast majority came from cyber attacks. But there were also 729 system and human errors that exposed data, 242 third-party supply chain attacks, and 53 physical data thefts. Data on 352 million American residents was stolen last year. Thirty-seven million came from a data breach at wireless carrier T-Mobile, and 35 million were from telecom provider Xfinity.

The Akira ransomware gang says it will soon start posting 33GB of data it says was stolen earlier this month from the Toronto Zoo. The zoo says personal information of current, former and retired employees dating back to 1989 was copied. The data included Social Insurance numbers, birthdates, telephone numbers and home addresses. The Zoo’s IT system is separate from the city’s.

A Chinese-aligned threat group has been delivering a backdoor by hijacking update requests from legitimate Chinese software undetected for years. That’s the finding of researchers at ESET. The targets were Chinese and Japanese companies as well as individuals in China, Japan and the U.K. who use applications from Tencent, WSOffice and others. Researchers can’t explain exactly how the software companies’ update mechanisms were compromised. But the report is a reminder to software firms to patch all internet connected devices to prevent them from being compromised, train staff to recognize suspicious email attachments and to regularly monitor their application update servers for compromise.

Finally, a Russian national has been sentenced by a U.S. judge to five years and four months in prison for his role in developing and deploying the Trickbot malware. Vladimir Dunaev [DOON-EV] had been extradited to the U.S. from South Korea in 2021. He pleaded guilty to several charges last November. One of his co-conspirators was sentenced to two years and eight months.

That’s it for now. But later today my Week in Review podcast will be available. Terry Cutler of Cyology Labs will discuss recommendations by the Network Resilience Coalition, a hack at Microsoft and more.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Jan. 26, 2024 – US government employees slammed for backing forbidden videocam purchases, and more first appeared on IT World Canada.

AI solves a bus driver shortage, a study is questioning the impact of AI on the quality of code – and researchers discover that your iPhone might be sending out a lot more data on you than anyone thought. 

All this and more on the final day of privacy week edition of Hashtag Trending. I’m your host Jim Love, CIO of IT World Canada and TechNewsDay in the US.  

In the face of nationwide bus driver shortages, school districts are turning to an innovative AI-powered tool for a solution. District 11 in Colorado Springs, serving around 22,000 students, has successfully implemented this technology, developed by child-transportation provider HopSkipDrive, to optimize bus routes and transportation options.

The AI tool, named “Strategic Routing,” analyzes student pickup needs and suggests efficient combinations of traditional buses and HopSkipDrive’s “CareDrivers.” This strategic approach has led to significant improvements for District 11. They’ve managed to reduce their bus routes from over 100 to 55, replacing some underutilized routes with HopSkipDrive rides. This change has not only increased on-time arrival rates from 85 per cent to 99 per cent but also projected savings of $8 million over a decade.

D11 superintendent Michael Gaal highlights the tool’s ability to provide predictive, rather than reactive, solutions. It offers a variety of options, including the use of smaller vehicles for less frequented routes, ensuring a more tailored approach to student transportation needs.

While some parents initially expressed skepticism about HopSkipDrive rides, they have come to appreciate the personalized transportation service. The tool’s flexibility allows for adjustments throughout the school year, ensuring optimal routing based on changing needs.

In the midst of concerns about job losses and hallucinations and all of that, we can easily lose sight of how AI can address worker shortages effectively, providing solutions that complement human efforts rather than replacing them.

Sources include: [Axios](https://www.axios.com/2024/01/25/ai-school-bus-driver-shortage-hopskipdrive)

A story I read today talked about how Google may finally come to market with something that will really challenge ChatGPT. 

Reportedly, in an upcoming release, Chrome will introduce an experimental AI-powered feature aimed at enhancing users’ writing experiences on the web. This includes a “Help me Write” feature, which can be accessed by right-clicking on any text box, prompting Google’s AI to assist in generating initial drafts for various writing tasks.

This integration could significantly reduce the reliance on external platforms like ChatGPT for drafting content, as users often work directly on the web for emails, articles, and presentations. Google CEO Sundar Pichai emphasized the ease these AI features bring to web tasks.

Google is not just focusing on text generation. It’s also advancing in multimodality with the introduction of Lumiere, a text-to-video diffusion model capable of synthesizing videos with realistic and coherent motion. 

The integration of AI and machine learning into Chrome is significant, considering Google’s dominance in online search and the widespread use of Chrome, which currently has 3.22 billion users compared to ChatGPT’s 100 million.

Google’s integration of AI into Chrome, coupled with advancements in multimodal AI capabilities, positions the company as a strong contender in the AI space, potentially challenging platforms like ChatGPT.

