The US Asks Private Companies to Hack Back - DTNS 5331

[music] >> This is the Daily Tech News for Thursday, August 13th. Thursday the 13th, 1 2 26. We tell you what you need to know, give you important context, and help each other understand. >> Today, the US changes policies to let private companies help fight transnational crime syndicates. >> I'm Tom Merritt. >> I'm When Tway Dao. >> Let's start with what you need to know with that big story. Yeah, so the president of the United States signed a memo Wednesday ordering the Department of Homeland Security's new National Coordination Center in coordination with the Department of Justice to create a program that would use private companies in operations against transnational criminal organizations. So, this is at least in the memo, very narrow. Uh at the direction of this NCC, private companies would be allowed to help fight criminal organizations that cross international boundaries. Specifically, the program is trying to go after ransomware attacks, phishing campaigns, financial fraud, sex torsion schemes, impersonation scams, all the stuff that you hear about in the technology security news. The program would enable the government to use the talent and resources of private organizations to conduct such operations. Previously, that has exclusively been operated by government or military personnel. Uh companies would be encouraged to gather threat information and share it. Also, propose operations against the threats, although they're not supposed to do them themselves, just propose them. Uh that would include, though, the ability to, at the direction of this uh coordination center, plant spyware, uh as well as disrupt criminal data and systems. Uh it is illegal to conduct these kinds of operations as a private company independently without a court order. Uh the law says you can only defend yourself. You can't hack back. This would not allow private companies to hack back on their own, but it would allow the government to bring private companies in and use their talent. Uh some people were comparing it to a 19th century letter of mark, uh which is was given to private ships to allow them to attack pirates. Uh which makes it very romantic, I suppose. >> [laughter] >> A fact sheet issued about the program said the program will include, and I'll quote, "Rigorous procedures for the review and conduct of these limited cyber operations at the direction of the US government, ensuring strict compliance with the US Constitution and laws, as well as applicable international agreements. It also requires companies to immediately stop any operations if they find their activity exceeding limits or unintended targeting of US citizens or US-based systems." Uh this is the big concern of of opponents of this is when you start hacking the bad guys, sometimes you accidentally hack the good guys. Uh and this says, "Well, if the if that happens to US people, you got to stop immediately." Participating companies must maintain a bond of escrow worth at least a $1 million, and if they are found to violate any of these contractual agreements, any of these guidelines that say you can't do this and you can't do that, then they'd forfeit the $1 million. Um When I uh the This is the kind of thing that is fraught with people, you know, picking a side based on who they like. Uh and a lot of it will depend on, "Okay, it says this. Do we hew to that?" But what do you think about the words? What do you think about the way it was actually said? >> Um [sighs] I I I think I felt I felt Yeah, I This is This is I think this is especially someone who works technology. I'm trying very hard to kind of narrow and be as objective as humanly possible uh a human being with thoughts and feelings and opinions about this just because this is a lot. I do like that the yeah, you emphasize of course it is very narrow. It's transnational criminal organizations. So, I suppose that yes, the scope being narrow is a good thing. Uh all the things that you mentioned, the specific crimes and criminal activities are all like I think we can unabashedly say very, very bad things that do target, you know, regular ordinary people. This This is not It It doesn't feel like, you know, a kind of government v. government. Espionage thing, it feels like these are things that very, very deeply harm like real people. So, that's a good thing. I The rest of it It's It's really difficult. It feels like there is This feels like one of the things where we have an idea. Let's Let's say off the top that nominally it's a good idea. Like a like a like like a fine idea to use private resources in in in it especially with these kind of more transnational nature of this that it's a good idea. We're just going to call it a good idea. I think it is as you said, it is just There I feel like the Again, it's a memo. So, there's not like like egregious detail about this. So, we we can only speculate so far. I think that is the thing though is that what are the specifics of this? Um and words like encouraged don't make me feel as someone who's in technology feel very good. That feels like a very like a lot of the language feels a bit loose. Uh and again, it's