Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, and authored by Carola Frediani and Andrea Signorelli.

N.22 - 17 June 2025

“Any attempts to illegally access data of citizens, including journalists and political opponents, is unacceptable, if confirmed,” the European Union’s executive branch said in a statement Wednesday in response to questions from members of parliament. The European Commission “will use all the tools at its disposal to ensure the effective application of EU law.”
That was the message from the European Commission on June 11, 2025, responding to questions from EU Parliament members about Italy’s use of spyware.

“The Commission is aware of the recent reports on the use of Paragon,” said the executive vice-president and responsible for Democracy, Henna Virkkunen, who warned Italy that the new European Media Freedom Regulation (EMFA) will be applicable from August 8, 2025, and “the Commission will use all the tools at its disposal to ensure the effective application of EU law.
The regulation specifically bans authorities from using surveillance tools against journalists, except in rare cases of overriding public interest. Still, critics warn that the “national security” loophole could allow spyware to sneak onto journalists’ devices under the guise of security needs.

The Copasir Report: What We Know

The Commission’s intervention followed days of apparent silence, as if the Paragon case had faded away. But the story, like a persistent virus, keeps resurfacing. On June 4, the Italian parliamentary intelligence oversight committee (Copasir) confirmed that Israeli company Paragon did indeed sell its Graphite spyware to Italy’s intelligence agencies, AISI and AISE, starting in 2023. According to Copasir, the version of Graphite provided did not allow activation of microphones or cameras, but did let operators access encrypted communications on targeted devices.

Copasir wrote in its report: “Since January 2024, Graphite has been used to acquire dynamic data—ongoing communications through encrypted instant messaging systems—on a very limited number of users, always with authorization from the Chief Prosecutor at the Rome Court of Appeal, as well as to extract chat messages stored on targeted devices.”

Mediterranean Activists Targeted

The report also confirmed that Graphite exploited a WhatsApp vulnerability patched by Meta in December 2024, just a month before the spyware’s use became public. Most importantly, Copasir verified that both Luca Casarini and Giuseppe Caccia, leading figures in the NGO Mediterranea Saving Humans, were intercepted using Graphite. David Yambio, spokesperson for Refugees in Libya, was wiretapped by traditional means, while chaplain Don Mattia Ferrari was not directly targeted. These activists are known for their work rescuing migrants at sea.

Italian online news outlet Fanpage summarized Copasir’s findings: “Casarini was targeted in two separate operations, both authorized by then-Prime Minister Giuseppe Conte. The first lasted a few months between 2019 and 2020; the second, broader operation began on May 26, 2020, as a phone tap and ended in May 2024 under the Draghi and Meloni governments. Graphite was authorized for use on September 5, 2024, by Undersecretary Mantovano. Casarini, Caccia, and Yambio were all monitored, but Don Ferrari was not, although a phone registered to him but used by Yambio was tapped without Graphite. Copasir found that all operations were authorized and within legal limits”.

“Francesco Cancellato Was Not Monitored”

As for Fanpage’s editor-in-chief, Francesco Cancellato, Copasir categorically excluded any surveillance by intelligence agencies. The report stated: “Based on the evidence gathered and checks carried out, the Committee found that Cancellato was not subject to any surveillance by Italian intelligence using Paragon spyware. During inspections at AISI, AISE, and the Rome Court of Appeal, Committee members directly queried the Paragon system’s database and audit logs, using the journalist’s phone number, and found no evidence of interception via Graphite.”

Copasir also noted a key detail: “Following the media uproar, on February 14, 2025, Paragon, AISI, and AISE jointly agreed to suspend the use of Graphite on new targets.”

Alerts, Denials, and Contradictions

But before going on, let’s have a quick recap.

Late January: Meta/WhatsApp notifies dozens of European users, including Cancellato and several activists, that they were targeted by Paragon spyware.

Following initial institutional uncertainty, Copasir confirms the Italian intelligence services’ use of Paragon against activists, citing national security and proper procedures.

Copasir insists Graphite was not used against journalists or human rights activists, but only for activities potentially linked to irregular immigration.

Yet, politically, the question remains: is it justifiable to surveil, for years, activists who rescue migrants at sea? The issue seems to attract little attention from Italian politics or media.

Copasir’s report notes that the contract for Graphite prohibits targeting devices or individuals from certain countries and bans use against people based on religion, gender, ethnicity, nationality, or political affiliation. It also forbids targeting journalists or human rights activists. However, Copasir argues that Casarini and Caccia were not surveilled as activists, but for their alleged involvement in irregular immigration.

The Mystery of Cancellato’s Alert

Despite Copasir’s findings, the question remains: why did Cancellato receive a spyware alert from Meta/WhatsApp? Who was behind it? Copasir points out that Citizen Lab’s March 2025 report found no direct forensic evidence of infection on Cancellato’s phone, while confirming infections on Casarini and Caccia’s devices. The only indication of a possible breach was the WhatsApp notification itself, with no clear link to Graphite, says the Committee.

Paragon’s Response and the Breakdown

On June 9, Paragon announced it had terminated all contracts with Italian intelligence after Italy refused to participate in a technical procedure that would have clarified whether Graphite was used against Cancellato. Paragon said it had offered the government a way to determine this, but when authorities declined, it ended its business in Italy, according to Israeli daily Haaretz.

Previously, Paragon told Haaretz it had disconnected its systems from all Italian clients after learning a journalist had been targeted, pending the investigation’s outcome. This decision reportedly caused high-level tensions, with the Italian Prime Minister allegedly contacting Israel’s Benjamin Netanyahu for clarification, according to Haaretz.

Paragon’s statements appeared to contradict Copasir’s version of events.

Italian Agencies Push Back

On June 10, Copasir responded, strongly denying Paragon’s claims and offering to declassify the transcript of Paragon’s representatives’ hearing. The Italian security department (DIS) stated: “There was never any refusal or opposition from the government or intelligence agencies to cooperate. Copasir was able to check system logs, an unprecedented move, confirming the agencies’ statements.”
DIS clarified that Paragon’s proposed checks would have involved either using Paragon’s proprietary software or allowing Paragon staff direct access to Italian intelligence systems—both deemed unacceptable. Instead, Copasir was allowed to conduct its own checks.

The Pellegrino Case and Citizen Lab’s New Report

Meanwhile, in late April, Fanpage journalist Ciro Pellegrino received an Apple alert about government spyware. Pellegrino had his device analyzed by Citizen Lab, which, on June 12, reported with “high-confidence” and forensic evidence that both an unnamed major European journalist and Pellegrino had been targeted with Paragon’s Graphite spyware. Citizen Lab linked both cases to the same Paragon operator.

Citizen Lab also explained that it’s harder to find forensic traces on Android devices, like Cancellato’s, than on iPhones, like Pellegrino’s. The absence of evidence on Cancellato’s phone does not prove it wasn’t compromised—it may simply mean the relevant logs were not captured or were overwritten.

The Fanpage Cluster

Citizen Lab concluded: “Following Mr. Cancellato’s case, the identification of a second journalist at Fanpage.it targeted with Paragon suggests an effort to target this news organization This appears to be a distinct cluster of cases that warrants further scrutiny.”

The Puzzle Remains

To sum up: two journalists from the same outlet received spyware alerts—one from Meta, one from Apple. For one, forensic traces of infection were found; for the other, none, but it could also due to the fact that his Android was harder to analyze. Two major tech companies and an independent lab all say journalists were targeted with spyware. We also know that Italian intelligence was using Graphite, although they strongly deny targeting journalists. Moreover, Copasir’s checks found no evidence for Cancellato in the logs.

Could possibly be a mistake by Meta? And by Apple? And by Citizen Lab? Could possibly be a foreign state spying on Fanpage? The summer’s biggest mystery remains unsolved.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, and authored by Carola Frediani and Andrea Signorelli.

Subscribe now

N.22 - 27 February 2025

Surveillance, Spyware
Paragon: If No One Knows Anything, Start with the Victims

The most disconcerting aspect of the Paragon affair (if you're unfamiliar with it, read our previous newsletter) is not its potential use by Italy, but the apparent inability of everyone—especially politicians and institutions—to provide even basic information.

Weeks after the news of the attack using this government spyware on the phone of journalist Francesco Cancellato and various activists linked to migrant rescue operations in the Mediterranean, the incident and the spyware have become an elusive, almost ineffable entity (literally, as even institutions are threatening lawsuits, as reported by Fanpage, whose editor-in-chief is the same Cancellato).

We still know little about its technical workings (we are waiting for more detailed information from WhatsApp and Citizen Lab). We do know that Aise and Aisi (our foreign and domestic intelligence services, respectively) have admitted to being Paragon clients and to using it, but not against journalists and activists. Specifically, Aise Director Caravelli confirmed the use of Paragon's Graphite spyware, but not for spying on media or activists, according to Domani newspaper. Similar information, filtered through Copasir (the Parliament body that exercises control over the work of the Italian secret services) and reported by the press, was provided by Aisi Director Valensise.

It's also unclear whether Paragon's contracts with Italy have been terminated, as reported by foreign media, and subsequently denied by the Italian government. As summarized by Pagella Politica: "After the espionage was revealed, the government said it had nothing to do with it. According to The Guardian and Haaretz, Paragon Solutions terminated the contract with Italy because the government 'violated the terms and ethical framework,' but Minister Ciriani denied this account, saying the contract with Paragon Solutions is still in force."

Moreover, the Undersecretary of State to the Presidency of the Council of Ministers Alfredo Mantovano said the matter was "classified," yet the Minister of Justice Carlo Nordio discussed it in Parliament—as reported by Il Post—denying that his ministry's structures had contracts with companies like Paragon and stating that, in 2024, no one had been intercepted by the Penitentiary Police. (If you're wondering why this denial, it's because in this grotesque hunt for who used Paragon in Italy, in this mystery akin to "And Then There Were None," the Penitentiary Police were left holding the bag at one point).

So, What Now? Let's Start with the Spyware Targets

One of the targets is Luca Casarini, founder and mission leader of Mediterranea Saving Humans, an NGO that rescues migrants in the Mediterranean. Like others, he was notified on January 31 by a message from Meta/WhatsApp, informing him that he had been the target of a government hacking attack and advising him to contact Citizen Lab, a group of researchers that tracks government spyware, for phone analysis and support.
"The Meta message already suggested getting rid of the phone. Citizen Lab, which is conducting an initial analysis of the device, also recommended the same, as even a factory reset might not be enough," Casarini told Guerre di Rete.

I asked Valerio 'valerino' Lupi, CTO of Mentat and former developer at Hacking Team and Verint about this. He confirmed that, at least for some sophisticated spyware against Android devices, a factory reset may not be enough. Stefano Zanero, a professor of Computer Security and Digital Forensics and Cybercrime at the Politecnico di Milano, agreed, stating: "The reset is still controlled by the software, so it's not inconceivable that a well-made bootkit could survive."

Casarini also shared that Citizen Lab advised him to immediately put the phone in airplane mode, wrap it in aluminum foil, and leave it in a drawer, likely to prevent interference. "If the phone is infected, the best thing to do is remove the battery, if possible," Lupi added. "Or put it somewhere with no signal until the battery is dead."

Journalistic reports on the spyware's deployment against 90 Whatsapp users mentioned the use of PDFs and group chats to deliver the attack. Casarini doesn't recall a specific chat or PDF but he does remember an earlier incident. In February 2024, he received a Facebook alert that his account had been targeted by a government cyberattack and was advised to contact support. He only changed his password at the time, but recalled the incident when Citizen Lab asked about it. "They saw suspicious activity, an infection attempt that was blocked. Perhaps a preliminary activity for subsequent infections," Casarini commented (there’s also a press release from Mediterranea about the episode). Meta's February 2024 report detailed similar activities, including fake profiles on Facebook.

Ukraine, Satellites, USA
Starlink and the negotiations

U.S. negotiators discussing peace terms with Kyiv, particularly regarding access to Ukraine's mineral and natural resources, have reportedly suggested cutting Ukraine's access to the Starlink satellite internet system if no agreement is reached.

According to Reuters, which cited three sources familiar with the negotiations, the possibility of continuing or discontinuing the use of Starlink, owned by SpaceX and Elon Musk, was raised during discussions between U.S. and Ukrainian officials. This came after President Zelensky rejected an initial proposal from U.S. Treasury Secretary Scott Bessent, and again during meetings between U.S. Special Envoy for Ukraine Keith Kellogg and Zelensky. Zelensky had refused the initial U.S. demands for $500 billion in mineral wealth from Ukraine to repay Washington for wartime aid. Following the news, Musk tweeted that the article was "false" and that "Reuters is lying." Reuters has stood by its report.

SpaceX began providing Starlink terminals to Ukraine shortly after the Russian invasion, to support battlefield communications. Musk, however, has increasingly criticized Ukraine, as noted by the Kyiv Independent. Ukraine was also angered by a Starlink outage in 2022, which was linked to a drone attack on Russia's Black Sea fleet.

In addition, Musk, who heads the Department of Government Efficiency (DOGE), has called for the closure of the U.S. Agency for International Development (USAID), which provides vital humanitarian aid to Ukraine. Over the past four years, USAID has spent up to $500,000 and signed contracts worth up to $1 million for SpaceX's Starlink terminals, deploying them in Zimbabwe and South Africa. In its most significant partnership, USAID worked with SpaceX to send 5,000 Starlink terminals to Ukraine for free, worth about $3 million, after the war began in 2022, according to Forbes. In May 2024, USAID's Office of Inspector General announced an investigation into how Ukraine used the Starlink terminals and how USAID monitored their use.

The status of this investigation is unclear now that much of the agency's activities, if not the agency itself, are being shut down. The whole affair underscores the growing need for states to maintain full control over communications infrastructures.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, and authored by Carola Frediani and Andrea Signorelli.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.21 - 13 February 2025

A sensational exit. That's how the sale of a young Israeli offensive cyber company to the American private equity fund AE Industrial Partners for half a billion dollars was described in December. An exit that could reach 900 million, depending on the achievement of growth and profitability targets. Almost unicorn status for Paragon, a company founded in 2019 by a group of former members of 8200, one of the three units of the Military Intelligence Directorate of the Israeli Defence Forces (IDF), responsible for collecting intelligence and signals intelligence (SIGINT) and developing ad hoc tools.

Paragon, which now employs some 450 people, is a company that immediately set out to achieve very high standards. Its founders include Idan Norik, who is CEO, Lior Avraham, Liran Alkobi and Igor Bogdanov. Its president is Ehud Schneerson, a former commander of the same military intelligence unit. And its shareholder and board member is none other than former Labour Prime Minister and former Chief of Staff Ehud Barak.

The Graphite Software and The Context of the Spyware Market

Paragon's flagship product is the Graphite software, a spyware from which very little has been technically leaked. It seems to have the characteristics of other spyware or trojans that have been seen in the past, taking control of the mobile phone and intercepting communications in applications such as Whatsapp, Signal, Telegram, Gmail. This is the only function that is repeated in the media and at different times. Some write of persistence capabilities (a spyware that resists a reboot of the device), but also of a type of software that is more limited in its access to the device than others. But the technical part is still too vague at the moment.

What there is more information about is how Paragon is positioned. The context is that of companies selling spyware to governments for investigative purposes of a judicial or intelligence nature. A business that has grown in recent years, but which has generated many controversies (and inquiry committees, such as the European PEGA) for the use of these tools against journalists and political opponents. Controversies that have materialised in media and political attention, judicial investigations, lawsuits (WhatsApp against NSO, for example), as well as cyber attacks and information leaks. So much so that its direct competitor, the Israeli company NSO, which produces the Pegasus spyware, was placed on the Entity List, a kind of blacklist of the Department of Commerce, by the Biden administration, along with two other spyware companies founded by Israelis, Candiru and Intellexa.

Paragon and the Etical Marketing

It is easy to see why, until recently, Paragon emphasised how it had managed to get on the US government-approved list of suppliers, even for the more "ethical" choice of selling only to democratic countries, excluding regimes or states accused of violating human rights. Paragon, the ethical spyware company. A difficult statement to digest for any digital rights activist, but one that had a very clear business rationale and a certain political positioning. Also in Israel and in relations with the US. In short: political opposition to Netanyahu, closeness to the Democratic administration in the US. Thus, while NSO, a key company in Netanyahu's cyber-diplomacy, was the target of journalistic investigations such as the Pegasus Project into the alleged misuse of its Pegasus spyware, and was blacklisted by the Biden administration, Paragon was weaving its commercial and diplomatic web in Washington (here a view from the Israeli right).

This is to outline the - much more complex - political plan. On the economic front, the Israeli cyber startup sector welcomed Paragon's exit with enthusiasm, despite the apparent reluctance of the Ministry of Defence to grant the authorization, and perhaps also despite the discontent of some sectors of the intelligence community. "To date," wrote Calcalist, "Paragon has only raised about $30 million, so this is a high return on investment, even though not all of the deal was in cash and some will be in shares of the company created by the merger."

