Holes in open source software, ransomware gang tries to evade cyber insurers and more

Welcome to Cyber Security Today. It’s Friday, February 24th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

Creators of open-source projects still aren’t doing enough to ensure their code is squeaky clean. Researchers at Synopsys released their annual Open Source Security and Risk Analysis report this week, which looked at 1,700 audits of commercial and proprietary software. And the results weren’t pretty. Eighty-four per cent of the codebases examined had at least one known open source vulnerability. That’s up four per cent from last year. Here’s something else: Of the 1,480 audited codebases that included risk assessments by corporate owners of the software, 91 per cent contained outdated versions of open-source components. Developers of applications and IT departments that buy them need to have complete visibility of their software, says Synopsys. It helps for developers to create and buyers to demand a software bill of goods, the company adds.

Hackers have created a new class of bugs that get around the security protection of iPhones,iPads and Macs. Researchers at Trellix found the malware could evade protections preventing unapproved software running on the macOS and iOS operating systems. Normally this would be a significant breach of the Apple security model. However, the vulnerabilities were addressed with the recent releases of macOS 13.2 and iOS 16.3. Which is why you should have installed them by now.

The HardBit ransomware gang has a new tactic for dealing with corporate victims: Rather than haggling over payment to get access to encrypted data back, organizations are asked to go behind the backs of their insurers and divulge details of their cyber insurance policies (if they have one). Then the payment demanded will just be the maximum under the coverage. It’s pitched as a deal: If the gang knows you are insured only for, say $10 million, it promises not to demand more than $10 million.

A Russian citizen has been extradited to the U.S. from the republic of Georgia to face computer fraud and other charges. The man was arrested last October. It is alleged he created a program able to decrypt scrambled login credentials, a program he sold to other crooks. He also sold the cracked passwords.

Finally, if you use the Google Chrome browser make sure it’s running the latest version. This week it began rolling out a Windows version that starts with 110 and ends with .117 that fixes 10 security flaws, one of which is critical

That’s it for now. But later today the Week in Review will be available. Guest commentator Terry Cutler and I will look at employees falling for SMS text scams, information security leaders leaving their jobs and more.

Links to details about podcast stories are in the text version at ITWorldCanada.com. That’s where you’ll also find other stories of mine.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon

The post Cyber Security Today, Feb. 24, 2023 – Holes in open source software, ransomware gang tries to evade cyber insurers and more first appeared on IT World Canada.

Google Cloud asks employees to share desks, Canada starts investigation into TikTok and AI-created images lose their copyright protection.

It’s Friday, February 24th. These stories and more on Hashtag Trending–today’s top technology news stories. I’m your host, Jim Love.

In its latest cost-cutting moves, the cloud unit of Google has asked employees to transition to a desk-sharing workspace in five of its locations.

The new desk-sharing model will apply to Google Cloud’s five largest U.S. locations — Kirkland, Washington; New York City; San Francisco; Seattle; and Sunnyvale, California.

Google has said previously in its fourth-quarter earnings call that it expects to incur costs of about $500 million related to reduced global office space and other real estate charges. 

Employees and partners are being asked to share their desks on alternate days with their desk mates, starting next quarter.

The memo announcing the change says employees may come in on other days, but if they’re in on an unassigned day, they will use “overflow drop-in space.”

Internal documents reveal that the tech giant is pushing a slow return to office patterns, while ensuring “real estate efficiency” and continued investment in the Cloud unit;s growth.

The new seating arrangement is called “Cloud Office Evolution”, which the company described as “combining the best of pre-pandemic collaboration with the flexibility” of hybrid work.”

The company has noted the new workspace plan is not a temporary pilot and will lead to more efficient use of its space.

Following the announcement, memes rolled in, specifically on the “corpspeak” used by the head of the company to promote the new desk-sharing model.

One meme read; “Not every cost-cutting measure needs to be word mangled into sounding good for employees. A simple ‘We are cutting office space to reduce costs’ would make leadership sound more believable.”

Source: CNBC

Concerns about TikTok are spreading across the US and now into Canada and even the European Union.

Canada’s federal privacy commissioner, along with three provincial privacy commissioners, have started an investigation into TikTok, examining how the video-streaming platform collects the personal data of Canadian users.

The three participating provincial commissioners are Québec, Alberta, and British Columbia.

The privacy watchdogs will assess whether TikTok’s data collection practices are in compliance with Canadian privacy legislation, particularly whether valid and meaningful consent is being obtained for collection, use, and disclosure of personal information. The investigation will also examine whether the company is meeting the transparency requirements when collecting personal information of its users.

