It is called Night in the Garden of Love, is produced in partnership with Weils, the Centre for Contemporary Art in Brussels, and it combines traditional art with an obvious technology bent that, in the words of its creator, “transports visitors into new and imaginary worlds.”

That creator is contemporary artist Shezad Dawood, a U.K. multidisciplinary artist who, according to his  bio, “interweaves stories, realities and symbolism to create richly layered artworks, spanning painting, textiles, sculpture, film, and digital media.”

Lateef and Dawood. Photo courtesy of Aga Khan Museum

Dawood based Night in the Garden of Love, which opened last month at the Aga Khan Museum in Toronto and runs until May 5, 2024, on the novella of the same name by African-American Muslim musician, composer, and polymath, Dr. Yusef Lateef, who passed away in 2013 at the age of 93.

Marianne Fenton, curator of special projects at the museum, described it as a “multisensory art experience. Centred around scores and rhythms, the exhibition explores the harmonic relationship between Dawood and Lateef’s work. It reflects the spirit and musicality of Lateef’s idea and drawings through Dawood’s interpretations, exploring gardens as realms of creation and optimism in the face of the climate crisis.”

During a media tour prior to the official opening, she described the exhibit, which contains a major virtual reality (VR) component as well as using artificial intelligence (AI), as “experiential, and we invite everyone to see it through that lens.”

The VR experience. Photo courtesy of Aga Khan Museum

Dawood collaborated with immersive film and digital arts production company UBIK Productions to create a two-player VR environment that Fenton said is designed to “immerse audiences in key scenes from the novella. This 3D reimagining of (it) begins in outer space, transports the players to the streets of Detroit, trails the mutant (a key figure in the novella) to a recycling plant, and culminates in a utopic garden adorned with imagined plants.

“The VR experience provides viewers with imagined interpretations of key moments from the novella. It also provides an interesting take on sustainability by viewing the discourse surrounding climate change through a hopeful lens.”

During the tour, Dawood, who is also a research fellow in experimental media at the University of Westminister in London, told IT World Canada he had never done a two-player VR before, and, he said, ” I was really interested, particularly with the thread of the narrative in the novella about this couple who the mutant leads into the Garden of Love. I was like, ‘oh, what is that experience of intimacy in the digital world? How do you bring intimacy into this space, which is not a likely candidate for intimacy?’

“I am actually very skeptical of digital media, believe it or not, even though I use it, but I think to use anything effectively, you have to be very critical of it. And it was this idea of like, ‘oh, what is that experience? Totally aside from VR, just the fact that you suddenly are in a position of a shared journey, or otherworldly space that opens up for you and one other person, if they are a partner, a friend, a colleague, or a perfect stranger.’ What does that do in terms of what you take away from the experience?”

AI was used in an unusual manner, according to a release issued prior to the Nov. 10 opening: “Accompanying the exhibition will be a scent created by Dawood in collaboration with Olivia Bransbourg of boutique perfume label Iconofly, perfumer Nicolas Bonneville, and fragrance house dsm-firmenich. The distinctive fragrance features eight middle notes. While some are recognizable, such as jasmine, others were crafted using artificial intelligence to represent plants that do not naturally produce a discernible scent.”

It is, said Fenton, “a union of nature and artificial intelligence. Here we see the digital and the analogue intersecting to create something previously unimagined and unique.”

According to the release, Dawood uses gardens as a starting point for creative, futuristic and intercultural conversations. It is a blend of two individuals – Dawood and Lateef, who the release notes was a “major force on the international music scene for more than six decades.

Photo courtesy of Aga Khan Museum

“Audiences will encounter a series of painted textile works by Dawood of real and imagined plants, original artwork by Lateef, and objects from the museum’s Permanent Collection as they journey through time, navigating a blend of analogue and digital spaces.”

Dawood’s interest in Lateef goes back well beyond his becoming an artist. “I knew the music of Yusef Lateef from my childhood,” he said during the media tour. “In a a very bizarre kind of twist of fate, my maternal uncle is called Yusef Lateef, so it was a running joke in our family, like, ‘not that Lateef, the other one.’”

He describes the exhibition as a “dynamic symphony with objects from the museum’s permanent collection joining the conversation as a juxtaposition between Lateef’s work and my own, it allows visitors to dive into the many flowerings and expressions of gardens throughout history.”

Admission prices for both the museum and Night in the Garden of Love are $20 for adults, $15 for seniors, $12 for students, $10 for those aged between seven and 13, and free for children six or younger. There is no admission charge on BMO Free Wednesdays, from 4 to 8 p.m.

The post Multisensory art exhibit at the Aga Khan Museum taps into AI, VR first appeared on IT World Canada.

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, December 15th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes Terry Cutler of Montreal’s Cyology Labs will be here to discuss several stories from the past seven days. These include a U.K. Parliamentary report saying the country isn’t prepared for a targeted ransomware attack, North Korea’s Lazarus group is still exploiting the two-year old Log4j vulnerability and the latest on insider attacks in a jail sentencing and a U.S. Air Force report into data leaking by an Airman.

But before we get to the discussion on those stories, here’s other recent news that happened this week:

The United States and the U.K. issued sanctions against the Russian-based Callisto Group, which is accused not only of widespread cyber attacks but also of trying to undermine democratic processes in Britain.

The Edulog Parent Portal used by some school boards so parents could keep track of school buses had access control problems that impaired security. Researchers at Tenable said the vulnerability could have allowed anyone access to sensitive data. Edulog says it has fixed the issue in the portal’s API.