Over to you – OpenAI…

Sources include: Analytics India

Recent research by GitClear, a developer analytics company, suggests that the growing popularity of AI assistance in software development is leading to lower code quality. The study, analyzing 150 million changed lines of code from both private corporations and open-source projects, highlights issues like increased code churn (code added and then shortly deleted) and a higher proportion of repeated code.

GitHub’s Copilot, a prominent AI coding tool, boasts over 1 million developers with paid subscriptions. While it has been reported that developers complete tasks 55 per cent faster with Copilot, and 46 per cent of code in enabled files is completed by it, GitClear’s research focuses on the quality rather than the quantity of code. The study observes that AI assistants primarily suggest added code, but rarely advise on updating, moving, or deleting code. This trend leads to concerns about the conciseness and readability of the code.

The research identifies a rise in code churn, now at 7.1 per cent compared to 3.3 per cent in 2020, and a decrease in instances of code being moved, which could indicate less refactoring. The researchers criticize the increased use of copy/pasted code, calling it a major issue for long-term code maintainability.

While the reasons for these trends are speculative, the researchers link them to the growing use of AI coding techniques. They suggest that engineering leaders should monitor these trends and their implications for future product maintenance. The study concludes that AI coding assistants are not likely to replace human developers anytime soon, as current AI is too error-prone and far from being able to securely modify existing code.

This research may reassure developers concerned about being replaced by AI tools, emphasizing the current limitations of AI in coding contexts.

Sources include: The Register

Apple is set to allow alternative app stores on its iPhones in the European Union (EU) starting from March, marking a significant shift from its current policy where iPhone users can only download apps from Apple’s own App Store. This change is a response to the EU’s Digital Markets Act, aiming to regulate large companies and create a fairer market for both established and smaller firms.

The move could potentially enable iPhone users in Europe to access apps like Fortnite, which was withdrawn from the App Store in 2020 due to disagreements over Apple’s policies. However, the changes will not be applicable in the UK since it’s no longer part of the EU, but they have similar legislation being proposed called the UK’s Digital Markets Bill.

Apple has always maintained that its App Store rules are designed to protect users’ security. However, it has faced accusations of creating a monopoly and charging high commissions to developers. The introduction of alternative app stores is expected to address these concerns but comes with a warning from Apple about potential security risks, including increased exposure to malware, fraud, and scams.

Additionally, Apple announced it would open up browser choices for EU users, allowing them to opt out of using Safari from the first use. This development reflects the ongoing efforts to maintain open and competitive markets in the tech industry.

This has the potential to hit Apple’s bottom line and you can bet that Apple will do everything in its power to keep this from spreading to North America.

In its various stores some estimates say that Apple reportedly there are close to 100 billion dollars of purchases on in app purchases, subscriptions and premium apps.  A billion here, a billion there – soon you’re talking real money. 

Sources include: BBC and Statista 

And one more Apple story for today, this one with a theme to end privacy week.

Security researchers at Mysk Inc. have discovered that iPhone apps, including major ones like Facebook, LinkedIn, TikTok, and Twitter, are bypassing Apple’s privacy rules to collect user data through notifications. 

This method allows these apps to gather data even when users close them to prevent background data collection. The data collected, which is not necessary for processing notifications, appears to be used for analytics, advertising, and tracking users across different apps and devices.

The researchers were surprised to find that dismissing a notification could trigger the sending of detailed device information to remote servers. 

This practice is widespread in the iPhone ecosystem, not limited to a few apps. Meta (Facebook’s parent company) and LinkedIn have denied using the data for advertising or other inappropriate purposes, with LinkedIn stating that the data is only used to ensure notifications work properly and is in compliance with Apple’s guidelines.

This issue raises concerns about “fingerprinting,” a technique used to identify users based on various device details, which Apple explicitly forbids. The data collected includes IP addresses, phone memory space, and other details that can be combined to identify a person accurately. 

However, companies like Google, through apps like Gmail and YouTube, only collect data directly related to processing notifications, suggesting that the extensive data collection by other apps might have ulterior motives.

The upcoming changes to the iPhone operating system’s rules might improve the situation by requiring app developers to explain why and how they use certain APIs. However, it’s unclear how Apple will enforce these rules.

This revelation highlights the ongoing challenges in digital privacy and the complexities of managing user data collection in the ever-evolving tech landscape.

Well, that’s one way to end privacy week.

Sources include: Gizmodo

Hashtag Trending goes to air five days a week with a daily news show and every Saturday, we have an interview show called the Weekend Edition.  This weekend we’ll be looking at how Vancouver is becoming a hub for the new breed of financial services companies. I hope you’ll catch the show.

We love your comments. Please let us know what you think. You can reach me at jlove@itwc.ca  or leave a comment under the show notes at www.itworldcanada.com/podcasts. 

