1
2
ECSI - Help fix COPPA laws (ecsi-33c27b.gitlab.io)
submitted 9 hours ago by ty842@lemmy.org to c/privacy@lemmy.ml

COPPA feels pretty outdated in today’s online world. A lot of sites now ask users to confirm their age even when it’s not really needed, sometimes using AI tools that can get things wrong or push people to share personal info. This brings up some serious worries about privacy, accuracy, and how accessible things are online. The Electronic Child Safety Initiative (ECSI) thinks that laws about online safety, like the Children's Online Privacy Protection Act, should keep kids safe without relying on unnecessary tracking or dodgy tech. If you think these laws can be better, consider joining the conversation and help push for changes by taking part in the ECSI community forums.

2
46
submitted 19 hours ago* (last edited 19 hours ago) by helloyanis@furries.club to c/privacy@lemmy.ml

I just found a security breach that can leak thousands of emails on a website!!

Today, I snooped around on a website I won't mention the name of for privacy reasons, and they assign your account an user ID when you register.

Well, with a very simple trick in the console I managed to get everyone else's email and account info (for example checking if they have a paid plan or not) by just lowering the user id, with no rate-limit on the endpoint!

So a bad actor could send targetted phishing emails to people by telling them there is a problem with their payment!

It's funny because on their homepage, they state they use "Military grade encryption" (whatever that means!), and their privacy policy says "We encrypt the transmission of that information" (does that just mean they do it over https?)

So, moral of the story, don't trust companies with your personal info!

I contacted the site, we'll see if they fix it.

@privacy@lemmy.ml @privacy@lemmy.world @soatok

#cybersecurity #privacy #web #hacking

3
209

cross-posted from: https://lemmy.dbzer0.com/post/64875667

They are currently voting on amends to the regulation. The "Chat Control" proposal would legalise scanning of all private digital communications, including encrypted messages and photos. This threatens fundamental privacy rights and digital security for all EU citizens.

https://fightchatcontrol.eu/

4
53

Let's say I live under an oppressive regime (don't we all?) How can I use social media anonymously, so I don't face reprisals from the government?

Mastodon, Lemmy, Reddit and other social media platforms restrict users who connect through TOR or a VPN.

Is there any way I can create an account on these services and use them anonymously?

Thanks in advance for any information and advice you can provide.

5
406

(Not sure if this is worldwide or only in some countries)

Updating to iOS 26.4DB2 will put your phone into a parental-restricted mode with adult websites blocked on all browsers, warning prompts every time you try to send or receive an explicit image on a messaging app, and all social media apps blocked on the App Store (in Australia)

The settings to disable this mode are locked off until you verify your age either with a credit card, photo ID, or though information Apple already has (like the age of your account).

I've been an apple user my entire adult life but this might finally be the thing that forces me off the platform. Do any other long term apple users have some tips about migrating? I've heard Ashai Linux is pretty good on mac hardware these days and I've been thinking about GrapheneOS for a while.

6
12

See title. A bit of a dumb question, but given my threat model, I'm curious if it's maybe strategically better to not rely on Proton for their VPN. If I rely too much on one provider, I think that that's not a good idea.

7
119

What a complete idiot. You create a protest email account linked to your credit card?

8
141
submitted 1 day ago by jrcruciani@lemmy.wtf to c/privacy@lemmy.ml

Awesome...

9
-7
submitted 14 hours ago by mlxdy@lemmy.world to c/privacy@lemmy.ml

Hardware wallets like Trezor and Ledger are terrible choice for privacy as they're more like hot wallets. You need to download their shitty electron app to configure your wallet and even if these apps are open-source I can't consider them safe, because they have toooooo much features. At the same time they're missing basic features like connecting through TOR network to them which should be must have as they rely heavily on internet features like online exchanges which can easily reveal your data.

Do you have any idea how to access crypto easily while at the same keep it private and safe?

10
411
submitted 2 days ago by yogthos@lemmy.ml to c/privacy@lemmy.ml
11
7

Found out about these two open-source cloud storage providers and wanted to know what anyone thought of them.

ente.io crypt.ee

12
208
submitted 3 days ago by sveltecider@lemmy.ca to c/privacy@lemmy.ml
13
18
Tor Guardians (lemmy.ml)
submitted 2 days ago by NahMarcas@lemmy.ml to c/privacy@lemmy.ml

My tor guardian have been the same since 2-3 weeks I think, is always the one from USA and sometimes one from Ireland. I feel something wrong happen in my computer or directly to the entire TOR web

14
25
submitted 2 days ago by mrnobody@reddthat.com to c/privacy@lemmy.ml

A friend of mine shared this link regarding Flock cameras being removed from Illinois. They're a 2-party consent state regarding audio recordings. I figure it's worth sharing here since I don't have other accts

15
61
submitted 3 days ago by jerrimu@lemmy.world to c/privacy@lemmy.ml

We built Umbra by forking, updating, and improving the ghostery browser build script, fern.js

Umbra removes all telemetry and outgoing requests except for codec requests ( netfix works!) All non-browsing features like AI, pocket, and profiles are also removed,

The idea behind umbra is usable privacy. By default RFP is off because it breaks websites.

