The RISKS Digest
Volume 34 Issue 17

Sunday, 14th April 2024

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

96% of US hospital websites share visitor info with Meta, Google, data brokers
Steve Bacher
Corporate Greed Made the Change Healthcare Cyberattack Worse
NYMag
Hackable Intel and Lenovo hardware that went undetected for 5 years won't ever be fixed
ArsTechnica
Thermostats and Complexity
Tom Vab Vleck
“Are We Watching the Internet Die?”
Ed Zitron via Rich Kulawiec
AI chatbots spread falsehoods about the EU elections, report finds
Clothilde Goujard
How I Built an AI-Powered, Self-Running Propaganda Machine for $105
WSJ
Norwescon sci-fi con: Knightscope, AI manuscript deluge, genre in crisis
Douglas Lucas
Hatsune Miku is playing Coachella, but she's not human. Why brands are working with digital avatars
LA Times
AI on Wall Street
NYTimes
Humane AI Pin review: the post-smartphone future isn't here yet
David Pierce
AT&T Data breach affects 73 million or 51-million customers. No, we won't explain.
ArsTechnica
Apple alerts users in 92 nations to mercenary spyware attacks
TechCrunch
Apple will open the iPhone to repair with used parts—but …
The Verge and TechCrunch via Monty Solomon
Texas Surgeon Is Accused of Secretly Denying Liver Transplants
NYTimes
Palo Alto Zero exploit
Cliff Kilby
After the Eclipse, Motorists Observe a Path of Immobility
NYTimes via PGN
Delta eclipse flight from Dallas veered off path of totality
WashPost
Re: The total eclipse shows us how important solar energy is to the U.S.
Douglas Lucas
Re: AI that targets civilians …
Amos Shapir
Re: Texas Will Use Computers to Grade STAAR Tests
Douglas Lucas
Info on RISKS (comp.risks)

96% of US hospital websites share visitor info with Meta, Google, data brokers

Steve Bacher <sebmb1@verizon.net>
Sun, 14 Apr 2024 08:07:35 -0700

[Could have been worse “ last time researchers checked it was 98.6%.]

Hospitals “ despite being places where people implicitly expect to have their personal details kept private “ frequently use tracking technologies on their websites to share user information with Google, Meta, data brokers, and other third parties, according to research published today.


Corporate Greed Made the Change Healthcare Cyberattack Worse (NYMag)

Monty Solomon <monty@roscom.com>
Sun, 14 Apr 2024 10:02:02 -0400

https://nymag.com/intelligencer/article/corporate-greed-made-the-change-healthcare-cyberattack-worse.html


Hackable Intel and Lenovo hardware that went undetected for 5 years won't ever be fixed (ArsTechnica)

Monty Solomon <monty@roscom.com>
Thu, 11 Apr 2024 23:04:07 -0400

https://arstechnica.com/?p=2016577


Thermostats and Complexity

Tom Van Vleck <thvv@multicians.org>
Sun, 14 Apr 2024 09:02:47 -0400

“Computers as tools for humans are so useful exactly because they can’t think and do tedious work like calculations or information storage and retrieval for humans in a deterministic way. It took like nearly 90 years of digital computers to make them powerful enough to run a wasteful algorithm that pretends to think (but doesn’t) and to deliver bullshit non-deterministic results while using absurd amounts of computational and environmental resources.”

https://hachyderm.io/@thomasfuchs/112265521636541465


Ed Zitron: “Are We Watching the Internet Die?”

Rich Kulawiec <rsk@gsp.org>
April 11, 2024 22:21:13 JST

[via Dave Farber]

This is an excellent piece about where we find ourselves:

Are We Watching The Internet Die? https://www.wheresyoured.at/are-we-watching-the-Internet-die/

“We're at the end of a vast, multi-faceted con of Internet users, where ultra-rich technologists tricked their customers into building their companies for free. And while the trade once seemed fair, it's become apparent that these executives see users not as willing participants in some sort of fair exchange, but as veins of data to be exploitatively mined as many times as possible, given nothing in return other than access to a platform that may or may not work properly.”

and

“There are simply too many users, too many websites and too many content providers to manually organize and curate the contents of the Internet, making algorithms necessary for platforms to provide a service. Generative AI is a perfect tool for soullessly churning out content to match a particular set of instructions—such as those that an algorithm follows — and while an algorithm can theoretically be tuned to evaluate content as ‘human,’ so can scaled content be tweaked to make it seem more human.