I’m your host Jim Love, thanks for listening and have a Fabulous Friday!

The post Hashtag Trending Jan.26-AI solves bus driver shortage; Impact of AI on quality of code; Apple’s privacy rules getting bypassed by Facebook, LinkedIn, Twitter and more first appeared on IT World Canada.

Google’s philanthropic arm is giving a $1.3 million grant to a Quebec agency for cybersecurity research.

The company said today the funds from Google.org are going to the Multidisciplinary Institute for Cybersecurity and Cyber Resilience (IMC2) to support research on the growing number of global cyber risks.

IMC2 is a partnership between Polytechnique Montréal, the initiator of the project, the University of Montreal, and HEC Montréal. Google.org says it supports nonprofits and social enterprises “whose work has the potential to produce meaningful change.”

Google Canada will also launch the Google Cybersecurity Certificate, an online course from Grow with Google that prepares learners for entry-level jobs in cybersecurity in less than six months, in French.

Google Canada will work with non-profit partners CyberQuebec, Hackfest, Cybereco, Canada Learning Code, and ComIT to provide scholarships to at-need communities and those in their networks to access the certificate for free.

Graduates from the Google Career Certificates program are connected to an employer consortium of companies including Bell, Shopify, Publicis Groupe and Unilever that consider students for relevant open roles. In Canada, over 19,000 people have graduated from the Google Career Certificate program, the company says.

“The grant from Google.org empowers IMC2 to drive cybersecurity initiatives which are essential for our vision of a cyber-resilient society,” Marc Gervais, the institute’s executive director, said in a statement. “The project focuses on four critical areas: fostering a cyber-aware and cyber-responsible society, implementing a secure platform for our researchers to share and leverage cybersecurity data, addressing the alignment between cyber initiatives and the creation of an environmentally friendly future, and driving economic growth and employment opportunities in Québec and Canada by supporting the entrepreneurial spirit in cybersecurity ventures.”

The post Quebec cybersecurity institute gets $1.3 million grant from Google first appeared on IT World Canada.

Bell has accused Québecor of refusing to enter into necessary mobile virtual network operator (MVNO) access agreements.

This comes a month after Québecor accused Bell, in a Part 1 application to the Canadian Radio-television Telecommunications Commission (CRTC), of undue delays in granting access to its network for the launch of its MVNO service.

The CRTC set out an initial policy in 2021, allowing regional cell phone providers to compete as MVNOs across Canada. Under this policy, large cell phone companies must share their networks with competitors who are able to serve in areas that incumbent carriers do not operate.

The Commission then established a deadline for regional providers to negotiate MVNO access agreements with incumbent carriers. If they cannot come to an agreement, they can ask the CRTC to set the rate through a process known as final offer arbitration (FOA), wherein each company submits its proposed rate.

Québecor and Bell entered into FOA last year and, in October, the CRTC ended up siding with Bell for Québecor’s access to its wireless network,

Right after that, Québecor announced the launch date of Oct. 11 for its MVNO service, which it said Bell did not honour. Consequently, Québecor asked the CRTC to apply the rate retroactively to that date and impose a monetary penalty on Bell for the alleged inappropriate and anti-competitive delays.

Bell, instead contends that Québecor has refused to enter into the MVNO access service agreement that would then establish the start date for the launch of the service.

“Bell has consistently acted expeditiously and in accordance with its tariffs; Québecor is simply asking the Commission to grant it an unjustified windfall payment from Bell,” the company said in a reply to Québecor’s Part 1 application.

The telco added, “Québecor’s true motivation in its application has nothing to do with the launch of its MVNO service to consumers or with the contents of Bell’s proposed MVNO access agreement. It is simply to extract a windfall retroactive payment from Bell (and Telus) for its roaming usage on Bell and Telus’ networks.”

MVNO and roaming are two different services, and granting Québecor’s request would be imposing a roaming rate that was not determined in accordance with the Roaming Tariff or the Roaming Agreement, Bell argued.

Bell also noted that Québecor services had already launched on existing roaming agreements with Bell following the CRTC’s FOA decision in October.

Telus, which also provides MVNO service to regional carriers in its network area via an agreement with Bell, also intervened in the dispute between the two companies, asking the CRTC to deny Québecor’s retroactive rate adjustment request.

“Regardless of the existence of any Bell/Québecor MVNO service agreement, the Commission cannot force Telus to charge rates other than the domestic roaming rates for traffic,” affirmed Telus.

Québecor has until tomorrow to file its reply to Bell’s allegations.

The post Bell and Québecor spar over MVNO access service agreements first appeared on IT World Canada.

