The IT Nerd

One of the biggest pizza operations in Canada is Pizza Pizza. But they seem to have dropped themselves into it big time as the Toronto Star has discovered. Apparently according to the Toronto Star, Toronto Police while investigating gangs in the city, trolled customer information using Pizza Pizza’s databases without going for a warrant first. And Pizza Pizza simply complied:

Amid a major criminal investigation that announced dozens of arrests last year, the popular pizza chain voluntarily searched its internal data and handed over customers’ personal information to Toronto police investigators, the Star has learned. 

Officers used the technique in Project Kraken, an investigation into guns, gangs and drugs that resulted in more than 70 arrests last June. Seven of those charged were tow truck operators, police said at the time. The accused are awaiting trial.

During the investigation, Toronto police obtained telephone numbers from phone intercepts. Officers then took those numbers to Pizza Pizza to get any matching customers’ names.

None of the accused were identified using the technique. Rather, it was used to identify people associated with targets of the investigation. It is not clear how many people were identified. 

Two sources connected to the case told the Star police used the technique. The Star is not identifying the sources because they can’t publicly speak about material that is part of disclosure.

Well, that is something that doesn’t sit well with me. And I am sure that if you have used Pizza Pizza it doesn’t sit well with you either. The cops won’t say anything about this. But Pizza Pizza says this:

The Star also asked Pizza Pizza for comment. In an emailed response, the company said it is “committed to protecting the Personal Information provided by customers. Our Privacy Policy details how we protect and use customer data in the fulfilment of customer orders.”

Pizza Pizza’s privacy policy states the company “reserves the right to access and/or disclose Personal Information where required to comply with applicable laws or lawful government requests.”

Customers, the policy states, consent with every order made to the “collection, use and disclosure of your information by Pizza Pizza in accordance with” its policy terms.

So, what that tells me is the following:

1. If you use Pizza Pizza’s online services to order a pizza for pickup or delivery. Then your personal information could be subject to being handed over to someone in law enforcement of government.
2. Pizza Pizza clearly doesn’t require a warrant to hand that info over.

I have the Pizza Pizza app on my iPhone, and this is enough for me to delete it off my iPhone and not use their services again. Now Pizza Pizza may not care about that. But they will care about this:

In response to Star queries, a spokesperson for the Office of the Privacy Commissioner of Canada said the office could not comment on this specific scenario involving Pizza Pizza because it had not examined it “in detail.”

I read that as this might get a serious look by the Ontario Privacy Commissioner. And I hope it does as this behavior by Pizza Pizza is simply unacceptable.

CAM4, a popular adult platform that advertises “free live sex cams,” misconfigured an ElasticSearch production database so that it was easy to find and view heaps of personally identifiable information, as well as corporate details like fraud and spam detection logs. According to Wired, the database exposed 7 terabytes of names, sexual orientations, payment logs, and email and chat transcripts — 10.88 billions records in all. 

First of all, very important distinction here: There’s no evidence that CAM4 was hacked, or that the database was accessed by malicious actors. That doesn’t mean it wasn’t, but this is not an Ashley Madison–style meltdown. It’s the difference between leaving the bank vault door wide open (bad) and robbers actually stealing the money (much worse).

The mistake CAM4 made is also not unique. ElasticSearch server goofs have been the cause of countless high-profile data leaks. What typically happens: They’re intended for internal use only, but someone makes a configuration error that leaves it online with no password protection. “It’s a really common experience for me to see a lot of exposed ElasticSearch instances,” says security consultant Bob Diachenko, who has a long history of finding exposed databases. “The only surprise that came out of this is the data that is exposed this time.”

And there’s the rub. The list of data that CAM4 leaked is alarmingly comprehensive. The production logs Safety Detectives found date back to March 16 of this year; in addition to the categories of information mentioned above, they also included country of origin, sign-up dates, device information, language preferences, user names, hashed passwords, and email correspondence between users and the company.

This is not trivial. If you take the adult nature of what this site does out of the equation, this is a massive leak of data that could really have long term consequences for users of this site if this data was accessed. Which there isn’t evidence that it has been accessed. At least not at present. But if we start to see things like targeted attacks and extortion phishing emails start to pop up in users inboxes, then we’ll know that this has gone from bad to worse.

You might recall that I posted a story on Toronto Police being ordered by their chief to stop using facial recognition tech from a controversial company named Clearview AI. This is a company who has a massive database of faces that they’ve scraped from places like Facebook and Twitter, violating those platforms terms of service in the process. Well, it now turns out the RCMP has been using this software too according to the CBC:

The RCMP acknowledged use of Clearview AI’s facial recognition technology in a statement Thursday, detailing its use to rescue children from abuse.

The force said it has used the technology in 15 child exploitation investigations over the past four months, resulting in the identification and rescue of two children.