The outage at the AlphV/BlackCat ransomware gang’s data leak site is still unexplained. No law enforcement agency has acknowledged having a hand in the outage. However, on Thursday the gang managed to get a message out that it hit a Toronto business management firm. It claims 8TB of data was copied. The firm hasn’t replied to my email request for comment.

Microsoft has seized the U.S.-based websites and IT infrastructure of a gang it calls Storm-1152. It’s the number one creator and seller to crooks of fake Microsoft accounts. These accounts can be used to bypass identity verification software. However, the gang may have online distribution sites in other countries.

A number of data management products from Dell Technologies need to be patched. The company says its PowerProtect Data Domain, APEX Protection Storage and Data Manger Appliance servers need to be updated to fix serious vulnerabilities.

Police in France arrested a Russian man suspected of laundering funds for the Hive ransomware gang. More than a half a million euros worth of cryptocurrency was seized. The Hive network was dismantled in January.

The British Ministry of Defence has been fined the equivalent of almost $600,000 for making a common email mistake: Sending a mass email to many people and putting all their email addresses in the “To” section. The email addresses should have been sent as a blind copy. Instead, the names and details of 265 Afghans seeking admission to the United Kingdom were revealed. Had the list of names fallen into the hands of the Taliban their lives could have been threatened.

And Southern Illinois Healthcare is notifying over 147,000 patients of a data breach. The incident at its Harrisburg clinic happened 12 months ago. Data copied may have included names, dates of birth, Social Security numbers and clinical information.

(This edited transcript covers one of the four issues discussed. To hear the full conversation play the podcast)

Howard: How much should a government lead in the fight against ransomware?

A British Parliamentary National Security Strategy report on ransomware this week said because large parts of the U.K. critical infrastructure is vulnerable, a co-ordinated and targeted attack has the potential to cause severe damage to the British economy. The report says the government should consider establishing a national cyber resilience regulator for critical infrastructure, which would cover utilities, banks, telecommunications, transportation, agriculture and governments. The report complained firms hit by ransomware get next to no support from law enforcement or government agencies. At the very least the government National Cyber Security Centre should be funded to support all public sector victims — like municipalities and hospitals — to the point of full recovery. More critically the report complains that while the Home Office — which has responsibility for police departments among other things — is supposed to be the lead department on ransomware the former cabinet minister in charge, the Home Secretary, had no interest in it. The report says responsibility for ransomware should be in the hands of the Deputy Prime Minister.

This is pretty incendiary stuff. My first question is, is any country ready for what the report calls “a co-ordinated and targeted attack?”

Terry Cutler: There’s a lot to digest here, and not just because of the amount of sheer complexity that’s involved. There’s not just one group that handles everything [in a nation] so we have to have an advanced cyber security infrastructure and kept constantly up to date. And there would have to be collaboration between national and corporate levels. Just try to imagine the people involved in handling all this. You’ve got CISOs that are aging three years just in one company and they would probably lose 50 years of their life handling all this. So the biggest piece is going to be collaboration between government and the private sector. There’s got to be regular application updating, audits and penetration testing all the time, which we’re not seeing now with companies. And if they’re also to adhere to a stronger regulatory framework there’s got to be strong stronger laws in place — something like GDPR in Europe, where there has to be breach notifications to victims and government.

Howard: This year we’ve seen record reported ransomware attacks, which raises the question of can a country be ready for a co-ordinated and targeted ransomware attack that’s a worst-case scenario?

Terry: It’s going to come down to rapid response and detection. But we’re short staffed in cyber security. We’re 3 million personnel short worldwide. Not many of us want to work for the government, for example, because the pay is a lot less [than the private sector]. You have less flexibility with your schedule. All those factors come into place. I do agree there needs to be a specialized cyber security force that’s going to have the proper measures in place to help protect the country. There also needs to be collaboration with law enforcement because we can stop these attacks in certain ways, but we need to go to the source and and shut these bad guys down.

Howard: I’ve asked this question many times before: This is 2023, ransomware is only a couple of years old and surely every company knows by now to be prepared for any cyber attack. So why aren’t critical infrastructure sectors ready now?

Terry: You still have a lot of legacy IT systems lying around, especially in healthcare. We’re still seeing Windows XP [in organizations], and they’re not designed to work with more modern technologies that are out there. But you can’t just mass update these things or replace them because it can be extremely expensive. Not only that some operating systems are embedded into the technology. For example, in healthcare a radio radiology machine that can cost $200,000 may have Windows XP built right into the box. You can’t just update the firmware; you have to replace the entire equipment. And there are budget constraints. There’s not an infinite budget for cyber security, especially in the private sector. I think the biggest challenge, too, is that these threats are evolving so quickly that we need AI and other technologies to stop attacks.

…Human error is one of the biggest threats. Even if we do a lot of security awareness training one employee could have an off day. They click on something they’re not supposed to and it allows the hacker to get into their environment. We’re also dealing with supply chain issues like we saw with Solarwinds … There’s just too much complexity [in IT environments] and it’s very, very hard to protect them.

Howard: The report raises the question I think of how much of this falls on the shoulders of government. In Canada and the U.S. there are government agencies like the U.S. Cyber Security and Infrastructure Security Agency (CISA), the Canadian Center for Cyber Security. They’ve got resources that companies can draw on. And of course companies can rely on their major providers — Microsoft, IBM, Cisco Systems and so on. But it seems companies aren’t getting the message. One thing we know from investigations is that a lot of companies are still failing on basic cyber security. Why is that happening? Should governments be pushing on cyber security or should industry lead?

