WhatsApp Files Lawsuit in India over New Laws That Impact User Privacy

WhatsApp has filed a lawsuit challenging the Indian government’s new rules that require the Facebook-owned messaging platform to make people’s messages traceable, a move it says would undermine the privacy of users.The lawsuit was filed as India brought sweeping new regulations into force on Wednesday to make social media and technology companies, that have tens of millions of users in the country, more accountable for content on their platform.One of the new rules would require messaging platforms to identify the “first originator of information” when authorities demand it. WhatsApp wants that regulation blocked saying that it undermines citizens’ fundamental right to privacy.In a statement issued after the lawsuit was filed, the government said it respects the right to privacy as a fundamental right but “no Fundamental Right, including the Right to Privacy, is absolute and it is subject to reasonable restrictions.”The statement by the Ministry of Electronics and Information Technology said the requirement to disclose the origin of a particular message will only arise in the case of “prevention, investigation or punishment” of very serious offences.With over 40 million users, India is one of the biggest markets for the messaging platform. It has said that it is committed to protecting the privacy of people’s personal messages.“Technology and privacy experts have determined that traceability breaks end-to-end encryption and would severely undermine the privacy of billions of people who communicate digitally,” WhatsApp says in a blog post on its website. It said that a government “that chooses to mandate traceability is effectively mandating a new form of mass surveillance.”Technology experts in New Delhi called the lawsuit by WhatsApp significant.“This is one of the most significant lawsuits for privacy and it has implications not just for Indian users but globally. What will be debated in court is — can privacy of all users be compromised because there might be a legitimate demand from law enforcement agencies for information on one user or one message,” said Nikhil Pahwa, a digital rights activist and founder of technology publication Medianama. “Basically many governments around the world don’t want these kind of encrypted platforms because these platforms are blind to them and do not allow mass surveillance.”FILE – Rohitash Repswal, a digital marketer, shows a software tool that appears to automate the process of sending messages to WhatsApp users, on a screen inside his office in New Delhi, India, May 8, 2019.The sweeping new rules that were announced in February give the government more power to order social media companies, digital media and streaming platforms to remove content that it considers unlawful and require them to help with police investigations in identifying people who post “misinformation.” The employees of the companies in India can be held criminally liable for failing to comply with the government’s requests.Social media companies in India have been facing a tougher environment as the government seeks to regulate content posted online, which has become one of the most important spaces to express dissenting views.A spokesman for the opposition Congress Party, Abhishek Manu Singhvi, said the new rules were “extremely dangerous” for free speech and creativity, “unless extreme restraint is exercised” in implementing them.Critics accuse the government of trying to stifle online criticism and point to its requests to Twitter last month to remove several tweets including some that were critical of the government’s handling of the pandemic ravaging India. The government had said the messages could incite panic and were misinformation.Police also turned up at the local offices of Twitter in New Delhi on Monday to serve notice to the company concerning an investigation into the tagging of some government official’s tweets as “manipulated media.” 

