Is your TV spying on YOU? It sounds like science fiction but many new TVs can watch you - telling advertisers your favourite shows or even filming you on the sofa. And there's no off switch!

You are sitting in bed in your pyjamas, drinking a cup of cocoa. A loved one lies next to you, watching late-night television. Pillow talk is exchanged. An alarm clock is set. Eventually the lights are turned out.

Earlier, you sat on the living-room sofa eating supper, before loading the dishwasher and heading upstairs.

You have, in other words, just enjoyed a perfectly normal night, in a perfectly normal home. The curtains are drawn, the central heating turned up. It’s cosy, relaxing and, above all, completely private. Or so you thought.

The truth turns out to be quite the opposite. For on the other side of the world, people you didn’t know existed are keeping a beady eye on your every move.

On the other side of the world, people you didn't know existed are keeping a beady eye on your every move

These characters can see what clothes you have been wearing and what food you’ve eaten. They heard every word you said, and logged every TV show you watched. Some are criminals, others work for major corporations. And now they know your most intimate secrets.

It may sound like a plot summary for a futuristic science-fiction movie. But real-life versions of this Orwellian scenario are being played out every day in towns and cities across the globe — and in most cases the victims have no idea.

At fault is a common electronic device invented nearly a century ago and found in almost every modern household: the domestic television set.

Put simply, our TVs have started spying on us.

 

More...

• Campaigners reveal horrific injuries they say were suffered by staff forced to work under terrible conditions in factories where Apple touchscreens are produced
• Cut off nuisance calls! Cold-calls are still getting through despite regulations designed to stop them

Last week, there was a high-profile case in point. An IT consultant called Jason Huntley, who lives in a village near Hull, uncovered evidence that a flat-screen television, which had been sitting in his living room since the summer, was secretly invading his family’s privacy.

He began investigating the £400 LG device after noticing that its home screen appeared to be showing him ‘targeted’ adverts — for cars, and Knorr stock cubes — based on programmes he’d just been watching.

Huntley decided to monitor information that the so-called smart TV — which connects to the internet — was sending and receiving. He did this by using his laptop effectively as a bridge between his television and the internet receiver, so the laptop was able to show all the data being sucked out of his set.

He soon discovered that details of not just every show he watched but every button he pressed on his remote control were being sent back to LG’s corporate headquarters  in South Korea.

Smart televisions, which connect to the internet, could be invading ordinary families' privacy (stock picture)

There, the electronics company appeared to be using its customers’ data to make money. A promotional video shown to commercial clients suggested that data was being used to provide ‘the ad experience you have always dreamed of’.

The information Huntley’s TV had sent — without his knowledge — included the contents of his private digital video collection, which he’d watched on the television. This included camcorder footage of family celebrations containing images of his wife and two young children.

Most worrying of all, the device continued sending such information to Korea even after Huntley had adjusted the television’s default settings to ‘opt out’ of data sharing.

Huntley wrote about the findings on his blog. After his case was picked up by mainstream news outlets, LG announced an investigation. ‘Customer privacy is a top priority,’ the firm said. ‘We are looking into reports that certain viewing information on LG smart TVs was shared without consent.’

LG has also removed its promotional video about targeted advertising from its website.

The Information Commissioner’s Office says it is now investigating the firm for a ‘possible breach’ of the Data Protection Act. Jason Huntley, meanwhile, tells me he is ‘very suspicious and also a little worried’ by the affair.

‘I don’t think we’ve heard the last of this. Who knows what else these televisions are doing that we don’t know about?’

It doesn’t take much digging to find out. Talk to any IT security expert and they will tell you that Huntley’s discovery is probably the tip of the iceberg.

What’s to blame is the continuing rise of smart televisions, which account for most new TV sets sold and are predicted to be in more than half of British homes by 2016. These high-tech devices differ from traditional televisions in that they are not just passive boxes that receive a signal and transfer it to a backlit screen.

Instead, they are essentially computers that connect to the internet — and so also send information back the other way.