You can build Umbra yourself but using the build script at https://github.com/openconstruct/user-agent-desktop

Or downod binaries for Linux/WIn at https://github.com/openconstruct/umbra/releases

16
9

Hello,

I've noticed difficulty trying to use https://reports.exodus-privacy.eu.org/.

The pages just don't load for me on my computer or phone. iirc the last time I tried (months ago) it may not have worked then either, but I don't know for sure.

Has something happened with the service? I didn't find anything stating as such.

Thank you for your time, I hope you have a good week.

17
785
submitted 4 days ago by Goldenring@lemmy.ca to c/privacy@lemmy.ml

The installation was very easy! It's very greatful that my data doesn't send to Google any more.

18
736
submitted 5 days ago by inimzi@piefed.social to c/privacy@lemmy.ml
19
383
20
47
submitted 4 days ago by pineapple@lemmy.ml to c/privacy@lemmy.ml

I can't believe I've never thought about this and that no one is really talking about it. GPS is a system that everyone uses everyday on there phone and is constantly tracking your location.

Many people here (including myself) use airplane mode to block mobile data signals so that mobile data companies cannot track your location and sell it to data brokers. But airplane mode doesn't block GPS (I just tested this now on my phone, maybe your phone works differently). Is GPS somehow designed in a way so that it's private?

21
73
submitted 4 days ago by 64bithero@lemmy.world to c/privacy@lemmy.ml

Not the biggest fan of Chromium based browsers. Thoughts on Helium ?

https://helium.computer/

22
13
submitted 3 days ago* (last edited 3 days ago) by hyacin@lemmy.ml to c/privacy@lemmy.ml

I don't know if it's just me - I go to great lengths to keep my fedi activity separate from my other internet activity, and I get REALLY mad when I'm browsing Lemmy, click something that I assume will take me to a local discussion (or meme, mostly,) and it opens some random external site - often one I've never even heard of - and now who knows what that site is doing, trying to do, cookies, etc., trying to link me and my referrer to my other activity (I do all my fedi stuff by VPN too, so it wouldn't be by IP, but, they have ways) etc. etc.

As I couldn't find anything already available, I finally got off my butt and just made something to prevent it. These files can be dumped in a local folder, and then under Chrome/Opera/anything-Chromium extensions, you can 'enable developer options', and then 'load unpacked'. It's SUPER simple, and works, you just need to customize your instance hostname. I thought it might be something at least one other person in this community has thought about and fought with, so I figured I'd share it here!

~~Edit: Seems to be working most of the time, but then starts failing and external sites load without a popup (granted I'm testing it HARD, and normally it's just a one-off that I don't catch is an external link with my eyeballs first) - not sure if/how to troubleshoot, but will try. Just be warned, it's not flawless.~~

^ Seems to be fixed in latest version. ^

background.js - empty file, but required

content.js -

// List of allowed domains
const allowedDomains = ['lemmy.ml']; // You can add other domains here

// Function to check if the current domain is allowed
function isAllowedDomain() {
  const currentDomain = window.location.hostname;
  return allowedDomains.includes(currentDomain);
}

// Event handler for link clicks
function linkClickHandler(event) {
  const href = this.href;
  const currentDomain = window.location.hostname;

  if (new URL(href).hostname !== currentDomain) {
    event.preventDefault(); // Prevent default navigation
    const confirmation = confirm("You are about to leave " + currentDomain + ". Do you want to continue?");
    if (confirmation) {
      window.open(href, '_blank'); // Open in a new tab
    }
  }
}

// Attach link listeners
function addLinkListeners() {
  if (!isAllowedDomain()) return; // Only add listeners if on an allowed domain
  
  const links = document.querySelectorAll('a');
  
  links.forEach(link => {
    if (!link.dataset.listenerAdded) { // Check if listener is already added
      link.addEventListener('click', linkClickHandler);
      link.dataset.listenerAdded = true; // Mark this link as having the listener
    }
  });
}

// Initial listener setup
addLinkListeners();

// Create a MutationObserver to watch for changes in the DOM
const observer = new MutationObserver((mutations) => {
  mutations.forEach(mutation => {
    if (mutation.addedNodes.length) {
      addLinkListeners(); // Reattach listeners for new links
    }
  });
});

// Observe the body for child additions
observer.observe(document.body, {
  childList: true,
  subtree: true
});

manifest.json -

{
  "manifest_version": 3,
  "name": "Block External Links",
  "version": "1.1.2",
  "permissions": [
    "tabs",
    "activeTab"
  ],
  "background": {
    "service_worker": "background.js"
  },
  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["content.js"]
    }
  ]
}

Hope this is useful to someone!!

23
22
submitted 4 days ago* (last edited 4 days ago) by sveltecider@lemmy.ca to c/privacy@lemmy.ml

I tried windscribe and proton vpn. Neither work with tailscale running on my Mac. I have to disable them. Does Mullvad work alongside tailscale?

24
34
submitted 4 days ago* (last edited 3 days ago) by PierceTheBubble@lemmy.ml to c/privacy@lemmy.ml

I've read all of Genetec's customer stories (the PDFs), and although I recognize these, as being Genetec marketing material (at least in part), they do contain insightful information, regarding implementation of surveillance systems; that is, from the perspective of a diverse palette of organisations. This palette primarily consists of: universities, school districts, ports, critical infrastructure providers, business to business companies, health care providers, real estate developers, gambling companies, (sports) venues, cities, public transportation services, airports, retailers, and foremost police departments. What most have in common, is the increasing scale at which they operate; setting in motion a search for IT-solutions, able to scale alongside organisational growth, and doing so in a cost-effective way. This entails: the centralisation of (previously "siloed") systems and departments, automatization of (previously time-consuming, or outright unmanageable) tasks, and proactive 'Data-Driven Decision-Making (DDDM)'; unlocking operational efficiencies and granular control over vast operations.