Data Privacy Week is a period when organizations should reflect on whether they are at least doing the basics, says British Columbia’s privacy czar.

“The basic fundamentals” are what privacy pros need to be pondering this week, Michael McEvoy, B.C’s information and privacy commissioner, said in an interview. “Which,” he added, “you have to be thinking about all the time.

“When you are putting together a new product, or considering a new marketing tool, or anything of that kind, you need to be thinking about the personal information you’ll be collecting about patients, clients, customers, and how you’re going to protect it, how you’re going to use it and how you’re going to be transparent to your customers.

“People are far more aware of these issues than they were 10 years ago. They are far more sensitive about how their personal information can be used, and misused. And if you misuse it, you’re quickly going to lose the trust of those customers, clients and patients. So you have to think about these issues — and you have to think about them at the outset [of a project], not as an afterthought.”

This is a time when many innovative companies are pushing new technologies to corporate buyers, he said, such as facial recognition and artificial intelligence applications. But before organizations jump into new technologies, they have to ask whether they will serve their clients well and build trust with customers.

As an example, he cited a case his office handled of “a large retailer” in B.C. that used a facial recognition application to reduce shoplifting. It collected images of everyone who walked into stores and compared them to images of known shoplifters. As soon as management learned the privacy commissioner was investigating in November 2021, they pulled the systems and wiped the servers.

“Had they thought about some of these issues at the beginning, I don’t think they would have gone down that path,” McEvoy said.

He didn’t name the company, but it was a reference to four independently owned Canadian Tire affiliate stores. Last year McEvoy ruled the stores didn’t adequately notify customers and did not obtain consent for the collection of personal information using facial recognition technology.

Asked if companies just don’t think about some things they do, or deliberately want to test the limits of privacy law, he replied “My experience as commissioner is for the most part organizations want to do the right thing. And sometimes they will come to us, not sure if they are doing the right thing.” His office can’t give legal advice but does give guidance.

The best privacy action any organization can take is to create a privacy management program, he said. That doesn’t apply to just large firms, he added, because even small companies can collect a lot of personal information.

Related content: How to create a privacy management program

A privacy management program sets up a data privacy governance structure with processes employees have to follow — and includes measures to ensure they are being followed.

Senior management must actively champion the privacy program, according to guidance from three of the country’s privacy commissioners: “When senior management is committed to ensuring that the organization is compliant with privacy legislation, the program will have a better chance of success, and a culture of privacy will more likely be established.”

A data management program starts with the firm doing an inventory of all of the personal information it holds and categorizing it by sensitivity. When McEvoy’s office gets data breach reports, the first question asked is what information was breached. “You’d be surprised at the number of organizations that don’t have a good handle on exactly what they have,” he said.

A data inventory should lead to the creation of a data access policy, which restricts access to sensitive data to only those who need it.

Management also needs to decide why it is collecting, using, and disclosing data.

Then it has to develop internal policies to respect the principles in private-sector privacy legislation that the firm has to follow in each jurisdiction. That includes a policy on following data breach notification requirements to customers and/or a regulator.

Firms should conduct a privacy risk assessment of their data handling processes at least once a year.

Most of the incidents his office investigates could have been avoided, McEvoy said, had data been properly secured.

“That’s a hard lesson lots of organizations learn after the fact,” he said. Sometimes they didn’t want to spend the money. “But what is often not thought about is cost on the other side: what happens when things go wrong? What is the cost of that?”

Usually it’s far more worthwhile to spend on protecting data upfront than to pay for the costs of cleaning up after a privacy incident, he said. “Most cases are far more costly than any protection system you would have put in place”

The post Data Privacy Week: Are you meeting the fundamentals? first appeared on IT World Canada.

Organizations aren’t making much progress in convincing the public their data is being used responsibly in artificial intelligence applications, a new survey suggests.

The report, Cisco Systems’ seventh annual data privacy benchmark study, was released Thursday in conjunction with Data Privacy Week.

It includes responses from 2,600 security and privacy professionals in Australia, Brazil, China, France, Germany, India, Italy, Japan, Mexico, Spain, United Kingdom, and the United States. The survey was conducted in the summer of 2023.

Among the findings, 91 per cent of respondents agreed they need to do more to reassure customers that their data was being used only for intended and legitimate purposes in AI.

“This is similar to last year’s levels,” Cisco said in a news release accompanying the report, “suggesting not much process has been achieved.”

Most respondents said their organizations were limiting the use of generative AI (GenAI) over data privacy and security issues. Twenty-seven per cent said their firm had banned its use, at least temporarily.

Customers increasingly want to buy from organizations they can trust with their data, the report says, with 94 percent of respondents agreeing their customers would not buy from them if they did not adequately protect customer data.