Things get worse when you realize that the sheer volume of Internet content makes algorithmic recommendations a necessity to sift through an ever-growing pile of crap. Generative AI allows creators to weaponize the algorithms' weaknesses to monetize and popularize low-effort crap, and ultimately, what is a platform to do? Ban anything that uses AI-generated content? Adjust the algorithm to penalize videos without people's faces? How does a platform judge the difference between a popular video and a video that the platform made popular? And if these videos are made by humans and enjoyed by humans, why should it stop them?”


AI chatbots spread falsehoods about the EU elections, report finds (Clothilde Goujard)

Peter Neumann <neumann@csl.sri.com>
Thu, 11 Apr 2024 13:47:13 PDT

Clothilde Goujard, Politico

BRUSSELS—Chatbots produced by Google, Microsoft and OpenAI shared some false information about the European election, two months before hundreds of millions head to cast their ballots, according to an analysis shared exclusively with POLITICO.

While the artificial intelligence tools remained politically neutral, they tended to return incorrect election dates and information about how to cast a ballot, said Democracy Reporting International, a Berlin-based NGO that carried out the research in March. Chatbots also often provided broken or even irrelevant links to YouTube videos or content in Japanese, researchers added.

“We were not surprised to find wrong information about details of the European elections, because chatbots are known to invent facts when providing answers, a phenomenon known as hallucination,” said Michael Meyer-Resende, co-founder and executive director of Democracy Reporting International.

Researchers noted that AI chatbots were dynamic, making the experiment hard to replicate. In a series of a dozen tests with similar questions carried out by POLITICO on Tuesday, the chatbots either declined to respond entirely or else had updated responses with links directing users to the EU institutions' websites.

Meyer-Resende said the experiment was, however, large enough to be representative. It also provided new evidence about the risks of so-called AI hallucinations—which often occur because of insufficient training data, biases and false assumptions—ahead of the European election, which takes place from June 6-9.

The fast emergence of easy-to-use AI tools generating text, audio and video has prompted concerns about a rise in misinformation in a year with crucial elections in the EU, the United States, the United Kingdom and India. The European Commission in March ordered several tech firms including Bing and Google to explain—before April 5—how they were limiting potential risks to elections connected to their generative AI tools under the Digital Services Act.

Researchers asked the same 10 questions in 10 languages—including German, Italian, Polish and Portuguese—from March 11-14 to the four most popular and accessible chatbots: OpenAI's ChatGPT 3.5 and 4, Google's Gemini and Microsoft's Copilot.

ChatGPT's newest paid version performed the best, while Google's Gemini was deemed the least likely to give correct answers at the time of the test.

“Because of the known limitations of all LLMs, we believe a responsible approach for Gemini is to restrict most election-related queries and to direct users to Google Search for the latest and most accurate information,” said Karl Ryan, a Google spokesperson.

He added that Google's Gemini was in the process of rolling out restrictions in March but the restrictions are now in place. “We will continue to quickly address instances in which Gemini isn't responding appropriately.”

“We are continuing to address issues and prepare our tools to perform to our expectations for the 2024 elections,” said Robin Koch, a Microsoft spokesperson. He added that some of the measures included giving users of Microsoft's Copilot election information from authoritative sources and pushing them to check web links.

OpenAI did not reply to a request for comment in time for publication.