Which is where Genetec introduces itself, primarily through its partners (including: hardware manufacturers, software solutions companies, system integrators, consultancy firms, etc.), often during an organisation's 'call for tender' or 'Request For Proposal (RFP)'; or it's recommended by other Genetec customers (including by law enforcement, to "community" partners: primarily businesses). The most recognizable partners, of the consortium-like construction, include: Axis Communications, Sony Corporation, Hanwha Vision, Bosch, NVIDIA, ASSA ABLOY, Intel, Pelco, Canon, Dell technologies, HID Global, FLIR Systems, Global Parking Solutions, and Seagate Technology. Alongside the Genetec-certified hardware and software integrations (of which their partners' being actively co-marketed to customers), it also allows for custom integrations: through their 'Software Development Kits (SDKs)', and 'Application Programming Interfaces (APIs)'. So instead of single-vendor lock-in, organisations are effectively subject to multi-vendor lock-in (unless: spending resources, on custom integrations, is more cost-effective).

Genetec's primary focus, lies on their extensive suite, of (specialized) software applications, deployed on: an on-site server, multiple (distributed) on-site servers (possibly federated: allowing for a centralized view over multiple implementations), in the "cloud" (i.e. someone else's server) as a '... as a Service' solution; or a combination of aforementioned (providing "cloud" flexibility). When using multiple applications, Genetec's 'Security Center' can unify all; meaning operators aren't required to switch between applications. And considering applications aren't limited to just camera surveillance, but also include: intrusion detection (intrusion panels, line-crossing cameras, panic switches, etc.), access control (electronic locks, access control readers (pin, card, tag, mobile, and/or biometric), door control modules, etc.), communication (intercoms, 'Public Address (PA)' systems, emergency stations, etc.) and ALPR (ALPR boom gates, gateless (license plate as a credential), enforcement vehicles, etc.); it allows for centralization of these systems (unless prohibited by strict IT policies).

All of these technologies combined, primarily serve to: save on resources, protect assets, prevent losses, ensure operational continuity, and resolve disputes over: parking tickets, insurance claims (as a result of damages: suffered or caused on premise; potentially increasing premium), or even legal allegations ("increase the number of early guilty pleas"); all of course, under the guise of safety. Whether it be organisations individually, or "community" initiatives (often spearheaded by businesses, while citizens are left to follow); most circle back to previously outlined, financially-grounded motives. Resources include staff, who's function might become more versatile, or entirely obsolete (through efficiency gains), and might depend on events, reported by analytics (growing queues, areas requiring clean-up, crowd bottlenecks, etc.); meaning they too, are subject to this system: from onboarding ("minimise the time that elapses before they make a productive contribution") and throughout their career ("employee theft", "employee attendance", "agents' activities, collectively or individually", etc.).

Previously, some organisations utilized analog cameras (having a recorder each), in which: a looping tape, would periodically overwrite previous recordings (minimizing retention periods: physically); which possbily caused quality degradations, sometimes to such a degree, footage could no longer serve as legal evidence (which too, is privacy-friendly). If legally required to retain footage (possibly relevant in such cases), contents would have to be archived (physically). More modern 'Digital Video Recorders (DVRs)' could centralize footage, from multiple analog (converted) or digital cameras, and store footage digitally; but retention periods however, remained limited by on-site capacity (in contast to "cloud"). Despite video walls, possibly showing human operators live feeds, from a selection of important cameras (those still functional: no automated hardware health-reporting); events on small tiles, might've easily gone unnoticed. And after-the-fact investigations, would require the operator to: identify a camera (using a schematic), and tediously locate the footage, on whichever DVR contained it.

With an steep increase, in requests for footage (mostly serving as evidence, or to provide transparency to "data subjects": possibly amounting to thousands collectively; year after year); the processing of such requests (inluding: documenting and validating each request, compiling all relevant footage, formatting files, and transferring these onto physical media; to be collected in person), made complying unsustainable on legacy systems. Another primary contributor, ironically being "privacy" legislation (outlined by 'General Data Protection Regulations (GDPR)', among others), requiring operators to: (manually) redact any third parties in frame (which may contain thousands), for every camera the "subject" appears in. And finally, organisations possibly held liable, for leaking any private information; leading many, to effectively outsource that responsibility, to compliant solutions providers (including Genetec). So while seemingly advantageous on paper (that is, from a citizen's perspective), it has led to more capable (and therefore more privacy-invasive) surveillance systems in practice.

Like every "privacy"-invasive solution, it shifts the focus to "security"; as it's aware of the privacy-sensitive nature, of the collection it encourages (i.e. data worth protecting). The main problem with this approach being: organisations having the freedom, to configure their system (including access-rights to such information). It's not the hypothetical hacker or rogue operator, which forms the primary threat to data subjects, but rather someone, in a supervisory position (which may, or may not, exhibit sociopathic traits): granting themselves far-reaching access, possibly even from the comfort of their home ("live CCTV footage running 24 hours a day, seven days a week on big screens in his study at home"). These actors are authorized (which they arguably shouldn't be), while in a position motivating them, to actively surveil data subjects; without provision of any opt-out. The only privacy-respecting solution, is one that physically minimizes data-collection; because anxiously securing systems that don't, is nothing but damage-prevention, and avoidance of potential liability-claims.