Source: IT World Canada   

The European Commission, on the other hand, has straight up banned the use of TikTok on its staff devices.

The commission says it has around 32,000 permanent and contract employees.

They must remove the app as soon as possible and no later than the 15th of March

TikTok said the commission’s decision was based on mistaken ideas about its platform. E tu, EU?

Source: BBC

Perhaps fearing that the Edge browser will be used to download Chrome, and then remain unused, Microsoft is aggressively trying to keep customers on Edge and that’s by bombarding them with full-size ads, on the Chrome website. 

An attempt to install Chrome using Edge Canary now results in the browser displaying two ads: a small one that first pops on the screen when the Chrome website loads and second, a full-size banner once the download starts.

The banner states that Edge uses the same technology as Chrome but with the “added trust of Microsoft”.

Google also shows banners to promote Chrome, but they appear only on the company’s websites.

But Microsoft crying foul every time a user wants to download another browser remains questionable. Maybe, promoting the AI Bing might be a better strategy, after all, some of its behaviour has kept people on Edge.

Microsoft may be revising their strategy as apparently, the latest Edge releases did not get the banner.

In fact, as of today, the banner doesn’t show up in Edge Canary, Dev, and Stable. Beta is the only version still displaying the banner when you try to download Chrome.

Source: Neowin

Pirated Final Cut Pro is no bargain. Security researchers at Jamf Threat Labs found a cryptomining operation targeting macOS pirated version of Final Cut Pro. 

The software is distributed via Pirate Bay, a popular torrent site that allows people to download and stream entertainment media and software

It appears that users have also been uploading other macOS apps like Adobe Photoshop and Logic Pro X since 2019, all of them containing a payload for cryptocurrency mining.

The malware has undergone three major development stages, each time adding more complex evasion techniques. Security tools today only detect the first generation of threat, which stopped circulating in April 2021, according to Bleeping Computer.

The third and current generation appeared in October 2021 with a new capability to disguise its malicious processes as system processes on Spotlight to evade detection.

The latest version also incorporates a script that constantly checks for the Activity Monitor, and if it’s launched, it immediately terminates all of its processes to remain hidden from the user’s inspections.

The latest version of macOS, codenamed “Ventura,” has more stringent code-signing checks that may render hidden malware within user-launched apps, especially pirated ones, ineffective.

However, this only prevents the legitimate application from running, not the cryptocurrency miner, so Apple’s new security system still has some way to go to protect the user effectively.

Source: Bleeping Computer

Images created using AI may not protected by copyright.

At least that’s the case for images used in the graphic novel “Zarya of the Dawn,” according to a U.S. Copyright Office ruling.

The author of the graphic novel, Kris Kashtanova was informed that he is entitled to a copyright for the parts of the book that he wrote and arranged, but not for the images produced by Midjourney.

The decision is one of the first by a U.S. court or agency on the scope of copyright protection for works created with AI, and comes as generative AI software like Midjourney, Dall-E and ChatGPT are growing in popularity.

The author on Wednesday called it “great news” that the office allowed copyright protection for the novel’s story and the way the images were arranged, which he said “covers a lot of uses for the people in the AI art community.”

Kashtanova said he was considering how to best counter the argument that the images themselves were not a “direct expression of someone’s creativity and therefore copyrightable.”

The decision may not apply to all AI images. “The fact that Midjourney’s specific output cannot be predicted by users makes Midjourney different for copyright purposes than other tools used by artists,” the U.S. Copyright Office’s decision said.

So naturally we went to the real authority on this and asked ChatGPT who owned copyright from AI generated images, here’s the answer we got. 

Ultimately, the question of copyright ownership from AI-generated images is a complex legal issue that may depend on the specific facts and circumstances of each case. As AI technology continues to evolve, legal frameworks may need to be adapted to address these issues more effectively.

Couldn’t have said it better. 

Source: Reuters

That’s the top tech news stories for today

Links to these stories can be found in the article posted on itworldcanada.com/podcasts. You can also find more great stories and more in-depth coverage on itworldcanada.com or in the US on technewsday.com

Hashtag Trending goes to air five days a week with a daily newscast and we have a special weekend edition with an interview featuring an expert in some aspect of technology that is making the news.

Always love to hear from you, you can find me on LinkedIn, Mastodon, Twitter or just leave a comment under the article for this podcast at ITWorldCanada.com.  

I’m Jim Love, and on a personal note, I turn 67 today, so you have a great Friday. I’m going to have an old one.

The post Hashtag Trending Feb.24th- Google asks employees to share desks, Canada starts investigation against TikTok and AI-created images loses copyright first appeared on IT World Canada.