In theory, this can be extremely useful. For example, many smart TVs have shopping ‘apps’ to access Amazon. They connect to iTunes. They allow us to watch YouTube, instantly download films via Netflix, stream BBC shows on iPlayer, and talk to friends using the video phone link Skype.

But in practice, like almost every type of computer, they can be all-too-easily hacked. And unlike PCs, almost all of which have fairly good anti-virus ‘firewalls’, smart TVs have little or no such software.
Indeed, most have been designed so that outside software — including anti-virus programmes — can never be installed.

This year, Luigi Auriemma, an IT security researcher and computer programmer from Malta, demonstrated the risks that these devices pose when he showed it was possible to hack into several types of Samsung smart television.

Last week, IT consultant Jason Huntley uncovered evidence that his LG flat-screen television, which had been sitting in his living room since the summer, was secretly invading his family's privacy

After accessing the devices via the internet, Auriemma was able to control them: turning the TVs off and on, and secretly accessing data they held about a user’s viewing habits.

Had he been a criminal, he could also have obtained details of the credit cards that users had uploaded to access pay-per-view TV, download films or use  shopping apps.

Other experts recently made the chilling discovery that it is possible to remotely access the video cameras built into the front of thousands of smart televisions, and spy on the users in their own home.

One such expert is Kurt Stammberger, who works for the IT security firm Mocana. He says the company was recently asked by a television manufacturer to do ‘penetration tests’ on its devices.
‘We weren’t just able to find out what someone was watching, and had watched,’ he says. ‘We could also install “spyware” that could, if they had a video camera, allow us to see through that camera — without even activating the little light that indicates it’s on.

‘It was a fairly straightforward thing to do. People who work in IT often place tape over their computer’s camera lens [in a laptop they are usually set into the inside of the lid] unless they want to actually use it, because it’s so common to hack them. We should all do the same with smart TVs.’

Such an attack, which Stammberger describes as ‘frighteningly easy’ to mount, could provide voyeuristic hackers with a chance to snoop on unsuspecting home-owners in their living rooms or bedrooms.

According to Roger Grimes, who has written eight books on IT security and worked in the field for 28 years, the gangs then sell lists of hacked credit card numbers to fellow criminals

You have only to witness the extraordinary success of the critically acclaimed Channel 4 show Gogglebox, in which consenting families allow the viewing public to watch them watching television, to appreciate how enticing that prospect could be.

More commercially minded hackers could use such an attack to steal commercial secrets. It could even be used to spy on foreign powers.

‘It’s a serious prospect and I would be very surprised if the Government ever puts in a big order for TVs from, for example, a Chinese manufacturer such as Huawei,’ adds Stammberger, referring to the giant corporation that has been banned in America because of fears over espionage.

‘But supply chains these days are so long and so complex that it’s very rare to buy an electronic device that doesn’t have some sort of Chinese component in it.’

Gangs based largely in Eastern Europe and Russia, meanwhile, are already using so-called ‘data-mining’ programmes to trawl the internet looking for smart TVs in which owners have entered their credit card details. A single search can yield thousands of results.

According to Roger Grimes, who has written eight books on IT security and worked in the field for 28 years, the gangs then sell lists of hacked credit card numbers to fellow criminals.

Card details that were obtained within the past 24 hours sell for around £2.20 each. Older ones are cheaper because there is more chance the cards could have been changed or stopped.

‘What we are starting to see now is really just a foretaste of what’s going to be happening in the next couple of decades,’ says Grimes.

‘Thanks firstly to mobile devices, and now smart TVs, we are entering a brave new world where there will be computers everywhere. Bad guys will take advantage of that.’

And we may not even be safe in our own living rooms.

link to www.dailymail.co.uk

Social Logins for Government Services Profile User's Identity

The current transition to electronic government (“e-gov”) means ditching all the paper + telephones + offices, and digitising everything, within the next few years. Driving licences, health records, prescriptions, taxes, benefits, voting, money … all of them will be digital. To access these services, each citizen must get a smart-chip to identify themselves to the government via an Identity Provider, such as Google, Facebook, Twitter, PayPal, LinkedIn or Microsoft.