The AE fund plans to merge Paragon with another company in its portfolio, RED LATTICE, which operates in the defence sector. "The agreement," writes Globes, "will allow Paragon to expand its market presence in countries such as the United Kingdom and Ireland, Australia, New Zealand, Canada and the United States.All this to arrive at the announcement of Meta/WhatsApp on the 31st of January, which comes as a bombshell for the company, which until now has not been affected by any investigations or controversies, and which has a very private profile. WhatsApp informed some media that it had sent a cease and desist letter to Paragon, ordering it to stop hacking some of its users. An attempted breach of about 90 users in more than 24 countries, including people in Europe, via malicious electronic documents [PDFs distributed in group chats, according to the Guardian. Ed]. The malicious document was sent to the targets in December and did not require any user interaction to be compromised, a zero-click attack. The 90 include members of civil society and journalists, WhatsApp spokespeople told the media, although it is not clear whether they are all or just some of the 90”.

The Italian angle

But some of them are certainly in Italy. WhatsApp sent a message to all the victims. Among them is the director of the news site Fanpage, Francesco Cancellato, as reported by the Italian media on 31 January; then the activist Luca Casarini, head of the mission and one of the founders of the NGO Mediterranea, which rescues migrants in the Mediterranean; and then the Libyan activist Husman El Gomati, critical of the policy on migrants between Italy and Libya. In the days that followed, other names linked to the same Mediterranea were involved, such as the shipowner Beppe Caccia. Meanwhile, some international newspapers wrote that Paragon had two clients in Italy, a police force and an intelligence agency.

This is where the all-Italian ballet begins. The requests for clarification to the government, which denies involvement, and in a note "rules out the possibility that [Italian users, ed] were under the control of the intelligence services and therefore the government". It added that it had asked the National Agency for Cyber Security (ACN), which is under the control of the government, to speak with the law firm Advant, which represents WhatsApp. From this conversation, the government said that the Italian users targeted were 7. And they also revealed who the other Paragon customers in Europe might be, to the delight of the other governments (it must be said that a user in a certain country does not necessarily mean that country has the spyware, a person could be a target of foreign intelligence services. But in general the chances are high, especially if there are many users): "From the same conversation it is clear that the users involved so far belong to numbers with telephone prefixes attributable to the following countries, in addition to Italy Belgium, Greece, Latvia, Lithuania, Austria, Cyprus, the Czech Republic, Denmark, Germany, the Netherlands, Portugal, Spain and Sweden", said the government note.

Who Used Paragon?

But if, according to official statements, it is not the secret service, could it still be someone operating without the government's knowledge? And if it really is not the secret service, could it instead be the judicial authority—such as a public prosecutor’s office—given that this type of tool, similar to Paragon's Graphite, has been used in investigations for years?

In fact, the government itself has alluded to public prosecutors. Although, according to the Italian newspaper Il Messaggero, "none of the largest and most important prosecutor's offices in Italy uses the Israeli spying system, which can exfiltrate data, intercept conversations and locate people. Graphite is not used for wiretapping in Rome, Milan, Naples, Palermo or Genoa", but in the past there have been investigations by prosecutors and the National Anti-Mafia Directorate (DNAA) against NGOs involved in the rescue of migrants. And more than one in seven Italian users belongs to this world.

Meanwhile, Paragon has announced that it has first asked for clarifications and then cancelled the contracts in Italy for violating the terms of the contracts themselves, which do not allow journalists or members of civil society to be targeted with the spy software, the foreign press writes. However, sources in the executive continue to say that the spyware is still in use.

Perhaps the most disturbing aspect of the whole affair is this institutional stalling on a crucial issue. Among the victims is at least one journalist who has co-ordinated critical and embarrassing investigations for the government. And activists who, if they were to be intercepted in this way as part of an investigation, would have to be accused of very serious crimes.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.20 - 22 January 2025

In this issue: 

• The European alternatives to Starlink

• NATO comes to Protect the Cables

• And more

Iris2 and GovSatCom: the European alternatives and Italy’s Role

One of the many issues raised by the potential €1.5 billion contract between Starlink and the Italian government is that the same services would also be provided by the GovSatCom (or GOVSATCOM) project, a specific initiative within the European Union's space program aimed at creating a secure satellite communications system that European governments can use for disaster response and security needs.

"A key element of the GOVSATCOM system is the Communications Hub. This IT platform will bring together both commercial and government satellite communications capabilities into a single service accessible to European governments", European Space Flight wrote last September. "The system is expected to be fully operational by mid-2027".

These timelines were reiterated in recent days by Christophe Grudler (Renew Europe, France), a member of the European Parliament and former Iris2 rapporteur, who told Euractiv that "the Italian deal would be a 'strategic mistake'", adding that Italian taxpayers would be paying twice for two systems.

"Grudler," Euractiv continues, "also stressed that the EU's GovSatCom program will provide most of the services Italy is seeking to access through the Starlink deal from 2025. He warned that Musk's company would replace Italian industry and cost jobs, sovereignty and strategic autonomy".

According to the EU's official website, EU GOVSATCOM will provide a wide range of communication services (e.g. voice, email, chat, messaging, videoconferencing, video, access to specific information systems) for crisis management. "The main users will be civil protection teams, internal security forces and police, military forces, humanitarian aid workers and local EU and national delegations. "EU GOVSATCOM will also support the operation of Remotely Piloted Aircraft Systems (RPAS), which are increasingly used in crisis management and surveillance missions. By providing a secure and stable satellite communications link, it will support both the control of RPAS and the retrieval of data collected by the system".

It will, of course, also provide services to diplomatic networks, for which "access to a means of communication completely independent of host states is a fundamental requirement".

In December, Spacenews also reported that the EU's GovSatCom project would begin offering services in 2025 using the capacity of geostationary satellites operated by member states.

Meanwhile, in those same December days, the European Commission and the European Space Agency signed contracts with an industrial consortium for the development of a secure connectivity constellation at a total cost of €10.6 billion [so not €10 billion from Italy alone – worth repeating, even if it is obvious, ed]. This is for the development of the Constellation of Infrastructure for Resilience, Interconnectivity and Security via Satellite, known as IRIS², composed of over 290 satellites, which should be operational by early 2031. IRIS² will provide secure communications to European governments for civil and security applications. It will also provide commercial satellite services, such as residential broadband.

Two Different Contests with the Same Players

So there is GovSatCom and there is Iris2. More broadly, we should remember that there are two different "games" being played. One is secure communications for government, military, diplomatic and crisis management; the other is residential broadband.

Europe is playing both games, on different timelines and with delays compared to its competitors. Starlink/SpaceX, a direct competitor to the European projects, is also competing in both arenas, targeting both government communications and residential broadband. The Italian government, for its part, is engaged in at least two parallel negotiations with Starlink-SpaceX for both areas (and here I continue to use the two names interchangeably because that is how they are now commonly referred to in Italy).

The second area, broadband, is also the subject of many Italian parliamentary questions and motions. One such motion links the two separate negotiations. Indeed, the authors of a parliamentary motion by the Italian Democratic Party in early December noted: "For years, the European Commission has been working on the development and implementation of a 'networked' satellite system, analogous to Starlink, called 'GovSatCom', with the aim of ensuring a secure European communications infrastructure, shared and protected against external interference, and avoiding the dependence of the strategic telecommunications of the European Union and its Member States on entirely private infrastructures. Italy participates in this program through Telespazio".

From the perspective of residential broadband for general users, the application mentions that Starlink is already authorized to provide low latency broadband in Italy (serving approximately 50,000 users). However, the Undersecretary of State for Technological Innovation, Alessio Butti, stated that Starlink has been identified as a possible solution to the delays in the implementation of the Italy at 1 Giga Plan, funded by the PNRR (National Recovery and Resilience Plan), to cover the most remote and inaccessible areas of Italy with broadband "in a period estimated between 6 and 9 months".

Let's take a step back. It should be noted that this is happening in a wider context of delays in the internet broadband infrastructure plan and tensions (reported by Il Sole24Ore) between Fibercop, controlled by the US fund KKR – now in control of the network infrastructure – and OpenFiber, controlled by Cassa Depositi e Prestiti (an Italian state-owned financial institution that manages and invests public savings).

The motion therefore asks whether the government has "carefully considered the risks associated with investing PNRR resources in the Starlink proposal, including the consequent failure to complete the ultra-broadband network within the service standards established at European level throughout the Italian territory, as well as the impact on the structure and functioning of the internal market".

It also raises the question of whether "the potential combined effect of assigning Starlink coverage in the 'grey areas' of the Italy at 1 Giga Plan, financed by the PNRR, together with the management of the connectivity and telecommunications infrastructure for Italian diplomatic offices and the mobile stations of Italian military ships, would create risks for national and European security, given that the control of strategic infrastructure would be in the hands of a foreign company controlled by a person who is poised to play a significant role in the incoming U.S. presidential administration".

In this complex matter (the Italy at 1 Giga Plan itself is quite extensive and cannot be fully explored here) and in these various competitions, there are more questions than answers.

The only clear takeaway so far is that any contracts awarded to Starlink/SpaceX-especially for GovSatCom communications-would be a major blow to European projects. If we were to make a simplified list of winners and losers, the winners would be SpaceX commercially, Elon Musk politically, and the U.S. government strategically. The losers would be the European project and its aspirations for strategic advancement in the space economy and common defense. As for Italy, would it be a winner or a loser? It may take years to find out. But the answer also depends on how much we believe in and bet on Europe's role in the economic and geopolitical spheres, and whether we believe that harming Europe could be good or bad for Italy itself.

BALTIC SEA

NATO comes to protect the cables

You may recall a few weeks ago we dedicated a special feature to the tensions in the Baltic Sea that have recently materialized in the investigation of damaged Internet cables. We called it "the Baltic Sea breaking point" to indicate that this was neither a temporary nor a minor issue.

In fact, there were other suspicious incidents at the end of December. As a result, NATO announced a few days ago that it would send several ships to monitor the submarine infrastructure in the Baltic Sea, according to the Finnish newspaper Yle. The ships will remain at sea until April, positioned near energy and data cables to deter any potential sabotage attempts.

Finland is investigating the oil tanker Eagle S, part of Moscow's "shadow fleet," which is suspected of breaking an electrical cable between Finland and Estonia, as well as four telecommunications cables over the Christmas period, Politico reported.

BITCOIN RUSSIA

Russia uses bitcoin in foreign trade, finance minister says

Source: Reuters

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.19 - 18 December 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• Deepfake and Politics

• Finland’s Approach to Combating Disinformation

• Poland, Intelligence Under Investigation Over Pegasus

• And more

DEEPFAKE

Deepfake and Politics

You've probably seen the fake video of the Italian Prime Minister Giorgia Meloni and Elon Musk kissing that's been circulating on social media and in the news. This video, created using artificial intelligence based on real photos of the two in Paris during the reopening of Notre-Dame, was easily recognizable as an AI-generated deepfake. It appears to have been initially shared by an X account that frequently posts deepfakes of politicians.

This particular type of deepfake probably seemed harmless to many, as it was so easily identifiable and exaggerated as to seem obvious.

However, deepfakes can be used in much more malicious ways, including against politicians. The American Sunlight Project (ASP), a think tank researching disinformation, has published a study on the use of deepfakes against U.S. politicians.

The research identified more than 35,000 mentions of non-consensual intimate images (NCII) depicting 26 members of US Congress – almost all women: 25 women and one man – recently found on deepfakes websites. Most of these images were quickly removed after researchers shared their findings with the affected members of Congress, likely thanks to quick reporting or legal action against site administrators.

Nonconsensual and fake intimate images of real people have existed for some time, but generative AI has expanded both the user base and the possibilities. "Currently, policies to limit their creation and distribution are inadequate", reports The19th.

The study highlights that it is highly unlikely that ordinary people – those without the resources available to members of Congress – would receive the same swift response from the creators and distributors of AI-generated NCII if they attempted to request removal.

In the past year, there have also been several reports in the U.S. of high school girls being targeted with sexualized images of various origins in California, New Jersey and Pennsylvania.

DISINFORMATION

Finland’s Approach to Combating Disinformation

In recent years, workshops aimed at teaching students – and others – how to identify fake news and counter its spread have proliferated across Europe. While some of these workshops are useful and well-designed, others lack the necessary care and preparation, and most are not part of a broader, sustained effort.

However, one European country is demonstrating what can be achieved when anti-fake news initiatives are carried out with competence and consistency: Finland. The Finnish government launched its anti-fake news initiative back in 2014: two years before the alarm over social media-driven disinformation peaked with Donald Trump's first election and the Brexit referendum.

The year Finland decided to embark on this project was no accident. In 2014, Russia annexed Crimea and the war in Donbass began. At that moment, Finland – a Nordic nation that shares more than 1,300 kilometers of border with Russia – realized the importance of fighting disinformation and Russian propaganda.

As Russian trolling escalated in Finland, President Sauli Niinistö urged every Finnish citizen to take responsibility for fighting false information. By 2015, Finland had brought in American experts to train officials on how to identify fake news, understand why it spreads, and develop strategies to combat it. The education system was also reformed to place more emphasis on critical thinking.

As CNN explains in a feature on Finland's fight against fake news, "the initiative is just one layer of a multi-pronged, cross-sector approach the country is taking to prepare citizens of all ages for the complex digital landscape of today – and tomorrow".

“A prime example of this effort is Prof. Valentina Uitto's social studies class, where a group of 10th graders recently debated key issues for the upcoming EU elections. Topics such as Brexit, immigration, security and the economy were passionately discussed before the students were asked to choose an issue to analyze”.

"They've collected what they think they know about the EU elections... now let's see if they can separate fact from fiction", Uitto said with a grin.

The students then broke into groups, using laptops and phones to investigate their chosen topics. The aim is to inspire them to become digital detectives – a modernized version of Sherlock Holmes for the post-Millennial generation.

Uitto’s class embodies Finland’s critical thinking curriculum, revised in 2016 to equip students with skills to identify disinformation, particularly the kind that has disrupted election campaigns in the US and across Europe.

Finland is uniquely positioned to create a virtuous cycle: trust in traditional media and a highly literate population make it easier to fight fake news, which in turn reinforces these strengths. The country ranks first in Europe for media literacy (followed by Denmark and the Netherlands), second in the world for press freedom (after Norway), and has the highest trust in traditional media in the world, according to the Reuters Institute Digital News Report.

These factors make Finland particularly resistant to Russian disinformation efforts and receptive to anti-fake news initiatives.

However, there are risks associated with anti-fake news efforts. CNN highlights the potential for justified skepticism to turn to cynicism, as the effort required to fact-check can overwhelm individuals. "It's very annoying to have to check everything and not be able to trust anything ... or anyone on the internet", said 15-year-old Tatu Tukiainen, a student in Uitto's class. "I think we should try to put a stop to it".

Moreover, Finland's success may not be easy to replicate elsewhere in Europe. With just over a century of independence from Russia, the threat of Russian interference is felt more acutely in Finland than in many other nations. Finland also has a strong sense of national identity.

"The Finns have a very unique and special strength in that they know who they are. And who they are is directly rooted in human rights and the rule of law – things that Russia, right now, is not", said Jed Willard, director of the Franklin Delano Roosevelt Center for Global Engagement at Harvard University, who was hired by Finland to train officials to identify and counter fake news. "There is a strong sense of what it means to be Finnish ... that is a superpower."

SPYWARE

Poland, Intelligence Under Investigation Over Pegasus

Piotr Pogonowski, who headed Poland’s Internal Security Agency (ABW) during the administration of the Law and Justice (PiS) party and is now a board member of the central bank, was detained by police and brought to testify before the parliamentary investigative committee probing the alleged misuse of the Pegasus spyware, developed by the Israeli company NSO and sold to governments. Pegasus was reportedly used to spy on politicians and opponents during the previous government's tenure.

Poland's new government, led by Donald Tusk, said last year that at least 578 people, including politicians, had been monitored since the PiS government acquired Pegasus in 2017. Neither the previous government nor the NSO has confirmed the purchase of the software.

This is not the first time that Europe has seen investigations and hearings into the use of Pegasus. In addition to the European Parliament's committee on the matter (as previously reported by Digital Conflicts), Spain's intelligence chief Paz Esteban was fired in 2022 after it was revealed that Pegasus had been used internally against Catalan separatist politicians and, separately, by a foreign entity against Prime Minister Sánchez.

More details are available on Notes from Poland.

AI AND TECH SOVEREIGNTY

Better Datasets Won’t Solve the Problem: AI for Africa Must Be Developed in Africa

Language models developed by major technology companies consistently underperform in African languages.

It's time to focus on local solutions. "It is this difference in prioritization that is the missing ingredient in current discussions about making AI more inclusive. Which problems people focus on, what we regard as informative data and what types of failure are considered acceptable are all human choices”.

An insightful article on AI and Africa published in Nature.