Someone on a criminal forum is selling what they claim is data on all Telus employees, as well as the Canadian telecommunications company’s GitHub software code repositories.

In response to an IT World Canada reporter’s query about the posting, Telus director of public affairs Richard Gilhooley said the company is looking into the allegation.

“We are investigating claims that a small amount of data related to internal Telus source code and select Telus team members’ information has appeared on the dark web,” he said in an email. “We can confirm that to this point our investigation, which we launched as soon as we were made aware of the incident, has not identified any corporate or retail customer data.”

The first dark web posting by someone named “Sieze” was made on Feb. 17. “Today we’re selling email lists of Telus employees from a very recent breach,” it says. “We have over 76k unique emails and on top of this have internal information associated with each employee scraped from Telus’ API.”

As proof, this posting includes what appears to be a list of Telus employee email addresses. It isn’t known if these are current or former staff — or even real.

A Feb. 21 posting adds, “We’re bringing you even more from the recent Telus breach!” The poster asks US$7K for the database file of “every person that works at Telus”; US$6K for a payroll file with 770 records of “all of the white collar workers … including the president of Telus”; and US$50K for all of the allegedly copied data, including a list of Telus private Github repositories, subdomains, and screenshots.

Interested buyers are asked to connect to one of two people on the Telegram messaging service.

It’s important to note that it’s not clear whether the data being sold is real, commented Brett Callow, a British Columbia-based threat analyst for Emsisoft. “That said, if it is real, this is a potentially serious incident which exposes Telus’ employees to increased risk of phishing and social engineering and, by extension, exposes the company’s customers’ to risk. The alleged exposure of the private Github repositories, supposedly including a sim-swap API, represents an additional tier of potentially significant risk.”

In 2020, a Telus division called Medisys Health Group was hit by a cyber attack involving customer data. At that time the company said it “securely retrieved the data by making a payment.”

The post Breaking news: Telus investigating sale of alleged code, employee information first appeared on IT World Canada.

Canada’s federal privacy commissioner, along with three provincial privacy commissioners, has started an investigation into TikTok, examining how the video-streaming platform collects the personal data of Canadian users.

The investigation is beginning now because class action lawsuits in the United States and Canada have been settled, the commissioners said in a statement.

The three participating provincial commissioners are from Québec, Alberta, and British Columbia.

The four privacy regulators will examine whether the organization’s practices are in compliance with Canadian privacy legislation, the statement said, and in particular, whether valid and meaningful consent is being obtained for the collection, use, and disclosure of personal information. The investigation will also determine if the company is meeting its transparency obligations, particularly when collecting personal information from its users.

“An important proportion of TikTok users are younger users,” the commissioners said. “Given the importance of protecting children’s privacy, the joint investigation will have a particular focus on TikTok’s privacy practices as they relate to younger users, including whether the company obtained valid and meaningful consent from these users for the collection, use and disclosure of their personal information.”

The federal Office of the Privacy Commissioner (OPC) will investigate possible breaches of the Personal Information Protection and Electronic Documents Act (PIPEDA), Québec’s  Commission d’accès à l’information du Québec will investigate compliance with the Act Respecting the Protection of Personal Information in the Private Sector and the Act to Establish a Legal Framework for Information Technology in Québec, B.C.’s commissioner will investigate compliance with the provincial Personal Information Protection Act and Alberta’s information commissioner will investigate compliance with the  province’s Personal Information Protection Act.

This isn’t the first time several of the country’s privacy and information commissioners have partnered to perform a joint investigation. Last year, a group report was issued into the use by Tim Hortons of its mobile app for location tracking of users. The commissioners found the app violated federal and provincial privacy laws.

In 2021, a joint investigation found facial recognition provider Clearview AI violated federal and provincial privacy laws by scraping images from the internet without permission and using them in its commercial product.

While every province and territory has a privacy or information commissioner, the business sectors of most are covered by the PIPEDA. B.C., Alberta and Québec have their own private sector privacy laws.

According to a news report, the class action settlement in the U.S. meant American residents who created videos on the app before September 30, 2021 would receive payments between US$27.84 and US$167.04 following the US$92 million settlement of a data privacy class-action with the social media platform.

Last year, a Canadian court approved a deal to settle claims here. TikTok agreed to pay $2 million to resolve two class action lawsuits in British Columbia, both of which alleged it wrongly collected private information from minors and adults.

In both the U.S. and Canadian lawsuits, TikTok didn’t admit any wrongdoing.

The post Breaking news: Canadian privacy commissioners investigating TikTok first appeared on IT World Canada.