The chip, called a secure element, can either be in a card, or a mobile phone, and you’ll have to hang onto it for dear life, because without it, your life would fall apart. This global smart ID is about to make its debut – using ‘social login’.



Apart from the surveillance involved using social logins, there will be a number of other chilling effects to follow – biometric enrolment, for starters, followed by relentless profiling in the name of predictive policing (aka NSA, GCHQ), and even digital clones used for simulations.

Mistrust will run amok. Always having to prove who you are, and what you’re allowed to do.

You could even be held responsible for maintaining our online profiles, meaning you’d be liable for what you claim about yourself, and for updating your details when your ID changes in any way. You will also have to pay to have your attributes (such as passing an exam) verified. People are already being advised to watch what they say online, but the global smart ID system would be able to restrict your access to certain resources if you are deemed to be illegible. This might soon happen to people on benefits – caught drinking, or smoking, their benefits might be stopped, for instance.

Without any public debate, it has been decided that you will pass control of your identity to one of the Identity Providers. It’s important to spread this information, because although the government insists it’s voluntary, there is no other option being presented for those who opt not to sign up. There aren’t any press releases, but this thing is happening right now. Offices and phone lines are being closed down. Even Bitcoin has gotten involved, as exchanges have begun using the very same ‘identity ecosystem’, and there are Bitcoin ATMs which require you to scan your palm print.

Any identity can be revoked, i.e. switched off.

The ultimate aim is to get us all using the same standards, which have been developed by the very same companies which stand to profit handsomely from this system.

OpenID, used for social logins for government services, “… is a standard that lets sites such as Google, Twitter or Facebook share the same login credentials. U.S. Government sites require a trust framework, a certification system that enables a party who accepts a digital identity credential to trust the identity, security and privacy policies of the party who issues the credential. OIX is the first Open Identity Trust Framework provider, enabling certified sites to share their login credentials with U.S. Government sites.” In 2010, Janrain was reportedly the only company to be, “working with the Apps.Gov site to provide OpenID-based login and registration tools.”

The Open Identity Exchange (OIX) was founded in 2010 by Google, PayPal, Equifax, VeriSign, Verizon, CA and Booz Allen Hamilton, to create a “trust framework” of standards and certification which would work across borders, and between public and private sectors.



Your government wants you to click ‘sign in with Facebook’, (or some other identity provider) to begin a transaction with any of its departments. This ‘social login’ sets in motion a sweep of the Internet to track and trace your words and actions, and decide if you’re a real person. This process is known as “internet life verification”. Each of the IDPs are part of the federated identity ecosystem, which means they are all using the same global standards; it means handing control of your identity to a third party, such as Facebook, Twitter, Google, PayPal, Microsoft, or LinkedIn. These are the dominant IDPs which provide citizens with a social (or federated) login.

Social login is the ability to access a web site or application using an account on a social network. You may have already used it, or at least seen the login buttons as an option on various sites' sign-in screens.

Some websites now have the ‘NASCAR logo’, which features the icons of the dominant Identity Providers (IDPs) listed above, (and maybe some others), and the option to sign in quickly using one of these social accounts is being offered by more and more websites and apps these days. Users may not realise that doing this would mean granting permission for their personal information to be gathered and analysed – every single time they sign in.

Over the next few years, more and more people all over the world will be using a smart phone, probably in combination with smart-rings or bracelets[1], to pay friends, and access buildings, using their NFC-enabled devices – simply verify yourself to your Identity Provider, and the IDP will do the rest for you. In the blink of an eye.



To understand what information can be gleaned from these IDPs, you gotta go here.Note that apps, etc, could get read/write access to people’s Facebook data, as well as that of their friends[2]. Security expert Dan Blum notes,

According to Janrain’s quarterly numbers and other sources, Facebook Login has almost 50% of the social login “market” and Google Plus (which is growing more rapidly) about 35%. Yahoo, Twitter and LinkedIn also register with smaller slices of the pie. Janrain notes: “Despite the possible perception that this is a two-horse race, it is critical to note the diversity of consumer preferences on different types of sites…We also have observed disparate preferences across geographic regions. For example, Hyves contends with Facebook as the most popular social network in the Netherlands…. In Brazil and India, Orkut is a popular identity provider for social login, while in China, Sina Weibo and Renren maintain popularity. Mixi is a common social login choice in Japan, while VK is preferred in Russia.

