13 Members Sue Gym Over Ceiling Spycam

MI - Members of a Clinton Township gym have sued the former owner who is accused of spying on members with a hidden camera.

Thirteen members filed the lawsuit in Macomb County Circuit Court earlier this month against Matthew Krakowski, who ran Switch Crossfit gym, alleging he invaded their privacy by filming gym-goers while changing their clothes and possibly using the bathroom in private areas...

Krakowski also faces criminal charges. He initially was charged with one count of surveiling an unclothed person last May after a woman reported seeing a camera in a ceiling tile in April while she changed in a private area. Police sifted through thousands of other images garnered from Krakowski’s computer or devices and found victims to produce 13 more charges. more

Like most of these cases which hit the courts, this camera was found serendipitously, by the victim. 

Businesses involved this way have no defense. In court, the case is viewed as a respondeat superior issue—the business is responsible for the actions of their employees. Defense is costly, as are the financial penalties. 

A proactive due diligence defense costs about $25.00, a price your business cannot afford... to pass up.

No Matter Where You Go, There You Are

Global automakers are feeding real-time location information and dozens of other data points from electric vehicles to Chinese government monitoring centers, potentially adding to China’s rich kit of surveillance tools as President Xi Jinping steps up the use of technology to track Chinese citizens.

Generally, it happens without car owners’ knowledge, The Associated Press found.

More than 200 automakers selling electric vehicles in China — including Tesla, Volkswagen, BMW, Daimler, Ford, General Motors, Nissan, Mitsubishi and U.S.-listed start-up NIO — send at least 61 data points to government-backed monitoring platforms, under rules published in 2016. Automakers say they are merely complying with local laws, which apply only to alternative energy vehicles. more

What's Up With Taps?!?!

A First Step Toward Making Counterespionage Actually Work

Pennsylvania High Court Finds Duty to Safeguard Employee Information

In Dittman et al. v. UPMC, the Pennsylvania Supreme Court ruled that employers have an affirmative legal responsibility to protect the confidential information of their employees. In reversing two lower court decisions, the justices ruled that by collecting and storing employees' personal information as a pre-condition to employment, employers had the legal duty to take reasonable steps to protect that information from a cyber attack. more

It's a small step, but... My cunning plan to really protect sensitive information may be catching on. The plan is explained in these two posts from about five and a half years ago...

A Cunning Plan to Protect Us from Business Espionage - March 21, 2012

Espionage Outrage Reaches the Boiling Point ...and a solution. - April 5, 2012

Dawn of the Vocal Fingerprint

The vast majority of people in developed countries now carry a smartphone everywhere. And while many of us are already well aware of privacy issues associated with smartphones, like their ability to track our movements or even take surreptitious photos, an increasing number of people are starting to worry that their smartphone is actually listening to everything they say.

There might not be much evidence for this but, it turns out, it isn’t far from the truth. Researchers worldwide have begun developing many types of powerful audio analysis AI algorithms that can extract a lot of information about us from sound alone. While this technology is only just beginning to emerge in the real world, these growing capabilities – coupled with its 24/7 presence – could have serious implications for our personal privacy.

Instead of analyzing every word people say, much of the listening AI that has been developed can actually learn a staggering amount of personal information just from the sound of our speech alone. It can determine everything from who you are and where you come from, your current location, your gender and age and what language you’re speaking – all just from the way your voice sounds when you speak.

If that isn’t creepy enough... more

"A Tough Year for the GRU"

Igor Korobov, head of the Russian military intelligence agency GRU, which has been accused of meddling in U.S. elections, has died in Moscow. He was 62.

The Defense Ministry said Thursday in a statement that Korobov, who led the GRU since 2016, died Wednesday of "a lengthy and grave illness," a usual Russian euphemism for cancer. His predecessor had died two years earlier, at 58.

Russian President Vladimir Putin offered condolences to Korobov's family but did not immediately name his successor...

This has been a tough year for the GRU, which has faced a series of exposures that revealed its inner workings. more

Multiple Audio/Video Eavesdropping Devices Found in Boardroom, Office and Records Room

South Africa - Science and technology minister Mmamoloko Kubayi-Ngubane has filed a complaint with the State Security Agency (SSA) after cameras were found in her office, the Sunday Times reports.

Police found multiple cameras which could record both video and sound, and could be accessed remotely.

The cameras were were reportedly placed within the minister’s boardroom, records room, and office.

According to the report, the cameras were discovered when senior managers confronted junior staff about discussions they had with the minister in her office. more

Note: The devices were only discovered when the eavesdroppers let on that they knew more than they should. Dumb on their part. 

Dumber, however, is they were not found sooner with a routine Technical Surveillance Countermeasures (TSCM) sweep, a standard practice at many organizations these days.

Can AI be Trusted with Surveillance Tasks?

China's war on jaywalking went to the next level last spring when AI-based facial recognition systems were integrated into some crosswalks, to punish jaywalkers by squirting them with water, sending them texts warning them about legal consequences of jaywalking, and/or publicly shaming them by displaying their pictures and names on large digital billboards.