Innovation is key, no matter what your business. And at a behemoth like Google, said John Cousens, managing director, public sector at Google Cloud Canada, it means taking what he called an approach of 10x thinking: coming up with radical solutions to huge problems, and solutions that provide a 10x improvement over what was done before.

That approach can also work for the public sector, he said in his keynote at IT World Canada’s Technicity GTA 2023 virtual event today.

Google has six primary principles around innovation, but to Cousens, the most important one for the public sector and those who work there is the first: Psychological safety.

“Psychological safety is a condition in which humans feel included, safe to learn, and safe to contribute, and safe to challenge the status quo,” he said. “Often government, which has a hierarchical structure,  challenges people to be able to express or do that in that hierarchy.”

It is, he added, not necessarily conducive to psychological safety if someone has to sit in front of a committee and defend something – “it’s adversarial in nature, versus open and transparent.”

Source: Google keynote

“So how do you have that psychological safety, where people are free to test things out and push different boundaries? That is a number one predictor of team success at Google, and I believe in public sector, we could adopt some more of these principles to ensure that we can drive this kind of success when we’re looking at digital transformation across the board.”

The second principle is Focus on the User. Google platforms are widely adopted, he said, because they are user-centric. “Focus on the user and everything else will follow,” he said. And be transparent – share information. Collaboration helps drive a culture of innovation.

“And frankly, innovation comes from everywhere,” said Cousens. “Too often in government, especially in technology, we find ourselves saying, ‘I’m this type of a shop’. In the digital era, I would argue that you can no longer say ‘I only use this tech’, because innovation is coming at us faster than ever before. And innovation comes from everywhere.”

Google, he said, tries to inspire innovation by encouraging employees to have 20 per cent projects – side projects that aren’t part of their core role.

“Taking this kind of principle means that no one’s questioning agendas. No one is questioning where the strategy is. It’s in the open and all the time,” Cousens noted.

Finally, he said, “have a healthy disregard for the impossible.” Don’t be bound by the status quo. Google, for example, he noted, has been using its Waze data, originally gathered to assist drivers in getting around traffic jams, and Google Cloud to give cities insights into everything from traffic patterns to environment insights around emissions.

It also provides the Waymo open data set containing data collected from millions of kilometres of autonomous driving in urban environments, which, Google says, empowers autonomous smart mobility providers with data.

“Think about this for the future of how we’re looking at innovation,” he said.

The post Technicity GTA 2023 keynote: 10x thinking for the public sector first appeared on IT World Canada.

In a LinkedIn live event last week, research firm Info-Tech Research Group revealed the main career challenges that Black tech professionals face in 2023, and the responsibilities that companies have in ensuring a comfortable and inclusive work experience for everyone.

The event was a preview discussion of an online survey that garnered responses from 633 IT professionals, 25 per cent of which were from Black professionals. The survey results will be released by Info-Tech at the end of February.

Info-Tech’s research director, Allison Straker, and senior product manager Ugbad Farah said during the event that the key objective of the survey is to zero in specifically on the Black professional experience in tech, which can be very different from that of other ethnic groups.

The survey asked respondents not only how they saw themselves, but also how the world sees them, as this discrepancy can reveal much about the struggles and level of job satisfaction that Black tech professionals experience.

The survey revealed that only 23 per cent of all Black respondents said they were satisfied with their jobs. Job satisfaction in general, however, remains low, with only 34 per cent of respondents from other ethnic groups reporting being satisfied with their jobs.

However, Straker pointed out that it is difficult to determine causation and not just correlation between identity and level of satisfaction with just the results of the survey, but deeper conversations with some respondents suggested lower satisfaction among Black professionals.

Furthermore, the number of barriers to career advancement reported in the survey were higher for Black professionals. 

Farah explained that one of these barriers is microaggression, a statement or incident that sometimes unintentionally causes discrimination to a marginalized group.

Seemingly innocent questions like ‘why is your hair so different?’, or ‘can I touch it?’, ‘Where are you from? But no, where are you really from?’ are examples of those microaggressions that can accumulate and contribute to poor mental health among Black professionals.

When asked what’s important to them, Black professionals deemed safety and recognition as less important, in contrast to other ethnic groups. Basic needs like safety are key to achieving higher needs like self-esteem and self-actualization, hence, better mental health, Straker explained, referring to Maslow’s hierarchy – a classification system, depicted as a pyramid showing the core needs of an individual, with the lower tiers of needs being key to achieving the higher tiers.