Many of the survey responses show organizations recognize privacy is a critical enabler of customer trust. Eighty per cent of respondents said their organizations were getting significant benefits in loyalty and trust from their privacy investment. That’s up from 75 per cent in the 2022 survey and 71 per cent from the 2021 survey.

Nearly all (98 per cent) of this year’s respondents said they report one or more privacy metrics to the board, and over half are reporting three or more. Many of the top privacy metrics tie very closely to issues of customer trust, says the report, including audit results (44 per cent), data breaches (43 per cent), data subject requests (31 per cent), and incident response (29 per cent).

However, only 17 per cent said they report progress to their boards on meeting an industry-standard privacy maturity model, and only 27 per cent report any privacy gaps that were found.

Respondents in this year’s report estimated the financial benefits of privacy remain higher than when Cisco started tracking them four years ago, but with a notable difference. On average, they estimated benefits in 2023 of US$2.9 million. This is lower than last year’s peak of US$3.4 million, with similar reductions in large and small organizations.

“The causes of this are unclear,” says the report, “since most of the other financial-oriented metrics, such as respondents saying privacy benefits exceed costs, respondents getting significant financial benefits from privacy investment, and ROI (return on investment) calculations, all point to more positive economics. We will continue to track
this in future research to identify if this is an aberration or a longer-term trend.”

One challenge facing organizations when it comes to building trust with data is that their
priorities may differ somewhat from those of their customers, says the report. Consumers surveyed said their top privacy priorities are getting clear information on exactly how their data is being used (37 per cent), and not having their data sold for marketing purposes (24 per cent). Privacy pros said their top priorities are complying with privacy laws (25 per cent) and avoiding data breaches (23 per cent).

“While these are all important objectives [for firms], it does suggest additional attention on transparency would be helpful to customers — especially with AI applications where it may be difficult to understand how the AI algorithms make their decisions,” says the report.

The report recommends organizations:

— be more transparent in how they apply, manage, and use personal data, because this will go a long way towards building and maintaining customer trust;
— establish protections, such as AI ethics management programs, involving humans in the
process, and work to remove any biases in the algorithms, when using AI for automated
decision-making involving customer data;
— apply appropriate control mechanisms and educate employees on the risks associated with generative AI applications;
— continue investing in privacy to realize the significant business and economic benefits.

The post More work needed to blunt public’s AI privacy concerns: Report first appeared on IT World Canada.

The use of artificial intelligence in Canada’s federal, provincial, territorial and municipal governments has to be regulated as much as its use in the private sector, a conference on AI in the public sector has been told.

However, Stephen Troupe, CEO of the Canadian Institute for Advanced Research (CIFAR), also warned that regulation here can’t be done in isolation from what other countries are doing.

“I am not convinced national level regulation will be enough, or even provincial regulation. And yet I think it’s going to be almost impossible to get global regulation,” he told the conference organized by Ontario’s Information and Privacy Commissioner on Wednesday.

CEOs of major companies are flying around the world calling for a “global compact around AI,” Troupe said, but that “is a cynical exercise, because it’s not likely to happen.”

Ontario AI panel. From the left Teressa Scassa, Colin Mckay, Chris Parsons, Stephen Troupe, Melissa Kittmer, moderator Mike Maddock and Ontario information and privacy commissioner Patricia Kosseim. Panel participant Jeni Tennison appeared by videoconference.

Instead he called for “regulatory coalitions” with other jurisdictions like the European Union to make our regulatory frameworks as compatible as possible with theirs “so we don’t have a regulatory reach for the bottom.”

At the same time, our public and private sector AI frameworks should be flexible so innovation isn’t stifled and creates barriers to Canada’s AI successes.

“That’s easier said than done,” he admitted, “It will be very complicated. But we will lose public trust [in the public and private sector use of AI] if we don’t do enough, and lose the potential for creativity and opportunity for Canada and Ontario if we don’t do it the right way.”

The conference was part of the Ontario privacy commissioner’s education efforts during Data Privacy Week.

The conference opened with Ontario Information and Privacy Commissioner Patricia Kosseim repeating her call for the province to have an AI framework with binding rules governing the use of AI in the public sector.

Melissa Kittmer, assistant deputy minister in Ontario’s Ministry of Public and Business Service Delivery, said the government has been working on a Trustworthy AI Framework since 2021.

It has three priorities: “AI that people can trust” (making clear the risks of using AI, putting in mitigation strategies to minimize harm to people); “AI that is responsible” (have mechanisms allowing residents to challenge decisions informed by AI); and “No AI in secret” (ensuring there is transparency and disclosure when AI has been used to inform government decisions).