Customer stories, are generally even less concerned with privacy; as they might consider, securing of such privacy-sensitive information, no longer their responsibility (generally leading to: increased data-collection and retention periods). Most won't mention privacy-concerns once, others may only express their frustrations with it (and understandably so: as explained before), some may proclaim "strong governance", and propagate "proactive messaging": to help "build trust and reduce surveillance concerns" (exclusively based on presumptions, rather than data subject opinion: as results might not allign, with that of management). One school district mentions, how their new cameras "are very discreet" (which can only be of importance, when otherwise potentially uncomfortable), and in contast, camera feeds may be displayed on monitors (in buses): "as a public advisory of video monitoring as well as an added deterrent against criminal activities" (potentially altering data subject behavior entirely: criminal or not).

The collection of data, beyond supposed limitations: by post-collection filtering (hinging on a trust-basis), seems rather intentional. This applies to public-facing "private" cameras: (deliberately) capturing beyond the perimeter ("to widen their reach at no cost to the tax payers"); but also ALPRs: which depending on implementation (and resulting 'Field Of View (FOV)'), effectively function like any other camera (while non-ALPRs, may also feature LPR-functionality: despite inferior reading-accuracy; in contrast to the 95% statistic, mentioned by one story: even in challenging weather conditions); and microphones (built into: cameras, intercoms, or sensors questionably limited to monitoring: gunshots, noise pollution, (indoor) sound levels, etc.). There's often a mutual interest at play, possibly resulting into a 'Public-Private Partnership (PPP)', where "participating" parties, might be required to sign a 'Memorandum Of Understanding (MOU)': "so that each parties' responsibilities are clear".

Further common motivators may be: the COVID-19 pandemic ('people counting' (occupancy reporting: for organisations to remain open), air quality sensors (possibly controlling ventilation systems), group detection (to ensure "social distancing" compliance), proximity reporting (upon positive test, individuals reported nearby, may also have to "self-isolate"), contactless technologies (a firm push towards digital), organisations burdened with hosting vaccination 'Points Of Distribution', remote work (tracking employees who "embrace the new hybrid work model"), (financial) impacts (leading one organisation to cloud storage instead), etc.); and the UN's 'Sustainable Development Goals (SDGs)' (digital instead of physical (expirables), car-free city centers (ALPR-based access control, centralised city-edge parking, enforcement of self-induced parking scarcity, etc.), IoT meters (monitoring (thermal) energy and water consumption), remote monitoring (not physically visiting remote sites), detection of: illegal dumpings, littering, or pollution (with regards to: air, noise and light), etc.

Alongside more specialized (inter)national involvement: industry-specific regulations, primarily mandating physical and cybersecurity standards; the underfunding of the public sector, while possibly increasing local bodies' responsibilities (i.e. the classic problem-reaction-solution paradigm: the "solution" of which, "conveniently", being technology); protection of associated institutions (the 'Council of the European Union' for example: in the case of Brussels), or even government grants (including the 'European Regional Development Fund (ERDF)': supposedly, to monitor 'Net Zero 2030' progress). Regulations primarily mandate: personel with "unescorted" access-rights, to secure areas of: (air)ports, critical infrastructure sites, research institutions (and their laboratories), or even food manufacturing facilities (anticipating for tightening food safety standards); to identify themselves (using a tamper-resistent credential: a 'Transportation Worker Identification Credential (TWIC)' for example; including thumb prints, which are increasingly cross-referenced, to biometric access control reads).

And finally, similar motives, not (directly) related to (inter)national involvement: "community" initiatives (an example being a neighborhood council: surveilling their retail district (as discouraging (petty) crime, is attractive to (new) businesses; which may in turn benefit the council); subsidizing an exterior camera for every participating business, which only pay the $15 monthly subscription fee), the hosting and management of large-scale events (the 'LA2015 Special Olympics' for example: which spawned a temporal, cloud-based ('Federation as a Service') control room, unifying cameras from nearby Genetec customers, including: universities, sports complexes and event facilities), renovation projects (often including revision of surveillance systems), the addition of new locations (often causing organisations, to standardize systems throughout), and a change of management (including organisations (especially airports): increasingly being co-owned and operated, by a shrinking number, of large-scale (international) operators; an example being 'Flughafen Zürich AG (FZAG)').

Where some stories contain critical undertones ('Manitoba Hydro' being a respectworthy example), others may support the involvement (possibly having co-shaped acts: granting themselves excuses); or happily go, above and beyond legal requirements (the use of (facial) biometric credentials, where a card would technically suffice). Other than that, there's sympathy to be had for (understaffed): public schools (especially when confronted with school shootings), hospitals (during the high-pressure, COVID-19 pandemic) and (local) governing bodies (playing an endless game of whack-a-mole: primarily resulting from poor fundamentals). However, turning a school into an effective prison (by a scheduled, electronic lockdown: every time the bell rings), and granting parents access to their child's school, only after a driver's license check, seems excessive; so is patient monitoring, well after the pandemic (which now may serve, to monitor patients with high fall risks: amassing "a return on investment over $7,000 per week, per unit"); and the realization of, an unmistakable surveillance state.