Gaza-based Journalists in Hamas Chat Blocked From Facebook-owned WhatsApp

A few hours after the latest cease-fire took effect in the Gaza Strip, a number of Palestinian journalists in the coastal enclave found they were blocked from accessing WhatsApp messenger — a crucial tool used to communicate with sources, editors and the world beyond the blockaded strip.  The Associated Press reached out to 17 journalists in Gaza who confirmed their Whatsapp accounts had been blocked since Friday. By midday Monday, only four journalists — working for Al Jazeera — confirmed their accounts had been restored.The incident marks the latest puzzling move concerning WhatsApp’s owner Facebook Inc. that’s left Palestinian users or their allies bewildered as to why they’ve been targeted by the company, or if indeed they’d been singled out for censorship at all.Twelve of the 17 journalists contacted by the AP said they had been part of a WhatsApp group that disseminates information related to Hamas military operations. Hamas, which rules over the Gaza Strip, is viewed as a terrorist organization by Israel and the United States, where WhatsApp owner Facebook is headquartered.It’s unclear if the journalists were targeted because they’d been following that group’s announcements on WhatsApp.  Hamas runs Gaza’s Health Ministry, which has a WhatsApp group followed by more than 80 people, many of them journalists. That group, for example, has not been blocked.  Hassan Slaieh, a freelance journalist in Gaza whose WhatsApp account is blocked, said he thinks his account might have been targeted because he was on a group called Hamas Media.”This has affected my work and my income because I lost conversations with sources and people,” Slaieh said.  Al Jazeera’s chief correspondent in Gaza, Wael al-Dahdouh, said his access to WhatsApp was blocked around dawn on Friday before it was reinstated Monday. He said journalists subscribe to Hamas groups only to get information needed to do journalistic work.A WhatsApp spokesperson said the company bans accounts to comply with its policies “to prevent harm as well as applicable law.” The company said it has been in touch with media outlets over the last week about its practices. “We will reinstate journalists if any were impacted,” the company said.  Israeli Missiles Destroy Gaza Building Housing Foreign Media OutletsAssociated Press says the ‘world will know less about’ escalating violence in Gaza because of attack on buildingAl Jazeera said that when it sought information regarding its four journalists in Gaza impacted by the blockage, they were told by Facebook that the company had blocked the numbers of groups based out of Gaza and consequently the cell phone numbers of Al Jazeera journalists were part of the groups they had blocked.Among those affected by the WhatsApp blockage are two Agence France-Presse journalists. The Paris-based international news service told the AP it is working with WhatsApp to understand what the problem is and to restore their accounts.The 11-day war caused widespread destruction across Gaza  with 248 Palestinians, including 66 children and 39 women, killed in the fighting. Israel says 12 people in Israel, including two children, also died.It’s not the first time journalists have been suddenly barred from WhatsApp. In 2019, a number of journalists in Gaza had their accounts blocked without explanation. The accounts of those working with international media organizations were restored after contacting the company.  Facebook and its photo and video-sharing platform Instagram were criticized this month for removing posts and deleting accounts by users posting about protests against efforts to evict Palestinians from their homes in east Jerusalem’s Sheikh Jarrah neighborhood. It prompted  an open letter signed by 30 organizations demanding to know why the posts had been removed.Gaza Diary: Shouts, a Hurried Evacuation, and Then the Bombs Came AP journalist details the destruction of the building housing his officesThe New York Times also reported that some 100 WhatsApp groups were used by Jewish extremists in Israel for the purpose of committing violence against Palestinian citizens of Israel.  WhatsApp said it does not have access to the contents of people’s personal chats, but that they ban accounts when information is reported they believe indicates a user may be involved in causing imminent harm. The company said it also responds to “valid legal requests from law enforcement for the limited information available to us.”The Arab Center for the Advancement of Social Media, or 7amleh, said in a report published this month that Facebook accepted 81% of requests made by Israel’s Cyber Unit to remove Palestinian content last year. It found that in 2020, Twitter suspended dozens of accounts of Palestinian users based on information from the Israeli Ministry of Strategic Affairs.Al-Dahdouh, the Al Jazeera correspondent, said although his account was restored, his past history of chats and messages was erased.  “The groups and conversations were back, but content is erased, as if you are joining a new group or starting a new conversation,” he said. “I have lost information, images, numbers, messages and communications.”Al Jazeera said its journalists in Gaza had their WhatsApp accounts blocked by the host without prior notification.”Al Jazeera would like to strongly emphasize that its journalists will continue to use their WhatsApp accounts and other applications for newsgathering purposes and personal communication,” the news network told the AP. “At no time, have Al Jazeera journalists used their accounts for any means other than for personal or professional use.”The Qatar-based news network’s  office in Gaza was destroyed during the war by Israeli airstrikes that took down the high-rise residential and office tower, which also housed The Associated Press offices. Press freedom groups accused the military, which claimed the building housed Hamas military intelligence, of trying to censor coverage of Israel’s offensive. The Israeli military telephoned a warning, giving occupants of the building one hour to evacuate.  Sada Social, a West Bank-based center tracking alleged violations against Palestinian content on social media, said it was collecting information on the number of Gaza-based journalists impacted by the latest WhatsApp decision.   