Terry: I think it should be industry-led because we’re on the front lines of of seeing these attacks. We’re doing a lot of incident response, we’re collecting a lot of evidence of how these attacks are coming in … Government’s role is to be in charge of setting standards and regulations. You want to make sure that organizations comply and ensure some type of baseline-level security. Now of course smaller companies think no one’s going to want to hack them. But cybercriminals know they don’t have the time money or resource to deal with cybersecurity, so it makes them the number one target. So they need help even if it’s government grants or tax breaks on help them get up to date [technology].

Government should also provide resources and guidance, like the CISA. They’re going to do some some R and D. Of course governments need international co-operation. There’s also public awareness campaigns to promote safer online behavior.

If we look at the private sector’s responsibility, they’re going to be tasked with implementing these measures, have technologies in place to help protect the company. This will also involve continuous training and education … The private sector also can invest in cyber talent. I think the biggest takeaway here is collaboration. We need to be able to share the the type of information that we’re seeing on the ground to the government and help them create proper frameworks.

Howard: The report raises the idea of the U.K. creating a new national cyber resilience regulator for critical infrastructure that would have the power to punish organizations that don’t meet a cyber security regulatory standard. What do you think about that idea in Canada or the U.S.?

Terry: It’s a really good idea. But a lot of companies will say they don’t have the time or budget. But if you have incentive programs like tax breaks that would probably help. There’s some pros and cons: Some of the benefits are they’re going to have a standardization of cyber security practices. A dedicated regulator could help enforce and standardize cybersecurity measures across all of these industries. At least there’s a baseline. There’ll be some accountability finally because we’re not seeing much of that right now. But you have regulatory complexity now … Cyber security is a global issue, so ensuring that regulators can align international norms and practices will be very, very difficult to do.

Howard: The Canadian government has proposed a cyber security law for overseeing critical infrastructure. It’s now before Parliament. One piece would give the Industry Minister the power to order telecommunications companies to take specific actions to secure the communications sector. The law would also create a cyber security compliance regime for all critical industries by using existing regulators like the Superintendent of Banks, who oversees the financial sector; the Canadian Energy Regulator, which oversees inter-provincial utilities. So there wouldn’t be a need to create a new regulator. But these bodies would have the ability to issue fines for not meeting cyber security standards. Athough the bill was introduced over a year ago it isn’t even at the committee discussion stage yet.

Terry: I remember presenting to the Conference Board of Canada back in 2013 about how much the telcos can see on the internet. One of the biggest problems is how do you defend against things that you don’t know or have never seen? This is where the telecommunication carriers come in, because they have the biggest visibility over the internet. And if you pair them with law enforcement cyber criminals are going to have a fight on their hands. Bill C 26 has some benefits here. It’ll help improve cyber security defences, especially in critical infrastructure. It’ll give authority to the Industry Minister, and it’ll help protect against cyber threats for sure because right now telecommunications companies are not providing much cyber security on the back end.

The post Cyber Security Today, Week in Review for the week ending Friday, Dec. 15, 2023 first appeared on IT World Canada.

Almost 7 million U.S. residents are being notified by a dental benefits provider that their personal information was stolen in one of the biggest single attacks involving the MOVEit file transfer application.

Delta Dental of California and its affiliates, which provide dental benefits to individuals through commercial groups, said the attacker copied subscribers’ names, Delta financial account number or their credit/debit card numbers, along with security access codes, passwords or PIN numbers with the accounts. Passport numbers in some cases were also copied.

According to numbers tracked by Emsisoft, this is the third biggest publicly confirmed data theft from an individual company so far. The biggest is Maximus Inc., a U.S. government services provider, which said information on 11.3 million people was stolen from its MOVEit Transfer system.

The Clop/Cl0p ransomware gang has taken credit for discovering and exploiting a zero day vulnerability allowing it to bypass multifactor authentication on both on-premises and cloud versions of Progress Software’s MOVEit application.

The vulnerability, CVE-2023-34362, has been assigned a severity rating of 9.8 out of 10. 

U.S.-based organizations account for 78.4 per cent of known victims, Emsisoft says, Canada-based 13.8 percent and Germany-based 1.4 per cent. The most heavily impacted sectors are education (40.0 percent), health (19.6 percent), and finance and professional services (12.7 percent).

According to researchers at Kroll LLC, the most common technique of compromise involved a dropped web shell to inject a session or create a malicious account. From there, threat actors were able to reauthenticate and use the MOVEit application itself to transfer files.

However, in a few instances, the attacker passed three variables to the web shell: The organization ID, the folder ID and the file name. From there, the web shell utilized MOVEit API calls for file enumeration and data exfiltration. A Python script was used exfiltrate data during the initial wave of co-ordinated and largely automated attacks across MOVEit servers.

Kroll forensic analysis has also seen activity suggesting the Clop gang was likely experimenting with ways to exploit this particular vulnerability as far back as 2021.

The post Dental benefits group notifying almost 7 million Americans of MOVEit data theft first appeared on IT World Canada.

One of the biggest public school boards in Southern Ontario has publicly acknowledged a cyber attack, over a month after it was detected.

