SoylentNews

upstart writes:

A surveillance vendor was caught exploiting a new SS7 attack to track people's phone locations:

Security researchers say they have caught a surveillance company in the Middle East exploiting a new attack capable of tricking phone operators into disclosing a cell subscriber's location.

The attack relies on bypassing security protections that carriers have put in place to protect intruders from accessing SS7, or Signaling System 7, a private set of protocols used by the global phone carriers to route subscribers' calls and text messages around the world.

SS7 also allows the carriers to request information about which cell tower a subscriber's phone is connected to, typically used for accurately billing customers when they call or text someone from overseas, for example.

Researchers at Enea, a cybersecurity company that provides protections for phone carriers, said this week that they have observed the unnamed surveillance vendor exploiting the new bypass attack as far back as late 2024 to obtain the locations of people's phones without their knowledge.

Enea VP of Technology Cathal Mc Daid, who co-authored the blog post, told TechCrunch that the company observed the surveillance vendor target "just a few subscribers" and that the attack did not work against all phone carriers.

Mc Daid said that the bypass attack allows the surveillance vendor to locate an individual to the nearest cell tower, which in urban or densely populated areas could be narrowed to a few hundred meters.

[...] Surveillance vendors, which can include spyware makers and providers of bulk internet traffic, are private companies that typically work exclusively for government customers to conduct intelligence-gathering operations against individuals. Governments often claim to use spyware and other exploitative technologies against serious criminals, but the tools have also been used to target members of civil society, including journalists and activists.

In the past, surveillance vendors have gained access to SS7 by way of a local phone operator, a misused leased "global title," or through a government connection.

But due to the nature of these attacks happening at the cell network level, there is little that phone subscribers can do to defend against exploitation. Rather, defending against these attacks rests largely on the telecom companies.

Original Submission

An Anonymous Coward writes:

Discord has revealed that one of its customer service providers has suffered a data breach. The attackers gained access to Government-ID images, and user details.

Discord doesn't actually mention when the breach took place, it only says it "recently discovered an incident". The fact that Government ID images were stolen is important, the U.K.'s Online Safety Act came into effect on July 25, 2025. So, that means the data breach happened sometime between then and October 3rd, when the news about the incident was revealed. It's also worth noting that the victim of the hack was a third-party customer service that has not been named.

As for the attack, the incident involved an unauthorized party compromising one of the messaging services' customer service providers, which in turn allowed the hackers access to limited customer data, pertaining to those who had contacted Customer Support and/or Trust & Safety teams. Discord says it revoked the breached service provider's access to its ticketing system. It is investigating the matter with the help of a computer forensics firm, and is working with law enforcement. Users who were impacted by the incident are being notified via an email that is sent from [email protected]

Here's what Discord says the hackers managed to access: Name, Discord username, email and other contact details that were provided to customer support, billing information such as payment type, the last four digits of credit cards, and purchase history of the accounts, IP addresses, messages with customer service agents, and limited corporate data (training materials, internal presentations).

There was something else.

"The unauthorized party also gained access to a small number of government?ID images (e.g., driver's license, passport) from users who had appealed an age determination. If your ID may have been accessed, that will be specified in the email you receive."

The story continues:

https://www.ghacks.net/2025/10/06/discord-customer-service-data-breached-government-id-images-and-user-details-stolen/

Original Submission

An Anonymous Coward writes:

https://www.nytimes.com/2025/11/14/magazine/neurotech-neuralink-rights-regulations.html
https://archive.ph/mgZRE

As neural implant technology and A.I. advance at breakneck speeds, do we need a new set of rights to protect our most intimate data — our minds?

On a recent afternoon in the minimalist headquarters of the M.I.T. Media Lab, the research scientist Nataliya Kosmyna handed me a pair of thick gray eyeglasses to try on. They looked almost ordinary aside from the three silver strips on their interior, each one outfitted with an array of electrical sensors. She placed a small robotic soccer ball on the table before us and suggested that I do some "basic mental calculus." I started running through multiples of 17 in my head. After a few seconds, the soccer ball lit up and spun around. I seemed to have made it move with the sheer force of my mind, though I had not willed it in any sense. My brain activity was connected to a foreign object. "Focus, focus," Kosmyna said. The ball swirled around again. "Nice," she said. "You will get better." Kosmyna, who is also a visiting research scientist at Google, designed the glasses herself. They are, in fact, a simple brain-computer interface, or B.C.I., a conduit between mind and machine. As my mind went from 17 to 34 to 51, electroencephalography (EEG) and electrooculography (EOG) sensors picked up heightened electrical activity in my eyes and brain. The ball had been programmed to light up and rotate whenever my level of neural "effort" reached a certain threshold. When my attention waned, the soccer ball stood still.