The statement also mentioned that “a few units in the RCMP” are also using it to “enhance criminal investigations,” without providing detail about how widely and where. 

“While the RCMP generally does not disclose specific tools and technologies used in the course of its investigations, in the interest of transparency, we can confirm that we recently started to use and explore Clearview AI’s facial recognition technology in a limited capacity,” the statement said. 

“We are also aware of limited use of Clearview AI on a trial basis by a few units in the RCMP to determine its utility to enhance criminal investigations.”

CBC News has requested further details of where else the force is using Clearview AI, but has yet to receive a response. 

Fortunately, there appears to be some scrutiny coming to this issue. The Privacy Commissioner is investigating the company, and the House of Commons Standing Committee on Access to Information, Privacy and Ethics is going to have a look as well. Seeing as Canada has some of the more strict privacy laws on the planet, with the exception of the EU of course, there’s a real chance that the use of this software could be curtailed. Seeing as the company behind it appears to have stolen images for its database, and software like this tends to misidentify racialized groups with alarming frequency, and is a significant invasion of your privacy, that would be a good thing.

Barclays has been criticised by HR experts and privacy campaigners after the bank installed “Big Brother” employee monitoring software in its London headquarters. In other words, the company used spyware to spy on their employees:

Introduced as a pilot last week, the technology monitors Barclays workers’ activity on their computers, and in some instances admonishes staff in daily updates to them if they are not deemed to have been active enough — which is described as being in “the zone.” The system tells staff to “avoid breaks” as it monitors their productivity in real-time, and records activities such as toilet visits as “unaccounted activity.” A whistleblower at the banking giant told City A.M. that “the stress this is causing is beyond belief” and that it “shows an utter disregard for employee wellbeing.” “Employees are worried to step away from their desks, have full lunch breaks, take bathroom breaks or even get up for water as we are not aware of the repercussions this might have on our statistics,” they added. Big Brother Watch, a privacy campaign group, described the technology as “creepy.” The software, provided by Sapience, has been rolled out throughout the product control department within the investment bank division at the firm’s Canary Wharf headquarters.

Once this was made public, Barclays terminated the program. But I suspect that Barclays isn’t the only company doing something like this because employers want to maximize the productivity of their employees. And some will use methods like this to do it. The problem is that once this is out in the public domain, employees who have a problem with this will simply leave. Which of course hurts the company as the talent leaves which is expensive, and then you have to try and recruit new talent which is also expensive. Plus train them and the like, which is you guessed it, expensive. While you should have no expectation of privacy in the workplace, schemes like this go way too far. Thus if you’re an employer who things that this is a good idea, you might want to think again.

The Norwegian Consumer Council published an analysis of how popular apps are sharing user data with the behavioral ad industry. TechCrunch reports the findings. You might want to sit down for this:

A majority of the apps that were tested for the report were found to transmit data to “unexpected third parties” — with users not being clearly informed about who was getting their information and what they were doing with it. Most of the apps also did not provide any meaningful options or on-board settings for users to prevent or reduce the sharing of data with third parties.

“The evidence keeps mounting against the commercial surveillance systems at the heart of online advertising,” the Council writes, dubbing the current situation “completely out of control, harming consumers, societies, and businesses,” and calling for curbs to prevalent practices in which app users’ personal data is broadcast and spread “with few restraints.” 

“The multitude of violations of fundamental rights are happening at a rate of billions of times per second, all in the name of profiling and targeting advertising. It is time for a serious debate about whether the surveillance-driven advertising systems that have taken over the internet, and which are economic drivers of misinformation online, is a fair trade-off for the possibility of showing slightly more relevant ads.

“The comprehensive digital surveillance happening across the ad tech industry may lead to harm to both individuals, to trust in the digital economy, and to democratic institutions,” it also warns.

And:

The 10 apps whose data flows were analyzed for the report are the dating apps Grindr, Happn, OkCupid,  and Tinder; fertility/period tracker apps Clue and MyDays; makeup app Perfect365; religious app Muslim: Qibla Finder; children’s app My Talking Tom 2; and the keyboard app Wave Keyboard.

Frankly,  I am not shocked by this because you have to assume that if you install an app on your phone, the possibility of it slurping up your data and sending it to a third party exists. And it is questionable if you could stop these apps from doing that. The one thing that I will note is that this report is heavily slanted towards the Android platform because there are more Android phones out there. The report points out that this is less of a problem on iOS. Though you have to do some work to make sure that info that you don’t want sent to advertisers isn’t sent to them as the relevant settings that limit this sort of thing are not on by default. But having said that, if you run iOS 13, they do seem to be effective.

The take home message is this. Assume that you’re being tracked and your data is being sent to third parties as there is nothing to suggest that this isn’t going on.