Економіка

Cybersecurity experts have been poring over the transcripts from Wednesday’s news conferences in Geneva to determine whether the U.S.-Russia summit will produce real progress in halting a wave of high-profile ransomware attacks. For most, the answer is: It’s too soon to tell. In the run-up to the meeting between President Joe Biden and Russian President Vladimir Putin, cyberattacks for ransom emanating from Russia emerged as a critical national security issue for the United States. Concern over Russia’s purported role in these attacks grew after ransomware criminals believed to be based in Russia breached the computer networks of Colonial Pipeline — the largest pipeline system for refined oil products in the U.S. — and beef processing giant JBS last month.FILE – A JBS Processing Plant stands dormant after halting operations on June 1, 2021 in Greeley, Colorado. JBS facilities around the globe were impacted by a ransomware attack, forcing many of their facilities to shut down.Biden vowed to confront Putin over ransomware. But while no breakthrough over cybersecurity emerged from the summit, the two leaders agreed to start consultations over the issue.  Cyber consultations  Experts from the two countries will be tasked to work on “specific understandings of what’s off-limits” and to follow up on cyberattacks that originate in either country, Biden said.   What that will entail remains to be seen, but cybersecurity experts say the talks will likely be conducted by working groups composed of low-level officials from across the Biden administration and their Russian counterparts.   Sixteen exemptions The president said he handed Putin a list of 16 sectors such as energy and water services that the U.S. insists are out of bounds to attacks. These were designated as critical infrastructure sectors under a 2013 presidential directive.   “I talked about the proposition that certain critical infrastructure should be off-limits to attack, period — by cyber or any other means,” Biden told reporters.  FILE – A gasoline station posts signage saying that it has run out of unleaded and mid-grade fuel and has a $20 limit on super, following a ransomware attack on Colonial Pipeline, at the pump in Atlanta, May 11, 2021.In addition to energy and water systems, the list includes information technology, health care and public health, and food and agriculture — all of which have been the FILE – John Demers of the National Security Division speaks during a press conference at the Justice Department in Washington, Oct. 7, 2020.John Demers, the outgoing head of the Justice Department’s national security division, said that while the U.S. has in the past asked Russia for information on cybercriminals, it has all but given up on seeking cooperation.    “I think we’ve reached the stage today where there’s very little point in doing so,” Demers said at an event Tuesday sponsored by public sector media company CyberScoop.  Biden said Russia will be judged by its actions.”Of course, the principle is one thing,” the president said. “It has to be backed up by practice. Responsible countries need to take action against criminals who conduct ransomware activities on their territory.”  U.S. cyber offensive capability  Biden said that while he issued no threats during the roughly three-hour meeting, he made it clear there will be consequences for Russian actions, telling Putin, “If you do that, then we’ll do this.”    In recent years, the U.S. has significantly bolstered its offensive cyber capabilities. The United States Cyber Command is tasked with carrying out cyberspace operations against malicious foreign actors. As part of an offensive cyber operation, Cyber Command can block a target’s internet access, destroy its databases or take down the group’s entire computer network. “I pointed out to him we have significant cyber capability, and he knows it,” Biden said of Putin. “He doesn’t know exactly what it is, but it’s significant.”  In 2018, a U.S. cyber operation reportedly blocked Russian troll farm Internet Research Agency’s internet access. Last year, Cyber Command, along with the National Security Agency, reportedly carried out a cyber operation against hackers working for Iran’s Islamic Revolutionary Guard Corps after they sent threatening emails to U.S. voters to undermine confidence in the November presidential elections.
…

Even as big tech companies such as Amazon limit their sale of facial recognition software to law enforcement, one company has not: Clearview AI, a facial recognition search engine that contains three billion images scraped from the internet.    More than 3,000 U.S. law enforcement agencies employ the software, which uses an advanced algorithm to identify and match faces, the company says.   “The way it works is very similar to Google, but instead of putting in words, you’re putting in photos of faces, and it will find anything publicly available on the internet that looks like that face,” said Hoan Ton-That, chief executive and co-founder of the company.   Police argue that facial recognition software is an important tool in fighting and solving crimes. But its increasing use has raised concerns that there are too few rules in place for when and how police can use it.    Limiting the scope of software Police typically have image search engines at their disposal that pull drivers’ license pictures or other photos among police records.  Clearview AI, in contrast, has gathered billions of images from social media sites and other websites, which internet firms say were obtained by breaking their rules.  Clearview AI’s Ton-That says that the company only pulls publicly available information.   In one case, federal agents were able to identify a man suspected of sexual abuse of a girl using a single image from the “dark web,” an area of the internet only accessible by special software and matching it through Clearview AI.   “He was in the background of someone else’s photo at the gym, in the mirror,” said Ton-That. “They were able to identify where the gym was, identify the person, he ended up doing 35 years in jail and they saved a seven-year-old.”   A tool for law enforcement The software was also instrumental in helping federal as well as state and local law enforcement identify suspects that stormed the U.S. Capitol in January, according to Ton-That.  In one way, Clearview AI, which has created its database from people’s social media accounts and other public parts of the internet, was well suited to help with this massive investigation of people whose mugshots wouldn’t necessarily be in police databases, he said.   Police were able to use Clearview AI, which runs about a second per search, he said, and find matching photos online of some suspects.   “So they were able to quickly identify them, and reduce a lot of false-positives, and also speed up the investigative process,” he said.     What about privacy? When police violence protests swept the U.S. last year, Amazon and other tech firms suspended sales of their facial recognition technology to law enforcement, a suspension they have said is indefinite.   Clearview AI continues to sell to law enforcement, and internet firms such as Facebook, Google and Twitter as well as civil rights advocates are raising the alarm about its power and potential abuse of people’s privacy.   The American Civil Liberties Union (ACLU) has sued the company in Chicago and California.   Kate Ruane, senior legislative counsel for the ACLU, said that facial recognition technology raises the specter of the government “being able to surveil us throughout every single aspect of our lives.”   Federal, state and local governments, she says, “do admit that they use it, but they don’t tell us how, when or how often.”   There needs to be oversight and regulation, she said, but until then, she is calling for a total moratorium on law enforcement use of facial recognition technology.   Legislation & regulation In recent months, congressional leaders have introduced bills that would limit police use of purchased data that was “illegally obtained” via deception or breach of contract.  Clearview’s Ton-That agrees that there needs to be more transparency and even regulation around the technology’s use. But as for banning police use of Clearview?   “Given the success of our technology in solving crimes, especially crimes against children, it would be counterproductive and inappropriate to enact a moratorium or ban of facial recognition or Clearview AI’s product,” he said.   Ton-That has a code of conduct for customers and has built-in prompts in its software to help law enforcement customers prevent the software’s misuse.   Repressive governments’ use of facial recognition tech The ACLU and other civil rights groups are also concerned about the implications of this technology in the hands of repressive governments like China. “Because the implications are terrifying,” said the ACLU’s Kate Ruane, “especially what is going on in China, where it is trying to track citizens across every single aspect of their lives.” Ton-That says his company does not sell its software to foreign governments and is focusing for now on law enforcement in the U.S. “We’ve worked occasionally with some other private entities for investigative purposes, but we’ve decided just to focus on law enforcement,” he said. “It’s the easiest, most explainable and best use case of our technology.” 
…