India, Twitter Dispute Intensifies Over Alleged ‘Manipulated Media’

Indian police officials say they visited Twitter’s Delhi and Gurgaon offices to serve notice to the company’s managing director concerning an investigation into the company tagging some government official’s tweets as “manipulated media.”Several leaders of Prime Minister Narendra Modi’s Bharatiya Janata Party (BJP) shared parts of a document they said was created by their main political opposition, Congress, which allegedly showed how it planned to hinder the government’s response to the coronavirus pandemic.Some have been critical of the government’s handling of the pandemic. The BJP has blamed state governments for the slow response and ignoring warnings by Modi of a second wave.Congress said the documents were fake and complained to Twitter, which tagged the posts as manipulated.Twitter tags posts as “manipulated media” “that include media (videos, audio, and images) that have been deceptively altered or fabricated.”Twitter has not commented on this case.Modi’s administration has reportedly ordered Twitter to take down posts critical of its handling of the coronavirus in recent months. It has also complained when those orders were not followed.India has been hit hard by a second wave of the pandemic in recent months. The country has reported nearly 27 million cases and over 300,000 deaths.The latest dispute between the Indian government and U.S. social media giants Twitter and Facebook come as a deadline nears for the platforms to comply with new government takedown requests.Officials have warned both companies that failure to comply with the new rules “could lead to loss of status and protections as intermediaries.”

Ransomware Moves from ‘Economic Nuisance’ to National Security Threat

The recent cyberattack on Colonial Pipeline, the operator of the largest petroleum pipeline in the U.S., shows how internet criminals are increasingly targeting companies and organizations for ransom in what officials and experts term a growing national security threat.These hackers penetrate victims’ computer systems with a form of malware that encrypts the files, then they demand payments to release the data. In 2013, a ransomware attack typically targeted a person’s desktop or laptop, with users paying $100 to $150 in ransom to regain access to their files, according to Michael Daniel, president and CEO of Cyber Threat Alliance.“It was a fairly minimal affair,” said Daniel, who served as cybersecurity coordinator on the National Security Council under U.S. President Barack Obama, at the RSA Cybersecurity Conference this week.In recent years, ransomware has become a big criminal enterprise. Last year, victim organizations in North America and Europe paid an average of more than $312,000 in ransom, up from $115,000 in 2019, according to a recent report by the cybersecurity firm Palo Alto Networks. The highest ransom paid doubled to $10 million last year while the highest ransom demand grew to $30 million, according to Palo Alto Networks.“Those are some very significant amounts of money,” Daniel said. “And it’s not just individuals being targeted but things like school systems.”Last year, some of the largest school districts in the U.S., including Clark County Public Schools in Nevada, Fairfax County Public Schools in Virginia and Baltimore County Public Schools in Maryland, FILE – In this Sept. 12, 2019, photo, County Sheriff Janis Mangum stands in a control room at the county jail in Jefferson, Ga. A ransomware attack in March took down the office’s computer system.Colonial’s payment wasn’t the largest ransom paid by a single organization. Last year, Garmin, the maker of the popular fitness tracker, reportedly FILE – In this Aug. 22, 2019, file photo, signs on a bank of computers tell visitors that the machines are not working at the public library in Wilmer, Texas. Twenty-two local governments in Texas were hit by ransomeware in August 2019.Last month, the U.S. Justice Department created a task force to develop strategies to combat ransomware.“This is something we’re acutely focused on,” Monaco said.In a report to the Biden administration last month, an industry-backed task force called for a more aggressive response to ransomware.“It will take nothing less than our total collective effort to mitigate the ransomware scourge,” the task force wrote.In a typical ransomware attack, hackers lock a user’s or company’s data, offering keys to unlock the files in exchange for a ransom.But over the past year, hackers have adopted a new extortion tactic. Instead of simply encrypting a user’s files for extortion, cyber actors “exfiltrate” data, threatening to leak or destroy it unless a ransom is paid.Using dedicated leak sites, the hackers then release the data slowly in an effort “to increase pressure on the victim organization to pay the extortion, rather than posting all of the exfiltrated data at once.”In March, cybercriminals used this method when they encrypted a large Florida public school district’s servers and stole more than 1 terabyte of sensitive data, demanding $40 million in return.“If this data is published you will be subject to huge court and government fines,” the Conti cybercrime gang warned a Broward County Public Schools official.The district refused to pay.Cybersecurity experts have a term for this tactic: double extortion. The method gained popularity during the COVID-19 pandemic as cyber criminals used it to extort hospitals and other critical service providers.“They’re looking to increase the cost to the victim,” Meyers said at the RSA conference.Recent attacks show cyber criminals are upping their game. In October, hackers struck Finnish psychotherapy service Vastaamo, stealing the data of 400 employees and about 40,000 patients. The hackers not only demanded a ransom from Vastaamo but also smaller payments from individual patients.This was the first notable case of a disturbing new trend in ransomware attacks, according to researchers at Check Point.“It seems that even when riding the wave of success, threat groups are in constant quest for more innovative and more fruitful business models,” the researchers wrote.