Black tech professionals also consider their work relationships with their managers as less important. But Straker underlined the fact that Black professionals are not a monolith and everyone’s work relationships can be largely unique. Yet, “for many, they [safety, recognition or work relationship] are not as important because there are other issues that they need to address first.”

The research also showed that Black tech professionals (55 per cent) are more likely to report they have had no career advancement or promotions within their career.

“We kind of thought to ourselves–maybe they’re less experienced, that’s why they’re not getting those promotions and those advancements. But no, it turns out, even Black professionals with 20 years of experience are not advancing the same as their peers,” stated Farah.

Solutions, according to Farah and Straker:

More diversity in leadership can increase satisfaction among Black tech professionals
Mentorship and sponsorship programs to advance careers of Black tech professionals
Encourage conversations, especially difficult ones about goals, concerns, areas of improvement, etc. This can help Black professionals to be their authentic selves at work
ERGs (Employee Resource groups) are not a substitute for individual mentorship. ERGs are great for groups to come together and talk about things that they can all relate to but mentorship or a sponsorship can help one individual navigate a corporate environment with the support of a leader. “If you could do both–amazing. And if you can’t, ERGs is always a great place to start,” said Farah.
Remote work has helped with job satisfaction for many reasons, but it should not be a means to escape an office culture or a bad environment. Companies have a responsibility to work on their office culture, even if it is remote or hybrid.
Zero tolerance policies are sometimes necessary to allow a culture to change and ensure that it is accommodating and comfortable for people to come to, if acts of discrimination happen.
The post Research reveals career challenges faced by Black professionals in tech: Info-Tech first appeared on IT World Canada.

A job that Artificial Intelligence can’t replace.  A potential court ruling that could shake the foundations of the web as we know it.  And, how good is the mileage on your supercomputer?

Welcome to Hashtag Trending for Thursday, February 23rd.  

I’m your host Jim Love, CIO of IT World Canada and TechNewsDay in the US – here’s today’s top tech news stories.

How many employees does it take to equal the salary of one CEO?

According to an article in the Register, HPE’s latest 10k filing shows that the answer is 271.  The value of CEO Antonio Neri’s compensation package was just over 17 million dollars in 2022 much of that in option awards.  The average salary of an HPE employee being about 64,000 dollars. gap

Neri, who replaced Meg Whitman took a pay cut from his 19 million dollar compensation in 2021. 

Tarek Robbiati, HPE’s CFO earned just over 8 million and Chief Operating Officer John Schulz was just shy of 8 million last year.  Chief People Officer Alan May made just under 5 million.

What did they do to earn that?  Well, HPE increased revenues 3 percent year-on-year to $28.5 billion which is up from previous years. Not as good as the 29 percent gains seen by AWS in calendar 2022 but significant.

Although HPE suffered somewhat from supply chain issues, it’s as-a-service offering Greenlake did achieve 17 percent growth to $936 million.  Not as strong as the 36 percent growth in the prior year but a healthy increase in an area that HPE hopes will compete with the other major cloud players. 

Source: The Register

Looking for a new job for when AI replaces you?  How about “prompt engineer.”  That’s what Sam Altman, CEO of ChatGPT recommended in an interview with Axios.

As everyone who has played with ChatGPT knows, the results you get vary measurably with the quality of the questions you ask.  

ChatGPT agrees and told us:  “A prompt engineer in the context of ChatGPT and generative AI would be someone who has expertise in crafting effective prompts to guide the output of a language model and achieve a desired outcome.”

Job’s are already being posted with prompt engineer as the function or as an important skill. There are number of platforms that are set up as “prompt search engines” such as Prompt Hero, Promptist and Krea. Remote course company Udemy is also offering classes.

Stephen Fragg the founder of chatbot-training business Prompt Yes!, told Axios, 

“It’s kind of like selling jeans during the gold rush. It’s not actually going out and digging up gold.” 

This is an allusion to the fact that overall, the merchants who supplied the gold miners in the Klondike Gold Rush made more money than the miners themselves. While some miners did strike it rich and found significant amounts of gold, the vast majority did not and struggled to make ends meet.

On the other hand, merchants like Levi Strauss who sold supplies to the miners, such as clothing, tools, and food, made significant profits.

How’d we know that?  Apparently, we might have a career as a prompt engineer.

Source: Axios 

Google’s lawyers have warned that a potential ruling by the US Supreme Court could “reshape the internet.”

The case, Gonzalez vs Google, was brought by the family of a terrorist victim.  They argue that YouTube violated the federal Anti-Terrorism Act because its algorithm recommended ISIS videos to users and helped spread the terrorist group’s message.