The goal of the framework is to enable the responsible use of AI by civil servants, she said. It will include policies, products, guidance, and tools to ensure the provincial government is transparent, accountable and responsible in its use of AI.

She didn’t say when the framework will be released.

Meanwhile, she said, Ontario is already using AI for extracting large amounts of data, in chatbots and virtual assistants, and for predictive soil mapping.

There are several initiatives across the country to legislate and regulate AI. Parliament is in the middle of debating a proposed Artificial Intelligence and Data Act (AIDA). But it only covers federally regulated businesses, as well as firms in provinces and territories that don’t have their own AI legislation. As for the federal civil service, Ottawa issued a directive on the use of AI in 2019. A guide for the federal use of generative AI was issued last year.

Last month, the European Union Council and members of Parliament reached a provisional agreement over a proposed Artificial Intelligence Act covering both the private and public sectors of the 27 member nations. Supporters hope it will be passed before Parliament adjourns for this summer’s elections.

In her opening remarks, Kosseim said AI “ushers in tremendous opportunities, with real world impacts unfolding in real time” that could affect everything from jobs to people’s health.

She said governments could use AI to draft plain language summaries of reports to help political decision-makers, cut delays to residents trying to access government benefits and services, enhance healthcare diagnosis through AI assistants, interpret medical images to find things the human eye might miss, predict the length of hospital stays, and help screen job applicants. Currently AI is being used to translate for people accessing emergency 911 who don’t speak English, she said.

However, she added, around the world there are examples of AI algorithms failing to return accurate results or perpetuating bias and discrimination against historically marginalized groups. One example: An algorithm used by a hospital to predict which patients will require extensive medical care was “heavily skewed in favour of white patients over black patients.” In another case, an algorithm used to accelerate job recruitment turned out to be biased against women.

“These and other examples speak to the importance of ridding bias in data sources used to train algorithms in the first place, as well as the need for human supervision over the returning results,” Kosseim said.

Troupe, who also oversees CIFAR’s Pan-Canadian AI Strategy, spoke of a Canadian Black computer scientist working on a facial recognition system for the art world who realized the system — which was already in use around the world — didn’t recognize her face, and by extension the faces of Black women. “That tells you the teams creating these systems were utterly unrepresentative,” he said. “To help generate widespread public confidence [in AI] we have to address that [system] creation.”

Big companies know about AI’s challenges, said Chris Parsons, manager of technology policy and strategic initiatives at the Ontario privacy commissioner’s office. Many have built safety checks, but there still can be bias in the underlying data they use. Many less regulated systems, he added, are “the wild west” that do things like generating child porn.

Organizations waiting for federal or provincial law on the use of generative AI should in the meantime turn to guidance issued by the country’s privacy commissioners, he said.

There are other reasons why provinces and territories need their own AI laws. Teressa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, reminded the conference that provinces — not the federal government — have authority over broader public sector institutions like hospitals and local police departments.

There are other issues AI raises, Scassa added, that involve non-personal information but that may have an effect on people’s lives. For example, she said, a data marketing company called Environics Analytics has a demonstration website of how publicly-available data it collects can categorize a postal zone for its customers. One north Toronto (North York) zone was described as “white collar,” with older families and empty nesters and an average income of $173,000. Data like this puts people into ‘ad hoc groups,’ she said, that could affect the delivery of services. How, she asked, is that addressed in privacy and human rights legislation?

“We need to have an eye on the broad impact [of the use of technology], not just individual privacy,” agreed Jeni Tennison, executive director of Connected by Data, which advocates for open data governance. What are needed are “group rights” so people can “match the power of big AI companies or governments when they deploy AI.”

The post Why Canadian provinces, territories need to regulate AI first appeared on IT World Canada.

Nearly 77 per cent of data professionals in Canada believe that the shortage of tech talent will continue throughout 2024, a new survey by Toronto-based IT consultancy firm Adastra found.

This is mainly because of the accelerated adoption of data analytics and AI.

Two specific areas are impacted by the widening talent gap, the survey revealed: frontline workers with the capacity to work with new analytic tools, strategies and programs, and senior data analysts/data scientists who can coordinate these activities and continue to discover business insights.

“We have certainly observed a spike in data analytics activity across all verticals, leading to a growing backlog of both talent and project demand within IT departments”, said Rahim Hajee, North American chief executive officer, Adastra, in a release. “Along with the shortage of qualified talent, the challenge in many companies is converting legacy mindsets and synergizing processes. 

This, he added, is a process of  “citizen enablement through re-training, allowing more members of an organization to participate through a no-code or low-code software environment.”

The survey, in fact, revealed that 90 per cent of respondents believe data optimization allows employers to redeploy staff to more meaningful and productive work.