CYBERSECURITY

Salt Typhoon’s Assault on U.S. Telcos

What we know about the attack that targeted major American telecommunications companies, accessing customer data and even communications in some cases.

"Here's another example of a backdoor access mechanism being exploited by the wrong spies", commented cryptographer Bruce Schneier. To make matters worse, in this particular case, the law does not require the use of a single platform managed through public and transparent processes. Instead, each operator is free to use proprietary platforms or third-party software. In essence, as EFF pointed out before the CALEA update, wiretapping has been handed over to private companies with limited oversight. Both phone companies and potential technology partners are directly involved in the interception, creating vulnerabilities.

An article by Marco Schiaffino for Guerre di Rete [Italian only].

STARLINK 

Halt on Starlink in Two Amendments Proposed by the Italian Democratic Party (PD)

Submitted as part of the Competition Act, these amendments aim to exclude the satellite connectivity company from PNRR (the National Recovery and Resilience Plan approved in 2021 by Italy to boost its economy after the COVID-19 pandemic) connectivity services and resources. "The goal is to prevent companies subject to the DSA (such as X and Starlink, both owned by Musk) from competing directly or indirectly with other telecom operators, essentially offering two services: connectivity and the platform itself. The concern seems to relate to competition and market dynamics, as the integrated service offering could create unmatched advantages".

A second amendment, authored by Nicita and Basso, seeks to exclude third-party satellite technology from accessing PNRR resources, reports Repubblica.

COMMUNICATION NETWORKS

How WhatsApp is Used Around the World

An in-depth analysis from Rest of the World.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.18 - 4 December 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• SPECIAL REPORT – Two Internet Cables and the Baltic Sea Breaking Point

• Reports and insights

SPECIAL REPORT

Two Internet Cables and the Baltic Sea Breaking Point

Two damaged cables may not constitute proof, but they are enough to spark investigations and suspicions of hybrid warfare—especially when they lie underwater in the politically tense waters of the Baltic Sea. These waters connect nations such as Sweden, Denmark, Germany, Finland, Lithuania, and Russia, all key players in a mystery that will eventually involve an unexpected actor, as we’ll see. This is the same sea traversed by the Nord Stream pipeline (sabotaged in 2022 – a sabotage attributed by The Wall Street Journal in August to Ukrainian forces) and frequently plagued by GPS signal interference, as previously reported in this newsletter.

On December 24, two undersea Internet cables in the Baltic Sea were suddenly damaged within a short period of time. The first reports came from the companies that manage these infrastructures.

The first cable, a 218 km link between Lithuania and the Swedish island of Gotland – called the BCS East-West Interlink – was reportedly physically damaged at 10 a.m. local time on Sunday, according to telecommunications company Telia Lietuva.

The second, called C-Lion, spans 1,200 kilometers along with gas and power lines from Helsinki (Finland), to Rostock (Germany). According to Cinia, the Finnish state-owned company that manages the connection, the damage occurred late Sunday night (early Monday morning). Repairs, which will require a specialized ship en route from France, could take up to two weeks.

The damage occurred in Sweden's exclusive economic zone south of the island of Öland, so Swedish authorities are responsible for the investigation. Swedish Defense Minister Carl-Oskar Bohlin confirmed this to SVT, saying that the case is under active investigation.

In this highly uncertain context, a joint statement by the foreign ministers of Finland and Germany on Monday came about pretty strong:

"We are deeply concerned about the severed undersea cable connecting Finland and Germany in the Baltic Sea. The fact that such an incident immediately raises suspicions of intentional damage speaks volumes about the volatility of our times. A thorough investigation is underway. Our European security is not only under threat from Russia’s war of aggression against Ukraine, but also from hybrid warfare by malicious actors. Safeguarding our shared critical infrastructure is vital to our security and the resilience of our societies".

The incident also occurred just two days after the Russian ship Yantar was escorted away from an area containing critical cables in the Irish Sea. Yantar is officially classified as a general-purpose oceanographic research and underwater salvage vessel, but its presence raised concerns about the security of cables between Ireland and the UK that carry global Internet traffic for tech giants such as Google and Microsoft, The Guardian reported.

But the situation is complex. In August, Beijing admitted that a Chinese-owned ship had damaged a critical pipeline in the Baltic Sea, but claimed the incident was accidental.

This context becomes relevant because shortly after the recent Internet cable damage, some open source intelligence (OSINT) researchers highlighted the presence of a Chinese ship, the Yi Peng 3, in the area.

By mid-week, the authorities also began to focus on the Chinese ship. Swedish police, who are leading the investigation into the alleged sabotage, announced that a Chinese ship off the Danish coast was "of interest". Meanwhile, the Danish navy began shadowing the Chinese-registered cargo ship.

The ship, identified as the aforementioned Yi Peng 3, allegedly crossed paths with the two cables on Sunday and Monday, around the time they were reportedly cut. The Danish navy was shadowing the ship as it passed through waters between Sweden and Denmark, according to The Guardian.

The Danish Defense Command made a brief statement confirming its presence in the area:

"The Danish Defence can confirm that we are present in the area near the Chinese ship Yi Peng 3. The Danish Defense has no further comments at this time."

As noted by Maritime-Executive, the Yi Peng 3 “was outbound from St. Petersburg in the Baltic during the timeframe of the two back-to-back cable breaks. Its AIS record [automatic identification system, a maritime technology for exchanging navigational and identification data] shows that it exhibited unusual course and speed changes at positions that may have corresponded to the twin incidents. The ship was intercepted by a Danish Navy patrol ship as it transited towards the Great Belt on November 18. The bulker then went to anchor in the Kattegat, with the patrol ship waiting nearby. Despite the appearance of formal intervention, Denmark stopped short of announcing that the ship had been detained”.

The Yi Peng 3, a Chinese-registered cargo ship en route from the Russian port of Ust-Luga to Port Said, Egypt, reportedly passed near the Swedish-Lithuanian and Finnish-German cables around the time they were cut, according to the maritime monitoring group MarineTraffic. The Finnish site MTV Uutiset even produced a video showing the coincidence (screenshots provided).

Owned by Ningbo Yipeng Shipping, a company with only one other ship, the Yi Peng 3 is based near the eastern Chinese port city of Ningbo. A company representative told the Financial Times that "the government has asked the company to cooperate with the investigation", but declined further comment.

The detention of a foreign ship without a warrant is rare. But a rarely invoked clause in a century-old treaty could give Denmark the legal authority to detain the Yi Peng 3, according to Kenneth Øhlenschlæger Buhl, a maritime law expert at the Royal Danish Defense College.

Some believe the Danish Navy's aggressive move signals a change in policy. "Several officials familiar with the investigation suspect that Russia orchestrated the sabotage, possibly using the Chinese-flagged ship to maintain plausible deniability (...) and that the Chinese government was likely unaware of the plot", the Wall Street Journal reported. How such an operation could be practically carried out, however, has not yet been explained by anyone. Russia, for its part, has rejected any accusation, pointing the finger at the Ukrainians.

Despite Monday’s immediate joint statement by the Finnish government together with the German government, Finnish officials have issued more measured statements, noting that accidental cable breaks are common worldwide, with about 200 incidents a year, mostly caused by anchors or trawling nets. Finnish Prime Minister Orpo said Tuesday that it was too early to talk about sabotage. U.S. officials interviewed by CNN also urged caution.

A few days ago, Sweden has formally asked China to co-operate with an investigation into damage to the two cables in the Baltic Sea.

Whether the incident ultimately proves to be accidental or deliberate, it underscores tensions in the Baltic region and growing concerns about the security of critical communications networks, particularly undersea cables.

Last September, the U.S. reportedly detected increased Russian military activity around key undersea cables, according to two U.S. officials who spoke to CNN. Russia, they said, is increasingly investing in a dedicated unit of surface ships, submarines and naval drones under the "General Staff Main Directorate for Deep Sea Research" (GUGI), which, according to US think tanks, appears to have a particular interest in the Baltic Sea.

Last May, Russia announced a plan to unilaterally extend its maritime borders with Lithuania and Finland, both NATO members (Finland joined in 2023). The plan was later removed from the government's website, according to the Financial Times.

Finally, just a month ago, German Defense Minister Boris Pistorius arrived in Rostock to inaugurate NATO's new Baltic Sea Command. The Commander Task Force Baltic will be led by a German admiral and will be including officers from 11 other nations. It aims to protect key supply routes, trade corridors and critical infrastructure.

In Brief

ITALY

What We Know About the Starlink Test in Lombardy

Elon Musk's satellite communications company is being mentioned in connection with a pilot project aimed at overcoming delays in broadband deployment plans in Italy. Here's what we know so far.

"The Italian government has long toyed with the idea of relying on satellites to avoid missing the National Recovery and Resilience Plan (part of the Next Generation EU) deadlines and losing European funds. However, Internet from space might not offer the same quality of connection," writes Zorloni in Wired Italy [Italian only].

EU TECH STARTUPS

“Don’t Sell!”

Xavier Niel, a leading European tech investor, argues that Europe can create AI industry leaders without the billions raised by US rivals - provided founders resist early buyouts. Financial Times.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.17 - 18 November 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• Tech policies under Trump: what to expect

• The internet is not a multilingual space

• The Democrats and conspiracy theories

• How U.S. judges use recidivism assessment systems

• And more

TECH POLICY

Tech Policy Under Trump: What to Expect

What can we expect from the new Trump administration in terms of digital policy? And how will it interact with European policies and regulations?

We are referring to issues such as AI governance, government relations with major platforms and social media, chip manufacturing and export rules, mergers and acquisitions, and antitrust policy.

Platforms and the European Union

Under Biden, Big Tech faced increased scrutiny from Washington regulators. The Federal Trade Commission (FTC), the federal agency charged with protecting consumers and preventing anti-competitive business practices, blocked several mergers in Silicon Valley. More broadly, the Department of Justice and the FTC have launched a series of anti-competitive lawsuits and investigations targeting Microsoft, OpenAI, and Nvidia – the American leaders in AI software and hardware. Amazon, Apple, and Google have also come under antitrust scrutiny.

Meanwhile, there's a lot going on across the Atlantic. Last March, the European Commission launched an investigation into Google, Apple and Meta for alleged violations of the Digital Markets Act (DMA). Also in March, the EU fined Apple €1.84 billion following a complaint from Swedish company Spotify. According to the Commission, Apple abused its dominant position by preventing music streaming app developers from informing iOS users about cheaper subscription options available outside the app (and from including links to their websites). This behavior, the EU said, violates its antitrust rules.

But that's not all. Just this week, under the DMA, the European Commission ordered Booking.com, another American giant known for vacation and travel bookings, to comply with several directives. For example, hotels, car rentals, and other service providers that use Booking.com will now be free to offer different (and potentially better) prices and conditions on their websites or other channels than on Booking.com.

On the antitrust front, Meta was also fined nearly €800 million by Brussels this week. Facebook's parent company is accused of stifling competition by "tying" its free marketplace services to the social network.

In July, the European Commission issued a preliminary opinion accusing X (formerly Twitter) of violating another European law, the Digital Services Act (DSA), by failing to comply with transparency and accountability rules. The Commission criticized X's blue check marks, calling them misleading.

"Since anyone can subscribe to obtain such a ‘verified’ status, it negatively affects users' ability to make free and informed decisions about the authenticity of the accounts and the content they interact with", the Commission wrote. Potential fines are up to 6% of a company’s global annual turnover. A finding of non-compliance could also trigger enhanced monitoring or even periodic penalty payments to enforce compliance.

According to some observers, if the EU were to fine X, Elon Musk's platform, for violating the DSA rules, relations between Trump and the European Commission could quickly sour, fueling the MAGA narrative that the EU is merely trying to undermine U.S. Big Tech.

European lawmakers have already urged the EU executive not to back down. German Green MEP Alexandra Geese said, "the European Commission now needs to stand tall and defend EU platform rules", while Dutch Green MEP Kim van Sparrentak stressed, "especially now, it’s more important than ever that Europe rises to defend our rights and democracy, also online", according to Politico.

With the new Trump administration, this implicit transatlantic consensus on regulating large US tech companies – which some had observed under Biden – could collapse.

Domestically, the potential appointment of Matt Gaetz as Attorney General (if confirmed) adds ambiguity to U.S. antitrust policy and relations with Big Tech. Gaetz has been a critic of Big Tech and has shown appreciation for Lina Khan, the current president of the FTC, although she is expected to step down (Musk promised to get her fired).

When it comes to the EU, however, the attitude is less nuanced. Trump has frequently claimed that the EU discriminates against U.S. companies and has vowed to prevent Europe from "taking advantage of our companies". He even claimed that Apple CEO Tim Cook called him to complain about the €13 billion in unpaid taxes the company owes Ireland.

The speed and enthusiasm with which top Big Tech executives, even those who had previously distanced themselves from Trump, rushed to congratulate him could indicate fear of retribution. But it could also indicate hopes of finding an ally on several fronts, including opposition to European regulation.

Cybersecurity

Given the mantra of "less regulation", some observers expect less effort than under Biden to regulate various critical infrastructure sectors (transportation, energy, water systems, health care-all of which have been targeted by attacks in recent years) to improve their cybersecurity.

The Cybersecurity and Infrastructure Security Agency (CISA) is likely to be refocused on strictly cyber-related issues, with its counter-disinformation initiatives scaled back.

In addition, the Biden administration had taken action against certain foreign producers of surveillance tools, such as spyware developed by the Israeli company NSO Group, by placing them on Entity List. This is effectively a blacklist that restricts NSO Group's access to American products and prohibits U.S. companies or agencies from purchasing or using NSO Group products, such as the Pegasus spyware.

According to some observers, the new administration may remove these companies from the list of entities considered a threat to national security. Companies like NSO Group have already lobbied Republicans to that effect.

Artificial Intelligence

Biden's executive order on artificial intelligence will almost certainly be repealed, according to Tech Policy and other analysts. The Republican Party had already pledged in its official platform to "repeal Joe Biden’s dangerous Executive Order that hinders AI Innovation" and instead promote the development of this technology "rooted in Free Speech and Human Flourishing" rather than "radical leftwing ideas". As a result, policies that protect workers, civil rights, and consumer protections are particularly at risk.

However, it's unclear how much of the bureaucratic apparatus built around the executive order will be dismantled. For example, what will happen to the requirement that major AI developers report their models to the government? Some believe this will be eliminated, but it may remain an open question.

One aspect of Biden's AI policy that may continue, and even intensify, under Trump is tighter export controls.

Under Biden, the Commerce Department's Bureau of Industry and Security has tightened export controls on AI technology. A key goal of these regulations is to block China's access to the most advanced AI chips. "A second Trump administration is likely to further tighten export restrictions on AI", writes the Brookings Institution.

Finally, right-leaning think tanks predict a loosening of various energy and environmental restrictions to pave the way for the AI industry, which is known to be highly energy-intensive.

Bitcoin and Cryptocurrencies

Make Bitcoin Great Again could sum up this section. Trump's victory is currently seen as a victory for the crypto world. The Republican Party had promised to end what it called the Democrats' "illegal and un-American crackdown on cryptocurrencies".

As such, few expect Gary Gensler, the chairman of the Securities and Exchange Commission (SEC), to politically survive in its current position. Gensler has been aggressively pursuing various players in the crypto sector.
(A consulting firm has produced a detailed report on how Gensler's SEC has prioritized oversight and regulation of the crypto industry).

RIGHTS, PLATFORMS, INTERNET

The Internet Is Not a Multilingual Space

Seventy-five percent of Internet users come from countries where English is not the official language, most of them in the so-called Global South. Yet many applications and websites are not available in the thousands of languages spoken daily around the world. Even more critical is the lack of moderators in these languages. The most translated interfaces are those of Wikipedia, Google Search, Google Maps, and YouTube.

From content moderation to hate speech, platforms' disregard for non-English languages also impacts human rights. The advent of artificial intelligence could bring change. Irene Doda writes about this on our website, Guerre di Rete (Italian only).

PLATFORMS, INFORMATION, DISINFORMATION

Democrats and Conspiracy Theories

Amid declining trust in traditional media and the sting of Trump's victory, some liberal and pro-Democratic voters in the U.S. appear to be developing – or leaning toward – conspiracy theories. This phenomenon parallels a trend seen in parts of the right, particularly the alt-right. A term has already been coined for it: BlueAnon (a play on the Democratic color blue and QAnon, the infamous, anti-liberal conspiracy theory). The concept gained traction after the attack on Trump, with various conspiracy theories about the authenticity of the event.

Recent liberal conspiracy theories, as reported by journalist Taylor Lorenz, range from skepticism about vote counts in key states to allegations of a criminal cover-up by Biden to ensure Democratic losses to claims of Russian interference in voting systems. One of the latest theories involves Elon Musk: the idea is that the billionaire somehow compromised the voting mechanism through Starlink, his satellite connectivity company, which is supposedly part of the supply chain for voting machines. This claim is false, not least because voting machines are not connected to the Internet.