Given long-standing organisations, having accumulated many disperate (proprietary) technologies over time (becoming increasingly difficult, and costly to maintain; or nearing 'End-Of-Life (EOL)'); there's a strong desire to capitalize on these prior investments. With use of gateways or video encoders, it's even possible to integrate existing analog hardware: leaving compatible appliances (including accompanying cabling) in place; reducing the upfront cost significantly (one story mentioning a cost-savings of "around $300 per door and $200 per camera"), alongside easing the migration phase, to more capable IP-based hardware in the future. This means, analog cameras, or any other legacy hardware (despite appearing unsophisticated), may still integrate, into state-of-the-art surveillance systems. Because of a history of vendor lock-in, Genetec's more open approach (multi-vendor, and SDK support), is appealing to organisations; but with cooperative hardware, these stories are suspiciously quiet, about the dependence on the software (and the associated licensing-fees: subject to future increases).

Armed with a more permissive system, most organisations tend to rapidly increase, granular control over their operation. Expanding camera coverage, using modern: (object-tracking) 'Pan, Tilt, Zoom (PTZ)', multidirectional (units with multiple sensors: with an orientation and stream each; which stitched, effectively create a modern panoramic: replacing single-sensor fisheyes), video intercoms, and fixed cameras (including typical ALPRs). Access to: sites, buildings, and rooms within becomes conditional, based on access rights (specified in exemption databases). This may be enforced by: electronically controlled barriers (gates opening: when an ALPR registers an exempted license plate; or doors opening: when an exempted credential, is registered by an access control reader). Typically, ALPRs are placed at site entries, and/or carried by enforement vehicles (readings of which, frequently cross-referenced to: private, and/or law enforcement hotlists); whereas the other technologies, provide most coverage (both indoor and outdoor): all usually connecting, to multiple on-site servers (federated as one).

Access control readers, most commonly require RFID cards; but considering (physical) issuance (including associated administration), and limited lifetime under certain conditions; such systems, may be quite expensive to maintain (especially with up to 70,000 cardholders, and replacement costing a university around $30). Which appears to be, the primary reason for many organisations, to migrate to mobile credentials instead (possibly through 'mobile-ready' readers: easing the transition). Where reasonable organisations, may provide alternatives (like PIN entry: for individuals not using smartphones), others disallow such flexibility; or bypass the (self-induced) "problem" altogether: using biometrics as a credential. Ultimately, facial recognition access control, would constitute the most frictionless method of entry (a concept featured in one story: also using it to clock employees): as it wouldn't require any interaction from the user. This concept is already the norm for vehicle access: where the license plate, forms the tamper-resistent credential (instead of a person's face).

Because of the overwhelming amount, of additional data being generated; the use of analytics tools, is practically required: actively monitoring for events, triggering alarms upon events, and generating reports based on events (providing actionable insights: possibly through visualizations). Common events, include the detection of: motion (primarily signaling activity (including where non is expected: meaning intrusion); and may also dynamically boost resolution), groups (mostly regarding crowd control, or growing queues), loitering (especially near sensitive areas; and may also include objects: left on scene), and intrusion (of predefined virtual perimeters: triggering when activity is detected within). Additionally: an access control attempt, a button press on a panel, or any other event, may automatically display nearby camera feeds; and with scene metadata being seachable, through: natural language ("gender, adult versus child, and predominant colors of an item"), or by specifying a bounding box; it's possible to track subjects across synchronized feeds (providing lead-up footage).

Instead of operators having to memorize protocols, or alternatively: leaf through a binder describing such protocols; organisations are increasingly, utilizing a 'Decision Management System (DMS)'. These systems may contain, a large collection of protocols; each describing standardized procedures: guiding operators through, a wide range of possible scenarios. This primarily serves to: enhance operator consistency (as in acting predictably: including not spending resources on false alarms), and increasing response times (possibly limited by legislation: mostly relating to (fire) safety, and security standards; and therefore also compliance to those). An analytics tool might trigger an alert, possibly causing an option: for displaying the associated protocol, to appear on screen. So instead of the process being fully automated (just yet), the current approach, seems to correspond to the 'Intelligent Automation (IA)' concept: outsourcing the active monitoring to 'Artificial Intelligence (AI)', while the human operator bears final responsibility.

As large-scale organisations (including multinationals, with locations across the globe), having many on-site control rooms, becomes financially unattractive. This leads many organisations, to centralize control rooms to fewer 'Operations Control Centers (OCCs)': responsible for more intensive monitoring, and alerting on-site security personel (often also having access to local systems: through a desktop or mobile client). One story mentions how an organisation, with locations across: North America, Latin America, Asia Pacific, and 'Europe, the Middle East and Africa', chose Asia Pacific, for its 24/7 global OCC; which surely is unrelated, to working conditions in that region. These distributed locations can still operate independently, but are simply being federated: providing a centralized view over the entire operation. This means a retail enterprise, also operating gas stations, likely centralizes data, from these seemingly disperate systems; the entirety of which, potentially further federated: to outsourced control rooms, or even law enforcement.