Hajee added that the democratization of data within any organization allows more people to be involved in the day-to-day analytics taking place and helps to reduce the backlog that may exist in one’s IT/analytics department.

Close to 62 per cent of respondents are using, for instance, Retrieval Augmented Generation (RAG), which enables companies to use proprietary information to enhance the customer and employee experience via chatbot.

“Most organizations have realized the importance of data to their functionality and bottom-line successes”, said Dmitry Krass, academic co-director, Master of Management Analytics program at the University of Toronto’s Rotman School of Management. “It is not the number of trained people that is a problem, but rather the skills emphasized by the training. A data scientist without a strong focus on business and business processes cannot deliver value.”

The study shows that 76 per cent of Canadian respondents will be spending more on data analytics this year, notably as the push towards AI skyrockets. 

Accordingly, 87 per cent of respondents consider using data a competitive advantage, and as a result, 45 per cent believe more new jobs will be created in 2024.

Nick Kozlo, research director at Info-Tech Research Group, contended that IT leaders should remember that machines are not replacements for human talent, and conversely, humans should not be treated as machines.

He added, “The automation era demands a delicate balance in the workplace. IT leaders are increasingly required to integrate AI with human teams, balance remote and in-office work models, merge technical and soft skills, and ensure high productivity while maintaining employee wellbeing. Achieving this balance is crucial for both organizational success and team development.”

“As generative AI enters the workplace, organizations must not lose sight of its ultimate impact on the organization’s people and the skills that only people can bring to the workplace,” Info-Tech’s IT Talent Trends Report 2024 report highlighted.

The report also emphasized the need to optimize the new remote environment for human interactivity and collaboration. 

The post Booming data analytics and AI exacerbating tech talent shortage: Survey first appeared on IT World Canada.

Researchers find huge vulnerabilities in open source AI models, a travel company sees a surge in popularity of the filter than allows you to choose which aircraft to avoid, scientists set the doomsday clock at 90 seconds to midnight naming AI as one of the causes, a professor demonstrates how easy it might be to hack a voting machine and we celebrate the 40th birthday of the Macintosh.

All this and more on this nostalgia edition of Hashtag Trending. I’m your host Jim Love, CIO of IT World Canada and TechNewsDay in the US.  

A recent study by Protect AI researchers uncovered a startling reality. Since August, they found 3,354 models that contained malicious code on Hugging Face, a popular AI model repository. 

Even more concerning, it’s reported that Hugging Face’s security scans failed to flag about a third of these as unsafe.

In response to this type of threat, the company Protect AI has launched a scanning tool designed to safeguard companies against the rising threat of malware in open source AI models.

Open source AI models are growing in popularity if only for the simple reason that few companies can afford the resources to develop and train an AI model from scratch. 

Platforms like Hugging Face are also growing in popularity as a way to share these models. But these repositories may lack comprehensive security measures, leaving the shared models vulnerable to hacker manipulation.

Founded in 2022, Protect AI’s new tool scans AI models for hidden malware before these models find their way into a company’s IT systems. 

Protect AI plans to use Huntr, an AI-focused bug bounty program it acquired, to help identify potential vulnerabilities.

Ian Swanson, CEO and co-founder of Protect AI, puts it plainly: “Companies are freely and blindly downloading these models, but they can contain things that can execute some pretty bad functions to steal data or take over systems.”

Sources include: Axios

Kayak, the online travel agent, has seen a huge increase in the use of a filter that allows travellers to filter by type of aircraft.  After an alarming incident involving an Alaska Airlines flight, where a piece of the fuselage fell off,

Initially launched in 2019, Kayak’s aircraft filter was rarely used. However, following the recent Alaska Airlines incident, usage of the filter spiked, leading to a 15-fold increase. This prompted Kayak to make the filter more prominent and user-friendly on their platform.

The revamped filter now allows users to distinguish between the 737 Max 8 and Max 9 models, particularly significant as the Max 9 has been grounded by the Federal Aviation Administration.

A Kayak spokesperson emphasized the goal of their filters: to empower travelers with information for smart decisions and confident travel. 

With this information being readily available, travelers are now actively avoiding certain aircraft models, a trend typically reserved only for seasoned travelers with specific preferences.

How much impact is this having on carriers? United Airlines, heavily invested in the affected Boeing models, issued a profit warning, indicating the significant financial and operational impacts of these safety concerns on airlines.

And as we are going to air, the Guardian has posted another story, which they attribute to the FAA, that says “a nose wheel fell off a Delta Air Lines Boeing 757 passenger jet and rolled away as the plane lined up for takeoff over the weekend from Atlanta’s international airport. 

Something tells me that filter usage will spike again.