Many of these election-related theories are circulating in Threads, showing that Meta's efforts to deprioritize and minimize journalistic content on the app may have created a vacuum where misinformation thrives unchecked, leaving users unable to find reliable news, the journalist observes.

This trend also reflects the progressive unraveling of the entire political and information ecosystem, with ominous implications.

"Of course," writes Leonardo Bianchi, a journalist who covers these issues for Facta News, "there is a big difference between QAnon and BlueAnon. The former is now an integral part of Republican propaganda, openly amplified thousands of times by Trump. The latter, however, has not been adopted by any Democratic lawmakers or officials and remains confined to pockets of the progressive electorate. But it has become impossible to ignore".

ALGORITHMS AND SOCIETY

Assessing the Risks of Risk Assessments

In the United States, pretrial risk assessment systems (long controversial) estimate the likelihood that a defendant will appear in court or commit further crimes. These tools use the defendant's criminal history, family background and a database of past cases to generate a risk score - either a "low", "medium", or "high" risk label or a number on a scale. Judges receive these scores during preliminary hearings that determine whether (and under what conditions) a defendant will be released.

A study published in the journal Social Problems found that judges neither fully adopt nor outright reject the recommendations of these algorithms. Instead, they use them selectively, driven by deeply human factors in deciding whether to heed or ignore the results. A key motivator is not necessarily the reliability of the system, but whether it helps justify a decision the judge already wants to make, the author argues. It's worth noting that the study is limited and its findings are nuanced, but the opportunistic use of these tools is an interesting point that merits further research. The topic has been debated in the U.S. since at least 2016, when a famous ProPublica investigation found that pre-trial risk assessment systems were unreliable and discriminatory (via The Verge).

IN BRIEF

AI ACT

The first draft of the General-Purpose AI Code of Practice, authored by independent experts, has been published. If you work in AI governance, this is a must-read

Silicon Valley Got What It Wanted

It's not just Elon Musk. It's a new day for deregulation, cryptocurrencies, and tech companies cozying up to Trump. A critical left-wing commentary by Brian Merchant (author of the excellent book Blood in the Machine).

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.16 - 29 October 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• What we know about the italian mega hack

• Influence Operations Using ChatGP

• EU Trusted Flaggers

CYBER ESPIONAGE

“A threat to democracy”: what we know about the Italian database scandal

The Milan prosecutor's office used very strong language, calling it "a threat to the security of democracy in Italy. It's hard to imagine that investigators are exaggerating the seriousness of what happened, considering that – according to the ongoing investigation, which has so far led to four arrests and 60 suspects – the most sensitive and confidential databases of the Italian State were hacked for profit, extortion, and political and business influence.

This scandal has exposed the vulnerability of the Italian state's information systems, which, as the public prosecutor Francesco De Tommasi has noted in official documents, allow "the indiscriminate circulation of sensitive, confidential and secret information" aimed at keeping both citizens and institutions under control.

For these purposes, some companies (which we will discuss shortly) are accused of having esfiltrated information from government databases such as SDI (Sistema di Indagine, a system containing citizens' criminal records, investigations, and alerts used by law enforcement), Serpico (a system that processes tax data to detect potential tax evasion), and at least three other databases containing records of suspicious financial transactions, personal data, and pension information.

According to prosecutors, the goal of these data thefts – which involved hundreds of thousands of accesses to documents, including some from Italian intelligence – was threefold: the information could be extracted for sale to customers, used for blackmail, or used to influence high-level political and business appointments or harm rivals.

Among the suspects are the two partners of Equalize, a Milan-based investigative firm that allegedly organized the data thefts. Equalize is 95% owned by Enrico Pazzali, president of Fiera di Milano Foundation (majority owner of Fiera di Milano, Italy's leading trade show and convention operator), and 5% owned by former police officer Carmine Gallo, known for leading major investigations (including the Gucci murder case).

According to the investigation, while Gallo sought to profit from the sale of confidential information, Pazzali's primary goal was political, allegedly attempting to damage rivals of politically connected figures or influence government appointments.

According to the prosecutors, Equalize accessed government databases with the assistance of law enforcement personnel who directly stole information. Other accesses were made through Trojans that targeted databases using information provided by IT technicians who maintain these systems. In some cases, computers and smartphones belonging to individuals under surveillance were also hacked.

Other companies involved in the investigation, and currently under seizure, include Mercury Advisor (private investigations), Develop and Go, and others specializing in intercepting and hacking devices.

Among those monitored are Senate President Ignazio La Russa (along with his son Geronimo), former Eni president and current AC Milan president Paolo Scaroni, as well as bankers, journalists and celebrities. Equalize's clients, those who are accused of having paid for access to confidential information, include executives from the energy company Erg and Barilla (the Italian pasta giant). Among those under investigations is Leonardo Maria Del Vecchio, son of Luxottica's founder.

The leaders of what the Milan prosecutor's office suspects is a "criminal association aimed at unauthorized access to computer systems" reportedly enjoy "high-level support in various sectors, including organized crime and even foreign intelligence services”. According to documents filed by Anti-Mafia Prosecutor Francesco De Tommasi, "the suspects often boasted of their ability to intervene in investigations and legal proceedings”.
The prosecutor also states that the group linked to Equalize operated a "cluster structure" in which each "member" and "collaborator" maintained "contacts within law enforcement and other public administration offices" in order to "illicitly obtain data". Milan prosecutors will also investigate the alleged sale of sensitive data and information abroad to determine whether it ended up in other countries.

AI AND INTELLIGENCE

Influence Operations Using ChatGPT and Similar Tools

One of the recurring themes regarding the potential risks of generative AI is its facilitation of influence and disinformation campaigns that have been active for years and have been thoroughly reported and dissected by platforms like Facebook, which publish detailed reports on such operations. The concern now, however, is that the ease of generating content (text, images, video) could increase the scale and effectiveness of such operations. But is this really the case? Is it already happening?

OpenAI, the company behind the best-known generative AI tool, ChatGPT, recently released a report on the deceptive use of its tools: "Since the beginning of the year”, the report states, “we’ve disrupted more than 20 operations and deceptive networks from around the world that attempted to use our models. To understand the ways in which threat actors attempt to use AI, we’ve analyzed the activity we’ve disrupted, identifying an initial set of trends that we believe can inform debate on how AI fits into the broader threat landscape".

So, what does this mean? There are indeed state and commercial entities that use tools like ChatGPT to create comments that are published on platforms like X (formerly Twitter) and Facebook. These are used, for example, to support the image of the government of Azerbaijan. In addition, AI is used to create fake profiles and images on social media, create biographies, analyze posts and comments, draft responses in multiple languages, and make corrections. These responses are then posted on platforms such as X or Facebook.

In one case, OpenAI shut down a series of ChatGPT accounts linked to an Iranian threat actor (previously identified by Microsoft and Meta) that were generating long articles and short comments in English and Spanish about the U.S. election.

But have they had a real impact? In reality, their impact appears to be relatively small. To measure this, the researchers use a scale, the Breakout Scale, which assesses whether an influence operation remains on a single platform or spreads across multiple platforms (including traditional media and political debates-a critical factor in assessing the success of an operation, which in turn raises the question of the accountability of news outlets and politics). It also measures whether the influence remains within a single community or spreads across multiple communities.

In any case, according to Ben Nimmo, co-author of the report, “AI companies, and thus AI investigators, sit in a unique niche in the information space—midway between upstream providers of things like emails, and downstream distribution platforms like social media. Final point: none of the operations we identified so far looked like it achieved viral breakout or audience engagement because of its use of AI. Social media are a tough environment".

A critical question arises: why is social media a though environment for influence operations? Perhaps these bad actors haven't made a serious investment yet, and we're still in the testing phase. Or maybe, after years of public hearings in various parliaments, some of these social media platforms, despite recent staff cuts, have taken steps to monitor and curb these abuses?

Answering this question is key to understanding how "bad actors" (mainly, but not exclusively, state actors) can be controlled in the AI era, where content distribution remains in the hands of social platforms. In general, such campaigns have a greater impact when they amplify existing problems rather than creating phenomena from scratch. But even in these cases, assessing their real impact remains the most difficult and elusive question.

DIGITAL SERVICES ACT

The EU Trusted Flaggers

Germany and Romania are the latest countries to appoint content flagging organizations under the EU’s Digital Services Act (DSA), the bloc’s law on platform responsibility. These organizations will help report online platforms' illegal behaviors.

Under the DSA, in fact, regulators from each EU member state need to appoint so-called “trusted flaggers,” to point out content that is illegal or violates intermediaries’ terms of services.

The number of countries that have appointed trusted flaggers under the DSA provisions has risen to 6: Austria, Denmark, Finland, Sweden, Germany and Romania. A few days ago, the Germany's main authority for infrastructure granted the first trusted flagger status to the REspect! reporting centre, that focuses on identifying hate speech, terrorist content and other violent content published in German, English or Arabic. Around the same time, in Romania the National Authority for Management and Regulation in Communications (ANCOM) granted the first trusted flagger certificate to Save the Children.

Trusted flaggers - explains the EU Commission website - must publish easily understandable and detailed annual reports. These must include information on notices submitted, the types of illegal content reported, and the actions taken by the online platforms.

The DSA came into force last February and the EU Commission has already started probes into TikToK, Facebook, Instagram, X and AliExpress.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.15 - 8 October 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• New developments in the case of exploding pagers

• The crisis of Northvolt

• GenAI as a commodity

• More

WAR IN LEBANON 

New developments in the case of exploding pagers

Our last newsletter was about the explosion of pagers and walkie-talkies in Lebanon (if you didn't read it or didn't follow the story closely, take a look, because we're going to make some assumptions). Two weeks on, what more do we know or what more can we say?

Unfortunately, it has become clear that the pager explosion was only the first phase of a larger campaign. A military campaign, or rather, let's call it what it is: a war, initiated by an intelligence operation that had been in the making for years. This operation involved the infiltration of Hezbollah (probably also through HUMINT, or human intelligence), the manipulation of the pager supply chain, the creation of intermediary companies and a "cyber" component, of which little has been revealed, involving the ability to remotely activate the explosive-laden devices in a coordinated manner.

“Creating distrust of communication devices within Hezbollah may well be Israel's purposeful tactic of ‘preparing the battle space' ahead of impending Israeli military operations against Lebanon”, Thomas Rid, a professor of strategic studies at Johns Hopkins University and author of Active Measures, who specializes in disinformation and influence operations, told Wired USA. “He compares the operation to cyberattacks or physical attacks on ‘command-and-control’ infrastructure at the beginning of a conflict, such as the United States' efforts, documented in former NSA chief Michael Hayden's book Playing to the Edge, to destroy the Iraqi military's fiber-optics-based communications in 2003 in order to ‘herd’ the enemy's military toward more easily intercepted radio-based communications”, Wired writes.

“This is taking attacks on command-on-control to a whole new level”, Rid says. “They sent the message: ‘No, we’re not just penetrating these devices and bugging them, we're literally blowing them up, taking away the confidence you might have had in your command-and-control and also in any future devices that you might procure’”.

However, this trust has also been taken away from the rest of the Lebanese population, who are now not only facing the nightmare of war, air strikes and displacement, but also living in a state of paranoia, suspicious of every device: starting with phones, but also power banks, solar panels or other everyday items, as reported by several media outlets.

This goes beyond Lebanon: Dubai's Emirates Airlines has banned passengers from carrying pagers and walkie-talkies on its flights.

Batteries containing explosives?

As for the pagers, one of the few details to emerge in recent days was reported by CNN. Lebanese authorities used some of the devices, which had been switched off during the attack and were therefore intact, and blew them up to investigate what had happened.

"The pagers used in the controlled explosions were switched off at the time of the attack on September 17, which meant they did not receive the message that caused the compromised devices to detonate," writes CNN. "The way in which the explosive material had been hidden inside the pagers’ batteries was so sophisticated that it could not be detected", said a Lebanese security source. "The explosive material was ‘laced’ inside the pager’s lithium battery and virtually undetectable". The source added that they had "never seen anything like it".

This account is corroborated by another Washington Post investigation published in the last few hours (based on several intelligence sources from different countries), which states that the modified pagers were a feat of engineering, with the explosives so carefully hidden that they were virtually undetectable even if the device was dismantled. In fact, according to Israeli sources, Hezbollah disassembled some of the pagers and may even have X-rayed them, but still failed to detect the trap.

An electronic signal from Israeli intelligence triggered the explosion of thousands of devices at once. On 17 September, thousands of compromised pagers rang out across Lebanon and Syria. A short phrase in Arabic appeared on the screens: "You have received an encrypted message". Many Hezbollah members followed the instructions to verify the coded messages, which involved pressing two buttons simultaneously with both hands, according to the Washington Post.

Let's not forget that within a week of the pager and walkie-talkie explosions, Nasrallah and other Hezbollah leaders were killed. As Natalia Antelava writes in the Coda newsletter, "assassinations of the entire command structure of the most powerful militia in the Middle East requires state of the art technology, incredible human penetration into target societies and extraordinary strategic patience. French media reported that Nasrallah’s arrival at Hezbollah underground HQ was leaked to the Israelis by an Iranian mole. These reports have not been corroborated, but the former Iranian president Mahmoud Ahmadinejad produced a jaw-dropping sound bite when he told CNN Turk that even the head of the Iranian unit countering Mossad was an Israeli agent”.

It's worth noting, however, that Ahmadinejad's interview with CNN Turk, which has resurfaced in recent days, appears to be much older. Nevertheless, it still points to an incredible level of human, not just technological, infiltration by Israel.

Who is Pauline? The circle of companies and the supply chain

What do we know about the supply chain and the companies involved? Last time, I wrote about two companies, BAC Consulting in Hungary and Norta Global in Bulgaria, with technology licensed from the Taiwanese company Gold Apollo.

Another piece of the puzzle has come into focus: Hong Kong. Specifically, there's a company, Ellenberg Trading, registered in the Hong Kong Companies Registry and founded in 2021 by a certain "Pauline Ellenberg" with an alleged residence in Zurich, who is currently untraceable by journalists.

The company allegedly made payments totaling millions of euros to the Bulgarian company Norta, which in turn transferred the money to the Hungarian company BAC Consulting, which commissioned the production of the pagers, according to Der Standard and others. According to this reconstruction, Ellenberg Trading was the company at the beginning of the payment chain, but the money was transferred from an account opened at Mizrahi Tefahot, Israel's third-largest bank.

"Who is Pauline Ellenberg? The answer could bring the world closer to discovering who launched the intelligence operation that led Hezbollah to purchase explosive-laden pagers," writes the Norwegian outlet VG. According to this reconstruction, the Hong Kong company transferred about 1.5 million euros to the Bulgarian company Norta Global, owned by a Norwegian (Rinson Jose, the Indian-Norwegian I wrote about in the last newsletter, is the subject of an international search warrant issued by Norwegian police as he disappeared after traveling to Boston for a conference).

The money transfers were made from an Israeli bank account. From Bulgaria, the money then went to a third company in Hungary, BAC Consulting, run by the Italian-Hungarian CEO Cristiana Barsony-Arcidiacono, which had a branch in Taiwan and was a distributor for Gold Apollo, according to the Taiwanese company's founder.

Norta Global allegedly transferred over one million euros to Budapest-based BAC in several installments between March 10, 2023 and June 7, 2024, according to the Hungarian outlet Telex. Meanwhile, BAC made dozens of transfers to the Taiwanese company Gold Apollo (for a total of over 717,000 euros). In addition, BAC sent money in four installments to a Hong Kong company, Apollo Systems Ltd, totaling over $122,000, as well as to the CEO of the same company ($43,000). BAC also paid a Hong Kong company for logistics services and another company that manufactured the pager displays.

However, according to the Shilin District Prosecutor's Office in Taiwan, BAC's Taiwan office is registered under the name Apollo Systems Ltd. The entire supply chain is a tangled web.

Where were the pagers built?

We still don't know one crucial piece of information: where the pagers were actually manufactured and how they got to Lebanon?

According to Telex, which gathered direct or indirect information from investigators who allegedly spoke with Cristiana Barsony-Arcidiacono, the shipment went from Taiwan to Hong Kong and then to Lebanon. The two European companies were used only for the commercial side, allowing Israeli intelligence (with or without their knowledge) to secretly pay for the pagers. It's unclear whether we're talking about a paper trail (virtual, but with supporting documents for the buyers) or an actual shipment.

The key question is: where were they assembled? Hezbollah leaders were wary of the risk of sabotage, so the pagers couldn't have come from Israel or its allies (at least on paper). In 2023, a purchase offer was made by an as-yet-unidentified woman who offered Taiwanese Apollo devices, a well-known brand and product line. According to the Washington Post, she was the former Middle East sales representative for the Taiwanese company, who had formed her own company and acquired a license to sell a line of pagers under the Apollo brand. It was this woman (who was unaware of the Israeli plan, as was Gold Apollo, according to Washington Post sources) who contacted Hezbollah officials.