A recent ‘conversation’ amongst developers, about the clear progression of social logins, became a “bloodbath”, with comments such as:

…. I don’t like being tracked. 

…. Leaves trails. 

…. I don’t like you (consumers don’t like the companies asking for the data or sharing data). 

…. I don’t like spooks (can be accessed by the government/intelligence professionals, metadata creates patterns, companies are beholden to government requirements). 

…. I like Mozilla persona (just use that). 

…. You’re a single point of vulnerability. 

…. You’re a single point of blockage. 

…. Too much power to Facebook. 

…. What’s going on is that corps are collecting data on what the users are doing.

Also, at the Internet Identity Workshop last month (October, 2013), a long list of “user challenges with federated login” were recorded in the minutes from the meeting; for instance, it was noted that the Identity Provider has the, “ability to follow the user to where they go”, and that when a user builds up a “long term identity relationship, [they] may get greater access to services for having a quality account”, but users (who are said to have given permission to share their data) may not understand “what get’s shared”, and be “unclear on the potential use of the data”.

A great many problems are touched upon in the meeting:

• [users] must relinquish data to gain service benefits
• if something goes wrong, who are you going to call, the RP [the Relying Party] or the IDP
• if the user is faced with inability to access a paid service, who reimburses the user?
• we are habituating consent
• if you fail to share data, you fail authentication

Social/federated logins are said to make people’s lives easier, and said to make them more private. A couple of clicks and you’re in – after that, whenever you need to prove who you are, and what you have access to, just click on your IDP icon, and the IDP will do everything for you - it will pre-populate forms for you when you register with a site, and, whenever you need to prove who you are, for example, to buy a ticket, it would confirm to the website owner only those credentials which are required, such as name, date of birth, address, etc.

Although this prevents other websites from seeing your details, there are several companies who will gather it up for them, literally splattering personal info all over the place. Data is now considered an asset in itself, so the trade in identities will become an even more lucrative market.

The thing is, the identity profiles are created and owned by the Data Miners, and, when social profiles are combined with the credit history, and “other offline data” about that person, (such as call history and device ID, see below), the profiles are considered to provide substantial assurance that the person being presented is indeed who they say they are. Combined with behavioural biometrics, they also provide deep insights into an individual’s personality and lifestyle.

Sunil Madhu, CEO of Socure explains, “Peoples’ social behavior is something that is a part of who they are; a hard to replicate biometric signature. Socure’s Social Biometrics solution focuses on the strength of our social behaviors on different types of social networks as a way to assert the authenticity of a user’s identity online. When Socure’s machine learning algorithms are combined with traditional legacy identity verification software, you have a very formidable set of fraud detection tools.”

Marketers are eager for any information which will enable them to personalise their services, i.e. targeted ads. They really want to get to know their customers, as explained in a White Paper by Janrain, another social identity proofing company:

Marketers can gain a more sophisticated understanding of their consumers by leveraging the profile data that people already maintain on their social networks. Social profile data includes not only basic demographics such as name, age, gender, geography and email address, but also deeper psychographic information such as interests, marital status, political views, hobbies and friends. And because the profile information that users maintain on their social networks is transparent to friends, family and coworkers, it is more likely to be current and accurate than personal data that consumers may supply during a traditional registration process.

Trulioo is another company which aggregates social data from the Internet; it then runs proprietary algorithms which can spot ‘fake IDs’, such as those created on Facebook. Developers are advised:

TruVerify is installed on your website as a widget that enables global identity verification with as little as a single click supporting 9 different social networks and email providers. Once the user authenticates to their preferred provider, you send our API the profile information you would like verified, and we will return match results with a related confidence score in real-time. The verification process does not rely on information that a user has claimed in any specific social network profile. Instead it draws conclusions about the user’s identity based on their interactions on the Internet across time utilizing many sources to correlate identity information. 