a memo. It's going to be loose. But, I'm a little nervous. I'm I'm I I feel like I don't think it's a bad idea off the top necessarily. >> I think I get what you're saying. >> But, I do feel like I feel I I I It's always about the details uh about number one, like how we flesh out some of this wording to be very specific about what does encourage mean? I know you said that counter counter hacking is legal, but then I mean for me I'm and I'm not a security person, how does what's the crossover with that with planting spyware as, you know, gathering information? That feels also like may- may- and then >> Counter-hacking is illegal right now for private company. This memorandum makes it legal in these narrow cases. It says, "Yes, if the Department of Homeland Security's NCC tells you to Yes, we like your idea of planting spyware on the ransomware people's system, then you can do it." It does not make it legal for a company to be like, "We got attacked by a ransomware, and so we went and planted spyware on them without approval, right?" It has to go through the channels. >> All right. And I never feel great about I I And again, this is one of the things where it feels like they have to say the thing to make it known that they're aware of the thing. But the idea the just the wording of how that if they exceed limits and if they un- unintentionally target US citizens or US-based systems, then they have to immediately stop. I never like this kind of wording where it feels reactionary rather than more preventative. Again, it's just wording and certainly >> Well, what Are you sure there's not wording somewhere that says you're not allowed to target US citizens? If you find you have targeted US citizens, you have Like I don't know how you would write that otherwise, right? >> Yeah, absolutely. Absolutely. So that's that that's I think what things like this make me nervous about is that I think that there is an abstract that I think we can all picture in our minds, and I I don't mean this like even a flippant way. Like there there is a loophole here, but that using human words, and especially human processes and human like human governmental and legal institutions to enact those those words that are maybe not particularly adept at at least at this point at kind of describing this very particular and very complicated and very nuanced thing that we're trying to do is. And that's what makes me nervous. I >> [gasps] >> I think I think if you really wanted me to be objective and neutral, I'd be like, "Okay, but I need to hear more." It's It's Yeah. >> There There's a whole fact sheet out there that that, you know, I didn't quote all of it. So, that there's more out there and obviously there will be guidelines and things drawn up. And those should be made public. Yeah, it's so that so that we can see what the what the guardrails are. In the end, this kind of thing really comes down to do you trust the agencies involved to to follow those guidelines? Because I look at this and I and I say everything that I'm seeing and hearing makes sense to me in the in the in the light of we would like to take advantage of the talent and ideas of people who aren't involved in the government to better fight these things that we all agree should be fought, ransomware, sex exploitation, all of that, right? Um where it starts to break down is in two areas. One is, if you're someone who's like, "Yeah, but I don't believe that's what they mean." Well, then nothing they ever do will will will will matter. So, at that point it's like, "Well, we can't have a discussion anymore cuz if you just don't trust anything that ever happens, then we're we're not we're not going to be able to look at anything they do that way." If you're like, "Okay, well, let's look at this and realize it will outlast the current administration and this is a policy that is now set, you know, and if it is adhered to, how do you feel about it?" That's where we get into the second objection, which is the reason this has never been done. The reason this is not currently done by most governments is they want to put a very high barrier against private companies going beyond those boundaries or getting in the habit of going beyond those boundaries even though they're not supposed to. And a lot of concern about friendly fire, so to speak. That we should be very circumspect in how we combat the bad guys because those systems are so intertwined. You are going to affect private companies who you didn't mean to affect. You're going to affect private citizens in other countries who you didn't mean to affect. And so those are some of the more legitimate objections I've seen which is like yeah, the reason we don't do this is it tends to creep beyond the boundaries. It's hard to contain that kind of behavior. >> Mhm. I think that framing it that way is more interesting in that okay, let's let's decide on some rules now or let's talk about what this could look like. And then set a precedent for from this administration going forward. I I do for some reason I can't explain exactly. I do I do like the like the discussion and understanding and setting a bar is are important things to do. Because these kind