In this version of events, the pagers were physically assembled in Israel under Mossad supervision and contained a battery pack that concealed a small amount of powerful explosives.

The legal debate

While open warfare, bombings and casualties are understandably the focus of media attention today, the issue of exploding pagers and walkie-talkies remains a unique case that has sparked a separate debate. This debate centers on the legality of their use, the impact on civilians, the transformation of everyday civilian items into weapons, and the consequences for the perception of the technology, its manufacturers, its suppliers, and the security of the supply chain.

Here are just a couple of articles I’ll link to on the topic: a piece from Foreign Policy, which raises many questions and objections about the initial operation, an editorial from The Guardian, which argues that the use of booby-trapped objects is illegal and unacceptable. Finally, there is an article on the civilian victims of the pager explosions from Courrier International.

CLIMATE TECH

The Northvolt Crisis

Since its founding in 2016 to build "the world's greenest battery," Swedish startup Northvolt has been the undisputed champion of Europe's climate tech sector, while its rapid rise has attracted billions of dollars in investment and orders from the world's biggest car companies, including Volkswagen, BMW, and Volvo.

But as Europe’s electric car market struggles, “much of this enthusiasm is starting to look like fantasy. In June, BMW cancelled a $2.2bn contract with Northvolt. And last week, amid a spiralling cashflow crisis, the battery manufacturer announced it was making 1,600 redundancies and suspending expansion of its Northvolt Ett factory in Skellefteå.

The Swedish government has ruled out a bailout for Northvolt, but the company’s fate threatens to be a political problem for Sweden and the EU.

The energy and industry minister, Ebba Busch, has said the Swedish government was “working actively” to help Northvolt continue operations and following developments closely, but it would not be appropriate for the state to step in with taxpayer loans or as a partner.

However, the prime minister, Ulf Kristersson, has said the government was helping to find new backers and ownership models, which he said they had discussed with Germany, which has also ruled out a financial lifeline for the firm.

Mats Engström, a senior policy fellow at the European Council on Foreign Relations thinktank (ECFR), said the company’s management had “overpromised and underdelivered”, adding that its future was on a knife-edge”.

Read the full article on The Guardian 

AI

GenAI as a commodity

Microsoft CEO Satya Nadella recently stated that large language models, which are driving the generative AI boom, are becoming "increasingly commoditized". As a result, it is becoming increasingly difficult to distinguish OpenAI's latest GPT from Anthropic's Claude or Google's Gemini.

An FT columnist writes: "OpenAI, without a working business model, is on track to burn through more than $5 billion in cash this year, with little prospect of stemming the flow in the short term". – An analysis by FT.

Meanwhile, OpenAI has raised a $6.6 billion funding round, achieving a stellar valuation - TechCrunch.

IN-DEPTH

PODCAST – The Consolation of Threat Intel

Renowned researcher Juan Andres Guerrero-Saade discusses the current state of threat intelligence, highlighting the need for an honest conversation about its direction and purpose. He talks about the growing disillusionment among those working in the field and the importance of regaining control. Juan also emphasizes the need for researchers, journalists, and even venture capitalists to contribute to a shift that could revitalize the industry.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.14 - 24 September 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• Exploded Pagers: a Reconstruction of Events

What follows is still a tentative, partial, slippery outline to help form a first idea for further investigation. No one here has explanations or solutions at hand, and anyone who claims otherwise is lying (unless they are one of the perpetrators, in which case other caveats would apply).

For this reason, I have limited my comments as much as possible and linked to the various sources I have collected. I've left out the political and legal implications for lack of space, but I may return to them in the future.

For now, the priority is to report the facts. [Carola Frediani]

The explosions

On the morning of September 17, thousands of pagers exploded in Lebanon and Syria. These were the devices used by Hezbollah, the Shiite militia that intervened in the conflict between Israel and Hamas after October 7. The group had ordered its members to abandon cell phones for fear they could be tracked or intercepted by Israel, and instead rely on a technology considered less traceable and less likely to become a target for assassination. In a televised speech more than six months ago, Secretary General Hassan Nasrallah urged Hezbollah members and their families in southern Lebanon to give up their cell phones. “Shut it off, bury it, put it in an iron chest and lock it up”, he said in a speech in February. “Do it for the sake of security and to protect the blood and dignity of people”.

On Thursday, after the explosions, Nasrallah said that Hezbollah's leadership still had old pagers, while the newer ones used in the attack had been delivered in the past six months. The group has launched an investigation into the blasts. "The enemy knew that the pager devices numbered 4,000", he added.

According to Lebanese security sources interviewed by CNN, Hezbollah purchased the pagers months ago, and on September 17, these devices exploded simultaneously after receiving a message (after ringing, according to Lebanese sources). A New York Times article quoted American officials as saying that Israel had placed explosive charges next to the battery of each pager, along with a detonation mechanism. Most of the pagers were reportedly Gold Apollo AR-924 models, but three other models were also included in the shipment (more details below).

The explosions initially caused more than 12 deaths (including two children) and more than 2,800 injuries (according to Lebanese sources, with the number rising), including the Iranian ambassador to Beirut (who claims not to have had a pager, but was near one and is now severely injured in the eyes). Panic spread, not only among Hezbollah militants: doctors at the American University of Beirut Medical Center were told to throw away their pagers, according to The Economist.

According to CNN, the attack was a joint operation by Mossad, Israel's intelligence agency, and the military. Israel refused to comment publicly on the blasts, although Israel's defense minister later said a "new era" of warfare was beginning, "tacitly acknowledging its role in shock twin attacks", CNN reported.

On September 18, an unspecified number of walkie-talkies also exploded in Lebanon (photos of an exploded walkie-talkie were published), initially causing several deaths and hundreds of injuries (the current toll is 25 dead and 600 injured, according to Lebanese sources cited by various media). In addition to the walkie-talkies, other devices were mentioned, but the information about them remains even more vague and confusing. "There are reports of several different devices blowing up", Al Jazeera wrote. "Chief among them are walkie-talkie radios, but there was also mention of mobile phones, laptops and even some solar energy systems. Several cars reportedly exploded as well, but it is not clear if those were caused by the car itself exploding or something inside it".

As for the walkie-talkies, images of the exploded devices showed labels with the name of the Japanese company ICOM, and they resembled the company's IC-V82 model. On Thursday, ICOM said that it was investigating the matter and could not confirm whether it had shipped the devices, in part because that model was discontinued 10 years ago.

The Flow of News

Before diving into some of the more confusing aspects of the story, let's recap the timeline and flow of news on September 17.

It's around noon GMT (3 p.m. in Lebanon) when the first reports emerge that Israel's internal security service (Shin Bet) had foiled a plot by a Lebanese armed group to assassinate a former senior defense official, and that the plan was to use explosives and a cell phone.

About an hour later, the first reports came from Lebanon that Hezbollah members had been injured by the explosions of their pagers. Another hour passes, and the Lebanese Ministry of Health issues an urgent statement saying that “large number of people with various injuries are arriving at Lebanese hospitals, and it has been initially determined that the injuries are related to the explosion of wireless devices that were in the possession of the injured”.

As a result, the Department urged all hospitals to be on high alert and increase their level of preparedness to respond to the emergency. It also advises all citizens who have wireless communication devices to stay away from them until further clarity is provided on the incident. In addition, the Department notes that most of the injuries are "to the face, especially the eyes, or to the hands or abdomen”.

Who Manufactured the Pagers

From the first images of the destroyed pagers, it was determined that they could have been made by Gold Apollo, a manufacturer based in Taiwan. A few hours later, however, Gold Apollo's founder, Hsu Ching-kuang, stated that the company did not manufacture the pagers used in the Lebanon explosions. Instead, they came from a European company, Bac Consulting KFT (based in Budapest), which had the right to use the Taiwanese company's trademark. In fact, "regarding the AR-924 pager model mentioned in the recent media reports [about Lebanon], we clarify that this model is produced and sold by BAC”, said Hsu Ching-kuang, adding that business relations between his company and Bac began three years ago and describing the Hungarian company's money transfers as "strange".

Bac Consulting had paid Gold Apollo from a Middle Eastern bank account that had been blocked at least once by Gold Apollo's Taiwanese bank, Hsu said.

The Hungarian Connection

Corporate records at the Hungarian Ministry of Justice show that Bac Consulting was registered as a company in May 2022, CBS News writes, with a CEO named Cristiana Barsony-Arcidiacono.

According to CBS, Barsony-Arcidiacono had also registered another company in her name in France in 2015, "specializing in business consulting and other activities", which was dissolved in 2016.

DW journalists visited Bac's official address in Budapest, but did not meet or see any employees. No one answered the door. An A4 sheet of paper with the name "Bac" printed on it was reportedly the only visible sign of the company. Residents of the building told DW that they were unaware of such a company and rarely saw mail sent to the address. According to data analyzed by DW, Bac Consulting recorded a net profit of 46,400 euros in 2023, on revenues of 546,000 euros.

The Hungarian government confirmed that Bac is a commercial intermediary with no production or operating facilities in Hungary. It has only one registered manager at the declared address, and the equipment mentioned has never been in Hungary. Meanwhile, Barsony-Arcidiacono's mother, contacted by AP in Sicily, said Friday that her daughter is now under the protection of Hungarian services. The government in Budapest hasn't confirmed.

The Bulgarian (and Norwegian) Connection

Just hours later, the Bulgarian connection also surfaced. It was brought to light by the Hungarian outlet Telex, which reported that Bac Consulting was merely an intermediary in the transaction. It claimed that Bac's CEO, Cristiana Barsony-Arcidiacono, had been dealing with a Bulgarian company, Norta Global Ltd, based in Sofia. "Although on paper it was BAC Consulting that signed the contract with Gold Apollo, Norta Global Ltd. was actually the one behind the deal. According to our information, it was the Bulgarian company, not BAC Consulting, that imported the pagers from Taiwan, and the Bulgarian company was also the one that arranged the delivery of the equipment, and sold it to Hezbollah", Telex writes.

According to documents reviewed by CBS News, Norta Global Ltd was registered as a company in Bulgaria in April 2022, with its sole owner being a Norwegian citizen named Rinson Jose. On its website - which is now offline - Norta Global Ltd was described as a company offering a range of services, from outsourcing to consulting, technology integration, payments and the processing of significant business transactions.

But who is Rinson Jose? The question sparked interest in the Indian media, because the Norwegian has roots in Kerala. The Indian publication Onmanorama profiled Jose, saying he was from the Wayanad district, a former seminarian, the son of a tailor, and later studied business administration. The newspaper also reported that it had contacted his family (in India), who said he was now in the US.

“Jose has a profile on Founders Nation, an Israeli business networking website, that lists multiple organizations with connections, either now or in the past, to the Israel Defense Forces as official partners", writes The Washington Post, adding that on Tuesday, the man was supposed to fly to Boston to attend a technology conference, but did not show up. Since then, his whereabouts have been unknown.

In any case, 1.6 million euros allegedly passed from the Bulgarian company Norta Global, owned by the Norwegian-Indian Rinson Jose, to the Hungarian company Bac, registered under Cristiana Barsony-Arcidiacono. Bac then outsourced the production and sale of the pagers to the Taiwanese company Gold Apollo, according to the Lebanese television station LBC.

An Elaborate Intelligence Project

Let's pause the reporting and move on to the analysis (preliminary, shaky, and to be taken with a grain of salt, like any analysis at this stage, in the face of such a complex and still unclear event).

Current and former U.S. and Israeli intelligence officials interviewed by the Washington Post painted the following picture. The explosions of the pagers (and later walkie-talkies and perhaps other devices) represented the culmination of a multiyear investment in penetrating Hezbollah's communications, logistics and supply structures. Long before the pagers were packed with explosives, some officials said, Israel's Mossad foreign intelligence agency and other services had developed a detailed understanding of "what Hezbollah needs, what are its gaps, which shell companies it works with, where they are, who are the contacts".

After mapping these networks, it was necessary to create an infrastructure of shell companies, where one sells to another, which sells to another, all to maneuver closer to Hezbollah's procurement agents, who rely on shell companies.

According to intelligence sources interviewed by ABC News, the operation was conceived 15 years ago, and the planning of the attack involved shell companies, with multiple layers of Israeli intelligence officers and assets providing cover for a legitimate company that manufactured the pagers. However, at least some of those involved in the operation did not know who they were actually working for.

"There’s a lot of front companies and cutouts and fake personas", Gavin Wilde, a former White House official and cybersecurity expert at the Carnegie Endowment for International Peace, told the Washington Post. "If there really are folks who were truly patsies, they’re going to have to live in fear the rest of their lives because [even if they were unaware of the plot] Hezbollah isn’t going to believe that".

Technical Analysis

But what kind of operation are we talking about? It appears to be a "supply chain interdiction" operation. Simply put, the crux of the attack lies in physically accessing and manipulating hardware devices and then controlling the supply. It is therefore primarily a traditional intelligence operation before it is anything else.

"The most obvious explanation is that a tiny quantity of explosive material was concealed inside the pagers. The devices would have exploded on receipt of a coded message. This is similar to a device initiated by mobile phone, but on a much smaller scale, and far more difficult to detect. For decades, armies have used sabotage tactics with varying amounts of explosives to disrupt supply chains, usually targeting insurgencies", British military explosives experts told the NGO AOAV.org.

Secretly attacking the supply chain is not a new technique in military and intelligence operations. For example, the U.S. National Security Agency has intercepted hardware and computers destined for foreign customers, inserted malware or other surveillance tools, and then repackaged them for delivery to specific foreign buyers, according to internal NSA documents from 2010.

Moreover, the creation or subsequent control of companies that manufacture or trade in communications equipment was immediately reminiscent of the multi-year CIA and German intelligence operation to manufacture and sell "backdoored" encryption machines.

However, what many observers say distinguishes this operation is the use of these well-established intelligence techniques to plant explosives (rather than surveillance tools) in communications devices, and to do so on a large scale (rather than in a single targeted killing, as Israel has done in the past). This was done in order to have them explode in unison after presumably succeeding in selling them to the enemy organization.

For some, the operation exemplifies the convergence of the cyber and physical domains (a topic that has been discussed for some time), namely the use of cyber attacks or cyber elements to cause physical harm. At the same time, it also highlights the gradual adoption of asymmetric tactics by states (and not just non-state actors).

How Did They Do It?

The Irish Information Security Forum (IISF) attempted to outline the phases of this attack:

Information Gathering, Infiltration, Planning

This requires knowledge of the targets' secret strategic decisions, purchasing decisions, supply chain networks, infiltration points, collection and transmission of secret information, and procurement of technical teams. It requires many resources typically associated with nation-states.

Insertion/Interception, Tampering or Re-engineering

Pager shipments can be intercepted at some point in the logistics chain. Alternatively, temporary business organizations can be created to handle ad hoc orders. However, the insertion of explosives requires careful design to ensure that the replaced or manufactured additional components are integrated without altering the appearance or basic functionality of the pagers.

Remote Activation

By their nature, pagers are designed to allow remote activation mechanisms such as test alarms, emergency transmission alarms, etc. This mechanism could use secure communication channels, possibly using satellite in combination with existing radio frequency networks. The synchronization of explosions in multiple locations indicates a high degree of coordination and real-time control.

Cyber Exploitation

Attackers would also need to "exploit vulnerabilities in the device's firmware, usage method, or communication protocols".

In addition, executing such an attack would present several technical challenges:

Miniaturization of Explosives

Integrating explosives into the device requires detailed engineering knowledge of both the electronics and the explosive components.

Secure Communication

Attackers must find a reliable and secure method to remotely trigger the detonation mechanism. This could be done by exploiting normal operating modes in combination with compromised firmware or other communication channels.

Synchronization

Coordinating the simultaneous detonation of thousands of pagers would require precise synchronization mechanisms. This could potentially be achieved with a centralized control system capable of sending activation signals to all modified devices at exactly the same time. Here ends the IISF's consideration, to which I refer for more technical details.

Why Pagers?

Pagers (beepers) leave a small electronic footprint compared to cell phones, making them less vulnerable to hacking, surveillance and location tracking. They are also easy to use, have battery life that lasts for days, and can receive messages without relying on the Internet or cellular networks.

“The Gold Apollo pagers can receive messages at a frequency of 450 to 470 megahertz", writes NBC. "The AR-924 model is alphanumeric, meaning it can send messages containing both numbers and letters. Like many other pagers, the AR-924 is a one-way device, meaning it is unable to send messages and instead only receives them".