Google maintains that it is protected by Section 230 of the Communications Decency Act, which protects platforms from legal action over user-generated content.  It also protects them if they remove content. Section 230 has withstood court challenges more than 25 years since it was passed in 1996. 

But there are signals from the Court that the judges may be questioning this immunity from prosecution, echoing similar questions from the US Congress. Internet firms are, understandably, concerned about loss of that protection and the potential liability for the results of their algorithms.  

Experts argue that the issues raised are not simple and any decisions could have real repercussions which lawmakers and even Supreme Court judges may be highly unqualified to judge. This was made clear in an exchange between Google’s lawyer and Chief Justice John Roberts who asked. “Would Google collapse and the internet be destroyed if Google was prevented from posting what it knows is defamatory?” 

“Not Google,” answered Blatt, but other, smaller websites, yes. Blatt was referring to the fear that removing Section 230 provisions, if done as a way of reigning in an increasingly unpopular “big tech” could have inadvertently impact everything from a simple one person WordPress blog all the way up to sites like Reddit or the new open source Mastodon. 

In a digital economy, justice may be blind, but can it afford to be technologically illiterate?

Source: Deadline & Tech Republic

In a related story, Twitter CEO Elon Musk has promised to make Twitter’s algorithm Open Source by next week.  This isn’t a new idea, Musk has been advocating it for some time.  It might seem to be counter-intuitive for a company to make public what some regard as a company secret.  Google, for instance has strictly guarded the secret of its algorithm.  

It’s also strange, given recent claims that Musk has allegedly asked developers to adjust Twitter’s code to favour his tweets and claims that Musk has allegedly threatened to sue any Twitter employee who violates their NDA.

But as the Register article reported, the Brookings Institute has said that Open Source algorithms could be a “boon for tech sector competition, help define AI standards and, as Musk has implied, help fight algorithmic bias.”

And of course, Twitter is also facing a case similar to Google’s where it might be held responsible for the results of its algorithm.  Would it hurt their defence if they no longer controlled the algorithm? 

Source: The Register

How good is the mileage on your supercomputer? 

Auto giant Mercedes Benz has teamed up with Google to offer “supercomputer-like performance” in every car.  Benz is in a race to match and exceed the software powered features of its competitors, Tesla, the big 5 automakers and a fast growing and already large Chinese car manufacturing industry which is already dwarfing even Tesla, despite its early lead in this area.

Benz is also partnering with chip manufacturer Nvidia, investing heavily to bring down the cost of new semi-conductors and chips that will be needed in these cars. They’ve also enlisted Luminar Technologies, which Benz has a small investment and struck a multi-billion dollar deal with the company to provide it with sensors needed for its fleet of intelligent automobiles.

The Google partnership is not unique. Several auto manufacturers including GM and Nissan have included Google Maps, Google Assistant and other features.  Benz will add he ability to view You Tube in self driving mode on a cabin wide screen.

The move is not just a competitive race for features. Benz plans to offer some of the premium features at an additional cost.  The time-honoured tradition of upselling on options makes its way into the digital era. 

Source: Reuters

And that’s the top tech stories for today.  Hashtag Trending is produced by the ITWC podcast network and is heard Monday to Friday with a special weekend edition where we feature interviews on key subjects in technology.

Follow us on Apple Podcasts, Google, Spotify or wherever you get your podcasts.  You can even have us delivered to you daily on your your smart speaker.  If you follow stories about cybersecurity, why not check out our sister podcast CyberSecurityToday. 

You can find all our podcasts and the text versions –  as well as more in-depth coverage itworldcanada.com  and on technewsday.com in the US.

Let us know what you think – are we hitting the mark on the stories you want to hear? You can drop me a note on Linked In, Twitter or on our own Mastodon site at TechNews.Social  Or write me at jlove@itwc.ca

I’m Jim Love, have an awesome Thursday.

The post Hashtag Trending Feb.23rd- The job that AI cannot replace; potential court ruling that could reshape the internet; supercomputer capabilities added to cars first appeared on IT World Canada.

How digital should your organization be? It was a simple question posed to a group of senior government IT executives in a roundtable discussion held earlier this month at the Verity Club in downtown Toronto, but one in which the correct answer involves embarking on a series of incredibly complex steps.

The session was organized by Gartner Canada and led by Hung LeHong, a distinguished VP analyst with the research firm.

Digital leadership, Gartner noted, is the “duty of government executives and elected officials to optimize, evolve and transform the organizations they lead by serving as champions to increase digital capabilities and policy competencies in the public sector.