of crimes and this meth this modality of attack is not going away for sure even though it feels relatively new right compared to and like when you were just speaking it made me think of like conventional warfare. Like the like everything you just said is very true of conventional warfare warfare like very deeply unfortunately. And so I feel like well if we're going to enter like we are already in this phase of the world but if like let's be explicit. Let's let's like discuss and let's put up boundaries for you know, in this new world where these things happen and where you know, like the cyber element is a modality that can be used to fight these kinds of crimes especially on a transnational level. Okay, let's talk about it. And I think that's very fair. >> And when you bring up the the parallel to to conventional warfare, another reason you often don't see private companies fighting alongside the military in a conventional sense, you know, they they'll make products for them which which already happens in the cyber area as well. But the reason you don't do that is now you are subject to penalization as a non-uniformed combatant, which is which means, you know, you start to have restrictions on where you can travel and and countries might arrest you for things that you have done in the theater of war and that could happen here, too. If you're just somebody working at a company and that company is involved in this, that could be enough for you to be traveling and like, oh, well, you work for this company and they are accused of war crimes against our country, Myanmar, Russia, whatever and so we are going to detain you. Like there's worries about those kinds of risks as well. These are these are not the kind of risk that you can't mitigate against, that you can't create systems against, but you need to, you know, if you're going to do this sort of thing and it's going to be very controversial, especially with allies of the United States. Like, well, wait, we all agreed we would never do this and you just went and did it. So, let's let's talk about that. I like the idea, though. If there's [snorts] a lot of ifs. If you can make it work in a responsible way, uh bringing some of the white hat minds uh to bear against this problem would go a long way to reducing the kind of fraud and crime that is preying on all of us right now. And I say all of us, it's not them, it's us. You you are assaulted every day and good for you that you haven't been made a victim yet. Percentage chances are eventually every single one of us will become a victim because these systems are improving at such a rapid pace uh and all of us have a weak moment where where our guard is down and you know, so it's just a just a matter of time unless we can reduce the number of chances that you are exposed to and this is an attempt to do that. >> I don't mind that framing at all. Okay, let's talk about it. >> Yeah, yeah. >> [laughter] >> All right, well, one thing we don't have to talk about is how grateful we are to you, the listener, because DTNS is made by you. So, let's take a little bit of time to thank Tyler Glaze, Ken Hayes, What the If, and Paul Boyer. >> All right, there's more we need to know today. Let's get to the briefs. >> All right, it's going to be one tough one into another cuz we're talking about Flock cameras right now, which are most well known for being used to track license plates of cars that have and they have been criticized for having insufficient protections against misuse by law enforcement and governments. Flock also sells drones, audio detection systems, and mobile trailers. Flock announced it will implement new policies on its systems, and these include reducing default settings for data retention from 30 days down to seven, requiring a case code to be entered to justify a search of data, letting customers restrict which types of offenses can justify a search, and implementing a mandatory audit log that can block users when it detects abnormal search patterns. >> Uh great. Wish you would have done this earlier is all I can say. [laughter] I doubt these are the only things that need to be done, but we've had stories that we've talked about on DTNS about like, well, if there had been an audit log, then you would have noticed this. And I really like that it's a mandatory audit log that will auto block and then put it up for review versus like, well, if someone looks at the audit log, I guess they'll figure it out. So, great. Probably need more, but good start. >> Yeah, and this is maybe again, maybe more of a a smaller scale, more like palatable version of what I was kind of feeling earlier with the previous story is that a lot of this is reactionary. And I think my opinion of tech companies is that they tend to be very reactionary like especially especially with these kinds of let's say backlashes or not back even backlashes, but these kind of like pitfalls of their technology. They they tend to just kind of like, can we do this thing? Let's do this thing. Oh shoot, there's a bunch of bad things about doing this thing. Let's pull it back a little bit. And even like things that are like nominally like innocuous like AirTags, right? So, I