"The idea is that the pager is always listening and has a unique address", explains to Digital Conflicts a cybersecurity expert who prefers to remain anonymous. "When you send a message to it (on a shared frequency, so you probably have a maximum number of simultaneous messages you can send per second for each frequency), it activates, beeps, decodes/decrypts the message, and sends it to you. Often these devices or protocols support broadcast messages. With a signal on the right frequency, at the right power, with the right encoding, you send a nice broadcast message (like an alert) that reaches all the pagers that pick up your radio signal. Now, just as the pager's processor/microcontroller decodes and displays the message and sends a signal to the ringtone buzzer, it can send a similar signal to a bomb if the message contains a predefined sequence. Of course, it's important that the sequence is long enough and random enough that no one accidentally sends the message too early. Perhaps it exploits a protocol violation. Of course, this is just speculation. We can only be more precise with more details".

According to Lebanese sources gathered by Reuters, the explosive used in the pagers was PETN. The NYT also says it was PETN. Cryptomuseum has collected all the technical specifications of the AR-924 on a very useful page.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.13 - 10 September 2024
Author: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• Telegram and France

• Is Telegram Really Privacy-Friendly

• If You Want Privacy, Use Signal

The Telegram Case

August certainly ended with a bang for those who follow platform developments, with the largely unexpected arrest of Pavel Durov, the 39-year-old founder of the Telegram app. In short, the Russian-born co-founder (who also holds Emirati, French, and Saint Kitts and Nevis passports) of the messaging platform (now almost a social media platform) was arrested as he stepped off his private jet in France. He was held in police custody for 24 hours, extended to 96 hours, and finally released on Wednesday, August 28, after being formally charged with a series of still vague charges. These charges seem to focus on the idea that Telegram is not cooperating enough with investigations into specific criminal activity on the platform. Durov was released on bail (set at 5 million euros), cannot leave France and must report to a police station twice a week.

France and Europe

European regulations have nothing to do with this case, however the EU Commission spokespeople felt compelled to clarify this. The initiative came from France and the Paris prosecutor's office. "Telegram's almost total lack of response to judicial requests was brought to the attention of the cybercrime section (J3) of the national organized crime court (JUNALCO) at the Paris prosecutor's office, in particular by the national office for minors (OFMIN)," reads a statement from the prosecutor's office, which includes a list of charges.

It all began in February 2024 when the Paris court opened a preliminary investigation and tasked OFMIN to conduct it. The Center for Combating Cybercrime (C3N) and the National Anti-Fraud Office (ONAF) subsequently took over the investigation.

According to Politico, Durov’s first issues stemmed from a separate investigation into child sexual abuse, in which a suspect allegedly used Telegram to lure underage girls by threatening to distribute CSAM (Child Sexual Abuse Material) on social media, including revealing a rape. However, when French authorities requested information to identify the suspect, Telegram reportedly did not respond, leading to a preliminary investigation into its reluctance to cooperate with law enforcement in a criminal matter.

Although Europe is not involved in the French investigation, it could soon step in thanks to the DSA, the Digital Services Act. Since February, the new law requires all platforms in the EU to protect users from illegal and harmful content. However, platforms with more than 45 million active monthly users in Europe are subject to stricter obligations and are regulated directly by the Commission (instead of national authorities). Telegram, which has come under scrutiny for its social media-like features (with groups and channels hosting thousands of users), had previously evaded stricter controls by claiming in February to have only 41 million users across the 27 EU countries. So Telegram should be overseen by Belgium's telecom authority BIPT as the so-called Digital Services Coordinator. But the Commission remains unconvinced.

According to The Financial Times, "Telegram said in February it had 41mn users in the EU. Under the EU’s Digital Services Act (DSA), Telegram was supposed to provide an updated number this month but did not, only declaring it had ‘significantly fewer than 45mn average monthly active recipients in the EU’. The failure to provide the new data puts Telegram in breach of the DSA, two EU officials said, added it was likely the EU’s probe would find the true number was above the threshold for ‘very large online platforms’. Such a designation brings greater obligations for compliance and content moderation, third-party auditing and mandatory data sharing with the European Commission".

Encryption

The charges also cite two laws regarding the import and provision of cryptology services/tools, for which documentation (a declaration of compliance) appears to be missing.

On a legal level, these French regulations are discussed here: "The supply, import and export of cryptology means in and from France are subject to a prior declaration or a prior authorisation of the French National Cybersecurity Agency (ANSSI), depending on technical functionalities and commercial operation (provision or import)".

This angle seems secondary for now, although some American media outlets, as noted by US journalist Marcy Wheeler, continue to discuss it as if it were a crime related to the use of encryption, when it appears to be about a registration issue. "Signal, easily the most protective encrypted messaging app, did register under this law when it first applied to offer Signal in French app stores. So, no, [Signal, unlike Telegram, is] not going to be prosecuted under that law, because they’re following the law".

The journalist's reference to Signal stems from comments made by one of Signal's lead developers (now at Apple), Frederic Jacobs, who recalls the bureaucratic task of getting the app published on the French App Store. He adds, "Good reminder that France is one of the rare countries in the world to have a declaration obligation when **importing** cryptography. While one doesn’t need approval, it is critical to file an accurate declaration of the encryption system to the Cybersecurity agency ANSSI. According to prosecutors, Telegram failed to accurately complete its declaration".

What Does Signal Say?

It’s worth quoting a response from Meredith Whittaker, president of Signal, to journalist Andy Greenberg (the whole interview is worth reading) after Durov’s arrest in France.

Greenberg asks Whittaker, who had just been in France and seemed interested in Europe as a possible base for Signal: "Does it really make sense to look for that kind of jurisdictional flexibility in Europe when Telegram founder Pavel Durov was just arrested in France? Does this give you pause about Signal’s future in the EU?".

Whittaker replies: "Well, to start: Telegram and Signal are very different applications with very different use cases. Telegram is a social media app that allows an individual to communicate with millions at once and doesn't provide meaningful privacy or end-to-end encryption. Signal is solely a private and secure communications app that has no social media features. So we're already talking about two different things.

And as of today [August 27, 2024] there are simply too many unanswered questions and too little concrete information about the specific rationale behind Durov’s arrest for me to give you an informed opinion. On the broader question, let's be real: There's no state in the world that has an unblemished record on encryption. There are also champions of private communications and expression everywhere in the world—including many in the French government and in Europe beyond. Those of us who’ve been fighting for privacy for the long term recognize that this is a persistent battle, with allies and adversaries everywhere. Trying to prioritize flexibility is not the same thing as idealizing one or another jurisdiction. We're clear-eyed about the waters we need to navigate, wherever they are. We see a huge amount of support and opportunity in Europe.

And there are really big differences between states, even in Europe. Germany is considering a law mandating end-to-end encryption, while Spain has been at the tip of the spear on pushing for undermining encryption. So again, it's not a monolith”.

Telegram and Durov’s Response

In recent days, there has been some discussion about the language used in Telegram’s FAQs, as some recent changes have been noticed. Specifically, a sentence that used to state: “All Telegram chats and group chats are private amongst their participants. We do not process any requests related to them” was reportedly removed. However, others point out that the same sentence still appears in other parts of the FAQ.

More interesting is Pavel Durov’s statement on his Telegram channel (signed as Du Rove, a playful twist on his name, which reportedly got on his controversial French passport, as Mediapart explained).

In essence, Durov seems to acknowledge that Telegram can do more to combat criminal activity, stating that it is not an "anarchic paradise" and expressing a willingness to engage.

Durov (or Du Rove, if you prefer) writes: "However, we hear voices saying that [what we’ve done] it’s not enough. Telegram’s abrupt increase in user count to 950M caused growing pains that made it easier for criminals to abuse our platform. That’s why I made it my personal goal to ensure we significantly improve things in this regard".

Is Telegram really privacy-friendly?

Privacy is often praised when discussing Telegram, but this reputation is highly overrated. Not only does Telegram collect metadata about users (such as who is messaging whom, how many messages were sent between the two, where, and at what time), but more importantly, unlike Signal, WhatsApp, and iMessage, it does not encrypt communications with end-to-end encryption by default.

Telegram's popularity is largely tied to its hybrid nature, functioning as both a messaging app and a highly permissive social network in terms of the content shared within it. Unlike WhatsApp, Telegram allows the creation of public channels and thematic groups that can be shared via links, but unlike a regular social network, it is much more tolerant of illegal or hateful content than Facebook or Instagram.

“Telegram looks much more like a social network that is not end-to-end encrypted,” John Scott-Railton, senior researcher at Citizen Lab, told The Verge. “And because of that, Telegram could potentially moderate or have access to those things, or be compelled to.

A lot of controversial web activity has moved to Telegram because of its permissiveness, making some people to compare it to other spaces like 4Chan or the Dark Web. But is that a fair comparison? Only partially. Telegram has previously shown that it is not insensitive to its abuse, and has autonomously shut down some of the app's most violent groups.  

More recently, Telegram has blocked extremist channels following media revelations, while the Stop Child Abuse channel, which fights the sharing of child sexual abuse material, claims that the platform has blocked over a thousand channels involved in this activity (though some believe that these channels are merely hidden, making them harder to find, rather than removed entirely).

So, Telegram is permissive toward illegal content, but it occasionally moderates it. Additionally, it does not encrypt end-to-end all communications, which would prevent it from providing any information to law enforcement, as already happened with Signal, but it refuses to do so. "Because Telegram does have this access, it puts a target on Durov for governmental attention in a way that would not be true if it really were an encrypted messenger”, said Scott-Railton.

Telegram has long operated on a razor's edge, attracting privacy-conscious users without implementing the kind of robust encryption that would protect all users and the platform itself. When child abuse or terrorism takes place in plain sight, platforms have a clear legal responsibility to moderate such content. This is true in both Europe and the United States.

Paradoxically, Durov's problems may be due in part to not protecting privacy enough, rather than protecting it too much. If all communications were encrypted end-to-end, some of the charges would be less valid, or even inadmissible. And this is all the more true because, of course, encryption is not illegal.

There is another problem that probably worries the CEOs of social media and messaging platforms: a lot of crime certainly happens on Facebook and other major social networks. And while Facebook and others try to moderate content, they don't always succeed. Since Telegram has also partially blocked illegal content, albeit poorly, one has to ask: how much lack of moderation is required before someone is arrested?

If You Want Privacy, Use Signal

Beyond Telegram's features, Durov's arrest has brought privacy back into the spotlight, making it a target once again for those who believe that privacy of communications is primarily for the protection of criminals and extremists, overlooking how important privacy is for protecting political dissidents in undemocratic countries or for protecting communications between journalists and their sources. Even the European Commission has recommended that its staff use Signal, a much more secure app than Telegram.

However, Signal too has often come under fire. Applications that prevent law enforcement from accessing messages and user metadata have been criticized not only by authoritarian regimes like China (which blocked the app in March 2021), but also by some politicians in democracies like the United States or France and even some children's rights organizations.

Signal also protects those who use privacy for far more noble reasons: Hong Kong activists, Black Lives Matter protesters, and anti-coup protesters in Myanmar are just a few of the groups that have used the encrypted app to communicate and organize. The United Nations itself has recommended using Signal to send journalists and NGOs evidence of abuses by totalitarian regimes.

For better or worse, Signal (which has about 70 million users compared to Telegram’s 1 billion and WhatsApp’s 2.7 billion) is the platform of choice for those who want to keep their conversations and metadata private.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.12 - 16 July 2024
Author: Andrea Daniele Signorelli

In this issue:

• The Russian Digital Gulag

• The European Digital Identity

• The European Union against Elon Musk and X

How Russia Built Its Digital Gulag

Andrei Chernyshov had just entered the Moscow metro, on his way to a May 2022 protest against the war in Ukraine. Within minutes, the 51-year-old – who had participated in another demonstration just a week before – was detained by law enforcement officials, who took him to a police station without further explanation.

Chernyshov wasn’t followed or even recognized by any police officers. Instead, he was identified and reported by Sfera, a facial recognition system used throughout the Moscow metro network.

According to OVD, a Russian human rights group, more than 140 people were arrested in 2022 alone as a result of alerts from Sfera, which captures metro passengers as they pass through the turnstiles and compares their images with those in its database. If the system finds a match, it alerts the police, who can intervene immediately.

Launched in September 2020, Sfera was introduced as a tool to quickly identify known criminals and thieves. In an authoritarian state like Russia, few were surprised when – as the digital rights group Roskomsvoboda explained to Wired USA – law enforcement began uploading photos of opposition leaders, prominent activists, and, over time, many people who had simply participated in protests unfavorable to the government. A tool promoted as a deterrent to crime quickly became a digital battering ram of repression, used to arrest or simply intimidate opponents of the Putin regime.

The facial recognition system, active across the entire Moscow metro network, is just one part of a vast and ever-expanding surveillance network known as SafeCity. The origins of this system, which we will discuss shortly, date back to the early 2010s. It was during the major protests of 2011-12, which were largely organized online, that the Kremlin decided to take seriously the threat posed by digital communications.

Soon, laws were enacted to block undesirable websites, while other laws required telephone companies and internet service providers to store phone calls and messages sent over their networks and to share that information with the police upon request. In 2014, new and stricter "anti-extremism" laws came into force, targeting social media users based on the content they posted, shared, or even just liked.

During this period, algorithms capable of quickly identifying undesirable content on online platforms began to be deployed, while Facebook, Instagram, Twitter and the Russian social network VKontakte were used by law enforcement to collect photographs of activists and undesirables. These images are likely part of the databases used for facial recognition today.

In addition, NTech launched the FindFace app in 2016, allowing anyone to recognize faces captured with their smartphone by comparing them with images collected from VKontakte. This disturbing app, which was downloaded by more than 1 million people in a few months and is no longer active, proved to be primarily a useful tool for training the algorithm now used in all facial recognition systems in Russia.

Thanks to these early experiments, in 2017 the city of Moscow finally announced the launch of SafeCity, initially equipped with 160,000 cameras (which has since grown to around 250,000), more than 3,000 of which had facial recognition capabilities (which has now nearly doubled). SafeCity, of which Sfera is only one part and which is managed by the Ministry of Transport, was launched in time for the 2018 FIFA World Cup in Russia and was further expanded in 2020, ostensibly to protect public health by quickly identifying those who violated the lockdowns during the Covid-19 pandemic.

Surveillance cameras, however, are not the only element. According to the Moscow municipality's website, SafeCity collects data from 169 different digital sources, using voice recognition devices, data collection systems based on the geolocation of mobile phones, automatic license plate recognition, and much more.

The technological infrastructure was designed – according to Wired – by Russian companies such as the aforementioned Ntech, Tevian, Rostec, and VisionLabs, but components for SafeCity were also supplied by US giants such as Nvidia and Intel (which have stated that they stopped exporting to Russia after the invasion of Ukraine), South Korean companies such as Samsung (which also stopped exporting), and Chinese companies such as Hikvision.

The work of Russian companies involved in SafeCity has been richly rewarded: in 2022 their business volume grew by 30-35 percent over the previous year, partly due – as Kommersant reports – to trade agreements with Middle Eastern, Southeast Asian and South American countries. Those companies can also count on numerous subsidies and tax exemptions guaranteed by the "Strategic Plan for Artificial Intelligence".

Meanwhile, SafeCity continues to grow and expand. In 2020, the government announced its intention to invest $1.3 billion to create similar systems across Russia, starting with cities like St. Petersburg, Novosibirsk and Kazan. Another more recent goal is to centralize video feeds from all cameras across Russian territory to monitor people of interest on a national level (the purpose is also to identify people trying to avoid conscription).

In addition, Rostec is reportedly developing an algorithm capable of analyzing video footage and information circulating in the media and on social networks to predict the formation of anti-government demonstrations. "Russian authorities should halt the expansion of their irresponsible and unregulated facial recognition systems," said Hugh Williamson, Europe and Central Asia director at Human Rights Watch, in a report. "Privacy concerns outweigh the purported security benefits. Fundamental rights must also be protected from the Kremlin's technological abuses".

These words are met with total indifference by the Kremlin: dissidents who in the past tried to appeal to the European Court of Human Rights are now faced with Russia's decision to withdraw from this institution, while the law known as "Experiments with Artificial Intelligence" allows the use of these technologies without complying with personal data regulations. Opposition lawmakers who have requested more information about the operation, databases and effectiveness of these systems (which have already led to the arrest of people mistaken for others) have encountered a wall of secrecy.

Thus, this opaque network of control based on artificial intelligence algorithms continues to restrict the operating space of opponents and dissidents, both online and in the physical world, creating what is increasingly being called a "digital gulag."

The European Digital Identity

By 2030, 100% of European Union citizens should have a digital identity system: a smartphone wallet to store ID cards, driving licenses or health cards. The launch is planned for 2026, but there are still many obstacles to overcome, as evidenced by a call for new projects that may overlap with ongoing experiments that will end in 2025. Then there's the issue of security: the more personal documents are stored on smartphones, the more important it is to ensure that they are adequately protected. According to experts, the technical standards adopted so far are not sufficient. The risk is that the European digital identity could become a nightmare for our privacy.