Higher levels of activity result in a higher score and are used to determine the level of social embededness or degree of digital life presence. This in turn is used to determine the confidence level on the consumers’ identity information. 

Depending on customer requirements, these responses may be supplemented with historical and temporal analysis, crowd sourced analytics and correlation against public information sets.

Trulioo is partnered with several companies, including Janrain, Socure, and Verizon, which provides ‘Universal Identity Services’.[3] Trulioo has been boasting that the UK government is planning to use its services, and saying social logins are a good way to “get people on board”.

For a few years now, financial organisations, such as PayPal and Equifax, have been using social profiles as an additional authentication factor when it comes to authorisation. (So it helps that Google and Facebook are insisting people use their real name.)

In other words, even without seeing your birth certificate or passport, the information contained in these profiles is considered to bolster the trustworthiness of data from credit bureaus, cell phones, and criminal records, and allow you to apply for credit online. Financial institutions are already using the services of companies like Janrain, Trulioo, and Socure to decrease the risk of fraud. These companies use “social biometrics”, to screen an online profile to see if it’s a “wet carbon lifeform”, i.e. a real person. The identity proofing companies take in all the data the person has ever entered into any of the social networks, combine it with other “publicly available data”, and analyse it to assess how genuine it is. There are no laws restricting the collection of this data, and it is even more valuable because it is user-generated (not from cookies), and therefore more reliable.

“While the companies can access only public information or what people choose to share, a great deal is readily accessible. Many young people allow the public to see certain parts of their Facebook profiles, as well as accounts on Twitter andLinkedIn (LNKD). Consumers also leave traces of themselves on blog posts, Yelp (YELP) reviews, and online forums. Public data can include photo tags, locale check-ins, and a person’s network of friends. Facebook and LinkedIn provide software tools that let companies automatically import information from profiles on the social networks—with users’ permission—and consumers are allowing this more often, opting for the ease of signing into a website through Facebook, for instance, instead of filling out a separate form. 

Intuit, the largest seller of personal-finance software and a provider of payment systems, has begun using LinkedIn to help verify the identities of users, whose profiles on the site list detailed employment history and often include endorsements and recommendations from colleagues. “There’s definitely enough meat on the bone there,” says Ken Miller, vice president of strategic risk services at Intuit. 

Equifax is teaming up with government agencies, both state and federal, to help detect whether citizens who are receiving benefits are truly eligible. The bureau must verify identity, state of residence, the existence of a criminal record, and income level, things that social media can help check, Roy says.

Even without any credit history, an individual’s social activity online can, over time, be enough to authenticate an identity to Level of Assurance 1. Once a user has begun the process, (e.g. by clicking, “sign in with Facebook”), an identity file is created, and can gradually be built up to become a trusted identity, by adding other layers of authentication, such as passport, driving licence, and biometrics such as fingerprints, or heartbeat patterns.

With all of these layers put together, a fully assured, Level 4 identity has been created, allowing that person to participate in everyday life. After all, you’ll be needing Level 4 more and more as time goes by….

You’re then supposed to carry this identity around with you wherever you go, because you’ll be needing it throughout the day – not just to access government services, or fill out a few forms on the Internet, but to open doors, pay for things, use your smart meter, log in at work, and much more, as time goes by, and trust decreases.

Labelling ‘the trusted ones’ has already begun. Have you noticed some websites are ‘secure’ and have the green address bar?

And you can’t leave comments on YouTube any more unless you sign in to Google.

For years, companies such as Google have traded their wares to marketers looking for that holy grail of advertising: an in-depth view of each individual customer, to be targeted with personalised ads. This they achieve by tracking their customers across the Internet, and in their phone and credit card transactions, in order to generate identity profiles of them. The profiles contain sets of ‘attributes’ which make up the digital identity. Marketing has gone beyond demographics, to dig deeper into who we are and reveal our ‘psychographics’. Our religious and political beliefs, our friends, our routines, our professed selves.

Are we really supposed to believe these profiles are not used by the NSA?