“Digital government offers opportunities to optimize existing citizen services and transform how the value of government is measured and delivered. Governments need digital leadership at every level of their organization and across related government silos.”

LeHong said in his opening comments that Gartner clients, both in the private and public sectors, are spending a “lot of money on becoming digital,” and that means they must be able to answer the question about how digital their organization should be, not with a response that is vague, such as ‘digital means different things to different people’, but something far more concrete.

“Your whole organization should understand what it means for you to be digital, and that’s what we are actually going to go through today.”

What digital should mean from a municipal perspective could be seen in a slide from the Department of Transport of the state of Victoria in Australia that he showed as an example of digital in action. In this case, the use of AI and image recognition have improved the speed with which the need for road repairs is recognized and catalogued, and ultimately performed.

“They used to drive around in a truck with clipboards and someone had to recognize that little arrow needs to be repainted, or this sign is broken,” said LeHong, adding that with a new digital initiative in place, tasks that once took weeks and months to complete can now be completed in days, and even in hours.

This is just one small example of what is happening in Victoria. The state’s digital strategy, a document that establishes the current government’s vision for a successful digital transformation, says that three key outcomes underpin it: better, fairer, more accessible services, a digital-ready public sector, a thriving digital economy.

“In delivering on these outcomes, we will improve the experience individuals, communities, businesses and the Victorian public sector have with government,” the document states.

LeHong, who, according to Gartner, “focuses on CEOs and other C-level executives to help them anticipate changes to business models and customer trends caused by digital business,” said much can be learned from what is happening in Victoria, in that going digital involves far more than simply adopting advanced technologies.

A municipality becoming more digital, he said, should revolve around conducting business operations in a more efficient manner.

“We call it digital business optimization, simply because it’s not that you are changing your products and services to whoever you are serving, you are not changing your business model – your public mandate, your mission remains the same, but boy, can you do things faster, cheaper and have a better customer experience with digital.”

Another example of digital business optimization, said LeHong, is taking place in Rio Grande do Sul, Brazil’s most southern state, which borders Argentina and Uruguay. Last year, the state’s 23 municipalities, he said, “integrated 20 databases representing the public safety ecosystem, including law enforcement, the prison system, courts, education, health, finance and traffic systems, supporting public safety and justice across the state.”

The result was a sharp reduction in violent crimes compared to 2021 and, in fact, the lowest number recorded since 2012.

“They all work together to catch the bad guys,” he said. “And the point is, they were not mandated to work together.”

Source: Gartner. © 2022 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates.

Throughout his presentation, there was discussion around one particular chart (see above) that had three components in different colours: In green was the Technology and Operating Model, in which modern technologies and approaches are used and form the base point of a digital transformation journey. Just above it to the left, and in orange lies Optimization; in which a municipality, having evolved their IT operating model conducts business more digitally, and right beside it in blue is the Transformation component, in which a whole new digital business model is created.

An assortment of Gartner benchmarks used during the 90-minute presentation revealed that not every municipality or every private enterprise will land on green, orange, and blue at the same time.

Dr. Peter Bak, chief information officer (CIO) at Humber River Hospital, said that all of LeHong’s insights and benchmarks were “extremely important, but the hard bit is how do you get the action going, and that would be a good follow-on topic to have.”

He said the way the “tech world is shifting does present an opportunity for us to rethink how healthcare is delivered, but that’s a very hard concept for people to grasp, because they believe you can’t change this – you treat people the way you treat them.

“It actually requires incredibly out-of-the-box thinking, which does not exist in healthcare. I don’t know how well it exists in other public sector environments, but I believe there are moments in time when opportunity presents itself to actually do a blue.”

In an interview with IT World Canada, Bak was asked if public service departments can learn from private enterprise when it comes to digital transformation, and his answer was “absolutely”. As proof, he referenced a recent executive hiring by the world famous Mayo Clinic, located in Rochester, Minn.

“(They) hired a chief digital officer who came from Best Buy, and it caught my attention. She had also worked in healthcare before, but I thought that was really fascinating. Why? Because they are trying to move to a much more online, engaged world with their patients, and healthcare is terrible at that because that’s not how healthcare functions.

“But which industry functions extremely well at that? It’s the consumer world, so why don’t we learn from them how they did it? It is not about the tech so much. It is about the engagement, change management, strategy, mindset, thinking. So yes, you can learn from other industries, and we should.”

The post Gartner panel explores how citizen needs impact digital strategies first appeared on IT World Canada.

Two weeks after suffering a cyber attack, Indigo Books and Music has acknowledged it was hit by ransomware and employee data was compromised.