The European Union against Elon Musk and X

Elon Musk's social media site X has been accused by the European Union of violating its rules on online content. The EU's tech watchdog highlighted the potential for "verified" blue tick accounts to deceive users, as anyone can pay for verification, leading to abuse by malicious actors. The investigation, under the Digital Services Act (DSA), could result in X being fined up to 6% of its global revenue and forced to change its operations in the EU. Musk and X CEO Linda Yaccarino defended the platform, arguing that they’ve implemented a democratized verification system. The regulator found that the blue tick system misled users about the authenticity of accounts. X can now defend itself or make changes to comply with the DSA. EU Commissioner Thierry Breton emphasized the need for trustworthy verification, while the Commission denied Musk's censorship claims, stating that its goal is to ensure a safe and fair online environment.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

N.11 - 2 July 2024
Author: Andrea Daniele Signorelli

In this issue:

• Europe Versus the Artificial Intelligence Oligopoly

• Apple Rebels Against the European Union

• European Tech Jewels Face Challenges

Europe Versus the Artificial Intelligence Oligopoly

For some time now, and especially since the introduction of the Digital Markets Act and the Digital Services Act, the European Union has been paying attention to the concentration of power held by Big Tech companies, their abuse of dominant positions, and the obstacles they put in the way of anyone who threatens their tight grip on the market.

These issues are also emerging in the field of artificial intelligence and have led the EU to announce an investigation into the partnership between Microsoft and OpenAI (which produces ChatGPT) and between Samsung and Google. As Politico writes, "Margrethe Vestager, the EU's competition commissioner, said officials had concluded that they couldn't review Microsoft's $13 billion investment in OpenAI under merger rules but would send the companies follow-up questions under antitrust rules ‘to understand whether certain exclusivity clauses could have a negative impact on competitors’".

The EU executive also wants "to better understand the effects of Google’s arrangement with Samsung to pre-install its small model 'Gemini nano' on certain Samsung devices," she said. "The risk we see is that big tech companies could make it difficult for smaller foundation model developers to reach end users".

“‘The large foundational models behind AI services require enormous amounts of data, computing power, cloud infrastructure, and talent, which only a few players possess’, Vestager said. According to her, European antitrust authorities are also monitoring so-called ‘acqui-hires’, where a company buys another to acquire talented workers (as may have been the case with Microsoft and AI developer Inflection). ‘We will ensure that these practices do not escape our merger control rules’, Vestager affirmed”.

Apple Takes On the European Union

Microsoft and Google are not the only companies facing new problems with the European Union. On June 24, the EU announced that it may soon fine Apple for violating the Digital Markets Act. According to the EU, Apple is preventing app developers from freely directing App Store users to cheaper alternatives. If the EU's preliminary investigation is confirmed, Apple could face a fine of up to $38 billion (10% of its annual revenue under the DMA).

Unlike what has happened so far, there is a sense that Apple intends to retaliate against the new European threats. Or that, in any case, the time when Big Tech bowed to EU dictates without much resistance may be coming to an end. As Wired Italy notes, "assuming that Apple was already aware of the European Union's intentions, it seemed suspicious that just a few days earlier, on June 21, Apple announced that its highly anticipated Apple Intelligence would be launched worldwide, but not in the European Union".

"The whole world will be able to see how Apple intends to use artificial intelligence to help us in our daily lives, but not the 450 million inhabitants of the European Union. As many have pointed out, Apple's move is preemptive: the European Union has made no statements regarding Apple Intelligence and has not (yet) put obstacles in the way of Tim Cook's new project. It was Apple that voluntarily decided to indefinitely postpone the launch of Apple Intelligence on our continent".

Apple's decision stems from fears that Europe could force the company to hand over to third parties all the information it collects about its users. The information is collected so that Apple Intelligence can help users better manage their professional and daily life – reminding us of commitments, retrieving the documents we need, scheduling appointments according to our availability, and much more (including a significant improvement to Siri, which has so far fallen short of expectations).

What stands out, however, is Apple’s decision not to roll out Apple Intelligence even before the European Union raised any issues. This is an unprecedented move: until now, Silicon Valley companies have always followed the motto "ask forgiveness, not permission" (the latest example being Meta's attempt to train its AIs with our data).

"The feeling is that Apple is now trying to present Europe with an unprecedented situation: Cupertino is threatening not to comply with strict European regulations, preferring to forgo the introduction of some important innovations altogether and risking turning us into a second-rate technology market".

Challenges for European Tech Jewels

Over the past few months, worrying news has emerged about two of the European Union's most important tech companies, both based in Sweden: the streaming giant Spotify and the climate tech unicorn Northvolt (batteries). Let’s start with Northvolt: the company has raised $15 billion in total and, as Sifted writes, "carries the weight of Europe’s domestic battery hopes on its shoulders."

Recently, however, some difficulties have emerged: "Last week, it was reported that a €2bn contract Northvolt had with German carmaker BMW — which is a shareholder in the company — had been canceled due to production delays. The contract, which was signed in 2020, was worth around 4% of Northvolt’s order book, which stands at $55bn according to the company’s 2022 annual report. An industry source told Sifted that Northvolt was two years behind schedule on the order when it was canceled".

To make matters worse, plans to open a fourth battery factory in Borlänge, also in Sweden, have been canceled. The reason for these problems, which are similar to those experienced by other companies, could be linked to oversupply. "Demand for lithium-ion batteries for both EVs and stationary storage came in at around 950 GWh last year. Global battery manufacturing capacity was more than twice that, at close to 2,600 GWh".

Some bad news also comes from the typically turbulent front of Spotify, which announced in June that it would again raise subscription prices again (for now, only in the U.S.), less than a year after the last increase, which also affected Europe.

"As in 2023", Slate notes, "the updated cost tiers have been imposed in response to persistent profitability concerns, most urgently stemming from the costs of Spotify’s aggressive push into audiobooks, a venture that has been a heavier lift than the company likely expected."

"On Spotify’s most recent quarterly earnings call, [Daniel Ek, Spotify CEO] sounded flabbergasted that in the aftermath of the company’s biggest-ever round of layoffs—17 percent of the workforce, about 1,500 employees, axed in December—there had been an ensuing impact on basic operations and even user growth". In a generally difficult scenario for tech startups, Spotify's staff cuts were justified by rising expenses and declining stock market value.

However, it is the musicians—the ones who make Spotify what it is—who are the least happy with the direction the company is taking. By raising prices, focusing on other areas (like audiobooks or video podcasts), cutting staff, and still not having found a business model that allows for fair compensation to artists, Spotify seems less interested in providing a quality product and more interested in pleasing shareholders. Spotify seems to be following the tech trend that sociologist Cory Doctorow calls "enshittification”.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.
Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks

Subscribe now

.
N.10 - 19 June 2024
Authors: Carola Frediani and Andrea Daniele Signorelli

In this issue:

• Hospitals and Healthcare Facilities Under Attack (Again)

• How Many Jobs Will Be Replaced By Artificial Intelligence?

• In brief

CYBERSECURITY
Hospitals and Healthcare Facilities Under Attack (Again)

The healthcare sector continues to suffer from cyber attacks that cause data breaches and disruptions, both in Italy and abroad. Between June 5 and 6, the IT network of Asst Rhodense – which includes the Garbagnate, Rho, and Bollate hospitals in Milan – suffered a cyberattack, Asst Rhodense reported on its Facebook page (the site was still unavailable several days later). Non-urgent surgeries, bookings, scheduled hospital admissions were suspended. Emergency rooms in Garbagnate and Rho remained active, but ambulance service was suspended. For emergencies, Asst Rhodense advised citizens to use other facilities.

According to Corriere.it, the attack also affected the Passirana aids, community houses, other local clinics: "It is estimated that it will take at least two weeks to return to full functionality. (...) Ambulances have been diverted, non-urgent hospitalizations and surgeries have been postponed, and nuclear medicine activities (such as bone density scans), radiology (CT scans, MRIs, X-rays and mammograms) and laboratory tests have been halted".
On June 12, Asst Rhodense provided an update: "Lab analysis services, booking activities and phlebotomy points are still suspended (...). Technicians are working to ensure the resumption of all activities, but it is not yet possible to define the timetable for the full restoration of the IT infrastructure".

Less publicized was an attack on the Marche Regional Health Agency a few days earlier, which affected the booking service. According to Rainews, "for a long time it was impossible to use all the health booking channels: from the physical counters in hospitals and clinics to the pharmacies participating in the project, as well as the call center and the app".

Unfortunately, this is a scenario we have seen many times in recent years. The latest incident was the cyber attack on Synlab Italia, part of a European network providing medical diagnostic services. The attack (a type of ransomware, as explained on their website, and similar to most attacks in the healthcare sector, where data is copied and encrypted and then a ransom is demanded to either decrypt it or prevent its online disclosure) first blocked several services, in particular all laboratory analytical activities, including the logistics service for sample collection. It then led to the online disclosure of company and patient/client data.

"In more than 380 Synlab laboratories – spread across Lombardy, Veneto, Friuli-Venezia Giulia, Emilia-Romagna, Lazio, Liguria, Campania and Tuscany – around 35 million tests are carried out every year," SkyTG24 writes. "At the moment it is not known how many people have been affected by the cyber attack, only that 1.5 terabytes of data have been published."

"The secure downloading of files is in progress and has been entrusted to a highly specialized company", Synlab said on May 23. "SYNLAB has immediately implemented various measures to combat the attack, including different strategies for analyzing the exfiltrated (copied) data. Due to the volumes involved and the operational complexities encountered during the analysis, it is not possible at this time to assess the position of each individual affected".

If you are one of the affected users, the most important thing is to be aware that you may be the target of fraud attempts by entities with various information about you, such as your tax code, address, or other data that can make an SMS, email, or phone call seem more credible. SYNLAB Italia also provides updated information on its website.

But the attacks on healthcare are not over. In early June, a number of London hospitals were forced to suspend many activities due to a cyber attack on their diagnostic service provider, Synnovis. Synnovis is a partnership between SYNLAB UK & Ireland and a network of English hospitals, Guy's and St. Thomas and King's College Hospital, covering southeast London. In a June 3 email sent to staff and seen by Digital Health News, Professor Ian Abbs, CEO of Guy's and St Thomas NHS Foundation Trust (a semi-autonomous unit of the NHS), said that an "ongoing critical incident" was having a significant impact on pathology services. “I can confirm that our pathology partner Synnovis experienced a major IT incident earlier today (...) This is having a major impact on the delivery of our services, with blood transfusions being particularly affected".

"It is an isolated incident to Synnovis with no connection to the cyber-attack on SYNLAB Italy on 18 April 2024", communicated SYNLAB AG. "The rest of the SYNLAB Group including the other SYNLAB facilities in the UK are not impacted".

Meanwhile, the effects on English hospitals were visible for days. On June 10, the transplant and transfusion service urged O-positive and O-negative blood donors to book an appointment at one of 25 centers to increase supplies because hospitals affected by the cyberattack could not match patients' blood as quickly as usual.

In a message to trainee doctors at Guy's and St Thomas' Trust, students were asked to volunteer for 10 or 12-hour shifts, the BBC reports. An NHS London spokesperson said staff were working "around the clock" to minimize "the significant disruption to patient care".

In the past days, the aftermath of the attack also affected other hospitals. According to The Independent, "more than 200 emergency and life-saving operations, including those which should be done within 24 hours, had to be cancelled by Guy’s and St Thomas’ Foundation Trust (GSTT) and King’s College University Hospital NHS Foundation Trust. (...) More than a third of procedures and operations have been cancelled, which includes over 3,000 non-surgical appointments and hundreds of patients who have been referred for urgent cancer diagnosis". It will take months to recover from the attack, sources told The Guardian.

According to Ciaran Martin, the former head of the UK's National Cyber Security Centre, the Qilin cybercriminal group is responsible for the attack. These groups, as we've often reported, target healthcare facilities and hospitals because the severity of service interruptions and the theft of sensitive data make them more vulnerable to extortion. These are complex structures, with legacy systems, difficulties in updating some software, a multitude of suppliers, and only in recent years have they started to take cybersecurity seriously. But it is no longer acceptable for them to be so exposed to attacks that have a significant operational impact, even on transfusions, emergency room admissions, or multiple healthcare interventions.

Now is the time for systemic interventions.

AI AND WORK
How Many Jobs Will Be Replaced By Artificial Intelligence?

What will be the impact of AI on jobs? This is one of the recurring questions since the race for generative AI began, and it's also the most difficult (perhaps impossible at this point) to answer. Among those who believe that AI will soon replace many jobs is Geoff Hinton, a pioneer in the development of AI and deep learning. Hinton has begun lobbying for a universal basic income in the UK (there is an unusual convergence between AI gurus and basic income movements. It should be noted that Hinton is unique in this regard, as he has always been openly progressive, even calling himself a "socialist"). In particular, Hinton has an interesting and different point of view compared to figures like Sam Altman or Elon Musk. "He said", writes the BBC, “that while he believes AI will increase productivity and wealth, the money will go to the rich ‘and not to the people whose jobs will be lost, and that's going to be very bad for society’”.

That is one scenario. But there is another one, especially in the short term, that is very close to what we would predict if we had to bet a pizza on it. That is, there could be partial replacement, not because AI can really replace all these jobs, but because it can become an excellent excuse to cut costs, optimize, reduce, and precarize.

Brian Merchant talks about this scenario in a recent post from his newsletter, titled after his book, which we never tire of recommending: Blood in the Machine. The tech journalist and historian of the Luddites writes: “If history is any indicator, there’s no catastrophic, Great Depression-level mass job loss event on the horizon, but that won’t stop bosses from trying to use AI to replace certain jobs, keep pay lower, and demand you and your coworkers produce more work. Your bosses’ measuring stick for AI output isn’t whether it’s so good it can replace you wholesale, but if it’s “good enough” to justify the savings on labor costs. Certain industries are uniquely vulnerable to generative AI output, and are more threatened than others. After workplaces are disrupted by generative AI, employees not laid off or reassigned will have to pick up the pieces, often with more work than before. Whether or not your boss adopts generative AI directly or your industry is threatened, the technology can be used as leverage against you and your colleagues. Generative AI may or may not be a flash in the pan, but it can be a wrecking ball to your job regardless, especially if your boss is looking for an excuse to cut costs or to appear innovative — and you should be ready”.

IN-BRIEF

JOURNALISM
Portrait of Eliot Higgins and Bellingcat

Wired USA writes: "Today, Bellingcat is the world’s foremost open source intelligence agency. From his home in the UK, Higgins oversees a staff of nearly 40 employees who have used an evolving set of online forensic techniques to investigate everything from the 2014 shoot-down of Malaysia Airlines Flight 17 over Ukraine to a 2020 dognapping to the various plots to kill Russian dissident Alexei Navalny. Bellingcat operates as an NGO headquartered in the Netherlands but is in demand everywhere: Its staffers train newsrooms and conduct workshops; they unearth war crimes; their forensic evidence is increasingly part of court trials”.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.
Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.9 - 28 May 2024
Authors: Carola Frediani and Andrea Daniele Signorelli

In this issue:
- What European Groups Are Saying About Digital Policy
- Looking for an Italian ChatGPT
- Company defrauded with deepfake
- In Brief

EU
What European Groups Are Saying About Digital Policy

In recent years, the European Union has become the watchdog of the digital world, attempting through its laws to curb the dominance of Big Tech — albeit not without contradictions and with effectiveness yet to be proven. For these reasons, one might have expected digital policy to play an important role in the run-up to the European elections next June.

As we will see, this has not been the case. With a few exceptions — and also because of the various emergencies that our continent is facing — proposals on digital issues are sometimes confused, sometimes reduced to a thin statement of intent, and sometimes absent altogether.

More generally, it is noted that European parties traditionally positioned on the right pay less attention to digital issues than those on the left. And overall, the focus is often on artificial intelligence, neglecting fundamental issues that perhaps deserve more attention (for example, reducing the digital divide or the need to reduce the growing environmental impact of new technologies).

We ranked the European parties according to their parliamentary presence. Here are the proposals on digital issues for the upcoming European elections.

European People's Party
The EPP's position on digital issues was outlined in more detail in the "Position Paper on Digital Policy" adopted during the Political Assembly in February 2022. This document is therefore no longer new, but it still represents the most comprehensive resource we have to interpret the position of the main European group on the topic of new technologies.

One of the most important aspects highlighted in this document is the need for Europe to not just introduce new regulations: "We need to produce not simply the right set of rules but also an enabling and coherent environment for our companies to thrive and grow in the digital economy. Digital policies should therefore always be discussed with the view to strengthen, harmonize, and complete the Digital Single Market (DSM)".

What does “Digital Single Market” mean? An example of measures taken in this regard is the abolition of roaming within the EU, allowing us to navigate online at no extra cost even when we are in another EU country. Other measures include the portability of online content on a continental scale, or the need to unlock e-commerce by ending geographic blocks (for more details, you can read here).

On artificial intelligence, the European People's Party affirms the importance of the AI Act, but warns against excessive regulation: "There should be limits on the use of AI applications that risk exploiting vulnerable groups. At the same time, we caution against overly prescriptive regulation as many sectors are already using and developing AI. That could hinder EU industry’s growth, discourage investments into AI start-ups, or delay or disincentivize innovations on the EU market".