I agree. I think these there's nothing I have no complaints about any of these restrictions in the new policies. It is again that more reactionary thing. And what they're I mean and and that's even like in the microcosm of abnormal search patterns. You don't really know what a normal normal search pattern is until you have examples of what the behaviors that they're trying to like remove is. I mean like for the most part. So, that is my worry again is that these are great. This is a good idea. Usually, you kind of want to think about these things first. And you can argue that again, you really don't know how people are going to use things until they put their hands on it, but if we can speculate on future technologies, I think we can speculate a little harder on how people might use them for bad things and try to like preemptively put stuff in. >> And municipalities were starting to back out of contracts, cancel contracts because of public pressure. Uh that is the kind of thing that pressures flock to put these in place. Uh so, that is a thing for you to know. >> Yes, just Yes, just know that it works. >> Uh Twitch now offers its streamers a way to opt out of their streams, VODs, clips, stream chats, and pictures and text on your channel to be used in a future training of a model developed by Amazon whose purpose would be to generate or synthesize text, audio, images, or video. Uh in short, you can now opt out of your content being used to train Amazon's models. To opt out, you got to find the setting. It is on your channel, not in your creator dashboard at twitch.tv/settings/security. Uh it's a little fuzzy whether Amazon has been training on your data up until now. Uh there was a a uh a quote in the Ars Technica article from 2 years ago that implied that maybe they've been training on your data for at least the past 2 years, uh but you can opt out now. So, >> [laughter] >> sensing a theme in today's story, which is well, wish you might have done that earlier, but okay, great. >> All right. Well, the Wall Street Journal says people familiar with the matter say Apple has been discussing deals with publishers to make current news stories available for its Siri voice assistant. The sources say Apple has proposed payments based on how much their content is used. Apple already pays publishers to train on content. This would basically be letting share share share shitty shittiest [laughter] >> That's Sean Connery's way >> That's a Sean Connery. I turn into Sean Connery so much when I read specific uh tech company names. Uh this would be this would let Siri AI access fresh news stories to answer queries. >> Yeah, I think this is really interesting because if you just read the headline, you might think like, oh, Apple's finally paying. Well, no, Apple's been paying. They they pay for inclusion in News+ they pay for uh inclusion for training. This is not for training. Like you said, this is we want Siri to be able to just look at your most recent stories and immediately go like, oh yeah, there's a story from Wall Street Journal. Here it is. Uh and they're they're paying for that. So, that will make Siri AI that much more usable and is good for publications in journalism. >> Absolutely. >> Yeah. All right, really quickly, since when also host Android faithful, I thought we'd get a quick check-in on what uh you when thought of the announcements, especially cuz we had not seen the live stream yet. Uh when we reported all the news yesterday, it came out of NDA early, uh but the live stream was after we recorded. So, what what did you think? >> It was fine. Uh I know everyone wanted to think wanted to was curious about what who the host was and how they would do compared to Jimmy Fallon. Um Trevor Noah was fine. He was very Trevor Noah. And it it was good. I I think it it's really hard to get a super excited. I I I telling a friend Actually, I was talking to Dr. Nikki yesterday about this cuz she was asking me about the phones. Um I said, you know, the phones are solid. I think the Pixel line's great. All of the little improvements are are good. The colors are amazing. And um there are significant improvements. Yes, the big thing is that because of RAMageddon, less RAM, more price. So, that is kind of like the big, I think, negative here. They did They were very We were We've been talking about the little LED highlight thing for months now in Android faithful. It's to let you know specifically a a specific contact is calling. You can set colors for different contacts and you can And that's cool. Um and I think that's actually my reaction. Cool. Like, if you're in the market for a new phone, uh strongly consider Pixel. Like like like literally right now, if you're in the market for a new phone, Pixel is a really solid option. They've got great colors. Uh everything is like kind of, you know, just getting a little like that much better and better. Um but that's it. Just cool. >> Yeah. And it is the newest phone of the major flagships at this point. Yeah. So, slightly newer than the Samsung phones by a month. >> That's absolutely. [clears throat] Um I mean, I I I did I pre-order a Pixel Fold because I'm a foldable girl, so I