“On February 8, 2023, Indigo experienced a ransomware attack,” the company says in an updated FAQ on its website. “Through our investigation we learned there is no reason to believe customer data has been improperly accessed, but that some employee data was.”

“We are notifying all affected employees,” the site says. “We have also notified and are co-operating with law enforcement.

“Since this incident, we have been working with third-party experts to strengthen our cybersecurity practices, enhance data security measures and review our existing controls.”

No ransomware group has taken responsibility for the attack as yet, according to a threat researcher for a cybersecurity company.

Also today, the company said it has been able to restore online sales of books — but not other items it sells.

“Books are back,” Indigo trumpeted on its website, saying thousands of titles are available. However, shoppers can only browse for lifestyle products. These will have to be bought in stores across the country.

Indigo is still in the process of remediation. The website says it is the “temporary online home,” suggesting that a new website is being built.

According to a report released today by Fortinet that looks at cyber incidents in the second half of 2022, ransomware volume around the world increased 16 per cent from the first half of last year.

Out of a total of 99 observed ransomware families, the top five families accounted for roughly 37 per cent of all ransomware activity during the second half of 2022, it said.

GandCrab, a ransomware-as-a-service malware that emerged in 2018, was at the top of the list. Although the criminals behind GandCrab announced that they were retiring after making over $2 billion in profits, the report says, there were many iterations of GandCrab during its active time. “It is possible that the long-tail legacy of this criminal group is still perpetuating, or the code has simply been built upon, changed, and re-released.”

In an IBM report, also released today, that looked at incidents the company was called on for help across all of 2022, researchers said incidents of ransomware dropped last year compared to 2021. However, deploying ransomware was the second most common action after a threat actor was able to breach security controls. Installing a back door was number one. Back doors lead to the distribution of malware, including ransomware, to further everything from credential theft through data theft and data destruction.

Alarmingly, IBM said there was a four per cent reduction in the average time for the deployment of ransomware attacks in 2022 compared to the previous year. To put that in perspective, what took attackers over two months in 2019 took just under four days in 2021.

The post Indigo admits cyber attack was ransomware, employee data accessed first appeared on IT World Canada.

The new head of the Canadian Radio-television and Telecommunications Commission (CRTC) is wasting no time kickstarting efforts to improve the reliability and resiliency of Canada’s telecommunications networks.

“Canadians need reliable, high-quality telecommunications services,” said Vicky Eatrides, chairperson and chief executive officer of the CRTC, in a release. “We are taking action to lessen the disruptive impact of service outages on Canadians, reduce their occurrence and length, and ensure that essential services such as 911 and emergency alerts are always available.”

To that end, the CRTC today launched the first of several consultations, this one asking Canadians for their comments on proposed requirements for the reporting of major service outages.

In its call for comments, entitled Development of a regulatory framework to improve network reliability and resiliency – Mandatory notification and reporting about major telecommunications service outages, the CRTC noted that the scale and frequency of outages caused by extreme weather, cyber-attacks, and accidents have been increasing, citing factors such as climate change, the increased economic and social importance of telecommunications, and what it referred to as “technological evolution”.

“As the complexity of telecommunications networks and the importance of communication in Canadians’ daily lives increases, there is a need for additional measures to improve network reliability and resiliency and to mitigate the impact of service outages,” the call for comments explained. “Building on the work of Innovation, Science and Economic Development Canada (ISED) and the Canadian Security Telecommunications Advisory Committee (CSTAC), the Commission is taking action to develop a framework to improve the reliability and resiliency of telecommunications networks. This notice of consultation is the first stage in this process.”

Meanwhile, it said, “on an interim basis pending the outcome of this proceeding, the Commission directs all Canadian carriers to report major service outages (including outages affecting only 9-1-1 networks) to the Commission within two hours of when the carrier becomes aware of such an outage. Additionally, the Commission directs carriers to file a comprehensive report with the Commission within 14 days following the outage. This direction takes effect on 8 March 2023.”

In addition, it is hiring an independent firm to review the mitigations Rogers has put in place after its July 2022 outage, and will, in collaboration with ISED, commission a report on the measures employed by telecommunications regulators internationally to make networks more reliable and resilient against vulnerabilities and threats that may lead to a telecom service outage.

Comments on the Commission’s proposed reporting requirements for carriers, detailed in the call for comments, may be submitted online, mailed to Secretary General, CRTC, Ottawa, Ontario K1A 0N2, or faxed to 819-994-0218. Inputs will be accepted until Mar. 24.

The post CRTC launches consultation on enhancing reliability of Canada’s telecom; imposes interim directive on carriers first appeared on IT World Canada.