Organisations conducting many investigations, may use an 'Evidence Management System (EMS)': to manage the increasing volume of digital evidence. In these systems, evidence may be added to case files: originating from internal (video footage, access control logs, or automated reports), or possibly collaborative, external systems (by an emailed link, to an online portal: facilitating file uploads; or even (limited, real-time) access, by use of: federation, or 'Active Directory (AD)' privileges). Some law enforcement agencies, also provide a map-based interface, in which users can register their cameras: as to be contacted for recordings, in case a nearby event occurs. Evidence from a legacy 'Records Management System (RMS)', may be migrated entirely, to Genetec's management system; or the existing database, could simply supply data, to cases on the replacing system. Organisations may have many specialized systems: increasingly managed by, or exchanging data with, Genetec software; which means data from any system, could serve as evidence (and will: when added to a case file).

Retention periods for evidence may be indefinite, or defined by regulations (including school "disciplinary" cases: 5 years after high school graduation, meaning 11 years if in 6th grade; possbily to comply with 'Family Educational Rights and Privacy Act (FERPA)' mandated: review of student records, which may be based thereon. Any other video footage, is typically retained 1~4 weeks: primarily depending on storage capacity, and less out of privacy consideration. Instead: aware of video footage, being considered most privacy-invasive; it's policies as such, seeking to propagate a false sense of proportionality. Retention periods from other sensing technologies (access control logs for example), or video-analytics reports (derived from (deleted) footage; while likely related to a personal credential, possibly serving as the pseudonym: being yet another Trojan Horse, included in the GDPR; which extends to removable "privacy" masking), receive no mention whatsoever; likely because retained indefinitely, which is not explicitly disclosed: as this could potentially distress data subjects, and rightfully so.

With modern H.264 compression capabilities, even permanently mobile (transportation vehicles and the like), or remote areas, can be monitored in real time (often through a cellular connection; or in metros, by radio antennae along the track). Archival footage (possibly stored by an onboard 'Network Video Recorder (NVR)'), and data not requiring real-time updates; are wirelessly offloaded at strategic locations (transportation terminals, or city halls for example). This limits bandwidth used during real-time monitoring, while prolonging the retention period, of uncompressed footage; beyond the capacity provided by NVRs. For more permanent installations, fiber-optics are perferred (the network of which, "conveniently" growing; or having completely replaced the 'Public Switched Telephone Network (PSTN)'). Where such infrastructure isn't available, a network of mesh nodes may be used (possibly able to take multiple paths: in case of congestion or power failure; and even when all goes down, the footage may be retained on cameras' built-in storage: automatically transferred, when connection is restored).

More specialized applications include: intrusion detection of large perimeters (possibly with the addition of: thermal imaging cameras, fence sensors, or even: radar, LiDAR, or sonar systems), on-demand observation (including: mobile surveillance cameras (to "temporarily" broaden visibility; an example being 'Police Observation Devices (PODs)'), body-worn devices (bodycams, or increasingly officer smartphones), and (aquatic) drones or helicopter downlinks), "transportation" cameras (onboard public transportation vehicles: monitoring the interior, and increasingly the exterior; one story mentioning: footage being requested, from buses frequently driving past a bank, when a robbery had occurred there), "traffic (flow)" cameras (insinuating use being limited to traffic analysis; despite multiple stories reporting, they may be monitored by law enforcement), and ALPR-equipped parking and law enforcement vehicles (primarily registering vehicle location, alongside a timestamp; while parking vehicles, may additionally have tire chalking cameras: photographing tire position, to detect if a vehicle has moved).

Parking-specific uses, inlude: issuing (role-based) permits digitally (possibly saving "$30,000 in labor and material"), enforcing uniformly (systematically locating every vehicle, instead of manual, and sporadic checks: analytically targetting vehicles in violation (unpermitted, overtime (beyond the grace period, the metered time, or stay-limit), re-parked (within the expiration period), scofflaw (having defaulted on open tickets), or abuse (of spaces reserved for specific uses)): fining users into purchasing permits (possibly being oversold: more permits than capacity; with a ratio based on occupancy reports), and therefore compliance (especially with evidence: disproving disputes)), digital metering (through parking meters, or increasingly by phone: possibly reducing overhead by "$25,000-$35,000 AUD per car park annually"), sharing resources (reallocating, or selling spaces: when underused), outsourcing enforcement (by sharing permit databases), reducing congestion (by automating gates, and redirecting vehicles to open spaces), and (long-term) analytics (used to futher incease (cost-)effectiveness).

Marketing, including data centers: offering 'Compliance as a Service (CaaS)' (providing evidence to customers: as to verify, compliance to standards and regulations). Car washes: detecting members by license plate, instead of a windshield tag (possibly unwanted by customers; while reducing payment-related delays, and RFID tag (installation) costs; enabling any vehicle (from members, or not), to be connected to sales data: to personalize marketing; based on visit frequency, and sales history). Casinos: giving "high rollers" specialty treatment (based on license plate recognition, of the VIPs). Stadiums: decreasing wait times, to allow fans more time at "concession stands and team stores" prior to the match (possibly increasing sales); and "exclusive parking options" (by license plate recognition, of: VIPs and members). Businesses: offering limited free parking (lowering the barrier of entry). And a bank: commiting to its "Large enough to serve you, small enough to know you" slogan (using facial recognition: to personally greet customers, to build loyalty; while adapting offerings, and identify potential suspects).

