Subject: FBI warns of cybercriminals using fake FBI crime reporting portals
Source: BleepingComputer
https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-fbi-crime-complaint-portals-used-for-cybercrime/
The FBI warned today that cybercriminals are impersonating its Internet Crime Complaint Center (IC3) website in what the law enforcement agency described as “possible malicious activity.”
Although it didn’t share any examples and didn’t point to specific attacks, the FBI said that such spoofed websites could be used by attackers in financial scams or to steal the visitors’ personal information.
“Threat actors create spoofed websites often by slightly altering characteristics of legitimate website domains, with the purpose of gathering personally identifiable information entered by a user into the site, including name, home address, phone number, email address, and banking information,” the FBI said.
While the FBI didn’t link to any domains spoofing the Crime Complaint Center website, BleepingComputer has found several examples hosted at icc3[.]live, practicinglawyer[.]net, and ic3a[.]com.
[thus opening themselves up for using non-.gov domain names]
To defend yourself from similar scam attempts, the FBI recommends always entering www.ic3.gov in your web browser’s address bar instead of using a search engine and avoiding clicking on sponsored search results, as they’re often paid by scammers trying to redirect traffic to their own phishing pages from legitimate sites.
…
Filed: https://www.bleepingcomputer.com/news/security/
Subject: USAi tool lets agencies test for AI biases, GSA official says
Source: FedScoop
https://fedscoop.com/usai-artificial-intelligence-tool-bias-general-services-administration-fedtalks-models-ai-testing/
“We allow for head-to-head model comparisons so we are actually capturing the telemetry of models, not only user behaviors within models, but also intertechnology and bias behaviors within models,” Shive said on stage at FedScoop’s annual FedTalks event. “We’re expressing out scoring so the agencies can see the effectiveness of those models.”
GSA launched the USAi.gov site last month, giving federal agencies the ability to test leading AI models before procuring them from the normal federal marketplace. The tool builds upon the GSA’s internal chatbot, GSAi, which rolled out internally in March for agency employees.
The evaluation suite currently offers AI models from OpenAI, Amazon, Anthropic, Google, Meta and Microsoft, but Shive noted GSA is exploring adding a handful of other models in the future.
“Technology, especially software, contains multiple biases. It contains the bias of people who wrote the software … and we humans all have biases,” Shive explained in a sideline interview with FedScoop. “That reflects itself in the software products that are built, that reflects itself in models, as well as what [models are] trained on and how they’re trained. Not just the mechanics — the technology mechanics of how they go about their training — but with data sources they’re trained on.”
Subject: Privacy
Source: Malwarebytes blog
https://www.malwarebytes.com/blog/category/privacy
Some recent items in the MWB blog on Privacy:
Meta ignored child sex abuse in VR, say whistleblowers – Danny Bradbury – September 11, 2025
Ransomware attack at blood center: Org tells users their data’s been stolen – Pieter Arntz – September 10, 2025
Google misled users about their privacy and now owes them $425m, says court – Danny Bradbury – September 9, 2025
- Clear: Overwriting the data with garbage data or, where that’s not available, factory resetting. The drawback is that there are usually inaccessible sections of a disk that the OS can’t write to, which won’t get erased. These occur because of features such as wear-leveling and overprovisioning that give storage devices extra data blocks they rotate in and out of use to extend their useful lifetimes. Data recovery is possible in a lab environment.
- Purge: Using extra techniques such as secure erase that clear all sections of the device, making data recovery difficult, even in a lab environment. Drives can still be reused, however.
- Destroy: Physically damaging the drives beyond repair so that they can never be used again. Methods include drive shredding and incineration. If done properly, not even individual NAND Flash chips can be left intact. This method is the most costly and worst for the environment because the drive (and possibly the device it powered) cannot be reused.l
Source: The Register
https://www.theregister.com/2025/09/14/destroy_data_company_laptops_or_else/
If you dispose of your old corporate laptops without making sure – really sure – that their drives are erased, you could be liable for millions of dollars in fines or legal damages if sensitive data falls into the wrong hands.
Morgan Stanley fined $35m after hard drives sold with customer info still on them.