App Store Would Be ‘Toxic’ Mess Without Control, Apple CEO Says

Apple’s online marketplace would become a “toxic” mess if the iPhone maker were forced to allow third-party apps without reviewing them, chief executive Tim Cook said in testimony at a high-stakes trial challenging the company’s tight control of its platform.Cook, the last scheduled witness in the case brought by Fortnite maker Epic Games, delivered a strong defense of Apple’s procedures for reviewing and approving all the apps it offers for iPhone and iPad users.”We could no longer make the promise … of privacy, safety and security,” Cook said under questioning from Apple attorney Veronica Moye in federal court in California.Cook said Apple’s review process helps keep out malicious software and other problematic apps, helping create a safe place for consumers.Without this review, the online marketplace “would become a toxic kind of mess,” he said.”It would also be terrible for the developer, because the developer depends on the store being a safe and trusted place.”Cook’s testimony caps a high-profile trial which opened earlier this month in which Apple is accused of abusing a monopoly on its marketplace by creating a “walled garden” that squeezes app makers.’Not about money’Under cross-examination, Cook sparred with Epic lawyer Gary Bornstein about the profitability of the App Store.Cook disputed Epic’s contention that its profit margin on apps was some 80%, but the exact figure was not disclosed in court due to confidentiality.The Apple executive said the proprietary payments system challenged by Epic was about convenience for consumers, more than about profits.”We always put the user at the center of everything we do,” Cook said. “It has nothing to do with money.”During his testimony, Cook defended Apple’s policy of barring apps directing consumers to other platforms to purchase subscriptions or credits for games and other services.”It would be akin to Best Buy advertising that you can go across the street to the Apple Store to buy an iPhone,” he said.Epic, maker of the popular Fortnite video game, is seeking to force Apple to open up the marketplace to third parties seeking to circumvent Apple’s procedures and commissions of up to 30%.Apple booted Fortnite from its App Store last year after Epic dodged revenue sharing with the iPhone maker.Apple does not allow users of its popular devices to download apps from anywhere but its App Store, and developers have to use Apple’s payment system, which takes its cut.The Epic lawyer also questioned Cook about Apple’s arrangement with Google to be the default search engine for the iPhone maker’s Safari browser, another area scrutinized by antitrust officials.Cook acknowledged that Google pays for this position but added that Apple made the arrangement “in the best interest of the user.”The case before District Court Judge Yvonne Gonzalez Rogers in Oakland comes with Apple feeling pressure from a wide range of app makers over its control of the App Store, which critics say represents monopolistic behavior.The European Union has formally accused Apple of unfairly squeezing out music streaming rivals based on a complaint brought by Sweden-based Spotify and others, which claim the California group sets rules that favor its own Apple Music.A recently formed Coalition for App Fairness, which includes both Spotify and Epic, have called for Apple to open up its marketplace, claiming its commission is a “tax” on rivals.Closing arguments in the bench trial in California were expected early next week, with the judge expected to rule within several weeks.