The NSA raised its efforts to control identity/access after the WikiLeaks saga and put together the Insider Threat Program – the message is, ‘trust no-one’, and always report them! The military sets the standards, and society must follow. Everyone is considered to be a potential threat. It’s all about “Information Assurance”.

Identity is also to be tied to the device we are using – this is part of achieving high authentication, and is to be controlled by the Trusted Computing Module (TCM), installed in billions of devices already. The TCM works with Windows 8 (which the German government was warned about), and has been approved by the NSA. Windows 7 can be used until the year 2020. The NSA also works with NIST (which is bringing in the NSTIC) to develop encryption standards.

All points are to be covered.

There are a great many sensors all around us which could be used to provide information to augment what is already known. Certainly, the trend will always be to increase security, as this is the start of a never-ending race to beat the identity thieves. The more that is known about a person, the less risk there is to the corporatocracy. Phones themselves have an incredible array of sensors,[4] even without biometrics.

Earlier this year, The Guardian reported on Raytheon’s RIOT system; they feature a video of a specialist at Raytheon showing how individuals could be tracked through their digital footprints, combined with transaction data.

However, the demo of RIOT, and even metadata analysis by the NSA, utterly pales in comparison to what marketers are already doing – with the information provided by the Data Controllers. By examining our every move, in real-time, highly revealing personality and lifestyle profiles are being stored and analysed all the time.

So if you’ve been riled by the idea of being tracked and scrutinized by intelligence personnel, you’re certain to reject enrolment in the Worldwide Federated Identity Ecosystem they are now proposing.

In fact, this is a truly marvellous opportunity for non-compliance, since the system is said to be voluntary. Living in the matrix makes our identities more vulnerable than they have ever been, to hackers and governments and the NSA, and programmers who work for them, creating a one-way mirror for surveillance and behaviour control. Forget their promise of privacy, because there will always be mistakes, hacktivists, and, worst of all, the quantum computer belonging to Google and Lockheed Martin.

Anyhow, the NSA, in its effort to predict crime, is already able to crack any encryption the Identity Providers provide, since they are all in cahoots:

The program used by the NSA that carves out its own “back door” in online encryptions, code-named Bullrun, “deployed custom-built, superfast computers to break codes.” But, the agency didn’t accomplish this on its own. 

According to the leaked document, courtesy of Snowden, The NSA worked with technology companies in the US and around the world to create entry points into their products. Some companies claim they were coerced by the government to build a back door for them or hand over their “master encryption keys.” 

The document, however, does not reveal specific company names. 

The NSA says its ability to crack encryptions is vital to its mission. The agency’s efforts are still governed by laws that forbid it from deliberately targeting Americans without a warrant, but if nothing else, the document on “Bullrun” reveals that privacy protections cannot necessarily deter the intelligence community from not only collecting data, but reading the information it collects.

Notes:

[1] Smart-rings and bracelets are now being trialled in an NSTIC pilot http://getmindsmart.com/NSTIC_UPDATES_LINKS.html by Exponent, HID Global, and others, with money awarded by the US government.

[2] Dan Blum noted, “Other than allowing one to choose or remove applications one by one, Facebook provides no granularity over how one’s data is handled. If, next to “Use apps, plugins, games and websites on Facebook and elsewhere?” one click’s on “Edit” there is only the draconian option to “Turn off Platform” and the stern warning…. You will not be able to log into websites or applications using Facebook; Your friends won’t be ale to interact and share with you using apps and websites; Instant personalisation will also be turned off; Apps you’ve previously installed may still have info you shared; Please contact these apps for details on removing this data.”

[3] Verizon is one of the IDPs chosen by the UK government. However, as reported by The Guardian, Verizon passed customer call records to the NSA, containing, “the phone number of every caller and recipient; the unique serial number of the phones involved; the time and duration of each phone call; and potentially the location of each of the participants when the call happened.” http://www.theguardian.com/world/2013/jun/06/phone-call-metadata-information-authorities

[4] See ‘A Survey of Mobile Phone Sensing’, by Lane, et al., 2010)
http://www.academia.edu/646416/A_survey_of_mobile_phone_sensing

Source: Activist Post