want to compare it with the Samsung because that's kind of like where in my mind uh we're going. So, but um yeah, cool. >> Yeah. Well, I like it. Uh that that that is the the a succinct and informative review [laughter] in my opinion. >> All right. Well, would you want a fun and informative listen about the intersection of science and technology? Well, guess what? You can spill the technical tea with me, Wendy O Dow, and Dr. Nikki wherever you get your podcasts. >> Let's get to those quick headlines that make you look smart. >> All right. Well, Microsoft is merging its Copilot and Microsoft 365 Copilot apps into one. What's the difference? Doesn't matter anymore. You can >> [laughter] >> sign into Copilot with a personal, school, or work account. >> Yeah, one of them was work and one of them was personal consumer, but yeah, thank you Microsoft for simplifying. >> Simplifying it, yeah. >> [laughter and clears throat] >> Uh Lenovo reported its revenue rose 43% year-over-year. Uh the majority of the boost coming from its infrastructure solutions group. Uh you could guess that's the part that sells servers and networking and storage nodes to data centers. So >> Gasp and shock. >> [laughter] >> Well, WhatsApp is rolling out scam alert in limited beta, which uses a local machine learning model to warn users if they appear to be targeted by a scammer. >> Machine learning I like hearing that uh the and local. I like hearing that. So, yeah. These are These are both good. >> Meta reported that it has deactivated around 756,000 Australian accounts as a result of the law that prevents younger people than 16 having them. 462,000 were removed from Instagram and 294,000 from Facebook. >> Well, Meta has donated 15,000 Ray-Ban Meta glasses to Vision Ireland, a charity that aids people who have lost their sight. Meta estimates it should be enough for a free pair for each person Vision Ireland supports. >> Yeah. Uh and if you're in Ireland and uh curious about applying for these, you just call them up or go to their website. Um I mean, I know I know why Meta is doing this. >> We know, but >> exactly why. But it's still a good thing, right? >> is good thing. >> Yeah. Uh review If If anyone's like, "Wait, why? Why are they doing it?" So that people go like, "Oh, it's not all harassers. Yeah, it's also blind people that need this." Uh reviews are out for the DJI Mic microphone Mini 2S has improved noise reduction and range, but the big thing that people are excited about is local recording. 32-bit float internal recording uh available in almost all the markets, not in the United States, uh but it starts at $149 Canadian, £79 UK, or €99. >> Well, Counterpoint Research estimates that China's YMTC has become the third biggest provider of NAND storage with 14% of the market behind SK Hynix and Samsung. YMTC pushed past Japan's Kioxia into third despite being on the US entity list, which restricts its access to parts and equipment. >> Just imagine how they'd be doing if they weren't restricted, I guess. [laughter] >> Seriously. >> Uh meanwhile, chipmaker CXMT uh has passed Tencent to become China's most valuable company with a market cap of $524 billion. CXMT is the world's fourth largest producer of DRAM. Not sure that these restrictions are having as much of an effect as maybe they were intended to have. >> All right. Well, the Financial Times reports that China's fastest-growing job sector is food delivery and ride ride-hailing drivers with the category gaining 10 million people in the past 2 years to reach more than 53 million as of the end of last year. >> Yeah, this this story is is broader than just those numbers, too, if you want to go take a look at it on on ft.com. Uh basically, no country is exempt from the uh their tech companies are making more money than ever because of data centers and the jobs are in the gig world and people are having a hard time finding jobs. It's it's uh it's happening in China as well. Anthropic is in talks to purchase a company called Descartes, d e c a r t. So, not Cogito Ergo Sum Descartes. This is a different Descartes. This Descartes makes software that can help chips work more efficiently and reduce the cost of training and operating models, which will bring down the cost of a data center and operating a data center and maybe eventually bring down the cost of RAM for the rest of us. >> One can only hope. All right. Well, in case you missed it on Sunday, Mark Gurman speculated that because of the US holiday on September 7th, Apple might do its big iPhone announcement on Wednesday, September 9th. Gurman also said on X that everyone at Apple calls the new foldable the iPhone Ultra. To my sadness, that is not the iFoldable. >> I mean, maybe that's just the code name and it won't be foldable. [laughter] >> The code name that just sounds like a regular old brand bottle name. >> That would be very Apple, I guess. I don't know. Uh finally, Love and Deep Space is an Otome, a narrative romance game that lets you meet space boyfriends. I mean, Otomes do all kinds of things, but Love and Deep Space specifically let you meet space boyfriends and date them. Uh it had never brought in less than $30 million since launch