How I Built an AI-Powered, Self-Running Propaganda Machine for $105 (WSJ)

Steve Bacher <sebmb1@verizon.net>
Sat, 13 Apr 2024 06:55:29 -0700

The author paid a website developer to create a fully automated, AI-generated ‘pink-slime’ news site, programmed to create false political stories. The results were impressive”and, in an election year, alarming.

https://www.wsj.com/politics/how-i-built-an-ai-powered-self-running-propaganda-machine-for-105-e9888705?st=eryapn7ks9k6807&reflink=desktopwebshare_permal


Norwescon sci-fi con: Knightscope, AI manuscript deluge, genre in crisis

Douglas Lucas <dal@riseup.net>
Sat, 13 Apr 2024 18:52:17 -0700

On Fri. Mar. 29, I attended Norwescon, a large science fiction convention hosted in Seattle since 1978. Three items might be of interest to RISKS. First, the parking lot had a hotel-hired Knightscope self-driving robot that aims to deter crime and records film for later optional viewing by humans. I took video of the Knightscope and described it in detail. Second, I posted my notes from a panel made up of editors from top science fiction and fantasy magazines, some still with print incarnations; they discussed in depth the deluge of unsolicited AI-created fiction manuscripts that they're receiving through their open submissions portals. According to one panelist, the scammers are not the submitters, but separate individuals taking advantage of gullible people, telling them that AI fiction is the path to riches, and when it doesn't work, and only threatens to crash the submissions portal, then selling them expensive tutorials on how to AI better. Third, I ask how the fandom, steeped in stories of sci-fi can-do heros, might overcome apathy and consumerism to do something about these sci-fi-style risks encroaching on the genre from the real world without!

https://douglaslucas.com/blog/2024/04/02/fading-fun-norwescon46-friday-future/


Hatsune Miku is playing Coachella, but she's not human. Why brands are working with digital avatars (LA Times)

Steve Bacher <sebmb1@verizon.net>
Sat, 13 Apr 2024 07:52:11 -0700

Hatsune Miku has already sold out venues for her concerts and she'll go to her biggest stage yet at Coachella. She looks like a teenage girl but she's not human. She's part of a growing number of digital characters, including Miquela and angelbaby, that are creating music for fans. […]

Her music ” mostly synthesizer-heavy dance pop ” is created from software developed by the Sapporo, Japan-based technology company Crypton Future Media.

The technology lets people, including fans, type in lyrics and punch in a melody. The program generates a singing voice for the song. Crypton then licenses the songs from the fans for her to sing at concerts. Miku herself is an illustrated character, resembling a 16-year-old girl from an anime or manga. To “perform” onstage, Miku’s image is displayed on a giant screen as a video behind a live band. <https://www.youtube.com/watch?v=jhl5afLEKdo>

https://www.latimes.com/entertainment-arts/business/story/2024-04-12/coachella-2024-hatsune-miku-zlu-hume-angelbaby


AI on Wall Street (NYTimes)

Steve Bacher <sebmb1@verizon.net>
Thu, 11 Apr 2024 11:47:49 -0700

The Worst Part of a Wall Street Career May Be Coming to an End

Artificial intelligence tools can replace much of Wall Street’s entry-level white-collar work, raising tough questions about the future of finance

https://archive.is/4iLEA


Humane AI Pin review: the post-smartphone future isn't here yet (David Pierce)

Monty Solomon <monty@roscom.com>
Fri, 12 Apr 2024 10:02:28 -0400

The Verge https://www.theverge.com/24126502/humane-ai-pin-review

Humane AI Pin review: not even close For $699 and $24 a month, this wearable computer promises to free you from your smartphone. There’s only one problem: it just doesn’t work.


AT&T Data breach affects 73 million or 51-million customers. No, we won't explain. (ArsTechnica)

Monty Solomon <monty@roscom.com>
Thu, 11 Apr 2024 23:05:56 -0400

https://arstechnica.com/?p=2016342


Apple alerts users in 92 nations to mercenary spyware attacks (TechCrunch)

Monty Solomon <monty@roscom.com>
Fri, 12 Apr 2024 09:52:20 -0400

https://techcrunch.com/2024/04/10/apple-warning-mercenary-spyware-attacks/


Apple will open the iPhone to repair with used parts—but … (The Verge and TechCrunch)

Monty Solomon <monty@roscom.com>
Thu, 11 Apr 2024 23:02:34 -0400

https://www.theverge.com/2024/4/11/24127278/apple-iphone-repair-used-parts

BUT: Apple will allow reuse of iPhone parts for repairs, with a notable catch As a result, “select iPhone models” this fall will allow for reusing biometric sensors and other parts, and anyone ordering parts from Apple can skip sending a device's serial number, so long as the repair doesn't involve a new main logic board. https://arstechnica.com/?p=2016470