South Korea Seeks Tax Cuts, Incentives for US Investment

South Korea requested from the United States incentives such as tax deductions and infrastructure construction to ease the U.S. investment of Korean firms, including leading chipmaker Samsung Electronics, its presidential office said Friday.South Korean President Moon Jae-in, in Washington for a summit with U.S. President Joe Biden, told a gathering of U.S. Secretary of Commerce Gina Raimondo, her South Korean counterpart and CEOs of Qualcomm, Samsung and other companies that both countries can benefit by strengthening supply chain cooperation.Biden has advocated for support for the U.S. chip industry amid a global chip shortage that has hit automakers and other industries.He met with executives from major companies including Samsung in April and previously announced plans to invest $50 billion in semiconductor manufacturing and research.Samsung plans to invest $17 billion for a new plant for chip contract manufacturing in the United States, South Korea’s presidential Blue House added in a statement, confirming plans previously reported.In February, documents filed with Texas state officials showed that Samsung is considering Austin, Texas, as one of the sites for a new $17 billion chip plant that the South Korean firm said could create 1,800 jobs.There has been no new public documentation filed on the potential Texas chip plant application since March, the website for the Texas Comptroller of Public Accounts showed Friday.The U.S. Department of Commerce and the Korean industry ministry agreed Friday that for continuous chip industry cooperation, policy measures such as incentive support, joint research and development, cooperation on setting standards, and manpower training and exchange are needed, the Blue House said.Meanwhile, DuPont announced plans to establish an R&D center in South Korea to develop original chip technologies such as photoresist for extreme ultraviolet (EUV) lithography, the Blue House said.

Hackers Targeted Solarwinds Earlier than Previously Known

The hackers who carried out the massive SolarWinds intrusion were in the software company’s system as early as January 2019, months earlier than previously known, the company’s top official said Wednesday. SolarWinds had previously traced the origins of the hack to the fall of 2019 but now believes that hackers were doing “very early recon activities” as far back as the prior January, according to Sudhakar Ramakrishna, the company’s president and CEO. “The tradecraft that the attackers used was extremely well done and extremely sophisticated, where they did everything possible to hide in plain sight, so to speak,” Ramakrishna said during a discussion hosted by the RSA Conference. The SolarWinds hack, which was first reported last December and which U.S. officials have linked to the Russian government, is one in a series of major breaches that has prompted a major cybersecurity focus from the Biden administration. By seeding the company’s widely used software update with malicious code, hackers were able to penetrate the networks of multiple U.S. government agencies and private sector corporations in an apparent act of cyber-espionage. The U.S. imposed sanctions against Russia last month. Also Wednesday, Ramakrishna apologized for the way the company blamed an intern earlier this year during congressional testimony for poor password security protocols. That public statement, he said, was “not appropriate.” “I have long held a belief system and an attitude that you never flog failure. You want your employees, including interns, to make mistakes and learn from those mistakes and together we become better,” he added. “Obviously you don’t want to make the same mistake over and over again. You want to improve.” 