For now, the glasses are solely for research purposes. At M.I.T., Kosmyna has used them to help patients with A.L.S. (Amyotrophic Lateral Sclerosis) communicate with caregivers — but she said she receives multiple purchase requests a week. So far she has declined them. She's too aware that they could easily be misused.

Neural data can offer unparalleled insight into the workings of the human mind. B.C.I.s are already frighteningly powerful: Using artificial intelligence, scientists have used B.C.I.s to decode "imagined speech," constructing words and sentences from neural data; to recreate mental images (a process known as brain-to-image decoding); and to trace emotions and energy levels. B.C.I.s have allowed people with locked-in syndrome, who cannot move or speak, to communicate with their families and caregivers and even play video games. Scientists have experimented with using neural data from fMRI imaging and EEG signals to detect sexual orientation, political ideology and deception, to name just a few examples.

Advances in optogenetics, a scientific technique that uses light to stimulate or suppress individual, genetically modified neurons, could allow scientists to "write" the brain as well, potentially altering human understanding and behavior. Optogenetic implants are already able to partially restore vision to patients with genetic eye disorders; lab experiments have shown that the same technique can be used to implant false memories in mammal brains, as well as to silence existing recollections and to recover lost ones.

Neuralink, Elon Musk's neural technology company, has so far implanted 12 people with its rechargeable devices. "You are your brain, and your experiences are these neurons firing," Musk said at a Neuralink presentation in June. "We don't know what consciousness is, but with Neuralink and the progress that the company is making, we'll begin to understand a lot more."

Musk's company aims to eventually connect the neural networks inside our brains to artificially intelligent ones on the outside, creating a two-way path between mind and machine. Neuroethicists have criticized the company for ethical violations in animal experiments, for a lack of transparency and for moving too quickly to introduce the technology to human subjects, allegations the company dismisses. "In some sense, we're really extending the fundamental substrate of the brain," a Neuralink engineer said in the presentation. "For the first time we are able to do this in a mass market product."

The neurotechnology industry already generates billions of dollars of revenue annually. It is expected to double or triple in size over the next decade. Today, B.C.I.s range from neural implants to wearable devices like headbands, caps and glasses that are freely available for purchase online, where they are marketed as tools for meditation, focus and stress relief. Sam Altman founded his own B.C.I. start-up, Merge Labs, this year, as part of his effort to bring about the day when humans will "merge" with machines. Jeff Bezos and Bill Gates are investors in Synchron, a Neuralink competitor.

hubie writes:

Beginning in March, all accounts will have a 'teen-appropriate experience by default'

Discord announced on Monday that it's rolling out age verification on its platform globally starting next month, when it will automatically set all users' accounts to a "teen-appropriate" experience unless they demonstrate that they're adults.

"For most adults, age verification won't be required, as Discord's age inference model uses account information such as account tenure, device and activity data, and aggregated, high-level patterns across Discord communities. Discord does not use private messages or any message content in this process," Savannah Badalich, Discord's global head of product policy, tells The Verge.

Users who aren't verified as adults will not be able to access age-restricted servers and channels, won't be able to speak in Discord's livestream-like "stage" channels, and will see content filters for any content Discord detects as graphic or sensitive. They will also get warning prompts for friend requests from potentially unfamiliar users, and DMs from unfamiliar users will be automatically filtered into a separate inbox.
Related

Direct messages and servers that are not age-restricted will continue to function normally, but users won't be able to send messages or view content in an age-restricted server until they complete the age check process, even if it's a server they were part of before age verification rolled out. Badalich says those servers will be "obfuscated" with a black screen until the user verifies they're an adult. Users also won't be able to join any new age-restricted servers without verifying their age.

[...] If Discord's age inference model can't determine a user's age, a government ID might still be required for age verification in its global rollout. According to Discord, to remove the new "teen-by-default" changes and limitations, "users can choose to use facial age estimation or submit a form of identification to [Discord's] vendor partners, with more options coming in the future."

The first option uses AI to analyze a user's video selfie, which Discord says never leaves the user's device. If the age group estimate (teen or adult) from the selfie is incorrect, users can appeal it or verify with a photo of an identity document instead. That document will be verified by a third party vendor, but Discord says the images of those documents "are deleted quickly — in most cases, immediately after age confirmation."

Badalich also says after the October data breach, Discord "immediately stopped doing any sort of age verification flows with that vendor" and is now using a different third-party vendor. She adds, "We're not doing biometric scanning [or] facial recognition. We're doing facial estimation. The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information."

[...] Even so, there's still a risk that some users will leave Discord as a result of the age verification rollout. "We do expect that there will be some sort of hit there, and we are incorporating that into what our planning looks like," Badalich says. "We'll find other ways to bring users back."

Original Submission

upstart writes:

Senator: ICE and CBP "have built an arsenal of surveillance technologies":

A few Senate Democrats introduced a bill called the ''ICE Out of Our Faces Act," which would ban Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) from using facial recognition technology.