Texas Surgeon Is Accused of Secretly Denying Liver Transplants (NYTimes)

Monty Solomon <monty@roscom.com>
Thu, 11 Apr 2024 21:50:52 -0400

https://www.nytimes.com/2024/04/11/us/organ-transplants-houston.html


Palo Alto Zero exploit

Cliff Kilby <cliffjkilby@gmail.com>
Fri, 12 Apr 2024 23:45:56 -0400

Perhaps avoid the use of dynamic scripting languages in what should be a secure context? Or, why does my firewall have python? https://security.paloaltonetworks.com/CVE-2024-3400


After the Eclipse, Motorists Observe a Path of Immobility (NYTimes)

Peter Neumann <neumann@csl.sri.com>
Sun, 14 Apr 2024 11:17:22 PDT

Miles of Taillights on Interstates Last Longer Than the Celestial Phenomenon in the Sky Charlie Smart, short article at the bottom of a full page of six graphics along the path of totality: (1) top half-page showing remarkably frequent major traffic delays from West Texas to Canada; (2) during totality (no delays, Syracuse to Bangor); (3) one hour after totality (building up, Syracuse to Bangor, delays north of Burlington VT)); (4) three hours after (delays all around Burligton), (5) six hours after still quite heavy going south from Burlington), (6) long traffic delays in the Midwesst, at 9pm ET still heavy leaving bigger cities (e.g., St. Louis, Indianapolis, Columbus, Toledo).

[The next major U.S. eclipse is not until 2045. But who will remember this situation in 2045? There could be many lessons for the expected exoduses from major disasters in large cities—spills, toxic train wrecks, although those would typically be local problems. Nevertheless, there are some risks lessons to be learned.


Delta eclipse flight from Dallas veered off path of totality (WashPost)

Monty Solomon <monty@roscom.com>
Fri, 12 Apr 2024 22:44:37 -0400

Delta Air Lines said the eclipse flight had to change its plans because area traffic control would not allow a special maneuver.

https://www.washingtonpost.com/travel/2024/04/12/delta-eclipse-flight-leaves-path-of-totality/


Re: The total eclipse shows us how important solar energy is to the U.S. (RISKS-34.16)

Douglas Lucas <dal@riseup.net>
Sat, 13 Apr 2024 18:40:43 -0700

The Verge article said that, when the total solar eclipse increased demand for electricity in the United States, the shortfall was made up in part by gas. Might be interesting to note that, if this chain of dominoes were followed for anything on Earth, not just the gas “peaker plants,” the energy source is the Sun. Biology, engineering, smartphones, whatever it is, ultimately it's the Sun that pays for everything. All of our rent-seeking economic systems are downstream of the big kahuna in the sky. What's the RISK? Red giant!


Re: AI that targets civilians … (Northrup, RISKS-34.16)

Amos Shapir <amos083@gmail.com>
Fri, 12 Apr 2024 13:21:21 +0300
> Facial recognition should be forbidden from use by law enforcement unless
> and until it is able to be used on white collar criminals

But white collar criminals do not hide their faces; it's the money they stole which should be identified.


Re: Texas Will Use Computers to Grade STAAR Tests (RISKS-34.16)

Douglas Lucas <dal@riseup.net>
Sat, 13 Apr 2024 18:29:41 -0700

Regarding Texas using AI to grade most of the mandatory STAAR tests taken by elementary, middle, and high schoolers: In the past decade and a half, I've more than once flunked the GRE writing test and the IELTS writing test, for admission into graduate school and Canada respectively. I'm pretty sure both were computer-scored, at least initially, but I wasn't enthusiastic enough about either destination to challenge the results much. If I ever have to flunk such a writing test again, I plan to re-take it and, instead of answering the question, type out my bonafides with evidentiary URLs—a summa writing degree; a CELTA cert for teaching ESL; numerous publications and media spots as a professional writer—along with my complaint that, for the life of me, I cannot seem to pass these computer-graded writing tests. Might make an interesting media stunt, if nothing else.

Please report problems with the web pages to the maintainer

x
Top