Entertainment, including event venues: monitoring booked spaces (facilitating: corporate events, weddings, or any other event-type). Sports venues monitoring: visitor behavior ("disgruntled fans", "rowdy crowds", and "dubious individuals"), foul balls (possibly causing injuries: needing medical attention; likely insurance-related), scalpers, skateboarders (using "rails and stairs as their playground"), VIPs (protecting: players, entertainers, and others); all possibly in collaboration, with other "stakeholders" ("neighboring venues, transit agencies, and police departments"). And gambling venues, monitoring: transactions (connected to video evidence: possibly required, for cash-outs over $10,000; alongside commissioner approval: from home, or anywhere on the casino floor), slot machines (to disprove a dispute: or customer "fabrication"), and fraud ("table fraud", "fowl play", "card fraud" (playing with abandoned member-cards: "avoiding major legal implications"), "internal theft", or "deceitful cash"), and identfying blacklisted, or self-excluded patrons (to "curb compulsive gambling").

Retail, including: 'Loss Prevention (LP)' (losses through: shoplifting (countered by: video analytics, 'Electronic Article Surveillance (EAS)' (tags or labels, registered by antennas at a perimeter: causing an alarm, when unexempted), and shopping cart wheels (locking: when attempting to leave, through places other than the check-out lanes), unregistered products at registers (with video being linked, to (live or historical) transactions: compared to receipt overlays), and fraud (suspicious transactions, primarily: refunds, markdowns, and employee- and gift card sales; possibly filtered by: cashier number, transaction type, or even specific 'Universal Product Code (UPC)'; and may involve "hundreds of stores", while evidence may: "accurately identify potential suspects, vehicles, merchandise and even currency denominations"); automatically flagged, by some third-party reporting systems), and gaining customer insights (through video analytics, and cart location (wheel locks, and cart locks: chaining carts together)), and automation (people counting through analytics, instead of greeters).

'Smart buildings', including offices: having deployed thermal imaging cameras (during the COVID-19 pandemic: to "monitor employee temperatures"); rewarding employees: using access control card credit ("for a job well-done": to be spent in the cafeteria); using smartphone applications to: enter (buildings, rooms, and elevators), book (parking spaces, (meeting) rooms, and desks), personalize (working spaces, lighting, and heating), and connect (to other app-users, and workplace services). Mixed-use developments: monitoring ('Chilled Water System (CWS)' temperatures, sewers and ventilation ducts (using cameras), and water leaks), and doing concierging remotely (reducing guarding costs by 30%). And retirement communities: eliminating re-keying through electronic locks (reducing cost and complexity), doing welfare checks remotely (by monitoring resident doors: having been opened in the morning, or not), overriding apartments' access rules (ensuring access to responders; or to quickly lock residents out: for whatever reason), and seniors using RFID cards, to purchase meals, and community shop items.

Industry, including the remote monitoring of: sites (intrusion thereof, and dumpings nearby), equipment (and the location of features: for planning improvements and maintainance, or detection of mechanical failures), and activity on sites (traffic flow: avoiding any congestion issues; and ensuring timely deliveries of materials (by 'Delivery Management System (DMS)' approved vehicles); especially for 'Just-In-Time (JIT)' plants; alongside processes at production lines, and warehouse floors: increasing efficencies, ensuring use of personal protection equipment, or spot any other safety hazards; potentially requiring better training). Whereas health care, may monitor: the obstetrics unit ("to prevent possible infant abductions"), patients (being nursed (including associated medical equipment), at the emergency room (possibly needing immediate medical attention), or with potential for violent outbursts), and liability claims (having been "drastically reduced", while "slip-trip-fall" events, only have a "minimum retention time": suggesting a disinterest in supportive evidence).

Transportation, including public transportation services: locating vehicles (using 'Automatic Vehicle Location (AVL)' data for buses: detecting route, and speed deviations; and delays in train schedules: diagnosed using camera footage), extending visibility from sites: into, and surrounding vehicles (with cameras typically being near entrances: for the interior; while on the front and rear, or possibly doubling as 'side mirror cameras': for the exterior); and ensuring continuity (infrastructure and services functioning, detecting "problematic customer behaviour" (in context of customers near rails), and safe passenger boarding; the last, at least relating to liability). And airports: similar to the previous, but in context of aircrafts: located on-ground and in-air (possibly with vehicles and drones in the way), the diagnosing of delays (mostly luggage and rescreen related), and continuity: but backed by anti-terrorism legislation (where even unaccompanied luggage, might be considered a potential risk, let alone passengers: explaining the possible use, of iris-scan and fingerprint technologies.

Education, including schools: showing evidence to parents (their child having "discipline issues"), resolving "he-said, she-said" disputes, remotely monitoring (halls, doors, cafeterias, and playgrounds), following persons (including children) across cameras, and tracking "dubious behaviour". And universities (including "Spy Hill campus"): enforcing barring notices, basing access (to: lecture halls, auditoriums, residential buildings, etc.) on: identity, role, enlisted courses or programs (including associated class schedules: possibly used to deny access if late; maintaining student discipline), and academic year (first-year students, not having access to second-year laboratories); "addressing" unplanned gatherings (which may include protests), (exclusively) using mobile credentials (allowing "meal-time" status, and balance decline notifications; and the potential tracking of smartphones, especially with incentivized wireless connectivity), and requiring access credentials to: use (books, equipment, and printers), buy (meals and items), and receive (post office packages).