The bill [PDF] would make it "unlawful for any covered immigration officer to acquire, possess, access, or use in the United States—(1) any biometric surveillance system; or (2) information derived from a biometric surveillance system operated by another entity." All data collected from such systems in the past would have to be deleted. The proposed ban extends beyond facial recognition to cover other biometric surveillance technologies, such as voice recognition.

The proposed ban would prohibit the federal government from using data from biometric surveillance systems in court cases or investigations. Individuals would have a right to sue the federal government for financial damages after violations, and state attorneys general would be able to bring suits on behalf of residents.

The bill was submitted yesterday by Sen. Edward J. Markey (D-Mass.), who held a press conference [video not reviewed -Ed] about the proposal with Sen. Jeff Merkley (D-Ore.), and US Rep. Pramila Jayapal (D-Wash.). The Senate bill is also cosponsored by Sens. Ron Wyden (D-Ore.), Angela Alsobrooks (D-Md.), and Bernie Sanders (I-Vt.).

"This is a dangerous moment for America," Markey said at the press conference, saying that ICE and CBP "have built an arsenal of surveillance technologies that are designed to track and to monitor and to target individual people, both citizens and non-citizens alike. Facial recognition technology sits at the center of a digital dragnet that has been created in our nation."

hubie writes:

"This is definitely not about dogs," senator says, urging a pause on Ring face scans:

Amazon and Flock Safety have ended a partnership that would've given law enforcement access to a vast web of Ring cameras.

The decision came after Amazon faced substantial backlash for airing a Super Bowl ad that was meant to be warm and fuzzy, but instead came across as disturbing and dystopian.

The ad begins with a young girl surprised to receive a puppy as a gift. It then warns that 10 million dogs go missing annually. Showing a series of lost dog posters, the ad introduces a new "Search Party" feature for Ring cameras that promises to revolutionize how neighbors come together to locate missing pets.

At that point, the ad takes a "creepy" turn, Sen. Ed Markey (D.-Mass.) told Amazon CEO Andy Jassy in a letter urging changes to enhance privacy at the company.

Illustrating how a single Ring post could use AI to instantly activate searchlights across an entire neighborhood, the ad shocked critics like Markey, who warned that the same technology could easily be used to "surveil and identify humans."

Markey suggested that in blasting out this one frame of the ad to Super Bowl viewers, Amazon "inadvertently revealed the serious privacy and civil liberties risks attendant to these types of Artificial Intelligence-enabled image recognition technologies."

In his letter, Markey also shared new insights from his prior correspondence with Amazon that he said exposed a wide range of privacy concerns. Ring cameras can "collect biometric information on anyone in their video range," he said, "without the individual's consent and often without their knowledge." Among privacy risks, Markey warned that Ring owners can retain swaths of biometric data, including face scans, indefinitely. And anyone wanting face scans removed from Ring cameras has no easy solution and is forced to go door to door to request deletions, Markey said.

On social media, other critics decried Amazon's ad as "awfully dystopian," declaring it was "disgusting to use dogs to normalize taking away our freedom to walk around in public spaces." Some feared the technology would be more likely to benefit police and Immigration and Customs Enforcement (ICE) officers than families looking for lost dogs.

Amazon's partnership with Flock, announced last October as coming soon, only inflamed those fears. So did the company's recent rollout of a feature using facial recognition technology called "Familiar Faces"—which Markey considers so invasive, he has demanded that the feature be paused.

"What this ad doesn't show: Ring also rolled out facial recognition for humans," Markey posted on X. "I wrote to them months ago about this. Their answer? They won't ask for your consent. This definitely isn't about dogs—it's about mass surveillance."

[...] But while Ring may have hurt its brand, WebProNews, which reports on business strategy in the tech industry, suggested that "the fallout may prove more consequential for Flock Safety than for Ring." For Flock, the Ring partnership represented a meaningful expansion of their business and "data collection capabilities," WebProNews reported. And because this all happened around one of the most-watched TV events of the year, other tech companies may be more hesitant to partner with Flock after Amazon dropped the integration and privacy advocates witnessed the seeming power of their collective outrage.

[...] Ring's statements so far do not "acknowledge the real issue," Scott-Railton said, which is privacy risks. For Ring, it seemed like a missed opportunity to discuss or introduce privacy features to reassure concerned users, he suggested, noting the backlash showed "Americans want more control of their privacy right now" and "are savvy enough to see through sappy dog pics."

"Stop trying to build a surveillance dystopia consumers didn't ask for" and "focus on shipping good, private products," Scott-Railton said.

He also suggested that lawmakers should take note of the grassroots support that could possibly help pass laws to push back on mass surveillance. That could help block not just a potential future partnership with Flock, but possibly also stop Ring from becoming the next Flock.

Original Submission