The York Region District School Board, which covers an area stretching from Toronto in the south to Lake Simcoe in the north, with a student population of over 128,000, said in a statement this week that late on Nov. 8, the IT department became aware of a cyber incident.

The cyber security response team immediately took mitigating action to preserve and contain data and ensure critical systems were protected, the statement says.

Since then, board has been working with third-party experts, including legal and technical, to analyze the extent of the incident and restore services. Law enforcement has also been contacted.

As part of its due diligence, the board will conduct a full investigation into what occurred, the statement says, although there is no promise the results will be made public.

“We know the public rely and trust the Board to maintain its data secure,” the statement says. “All our actions have been taken to ensure the integrity of staff and student data and ensure privacy is protected.”

Public sector organizations like school boards are favoured targets of hackers, who believe they can be more easily pressured into paying to get access back to stolen or encrypted data.

Related content: Durham region school board hit by cyber attack

In January, the Huron-Superior Catholic District School Board said unnamed attackers who stole “a significant number of files from a board file server” had deleted the data. Ultimately current and former students were sent data breach notification letters. 

However, vindictive hackers who don’t get paid may release data on children. In April, NBC News reported that a ransomware gang that broke into the Minneapolis Public Schools earlier this year published an enormous cache of files that appear to include highly sensitive documents on schoolchildren and teachers, including allegations of teacher abuse and students’ psychological reports.

The post Southern Ontario school board acknowledges ‘cyber incident’ first appeared on IT World Canada.

Threat actors are misusing OAuth-based applications as an automation tool for authentication, says Microsoft.

“Threat actors compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious activity,” the company said in a blog this week. “The misuse of OAuth also enables threat actors to maintain access to applications even if they lose access to the initially compromised account.”

Threat actors are launching phishing or password-spraying attacks to compromise user accounts that don’t have strong authentication mechanisms and have permissions to create or modify OAuth applications. The attackers misuse the OAuth applications with high privilege permissions to deploy virtual machines (VMs) for cryptocurrency mining, establish persistence following business email compromise (BEC), and launch spamming activity using the targeted organization’s resources and domain name.

IT managers should take the following steps to mitigate against OAuth abuse:
— implement security practices that strengthen account credentials, such as enabling multifactor authentication. That dramatically reduces the chance of attack, says Microsoft;
— to protect against attacks that leverage stolen credentials, enable conditional risk-based access policies;
— ensure continuous access evaluation is enabled if available in your environment;
— enable all security defaults in identity platforms;
— audit all apps and consented permissions to ensure applications are only accessing necessary data and adhering to the principles of least privilege access.

The report gives an example of what one threat actor, which Microsoft dubs Storm-1283, is doing. (Under Microsoft’s new naming taxonomy, groups dubbed ‘Storm’ are newly discovered or under development.)

Storm-1283 used a compromised user account to create an OAuth application and deploy VMs for cryptomining. The compromised account allowed the attacker to sign in through a VPN, create a new single-tenant OAuth application in Microsoft Entra ID named similarly to the Microsoft Entra ID tenant domain name, and add a set of secrets to the application.

A diagram of Storm-1283’s attack chain involving the creation of VMs for cryptocurrency mining. Microsoft graphic

As the compromised account had an ownership role on an Azure subscription, the actor also granted ‘Contributor’ role permission for the application to one of the active subscriptions using the compromised account.

The attacker also leveraged existing line-of-business OAuth applications that the compromised user account had access to in the tenant by adding an additional set of credentials to those applications, the report says. The actor initially deployed a small set of VMs in the same compromised subscriptions using one of the existing applications, and initiated the cryptomining activity. The actor then later returned to deploy more VMs using the new application. Targeted organizations incurred compute fees ranging from US$10,000 to US$1.5 million from the attacks, depending on the actor’s activity and duration of the attack.

The post Hackers abusing OAuth to automate cyber attacks, says Microsoft first appeared on IT World Canada.

A botnet expands, threats to unpatched TeamCity servers, and more.

Welcome to Cyber Security Today. It’s Friday, December 15th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

A botnet of compromised small and home office firewalls and routers continues to expand. Researchers at Lumen say those behind what it calls the KV-botnet most recently added internet-connected video cameras made by Axis and Netgear ProSafe firewalls. Lumen suspect the botnet is growing so it can be used for phishing campaigns during the holiday season. The researchers aren’t sure how devices are being infected. But they believe it’s run by a threat group dubbed Volt Typhoon or Bronze Silhouette by other researchers. It’s a state-sponsored group based in China that has been infiltrating critical infrastructure providers in the U.S. Often this botnet takes over out-of-date devices that can’t receive security patches anymore so they are ripe for picking. The report is a warning to IT and network leaders — as well as homeowners — to get rid of internet-connected equipment that isn’t supported anymore. At the very least make sure devices are regularly rebooted because that will flush some types of malware.

Unpatched servers hosting JetBrains’ TeamCity software are being exploited by Russian government hackers. That’s according to cyber authorities in the U.S., the U.K. and Poland. The Russian group, known as CozyBear, Nobelium or APT29 by security researchers, has been exploiting a vulnerability since September. Because TeamCity is used by software developers, a successful hacker gets access to source code and signing certificates that can be used to authenticate malware — everything needed for a supply chain attack. Companies using compromised and internet availableTeamCity servers have been found in the United States, Europe, Asia, and Australia. They include an energy trade association, internet hosting providers and more. Administrators of TeamCity who haven’t applied recent patches or workarounds should assume their servers have been compromised and take action.