until July when revenue fell to $10 million according to Sensor Tower. Why? The answer is incredibly complicated, but here's the short version. On June 22nd, the game introduced the sixth love interest, a werewolf called Valco, and a backlash happened for a lot of different reasons. In fact, The Next Web did the lord's work breaking down all those reasons. Uh and the character was deleted on June 30th, and now there's a backlash against the backlash saying we on the app until they bring Valco back. >> Um I will I will I will very proudly say I am an Otome fan. I don't actively play a lot anymore, but I I have been like it in periods of my life a big Otome fan. So, may I say I understand some of the reason for the backlash, but also not cool, you not cool, y'all. Um just just like so- some of the backlash like I mean, it's it's always it's always interesting especially with these kind of games about like it's not just a game, it's like marketing and and story writing and and and and character creation all those kind of things. A lot of work goes into it. Yeah, sometimes they misfire, but oh man, that's a big backlash, y'all, like two like like down two thirds. That's insane. >> $20 million yeah. >> I I would I I suppose I if you wanted to classify me, I would be on the backlash to the backlash side as like, "Uh y'all, this >> So, I have a little bit of a conspiracy theory that would probably take two setting up too much background >> Mhm. >> uh to really detail, >> Mhm. >> but >> [clears throat] >> the initial backlash included being mad about the file name having a number that related to an atrocity. >> I did not read that part. Okay, I'm I need to >> And that was it's not the only part of that backlash, but that part really reeks of online social media bot-led campaigns to get people mad about something. >> that's Okay. >> There was a backlash in Korea against Starbucks for calling something tank day that also felt like it was a legitimate beef, but it was whipped up online to be bigger. And the fact that the short 8-day backlash that got rid of Velco >> Mhm. >> is resulting in a $20 backlash from actual users makes me wonder if maybe that first 8-day backlash was some kind of tit for tat social media campaign. >> I honestly, I will put my foil hat on for that because it was very odd to me. Um and I I don't play Love and Deep Space. So, and I and every community's different, but I did find that a little odd. >> Yeah. >> Um I find the reasons that were cited like, "Okay, that's a fair reason." >> Yeah, there's some there's some very understandable reasons in the game. >> But yeah, >> Yeah, that it is very surprising. I mean, these things kind of happen all the time in otome, especially very long-lived ones like that I that I know. I have Let me think. Uh Sendai era Sendai era Japanese boyfriends uh that's that's like the warring states period. >> Uh-huh. >> And uh vampire boyfriends. Just outed myself. So, there you go. I I understand, but I I will put my tinfoil hat on uh for the for that because that is very strange. >> Yeah, and you can get fandoms whipped up pretty easy if you push the right buttons. [laughter] >> It's not hard. On that bombshell, we end every episode of DTNS with some shared perspective. Today, Med adds another concern to components in military drones that ping that they are online. >> Yeah, thank you Med for writing this in the Discord. Um we were talking about the Royal Marines drones that were found to be sending data and we were talking about like, well, they weren't sending personal data, but the data they were sending could be damaging. Um Med wrote some observations on the Royal Marines drones sending any data to China. All of your points were correct, but there's one angle missing. Some damage is already done. If those radio signals hit more than one tower, then China and potentially its allies can ascertain British military training grounds through triangulation. Uh so, it being able to tell like, oh, it was this this area, this area, this area. Uh and that's no small breach. Uh their allies are at war with ours. Med writes ours as allies. I I believe he means the UK. Uh and Russia have struck at NATO training sites both indirectly and directly. Um so, yeah, I didn't even think about the triangulation aspect of being able to kind of figure out location of where stuff is going on. A lot of that stuff's public, but not all of it is. Uh and that that could reveal some stuff that isn't supposed to be. >> Mhm. All right. Well, if you have any uh sharp insight like that into a story or you want to pontificate on either the less fun stories or you want to tell us whether you have a Sendai Warlord era boyfriend or a war boyfriend or space boyfriend, you can tell us. We'd love to hear. feedback@dailynewsshow.com >> Thanks to Med for contributing to today's show. Thank you for being along for Daily Tech News Show. You're the folks that keep us in business, whether it's just listening to an ad or supporting us directly, which helps us even more. patreon.com/dtns [music] >> The DTNS family of podcasts helping each other understand. >> Diamond Club hopes you have enjoyed this program. >> [laughter]