For example, in 2022, the US Securities and Exchange Commission fined Morgan Stanley Smith Barney (MSSB) $35 million for failing to properly dispose of devices that contained personally identifiable information (PII) after the finance firm hired an unqualified moving and storage company to clear out some datacenters.”According to the contract with MSSB, Moving Company would work with an e-waste management company (“IT Corp A”) to wipe or destroy any data present on the decommissioned devices,” the SEC wrote in a 2022 filing [PDF].”However, at some point during the engagement, Moving Company stopped working with IT Corp A and instead began selling unwiped devices removed from MSSB’s datacenters to another third party (“IT Corp B”).”Because MSSB didn’t properly oversee its vendor, the moving company sold 4,900 different assets, which included unwiped hard drives that contained thousands of instances of PII on them. The Office of the Comptroller of Currency (OCC) fined Morgan Stanley an additional $60 million and the company settled a class action suit for another $60 million [PDF], bringing its total liability to $155 million. Simply offloading the problem to a third-party did not shield MSSB from responsibility.These hard drives came from a datacenter, but they could just as easily have been inside laptops your company is replacing.
Guidelines for data or drive destruction – Any serious data destruction service will follow the NIST 800-88 guidelines Rev. 1 [PDF], first introduced by the US government in 2014. They don’t specify particular tools to use, but advise companies to make data sanitization decisions based on both the security categorization of the data and whether the media is leaving organizational control.
NIST says that there are three main ways to sanitize data:
- Clear: Overwriting the data with garbage data or, where that’s not available, factory resetting. The drawback is that there are usually inaccessible sections of a disk that the OS can’t write to, which won’t get erased. These occur because of features such as wear-leveling and overprovisioning that give storage devices extra data blocks they rotate in and out of use to extend their useful lifetimes. Data recovery is possible in a lab environment.
- Purge: Using extra techniques such as secure erase that clear all sections of the device, making data recovery difficult, even in a lab environment. Drives can still be reused, however.
- Destroy: Physically damaging the drives beyond repair so that they can never be used again. Methods include drive shredding and incineration. If done properly, not even individual NAND Flash chips can be left intact. This method is the most costly and worst for the environment because the drive (and possibly the device it powered) cannot be reused….
More about
Source: Gizmodo
https://gizmodo.com/spotify-would-prefer-you-didnt-sell-your-own-data-for-profit-2000658606
Spotify has never been shy about the fact that the massive amount of user data it collects is a major part of its secret sauce, from its user-specific Discover Weekly playlist to the annual event that is Spotify Wrapped. But the company, which does everything it can to lock people into long listening sessions and sells ads based on user data, would really prefer it if you didn’t bottle up that sauce and resell it for your own profit. According to a report from Ars Technica, a set of users did just that to make a little profit, much to the company’s chagrin.
More than 18,000 Spotify users joined a group called Unwrapped, which set out with the goal of allowing said users to monetize their data by selling it to a third party. They found a buyer on Vana, a startup platform that allows people to sell data to firms building AI models. The idea is that users can get some cash directly by selling sources of data that are largely untapped, including things like private messages from Twitter, Reddit, and Telegram—and, in this case, listening history data from Spotify.
…
Spotify also thinks selling your user data is bad, but for totally different reasons. According to Ars, the company told the developers in charge of the Unwrapped project that they were violating Spotfiy’s developer policy, which prohibits the use of Spotify content for machine learning or AI models. “Spotify honors our users’ privacy rights, including the right of portability,” Spotify’s spokesperson told the publication. “All of our users can receive a copy of their personal data to use as they see fit. That said, UnwrappedData.org is in violation of our Developer Terms, which prohibit the collection, aggregation, and sale of Spotify user data to third parties.”
…
Tagged:
Subject: Exclusive: US warns hidden radios may be embedded in solar-powered highway infrastructure
Source: Reuters
https://www.reuters.com/legal/government/us-warns-hidden-radios-may-be-embedded-solar-powered-highway-infrastructure-2025-09-10/
US officials voice concern about foreign technology in transportation infrastructure
- Advisory says undocumented radios were found in foreign-made inverters and batteries
- Advisory comes amid escalating US warnings about Chinese technology
WASHINGTON, Sept 10 (Reuters) – U.S. officials say solar-powered highway infrastructure including chargers, roadside weather stations, and traffic cameras should be scanned for the presence of rogue devices – such as hidden radios – secreted inside batteries and inverters.
Reuters reported in May that American energy officials had become concerned after experts found rogue communication devices in some Chinese inverters and batteries. Later that month, industry group Green Power Denmark said that unexplained electronic components had been found in imported equipment for Denmark’s energy supply network.