Here’s another example of someone not configuring a database properly and leaving it open in the internet. It was discovered by security researcher Jeremiah Fowler and appears to belong to an American company that makes a cloud-based management suite for nonprofits. It has subscribing organizations around the world. Had someone found this particular database they would have been able to download over 460GB of data. Fowler saw a document from a hospital charity that named a child, their medical conditions and their doctor. This is another reminder that organizations have to make sure all employees handling the personal data of customers and employees know how to protect data from exposure. In addition IT leaders have to constantly watch data stores created by employees for security breaches.

On a November podcast I told you that personal information of staff working at the Idaho National Laboratory, a federal nuclear energy research facility, had been stolen. The number of victims has now been released: It’s just over 45,000 current and former employees, their spouses and dependents. The notice to victims says the data was stolen from an off-site data centre and not the lab’s IT system.

Finally, users of the Discord voice, video and chat app can now use security key-based multifactor authentication to protect their accounts from being hacked. That means they can use Windows Hello, Apple Face ID, Touch ID or physical security keys for logging in to Discord.

That’s it for this podcast. However, later today the Week in Review edition will be available. Guest Terry Cutler of Cyology Labs will join me to discuss a report on the readiness of the U.K. to face malware, why applications with old versions Log4j is still being compromised and more.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Dec. 15, 2023 – A botnet expands, threats to unpatched TeamCity servers, and more first appeared on IT World Canada.

Dropbox communication slip up has users thinking their AI search may compromise their privacy, Intel launches its AI enabled chip for PCs. What might be behind OpenAI’s partnership with a German publishing group and our final installment of the X files for 2023. 

The Musk is out there.

I’m your host Jim Love, CIO of IT World Canada and Tech News Day in the US.

Dropbox’s new AI feature raises privacy concerns. Dropbox recently introduced a feature that automatically shares user data with OpenAI for an AI-powered search tool, causing unease among its users. 

This setting, enabled by default, only shares data when the feature is actively used, and Dropbox assures that the data isn’t used to train AI models and is deleted within 30 days. Despite these assurances, the default activation of this feature led to user discontent. 

Dropbox CEO Drew Houston apologized for the confusion, clarifying that no data is sent to third-party AI services without explicit user action. Critics argue that Dropbox could have communicated this change more transparently. 

The feature, part of the “Dropbox AI alpha,” allows users to interact with a ChatGPT-style bot for file inquiries. Dropbox emphasizes user control over the feature, which can be easily disabled in account settings. Currently, OpenAI is the sole AI provider for this Dropbox feature.

Sources include: ArsTechnica 

Intel Sees Growing Adoption of AI Chips in PCs  

Intel announced that dozens of manufacturers are utilizing its latest processors enabled with AI acceleration technology. The chip, with the code name Meteor Lake was developed specifically to handle AI workloads on laptops and desktops.

By embedding specialty AI circuitry – a neural processing unit within central processors, Intel promises to make AI more accessible in mainstream computing.

Wide adoption by major PC brands like Dell, Microsoft and Lenovo demonstrates burgeoning demand for on-device AI. Intel is positioning itself at the forefront with dedicated silicon tailored to intensive neural network computations. 

This new chip is only the first salvo as Intel ramps up to compete with Nvidia and AMD in this crucial new area. The company said it was working on a new chip called Gaudi 3 (again, I have to ask who makes these names up?)  Anyway, Intel hopes its new Guadi 3 will have what it takes to take on Nvidia in particular.  

Sources include: Reuters

European Union to classify gig workers as employees using the “duck test.” You know the saying – if it walks like a duck and talks like a Duck.

After two years of negotiation, the European Council and Parliament have reached a provisional agreement to reclassify many gig workers as employees. 

This change affects those who use apps for tasks like food delivery or taxi services. Currently, most of the EU’s 28 million platform workers are self-employed, but about 5.5 million may be misclassified. 

The new directive sets criteria for determining employment status and limits algorithmic management of workers. Workers will be considered employees if they meet at least two of five conditions related to payment caps, performance supervision, task allocation, control over working conditions, and discretion in work execution. 

The agreement also mandates human decision-making in dismissals and restricts the use of personal data for profiling or predicting union activity. The European Trade Union Confederation has welcomed the agreement, highlighting its potential to address issues of false self-employment and ensure fair labor rights.

Sources include: The Register

In recent events, the EU has passed the EU AI Act, which stipulates that foundation models must comply with specific transparency obligations before being placed on the market. The EU differentiates general-purpose AI models based on risks, and OpenAI falls under the high-risk category. Axel Springer’s partnership would assist OpenAI in demonstrating to EU officials that it has not used stolen data to train its models.

It turns out that OpenAI’s partnership with European global publisher Axel Springer may be much more strategic than it first appears. 

Axel Springer publishes Politico and Business Insider into ChatGPT. This collaboration, which also includes compensation for Axel Springer, aims to improve GPT-4’s capabilities. 

This move follows OpenAI’s earlier partnership with the Associated Press. 

But here’s where the strategy piece lies.  

OpenAI has a strained relationship with the European Union, especially after Germany considered banning ChatGPT over privacy concerns. 

This collaboration could help OpenAI navigate the EU’s new AI Act, which imposes strict transparency obligations on high-risk AI models like those of OpenAI. 

The partnership also comes amidst competition from Grok, which offers real-time information access. And there is also competition coming from Open Source like Mistral AI.  Open source companies are exempt from the EU’s legislation.