Last week, this system entered a new and exciting failure mode when a traffic-cam in the port city of Ningbo captured a face displayed on the side of a passing bus, correctly identified it as belonging to Dong Mingzhu, CEO of Chinese AC giant Gree Electric Appliances, and then plastered Ms Dong's face all over a giant billboard, falsely accusing her of jaywalking. more

This Week in Spycam News

AZ - A Phoenix-based American Airlines flight attendant was sentenced to five years of probation for taking videos of men and boys using public restrooms. more

WA - Ex-South Seattle College director Gene Baker 52 was arrested last Tuesday after a teenage tenant of his told police that he had planted a camera in an alarm clock in her bedroom and that it had captured footage of her in various states of dress. more

Japan - An analysis of 406 patients who visited a sex addiction clinic here for treatment for camera voyeurism showed that they took 1,000 peeping shots on average before seeking medical help, a clinic official reported. more

S. Korea - Police recently busted a website that was used to share pornographic pictures -- including spycam porn -- arresting the suspected owner and booking 86 others without detention. more

UK - A man who took covert video footage of young women in a state of undress has been jailed for six months and placed on the sex offenders register. Jonathan Thomas Watson, 21, from Harrogate, videoed one woman as she was getting changed in a cubicle at Knaresborough Swimming Pool...Watson filmed six other females at a property in Knaresborough using similar covert means. more

FL - Investigators say a Florida teacher confessed to secretly videotaping a high school student as she changed her shirt. more

S. Korea - After a months-long investigation into Yang Jin-ho, the owner of the nation's two biggest file sharing sites, police have confirmed the existence of a million-dollar cartel for the production and distribution of spycam porn videos. Apart from owning WeDisk and Filenori, file sharing platforms where spycam clips and revenge porn were circulated, police found Yang had a hand in virtually every stage of the profitable operation. more

When VPN means Very Poor Network

Roughly 60 percent of the top free mobile VPN apps returned by Google Play Store and Apple Play Store searches are from developers based in China or with Chinese ownership, raising serious concerns about data privacy, a study published today has revealed.

"Our investigation uncovered that over half of the top free VPN apps either had Chinese ownership or were actually based in China, which has aggressively clamped down on VPN services over the past year and maintains an iron grip on the internet within its borders," said Simon Migliano, Head of Research at Metric Labs, a company that runs the Top10VPN portal.

"Furthermore, we found the majority of free VPN apps had little-to-no formal privacy protections and non-existent user support," Migliano said.

The expert says that 86 percent of the apps he analyzed had "unacceptable privacy policies." For example, some apps didn't say if they logged traffic, some apps appeared to use generic privacy policies that didn't even mention the term VPN, while some apps didn't feature a privacy policy at all. On top of this, other apps admitted in their policies to sharing data with third-parties, tracking users, and sending and sharing data with Chinese third-parties. more

Kevin's Spybuster Tip # 724 - Check out Outline.

IT Director Alert - Patch Those Printers... now

Despite copious warnings and efforts by the security community to harden the defenses of printers, they continue to represent a ripe target for attackers.
Just this past summer researchers at Check Point found a vulnerability that allowed an attacker to compromise a multi-function printer with fax capabilities simply by sending a fax.

In July, Positive Technology shared a proof-of-concept attack that shows how attackers can compromise a corporate network via installing a customized Xerox printer firmware on a targeted printer. 

In August, HP Inc. patched hundreds of inkjet models vulnerable to two vulnerable remote code execution flaws (CVE-2018-5924, CVE-2018-5925).

Printers, security researchers say, are the Achilles Heel for network management. They sit on the network like a PC and need regular updating like any other network endpoint – but often don't. more

From the Don't Poop Where You are Going to Eat Files

For a century, Vienna has been the world capital of espionage.

It’s a city of world-class mystery and intrigue, as depicted in countless spy novels and films. Vienna has it all: lovely vistas, great food and wine, affordable prices, and an extraordinarily permissive environment for espionage.

In Austria, you’re free to spy on nearly whomever you want, and there are plenty of targets. Everybody has an embassy in Vienna, plus it’s the second city of the United Nations. When it comes to espionage, the only way to get in trouble in Vienna is by spying on your hosts—and that’s just what the Russians got caught doing. more

Spy Rule #629 - Don't Order Bugs Using Company Email

Eavesdropping charges have been filed against a central Illinois schools administrator who allegedly planned to secretly record a closed session of the school board.

The News-Gazette reports Champaign County State's Attorney Julia Rietz alleged Thursday that Samuel Byndom used a device disguised as a pen to record an Oct. 28 closed session of the school board. The 35-year-old Byndom is Urbana District 116's assistant superintendent of learning and instruction.

Click to enlarge.

Rietz said Urbana police have been investigating Byndom since a school district employee found an email order confirmation on a school district computer for a voice-activated recorder pen from a company called "SpyGuy."

Members of the school board members went forward with the closed session after learning about the recording device order, but searched the room before starting. They found the device and removed it. more

A New EU Spy School... with some possible strings attached.

The defense ministers of 25 EU member countries agreed Monday on a joint EU intelligence school, along with 16 other new projects, as part of their military pact...

The establishment of a joint EU spy school would be a big step forward for the bloc’s intelligence community. Until recently, a significant deepening of intelligence cooperation in the Union was blocked by the U.K., which viewed it as unwelcome competition to the Five Eyes intelligence alliance... With Brexit approaching, London no longer stands in the way.

However, eyebrows will be raised by the proposal to have Greece lead the academy, with help from Cyprus, meaning two of the EU’s members with the closest ties to Moscow would run the project. more

"So, uh, what's your Social Security number, kid?"

It's the cute toy tipped to be a Christmas hit, but there are fears ‘Dino’ the dinosaur may be vulnerable to hackers who could steal information about its young owners.

The ‘smart toy’, which is able to ‘learn’, answer questions and read bedtime stories, is among a series of technology gifts that have failed to win approval from the Mozilla Foundation...said it had been unable to determine if Dino – an internet-connected toy...uses sufficient encryption to guard against hackers.

It was also critical of the complexity of its privacy policy which includes an admission in the small print that, when a child plays with Dino, it automatically collects information about a child’s ‘likes and dislikes, interests, and other educational metrics’. more