Sources include: The Guardian

In a recent federal trial, a computer science professor from the University of Michigan, demonstrated the potential vulnerabilities of Georgia’s voting system. 

We are all familiar with the conspiracy theories that have been floating around that claim that there was massive fraud in the U.S. election.  None of these claims have ever been proven, in fact, in audits and court cases, they have been disproven.

But it doesn’t mean that the machines are not vulnerable. 

So in the courtroom, the professor, Alex Halderman, showed how easily a voting machine could be tampered with using simple tools like a pen, a fake voter card, or a USB device. His demonstration included altering the results of a hypothetical referendum and flipping the winner in a theoretical election.

This trial, presided over by U.S. District Judge Amy Totenberg, is trying to assess whether Georgia’s voting system is susceptible to manipulation or programming errors. Halderman’s testimony highlighted the ease of tampering with the machines, raising concerns about the security of the system.

Election officials, however, maintain that Georgia’s elections have never been hacked and that security measures in place effectively prevent interference. They argue that the vulnerabilities demonstrated are speculative and not indicative of real-world risks.

The trial also delves into the January 2021 breach in Coffee County, where election software was copied and distributed, raising questions about the overall security of the voting system. The plaintiffs, including Georgia voters and activists, are urging Judge Totenberg to prohibit the use of these touchscreens in the upcoming 2024 elections, advocating for hand-filled paper ballots instead.

The case, which includes testimonies from both sides, will be decided by Judge Totenberg, with the outcome potentially impacting the future of voting systems in Georgia and perhaps throughout the U.S. 

Sources include: AJC 

The Doomsday Clock, a symbol representing the likelihood of a man-made global catastrophe, remains set at 90 seconds to midnight, indicating a continued high risk of global peril. 

This year, artificial intelligence (AI) has been highlighted as one of the major threats contributing to this dire prediction. 

The Doomsday Clock was created by the scientists involved in the Manhattan Project, the U.S. group that developed the first atomic bomb as we saw in the movie Oppenheimer. 

It was first unveiled on the cover of a 1947 magazine called the Bulletin of Atomic Scientists and was initially set at seven minutes to midnight. It has moved 25 times in the past 77 years, mostly due to the potential of nuclear war. In recent years it has been set to 90 seconds to midnight but this time, not only because of global conflicts the potential for atomic war.

The Bulletin of Atomic Scientists, responsible for the Clock emphasized the risks posed by AI, including misinformation, military use, and its potential to exacerbate other threats.

The scientists were careful to point out AI’s dual nature. It poses significant risks, but it also offers great potential benefits if well managed. 

Rachel Bronson, President of the Bulletin, stressed the urgent need for global action as illustrated by the 90 seconds to midnight setting.  Bill Nye, who most of us remember as the “science guy” also participated in the announcement, maybe with the hope that the guy who taught our kids about science can teach us another lesson – for the good of humanity.

Sources include: Tom’s Guide

And yesterday was, I am told, the 40th birthday of Apple’s Macintosh computer. Amazingly, some of us were around when these amazing devices first made their way into our lives. 

Where we were all typing into a command line, the Macintosh had a graphical user interface and a mouse. All we could say was – wow!

Here’s a quote from Steve Jobs in Apple’s press release:

Macintosh easily fits on a desk, both in terms of its style of operation and its physical design. It takes up about the same amount of desk space as a piece of paper. With Macintosh, the computer is an aid to spontaneity and originality, not an obstacle. It allows ideas and relationships to be viewed in new ways. Macintosh enhances not just productivity, but also creativity.

Even back then, Jobs was selling an idea – never a product.

They were beautiful devices, but they never really took off in business. One reason? The pricing for the original Macintosh was far too high – about $2,500 USD, about $7,000 in today’s dollars. But it had to cost a lot. It had a whopping 8 MHZ processor, 128 kilobytes, yes, that’s kilobytes, not megabytes of RAM and 400 KB floppy drive for storage. 

But the Macintosh wouldn’t go away. It found a niche with graphic artists and those who needed its capabilities. 

It wasn’t til Jobs came back for a second run at running Apple that he really got to see his vision of “Think Different” working in the marketplace. 

Happy birthday old friend.

Hashtag Trending goes to air five days a week with a daily news show and every Saturday, we have an interview show called the Weekend Edition. 

We love your comments. Please let us know what you think. You can reach me at jlove@itwc.ca  or leave a comment under the show notes at www.itworldcanada.com/podcasts. 

I’m your host Jim Love, thanks for listening and have a Thrilling Thursday.

The post Hashtag Trending Jan.25- New tool against vulnerabilities in open source AI models; AI behind doomsday?; 40th birthday of Macintosh first appeared on IT World Canada.