One drawback is that OpenAI’s decision to partner with a specific media house could introduce bias into ChatGPT’s responses, which is a concern for OpenAI’s safety team. 

Despite potential drawbacks, this partnership is seen as a strategic move to and potentially one which could enhance ChatGPT’s accuracy and reduce misinformation.

Sources include: Analytics India 

Elon Musk’s X (formerly Twitter) is facing a significant downturn in advertising revenue. Insider sources revealed that X expects to end 2023 with around $2.5 billion in ad revenue, a substantial drop from previous years and half a billion short of its $3 billion target. 

In 2022, Twitter generated over $1 billion in ad revenue per quarter, but X has only managed a little over $600 million in each of the first three quarters of 2023. 

The recent advertiser fallout over antisemitic content on X, estimated to have caused a $75 million loss, further clouds the fourth quarter’s outlook. Advertising earnings, which comprise 70-75 per cent of X’s revenue, suggest total earnings of roughly $3.4 billion in 2023, including subscriptions and data licensing deals. 

If the damage caused by anti-semetic tweets wasn’t enough, Musk has doubled down by allowing Alex Jones, who denied the Sandy Hook massacres, to be allowed back on Twitter. How that will win new advertising revenue is a bit of a mystery to us mere mortals.

X’s head of business operations, Joe Benarroch, emphasized that X should no longer be compared to Twitter, as it is now an evolving business with multiple revenue streams. 

Amidst these challenges, X is attempting to attract more users and content creators with ad revenue sharing, but the current advertiser boycott and Musk’s controversial statements and behaviours may hinder these efforts.

Sources include: ArsTechnica 

Amazon’s ‘Alexa, thank my driver’ campaign has returned. 

Amazon has brought back its initiative to appreciate delivery drivers during the holiday season. By saying “Alexa, thank my driver,” customers can express their gratitude, and the first two million drivers to receive thanks will also get a $5 bonus from Amazon. 

This gesture acknowledges the crucial role of delivery drivers in the holiday economy, from stocking shelves to sorting packages. To thank a driver, users can simply use their Echo device or the Amazon shopping or Alexa app. The ‘Thank my driver’ feature is available for deliveries made within the past 14 days. 

After the first two million drivers have been thanked, customers can still express gratitude, but no monetary reward will be included. Additionally, customers can show appreciation by leaving snacks and refreshments or small gifts for their regular delivery drivers. This campaign is a way for Amazon to recognize the hard work of drivers during the busiest time of the year.

Sources include: ZDNet 

And that’s what’s trending today.

Hashtag Trending goes to air 5 days a week with a special weekend interview show we call “the Weekend Edition.” We’ll be off the air with the daily show until January 8th, but I’ll be doing a few live shows through that time, so keep checking on us.

One last request for this year – two actually.  One let me know how we are doing.  Are we hitting the right articles for you? Do you want to hear more of one thing and less of another. I’d love to use this in our planning for the coming year. Write to me at jlove@itwc.ca – it’s easy. J for Jim. Love and then itwc.ca for IT World Canada. jlove@itwc.ca Or just leave a comment after the show notes posted on itworldcanada.com 

And if you have enjoyed this podcast this year, why not send it to a friend and let them know about us. You can send them an email or post it to social media. You can find a shareable version at ITWorldCanada.com/podcasts

You can get us anywhere you get audio podcasts and there is a copy of the show notes at itworldcanada.com/podcasts 

I’m your host Jim Love.  Have a Fabulous Friday and a Happy Holiday.

The post Hashtag Trending Dec.15- Dropbox’s new AI feature raises privacy concerns; Intel’s AI-enabled chip for PCs; X’s ad revenue continues to plunge first appeared on IT World Canada.

The Benefit Delivery Modernization (BDM) program, the largest IT transformation initiative ever undertaken by the Government of Canada, was estimated to cost $1.75 billion when it launched in 2017. Five years later, the cost estimate reached $2.2 billion, and chances are it will be revised again, as delays and challenges persist, deplored Andrew Hayes, deputy auditor general, during a House of Commons Standing Committee on Public Accounts (CAPH) meeting today.

Halfway through the program’s 13 year timeline, we’re “still running on systems that are between 20 and 60 years old,” he added.

BDM is tasked with transforming how three key programs: Employment Insurance, the Canada Pension Plan, and Old Age Security benefits, are delivered to Canadians. Paul Thompson, deputy minister, Department of Employment and Social Development said that the transformed systems will be safer, agile and capable of delivering a better customer experience.

So far, Public Services and Procurement Canada (PSPC) has spent $817 million on the program, out of the $2.2 billion cost estimate, which includes $669 million in contracts with outside consultants. Four main system integrators, including Accenture, CGI Information Systems, Deloitte, and Fujitsu Consulting, account for the majority of that amount, said Thompson. And there are yet other million dollar contracts with IBM and Price Waterhouse Cooper (PwC).

“We’re approaching a billion dollars. These are astronomical figures. They’re immense, and they’re heavy for Canadians. And all this spending has led to the brutal findings from the Auditor General, warning of another Phoenix,” said NDP representative Blake Desjarlais.

A recent report from the Office of the Auditor General of Canada (OAG), in fact, showed that two-thirds of the government’s 7500 software applications were in poor health. Of those, 562 are essential to the health, safety, security, or economic well being of Canadians. Some of the systems date back to the early 1960s.