Irish Health Service Hit by ‘Very Sophisticated’ Ransomware Attack 

Ireland’s health service operator shut down all its IT systems Friday to protect them from a ransomware attack, which crippled diagnostic services and disrupted COVID-19 testing.An international cybercrime gang was behind the attack, said Ossian Smyth, Ireland’s minister responsible for e-government. Smyth described it as possibly the most significant cybercrime attempt against the Irish state.Ireland’s COVID-19 vaccination program was not directly affected, but the attack was affecting IT systems serving all other local and national health provisions, the head of the Health Service Executive (HSE) said.Ransomware attacks typically involve the infection of computers with malicious software, often downloaded by clicking on seemingly innocuous links in emails or other website pop-ups. Users are left locked out of their systems, with the demand that a ransom be paid to restore computer functions.No payment”We are very clear we will not be paying any ransom,” Prime Minister Micheál Martin told reporters.The HSE’s chief described the attack as “very sophisticated.” Officials said the gang exploited a previously unknown vulnerability. Authorities shut down the system as a precaution after discovering the attack early Friday morning and will seek to gradually reopen the network, although that will take “some days,” Martin said.The attack was largely affecting information stored on central servers, and officials said they were not aware that any patient data had been compromised. Hospital equipment was not impacted, with the exception of radiography services.”More services are working than not today,” HSE Chief Operations Officer Anne O’Connor told national broadcaster RTE.”However, if this continues to Monday, we will be in a very serious situation and will be canceling many services. At this moment, we can’t access lists of people scheduled for appointments on Monday so we don’t even know who to cancel.”

Facebook Faces Prospect of ‘Devastating’ Data Transfer Ban After Irish Ruling

Ireland’s data regulator can resume a probe that may trigger a ban on Facebook’s transatlantic data transfers, the High Court ruled Friday, raising the prospect of a stoppage the company warns would have a devastating impact on its business.
 
The case stems from EU concerns that U.S. government surveillance may not respect the privacy rights of EU citizens when their personal data is sent to the United States for commercial use.
 
Ireland’s Data Protection Commissioner (DPC), Facebook’s lead regulator in the European Union, launched an inquiry in August and issued a provisional order that the main mechanism Facebook uses to transfer EU user data to the United States “cannot in practice be used.”
 
Facebook had challenged both the inquiry and the Preliminary Draft Decision (PDD), saying they threatened “devastating” and “irreversible” consequences for its business, which relies on processing user data to serve targeted online ads.
 
The High Court rejected the challenge Friday. “I refuse all of the reliefs sought by FBI [Facebook Ireland] and dismiss the claims made by it in the proceedings,” Justice David Barniville said in a judgment that ran to nearly 200 pages.
 
“FBI has not established any basis for impugning the DPC decision or the PDD or the procedures for the inquiry adopted by the DPC,” the judgment said.
 
While the decision does not trigger an immediate halt to data flows, Austrian privacy activist Max Schrems, who forced the Irish data regulator to act in a series of legal actions over the past eight years, said he believed the decision made it Inevitable.
 
“After eight years, the DPC is now required to stop Facebook’s EU-U.S. data transfers, likely before summer,” he said.
 
A Facebook spokesman said the company looked forward to defending its compliance with EU data rules as the Irish regulator’s provisional order “could be damaging not only to Facebook, but also to users and other businesses.”
 Privileged access
 
If the Irish data regulator enforces the provisional order, it would effectively end the privileged access companies in the United States have to personal data from Europe and put them on the same footing as companies in other nations outside the bloc.
 
The mechanism being questioned by the Irish regulator, the Standard Contractual Clause (SCC), was deemed valid by the European Court of Justice in a July decision.
 
But the Court of Justice also ruled that, under SCCs, privacy watchdogs must suspend or prohibit transfers outside the EU if data protection in other countries cannot be assured.
 
A lawyer for Facebook in December told the High Court that the Irish regulator’s draft decision, if implemented, “would have devastating consequences” for Facebook’s business, affecting Facebook’s 410 million active users in Europe, hitting political groups and undermining freedom of speech.
 
Irish Data Protection Commissioner Helen Dixon in February said companies more broadly may face massive disruption to transatlantic data flows as a result of the European Court of Justice decision.
 
Dixon’s office welcomed the decision on Friday but declined further comment.