Public space surveillance, including: federation of (technically seperate) systems, to (regional) OCCs (either fully, or partially: to avoid "political stalemate"; as local archivers, may offload to long-term, centralized archivers anyway: 'BRIC' in case of Brussels; these often include sensors, questionably limited to monitoring: public works (public buildings, transport infrastructure, public spaces, public services, and environmental protection), alongside any other assets, from participating Genetec customers: including all aforementioned), and providing (local) departments, (limited: hopefully) access to OCC resources: spatial planning (use of infrastructure), water and sewer (intersection floods), sanitation (illegal dumpings, smart waste sensors, road debris, and fallen branches), transportation (de-iced sidewalks, traffic management, signals, tunnels, and major roadway construction projects), law enforcement (antisocial behaviour, environmental crimes, warranted suspects without physical addresses, and (street-level) crime), and courts (supportive evidence).

And law enforcement, including: automatically showing camera feeds, closest to the caller’s geocoordinate (to be reviewed, and assist nearby officers, through: radio, 'Computer-Assisted Dispatch (CAD)' comments, and/or shared: suspect images, or (live) 911 calls), associating events to incident-location (preseumably to detect hotspots, and potentially (re)place (addtional) PODs accordingly); accumulating further coverage (from other Genetec customers: individually, or collectively (as local OCCs); which may limit access rights: but rarely to public-facing cameras), wielding surveillance to "deter crime", and using analytics to identify: persons (based on profile: potentially containing images, enabling facial recognition), vehicles (by description, or license plate: possibly allowing "manual entries"); and objects (carried, or abandoned by subjects: weapons in particular), and events (criminal activities, movements of subjects, and "antisocial behaviour"). All generally incrasing efficiencies (including prosecution): used to justify additional funding, to further expand surveillance effords.

It seems there's nothing stopping the federation of all, into a globally spanning network of sensors: able to track persons around the globe (especially with growing interest, in use of facial recognition: even from an organsation like Brussels). Perhaps not centralized to a single location (given bandwidth limitations), but instead: a shrinking number of large-scale OCCs. Allowing capture, of public, however very personal, activities: from outdoor to indoor, public to private, stationary to mobile; likely retained as metadata (despite sources no longer existing: unless potential evidence; in pseudonomized form: technically no longer classifying as "personal"; allowing indefinite retention). The lower bandwidth requirement of metadata, could quite easily facillitate, the centralized storage of profiles, or alternatively: searches could be requested, based on a person's profile (keeping the data distributed: technically). The potential for abuse cannot be understated, and the only meaningful mitigation strategy, is one that physically minimizes collection: not one that compensates, using legislation.

Flock shows Genetec, as partner on their website (allowing integration), but the opposite doesn't appear to be true (although the 'Third-Party ALPR plugin', seems to allow ingestion of Flock ALPR-data): which is probably just Flock being petty, and Genetec showing professionalism; similar to common tender process, versus Flock's bribing, and allowing third-party hardware, instead of vendor-locking organisation to hardware (in addition to software). And where Genetec systems, may come in many forms (possibly reducing centralization concerns), Flock's uniform appearance, is easily recognized: which ultimately, might be Genetec's main advantage; as (misplaced) acceptance, from the underinformed majority, might be the key to longevity. I applaud Flock for its unprofessionalism and incompetence: because a solution like Genetec, might've never drawn sufficient attention to itself, for anyone to further investigate associated technologies. Flock has demonstrated, on a multitude of occasions, why centralized surveillance infrastructure, allows for abuse; and for Genetec, this might just be a matter of time.

Additional customers, mentioned in stories are: Chicago’s Office of Emergency Management and Communications (OEMC), Hasselt University, Schiphol Airport, Orlando Sanford International Airport, Surrey City Hall (British Columbia), University of California Los Angeles (UCLA), University of Southern California (USC), and Long Beach (California).

25
55
submitted 5 days ago by Username85920@lemmy.ml to c/privacy@lemmy.ml

I recently tried to clean up my digital life. I switched to Linux and switched to GrapheneOS and made more use of my proton subscription to replace google. But I have a few questions :

I tried https://coveryourtracks.eff.org/ on Librewolf on my PC and Vanadium on my phone and it say I have a nearly unique fingerprint. Is the benefit of using a privacy focused browser neglected by the low userbase and unique fingerprint ?

I did not have a great digital hygiene before so I have a google account, meta... How do I clean this up ? Are services like Incogni any good or is it just marketing ?

Finally I wanted to use tails with persistent storage to use as a live system if I ever need to use a PC that is not my own to connect to my accounts. However, I don't want the ISP to know I use Tor. I see it as a big "I have something to hide" flag for the ISP. But my understanding is if I install a VPN on tails it will be Tor over VPN (bad if I understand correctly) instead of VPN over Tor. Should I use something else than tails since I only want/need always on VPN with kill switch.

Thanks a lot for your help. I want to say the journey is much easier than what I anticipated. The hardest part is making people switch around me. The lobbying has started.

view more: next ›

Privacy

46763 readers
842 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago
MODERATORS