Canada’s chief information officer, Catherine Luelo, who appeared via videoconference, said, “We spend about $10 billion a year on technology, but I’m not sure this is about more money at this stage.”

The biggest challenge, she said, is a lack of skilled personnel in the public sector to carry out modernization.

“The reality is that there’s recruitment and retention challenges. It is a competitive marketplace for skilled IT professionals, which means that the government has to look creatively at how to retain and attract these people, but also has to take a good careful look at how they will train and upskill their current employees.”

Plus, she said, “we’re not paying our staff enough.”

Desjarlais added, “It’s much easier to work for IBM, it’s much easier to work for McKinsey, it’s much easier to work for these other companies that then hold the government hostage and say, ‘you will pay us because there’s no one else to do this work’, because you failed to pay our employees properly or at least a competitive rate.”

Audit after audit showed a continued pattern of outsourcing, which balloons cost while also diminishing public service, lamented Desjarlais.

However, Luelo maintained that modernization will be impossible without third party help. Hiring challenges, labour intensity and the volume of work all contribute to the decision to bring in third party firms.

Further, Luelo pointed to a lack of a central control around the disbursement of funds when it comes to modernizing Canada’s IT systems.

She explained that when she was a CIO in the private sector, she had the ability to set the strategy and then control the funding, meaning that there was a level of control when there was a sign-off on technology work that went across multiple divisions of publicly traded organizations. 

“That same level of oversight [in the government] does not exist. We are in a very vertical model for many good reasons. But these are horizontal problems, and we don’t have, in my opinion, the right horizontal financial controls in place on technology investment.”

Within the government, there’s also an issue of prioritization that staggers progress, as not all issues can be addressed at once, Luelo said.

“In prioritization, there’s winners and losers, and we don’t seem to have a comfort with stopping programs or delaying them to allow us to do the work that needs to happen on the higher risk program.”

Scott Jones, president of Shared Services Canada, explained that the information upon which priority decisions are made also delays progress.

“Departments themselves are responsible for modernizing their applications,” he said. “They sometimes have to make difficult decisions with their financing because if they have to pay for modernization, it might have to come out of the funds that they would otherwise use for services or programs for Canadians.”

During the committee meeting, Luelo also addressed her recent resignation.

“I would observe within the public service, I’m used to being in meetings talking about delivery velocity, talking about budgets, talking about change management, talking about adoption, talking about ‘the doing’. And what I find is we spend more talking about ‘the what we might do’ versus actually talking about the ‘how we’re doing it and the result’, and my opinion is that needs to change.”

The post Big budgets, laggard IT systems: Government officials questioned at House of Commons committee first appeared on IT World Canada.

Rogers and Lynk Global have announced that they have completed a successful satellite-to-mobile phone call, using Samsung Galaxy S22 smartphones.

The two companies also tested SMS, data, and emergency alerting services.

Newfoundland and Labrador Premier Andrew Furey conducted the call with a NL Search and Rescue volunteer, using Lynk’s low-earth orbit (LEO) satellites and Rogers national wireless spectrum.

Watch Premier Furey and Mabel Tilley (First Responder, Newfoundland and Labrador Search and Rescue Association) making the test call here.

“Newfoundland and Labrador is a vast, largely rural province, and connectivity is an important issue for us,” said Furey. “As Premier, I am excited about the breakthrough technology Rogers is testing to improve network coverage and the safety of people in our province and across the country.”

The call was conducted in Heart’s Content, NL, where the world’s first transatlantic telegraph cable transmission took place between Canada and Ireland, over 150 years ago.

Rogers said it will launch satellite-to-mobile phone technology in 2024, starting with SMS texting, mass notifications, and machine-to-machine AI applications, and then expand the service to include voice and data services.

Wireless spectrum ensures this technology works on existing smartphones so customers don’t need to install customized apps or not yet available hardware.

“We’re bringing coverage to Canada’s most remote areas to improve public safety and to connect communities that aren’t connected today,” said Tony Staffieri, president and chief executive, Rogers. “We’re proud to work with Lynk to bring Canadians the very latest global technology that will give them access to 911 and wireless services.”

Last month, Telus also used satellite connectivity to conduct voice calls, send text messages between smartphones, and connect to IoT devices, partnering with non-terrestrial-network (NTN) service provider Skylo and wholesale satellite services provider TerreStar.

The company also has made plans to introduce devices equipped with 5G satellite capabilities to customers in 2024.

The post Rogers and Lynk complete satellite-to-mobile phone call, 2024 launch anticipated first appeared on IT World Canada.

White House dives into open source AI debate, bots boom and Google comes back to the top spot in Cloudflare’s 2023 web report, Google Cloud partners with Mistral AI on generative language models and Google admits that its demonstration of Gemini was what it “could” be like. All that, and the ultimate Canadian Christmas gifts on Hashtag Trending.

I’m your host Jim Love, CIO of IT World Canada and Tech News Day in the US.

The Biden administration is wading into the debate  on the potential benefits and risks of open-source AI. The National Telecommunications and Information Administration (NTIA) is spearheading the initiative, aiming to determine whether freely accessible AI models can make society safer or unleash unforeseen dangers.

This move comes amid rising concerns about the potential misuse of AI and worries about the easy accessibility of open-source models.

Proponents of open-source AI argue that it fosters transparency and collaboration, allowing researchers to identify and mitigate biases and vulnerabilities in AI systems. 

Critics warn that open access could enable bad actors to exploit these models for malicious purposes or even weaponize them. 

The NTIA’s involvement signals the Biden administration’s commitment to shaping the responsible development and deployment of AI. 

Their efforts will involve convening stakeholders from academia, industry, and civil society to hash out a framework for open source AI that hopefully balances innovation with safety.

Sources include: Axios 

Cloudflare published its 2023 Year in Review and here are some of the key takeaways.

Global internet traffic increased by 25 per cent, driven by device connectivity and content consumption.

After a brief TikTok reign, Google recaptured the top spot as the most visited website.

Mobile devices now generate over 42 per cent of global internet traffic, with Android dominating most regions. Surprisingly, Finland, the land of Nokia, boasts the highest desktop traffic (80 per cent) globally.

Satellite internet provider Starlink tripled its traffic in 2023, showing rapid growth wherever it lands.

Bot Boom – Bot traffic surged by 33 per cent, with one-third originating from the US. 

However, Cloudflare notes that not all bots are malicious. 

IPv6 Lags: Despite years of anticipation, IPv6 adoption remains sluggish, with only 33.75 per cent of traffic on Cloudflare’s network utilizing the “next-generation” protocol.

You can explore the full report with interactive charts and graphs.  A link is included in the show notes at itworldcanada.com/podcasts 

 https://radar.cloudflare.com/year-in-review/2023

Sources include: https://radar.cloudflare.com/year-in-review/2023

We did a story on Mistral yesterday – it’s a new AI that is making waves because of its faster and cheaper training and operations, the fact that it rivals OpenAI 3.5 and beats other models in terms of its speed, accuracy and performance.  And oh yes, it’s open source.

Today Google Cloud announced a new partnership with Mistral AI to provide access to the generative language model via its cloud platform. Mistral integration with Google Cloud allows it to scale up rapidly, taking advantage of Google’s infrastructure, security and experience.

This partnership follows on the disappointing launch of Google’s Gemini, with allegations that the cloud giant may even have misled people with its video unveiling of its new AI update.

Sources include: Reuters 

And on that story Google acknowledged it may have misrepresented the capabilities of its Gemini AI chatbot during what was presented to appear as a live demo. 

The video that the company issued had been selectively edited to make it seem like the AI was having a real time conversation and responding to someone drawing in real time. This was not the case.

The actual demo was done with a text interface and still pictures.  

And Google’s response to the criticism that follows is:

Google’s vice president of research, Oriol Vinyals wrote a post on X which said “The video illustrates what the multimode user experiences built with Gemini could look like.” 

Operative word is COULD. 

The revelation demonstrates the gray area emerging around marketing language for generative AI products. There are already reports of tricks used to fool benchmark tests by including the questions in the model training set – like bringing crib notes to an exam in the old days.

There’s a lot of talk about responsibilities and guardrails to keep AI from misleading the public. Maybe we need a little more focus on human responsibility. 

As public excitement builds, and competition increases, tech companies feel pressure to position themselves as leaders.  

While showcasing AIs that can mimic human conversations generates buzz, responsibly portraying current limitations is what will foster public trust. 

Sources include: Yahoo News 

And this has nothing to do with technology, other than it’s digital marketing,  but our editor sent it to me and it’s delightful.

Expedia is partnering with Destination Canada to unveil a new tourism campaign focused on boosting travel to Canada. Dubbed “YesYouCanada,” it aims to inspire Americans to visit by highlighting unique Canadian destinations and experiences.

The promotion leans into playful Canadian stereotypes while showcasing the country’s vibrant culture and stunning landscapes. Example itineraries feature dog sledding, NHL games, and trips to see the Northern Lights.  

But the promotion also features for $20.23 each, and bookable on a first-come, first served basis, the right to name:

A resident moose at the Yukon Wildlife Preserve in the Yukon

A limited-edition beer at Container Brewing in Vancouver, British Columbia

A train seat on the Rocky Mountaineer that crosses the Canadian Rockies

A storm-watching hot tub at the Black Rock Oceanfront Resort on Vancouver Island

A polar bear at Churchill Wildlife Management Area in Churchill, Manitoba

A pond hockey team at Elk Ridge Resort in Saskatchewan

A potato field at FarmBoys Inc. on Prince Edward Island

A golf hole at Fairmont Chateau Whistler Golf Club in Whistler, British Columbia

An ice fishing shack on Lake Winnipeg in Gimli, Manitoba

A canoe at the iconic Fairmont Chateau Lake Louise in Banff, Alberta

And my personal favourite – a bar stool at the Rundle Lounge inside the Fairmont Banff Springs Hotel in Banff, Alberta

The press release notes that this “The chance to name one of these items after a loved one comes at a perfect time as many of us are struggling to finish up holiday shopping lists.” 

Like everyone whose been married for more than forty years, I’m always struggling to find a new idea. But I’m not sure about giving my wife a moose named after her. Maybe I’ll go for the beer.

Is this working? Expedia says they are seeing surging search queries for Canadian vacations. 

Sources include: Multivu

And that’s what’s trending today.

Hashtag Trending goes to air 5 days a week with a special weekend interview show we call “the Weekend Edition.”

You can get us anywhere you get audio podcasts and there is a copy of the show notes at itworldcanada.com/podcasts 

I’m your host Jim Love.  Have a thrilling Thursday!

The post Hashtag Trending Dec.14- White House wades in open source AI debate; Cloudflare’s 2023 web report; Google Cloud partners with Mistral AI first appeared on IT World Canada.