Socialists & Democrats
The goal of the main European left-wing group’s on digital issues is made clear from the title of the chapter dedicated to this topic: “Our Inclusive Digital Europe.” An interesting aspect of the European digital program is the short survey at the top, asking voters to express what they think is the priority among AI regulation, internet access for all, protection for platform workers (e.g., riders, Uber drivers), and online consumer protection. Currently, the need to regulate AI has garnered the majority of votes (57%), while protecting platform workers is in last place (only 7%).

On artificial intelligence, the program reads: “We must be vigilant of Artificial Intelligence (AI). The European Union must take action to ensure that our values are upheld and that AI is used in a responsible and safe manner. We need clear and strong rules to guarantee fairness and transparency in AI development and use. No one should have to sacrifice their fundamental rights for the sake of technological advancement. That's why we must demand that high-risk AI undergoes a thorough assessment for biases and discrimination, and if it poses a risk to our rights, it must be banned. Human oversight and transparency requirements should always be in place to ensure that AI is used ethically and responsibly. The use of AI in the workplace must be subject to strong regulations that protect workers' rights and dignity and can in no way lead to the exploitation or surveillance of workers’ performance. Any worker who has been harmed by the use of AI must have the right to seek redress and hold corporations accountable”.
All elements that, it should be noted, are often found in the AI Act.

Among other things, S&D argues that the right to Internet access should be considered a fundamental right: “Everyone should be able to use the internet to access government services, like paying taxes or applying for benefits - though no one should be forced to, especially where equal access is not yet guaranteed”.

Renew
The liberal group has recently published a paper titled “Securing the openness of a global internet.” It is a very technical paper but interesting to analyze from a geopolitical perspective. In line with its liberal positions, Renew’s priority seems to be to counter the growing "splinternet", that is, the tendency to fragment the global network into a series of small internets referring to the geopolitical area of affiliation.

Despite the lack of a dedicated digital policy section, Renew’s website indicates the group's attention to the creation of the digital euro (the European electronic currency issued by the ECB, still under study) and the need for further regulation of cryptocurrencies. Regarding artificial intelligence, Renew highlights the achievements made with the AI Act and even more the importance of avoiding Big Tech's monopoly in the sector.

The Greens
The European Greens pay particular attention to the environmental impact of new technologies, a crucial yet often underestimated issue. In the section dedicated to this topic, titled “Green our Tech”, it reads: “We all love our tech! That’s why, when our phone or favorite appliance breaks, we don’t want to be forced to throw it away and have to spend loads of money on a new one. We want to be able to repair it, replace broken parts, maybe even recycle it into something new”.

“We don’t want our appliances filling up dumpsites, and polluting the earth and water. We don’t want perfectly good raw materials to be shipped abroad in huge containers, when we could use them to relaunch a ‘repair economy’ that would create thousands of jobs”.
Between the circular economy, the right to repair, and the need to limit emissions from the tech sector, the Greens' digital priorities are clear and consistent with their environmental stance. What is perhaps missing is an overall vision for other aspects of the digital sphere.

Conservatives and Reformists
In the manifesto published last April, there are some points – although predictably secondary compared to the fight against immigration and the need to "revise the Green Deal" – related to the digital world. "We are committed to empowering small and medium-sized enterprises (SMEs) by cutting down on unnecessary red tape, calling for a temporary halt on new EU rules for small businesses, instead directing resources towards implementing and enforcing existing legislation, and modernising the EU's digital landscape to spur innovation and investment in cutting-edge technologies like AI, 5G/6G, and quantum computing", reads the manifesto. This is about all that can be found on the site regarding digital issues.

Identity and Democracy
The situation is even worse with Identity and Democracy, the far-right group. Although ID has long published its manifesto, it contains only a very brief reference to European policies: “Defense of individual freedoms and protection of freedom of expression, in particular digital freedoms”.

The Left
Finally, the Left group. In the manifesto published for the European elections, regarding digital issues, it reads: “We welcome the European Parliament’s attempt to regulate the use of artificial intelligence (AI) and support the ban on biometric surveillance, emotion recognition, and predictive policing by AI systems. However, the EP’s draft focuses on market-based regulation and thus misses the essential issue: the need for transparency and accountability (democratic and societal control) of technological innovation with regard to its social and environmental impacts”.

The Left's proposals include: “Effective regulation of AI with the humans-in-control principle must be incorporated into EU law; any regulation of AI by the EU must take into account the impact of AI on the world of work and social systems, and exclude possible discriminatory uses of AI or racially-biased systems; the introduction of AI in high-risk areas and mega-data transactions must be identified and prohibited; the use of AI in weapons systems must be prohibited”.

This is an excerpt of the original article written by one of our authors on Wired Italy (Italian only)

AI, LLM, ITALY
Looking for an Italian ChatGPT

“A strong dataset in Italian is still missing. And this is the main problem for having a national LLM champion. The question, at this point, is clear: why has this systematization work not been done? And who is responsible?”.
“The answer is that collecting these data, adding tags and metadata, is a long and complex operation,” explains the CTO of an important company, who agreed to speak on condition of anonymity.
“No one has done this systematization work before. And to get it done, the intervention of the State is needed, but also that of private entities.”
The CTO then returns to the commercial issue: “Whoever can sign profitable contracts will have the greatest advantage in the future”.
In any case, the article lists some of the most advanced projects in Italy regarding LLMs. This is a non-exhaustive and continuously updated list, but one that offers a good snapshot.
Read the full article (Italian only).

CYBERSECURITY
Company defrauded with deepfake

The British design and engineering firm Arup has confirmed that it was defrauded using deepfake technology in February of this year. The company lost $25 million after one of its Hong Kong employees was tricked into sending money to the wrong bank account. The employee said that he transferred the money after the fraudsters invited him to a video call with deepfake versions of his colleagues and the company's CFO.
A company spokesperson confirmed to CNN that “fake images and voices” were used. The Hong Kong police also mentioned “deepfake creations.”
According to the police, the employee initially suspected that he had received a phishing email from the company's UK office, as it specified the need for a secret transaction. However, after the video call, the employee overcame his doubts because the other people on the call looked and sounded like colleagues he recognized  – CNN

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.
Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.8 - 14 May 2024
Authors: Carola Frediani and Andrea Daniele Signorelli

In this issue:
- Poland continues investigation into alleged Pegasus abuse
- Managing the risks of generative AI
- The European AI startups
- In Brief

EUROPE/SPYWARE
Poland continues investigation into alleged Pegasus abuse

They reported abuses by their military police superiors and were placed under surveillance. In Poland, prosecutors investigating the use of Pegasus spyware in the country have called the first 31 people believed to have been spied on to testify.
The first group includes two former military police officers, Joanna Jałocha (sub-lieutenant) and Karolina Marchlewska (corporal), writes the Polish newspaper Onet. Both have been summoned as witnesses by the prosecutor's office in the case of abuse of power by public officials in the use of Pegasus.
"Our lives and health were destroyed. For seven years, Joanna and I were targeted, harassed, slandered, deprived of the opportunity to serve in the military, which was our passion. And today we find out that we were under surveillance using Pegasus. This must be explained and the perpetrators punished", said Karolina Marchlewska.

The new government of Prime Minister Donald Tusk, which took office in December, has pledged to investigate the alleged misuse of Pegasus. As a result, a special parliamentary committee was set up in February to investigate the use of spyware. The following month, the committee called as its first witness the leader of the PiS, Jarosław Kaczyński, the party in power during the alleged abuses.

Among the first 31 alleged victims surveilled by Pegasus is Krzysztof Brejza, a member of Tusk's Civic Platform (PO) party who was targeted while leading the PO's 2019 election campaign, then the main opposition to the PiS government, Notes from Poland writes.
There are nearly 600 people in Poland who are believed to have been under surveillance with Pegasus between 2017 and 2022 under the previous government, according to the current government's Justice Minister. The minister in charge of security services added that while many legitimate targets were monitored, there were "too many cases" where Pegasus was used against people who were simply considered "inconvenient" to the previous government.

According to the Polish newspaper Gazeta Wyborcza, the spyware was acquired by Poland's Central Anticorruption Bureau (CBA) in the autumn of 2017. The newspaper and the Polish broadcaster TVP report that "the CBA bought the spy software for 33.4 million zlotys (€7.84 million) from the Polish Matic company, which in turn acquired it from the Israeli NSO Group for 25 million zlotys (€5.86 million). Matic had an Interior Ministry license for IT services and arms dealing".

According to an AP investigation in December 2021 (based on research by Citizen Lab), just before the 2019 European Parliament and Polish parliamentary elections, Pegasus was allegedly used to spy on the phone of Senator Brejza.

As the European elections approach, it becomes clear why the issue of spyware use in Europe is becoming particularly heated.

US restrictions on individuals involved in the sale/development of commercial spyware

Meanwhile, "as part of U.S. efforts to counter the ongoing proliferation and misuse of commercial spyware", the U.S. State Department will impose visa restrictions on 13 individuals who have been involved in the development and sale of commercial spyware, or who are close associates of those involved. "These individuals have facilitated or derived financial benefit from the misuse of this technology, which has targeted journalists, academics, human rights defenders, dissidents and other perceived critics, and U.S. Government personnel".

Visa restrictions are part of a broader US government initiative to counter the abuse of commercial spyware and other surveillance tools.
In fact, American tech companies such as Salesforce, Microsoft, Zoom, Dell and Intel recently cut commercial ties with Sandvine, a Canadian network intelligence company. This is because the US Department of Commerce placed the company on its Entity List (a blacklist that imposes various restrictions) in February, penalizing it for providing "mass web monitoring and censorship technology" to the Egyptian government. "The designation effectively banned Sandvine from obtaining US technology", writes Bloomberg

GENAI RISKS
Managing the risks of generative AI

The NIST (National Institute of Standards and Technology, the US agency that produces standards for various systems) has released a document titled Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence - Profile.

It is a preliminary text, subject to change, that defines the risks created or exacerbated by the use of generative AI. The text also provides a definition of Generative AI (GAI): "The class of AI models that emulate the structure and characteristics of input data in order to generate derived synthetic content. This can include images, videos, audio, text, and other digital content”.

Most notably, the text lists and defines the risks: "Importantly, some GAI risks are unknown, and are therefore difficult to properly scope or evaluate given the uncertainty about potential GAI scale, complexity, and capabilities. Other risks may be known but difficult to estimate given the wide range of GAI stakeholders, uses, inputs, and outputs. Challenges with risk estimation are aggravated by a lack of visibility into GAI training data, and the generally immature state of the science of AI measurement and safety today.”

Among the risks analyzed are:

CBRN information
Lowering the barriers to accessing dangerous information about chemical, biological, radiological, or nuclear (CBRN) weapons.

Confabulation
The production of incorrect or false content although expressed with certainty (commonly known as "hallucinations" or "fabrications"). According to the NIST document, these are the result of the pre-training of generative AI, which involves predicting the next word.
"We note that the terms 'hallucination' and 'fabrication' can anthropomorphize GAI, which itself is a risk related to GAI systems as it can inappropriately attribute human characteristics to non-human entities", the authors write. Furthermore, while the research suggests that confabulated content is abundant, it is still difficult to estimate the extent and downstream effects (in the development of subsequent processes and applications).

Dangerous or violent recommendations
GAI systems may produce results or recommendations that incite, radicalize, threaten, or glorify violence. In addition, the document notes, a significant number of users talk to chatbots about mental health issues – which current systems are not equipped to adequately address, nor are they able to direct these users to get the help they may need.

Data privacy
GAI systems pose numerous privacy risks. Models can leak, generate, or correctly infer sensitive information about individuals, such as biometric, health, location, or other personally identifiable information (PII). For example, in some attacks, large language models (LLMs) have revealed private or sensitive information that was included in their training data. A problem that has been defined as "data memorization".

The problem is also that, as the document states, "most model developers do not disclose specific data sources (if any) on which models were trained. Unless training data is available for inspection, there is generally no way for consumers to know what kind of PII or other sensitive material may have been used to train GAI models. These practices also pose risks to compliance with existing privacy regulations”.
Moreover, GAI models may be able to correctly infer personal information that was not present in the training data and that was not disclosed by the user, piecing together data from a variety of different sources.

Environment
The document states: “Estimates suggest that training a single GAI transformer model can emit as much carbon as 300 round-trip flights between San Francisco and New York. In a study comparing energy consumption and carbon emissions for LLM inference, generative tasks (i.e., text summarization) were found to be more energy and carbon intensive than discriminative or non-generative tasks”. In short, generative AI would be more energy-intensive than other types of AI.

For the complete document, follow this link.

AI AND EUROPE
The European AI startups

"The numbers are crystal clear. In the decade from 2013 to 2022, 4,643 startups active in the field of artificial intelligence were founded in the United States. In China, the number reaches 1,337, while the United Kingdom, France, and Germany together barely exceed a thousand.

Investment figures are even more telling: in the past decade, the United States raised $249 billion in investment, China raised $95 billion, while the three main European nations have reached only $32 billion (leaving crumbs for the others). Other unflattering figures are reported by the specialized site Sifted, according to which just three Californian universities – Stanford, USC, and the University of California – have produced a number of founders of artificial intelligence startups (175) practically equal to that of the top ten European universities (177).

In short, it’s clear that Europe is not at the center of the artificial intelligence boom, especially when we consider that – according to Crunchbase data – OpenAI alone has raised more total funding than of all European startups combined
.Yet, if we step out of the impossible comparison with the United States and take a closer look at Europe in detail, a lively and growing landscape is still observed. In 2023, European startups active in the field of generative artificial intelligence raised $1.5 billion in funding, almost three times the amount reached in the previous year".

Europe's pursuit of AI is a challenging one. Who are the key players, the EU Commission's projects, and other available incentives. Read the article on the Guerre di Rete website (Italian only).

RIGHT TO REPAIR
EU Parliament enhances consumer access to repair services

On Tuesday, April 23, members of the European Parliament voted in favor of the Right to Repair Directive, which aims to improve consumer access to repair services and reduce waste. The directive, introduced by the Commission last March, aims to support the Green Deal by making repairs a simpler and more attractive option for consumers than buying a replacement. It also simplifies repairs, outlines manufacturers' obligations, and creates an online platform that helps locate repair shops and sellers of refurbished goods.

Swappie, a company that refurbishes used iPhones and sells them at a lower price than new ones, told Euractiv that the directive provides for an obligation to repair even outside the warranty.
This creates "greater opportunities to request a repair for cases not covered by warranty", such as a cracked screen, but "clearly anticipates that consumers should be able to choose to turn to any repair provider, regardless of whether it is affiliated with the original manufacturer", Swappie explained.

The company added that this action is considered essential to promote fair competition among repair providers and to strengthen consumer trust in independent repair services.
Technology companies, and Apple in particular, have often been criticized for their repair policies, which are said to make it difficult for independent repairers.

IN BRIEF

AI & WORK
A survey by the Society of Authors suggests that a third of translators and a quarter of illustrators could lose their jobs due to AI - SoA

TECH IN EUROPE
The challenge between London and Paris to become Europe’s tech capital – Sifted

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.7 - 26 April 2024
Authors: Carola Frediani and Andrea Daniele Signorelli

INDEX
- The Tactical Role of Cyberwarfare (and Other Emerging Technologies)
- Global Profile of the Tech Workforce
- In brief

WAR IN UKRAINE
The Tactical Role of Cyberwarfare (and Other Emerging Technologies)

A few days ago, the Ukrainian hacktivist group Cyber Resistance claimed on Telegram to have broken into the computer systems of the Russian drone manufacturer Albatross and stolen 100 gigabytes of data. This information is expected to be used in a series of coordinated articles with the InformNapalm outlet, which in an April 15 article claimed that it could confirm the involvement of the agricultural drone company Albatross in the development of the "suicidal" Shahed drones, designed by Iran and used by Russia against Ukraine.

In February, a mysterious group of hackers called the Prana Network leaked some information about an Iranian military company and circulated confidential documents claiming that Russia had purchased at least 6,000 Shahed 136 drones since the beginning of the war in Ukraine. Russia has also reportedly received extensive assistance in setting up local production lines for drones, and has rewarded this assistance with tons of gold ingots. According to the documents, the Russians paid nearly $200,000 per drone. However, the price would also include assistance in setting up autonomous production, after which the unit price would drop to $48,000. "Now, Russia is seeking both to buy and to manufacture thousands of more advanced drones," wrote Hareetz, which examined the documents.

Some rumors about Russia's efforts to establish its own production lines for these drones had already surfaced months ago, when the Financial Times wrote that "Albatross, a Russian group that previously specialized in farming tech, built its new factory inside the Alabuga special economic zone in Tatarstan — a site the US has claimed is the center of the Tehran-supported effort to develop Russia’s capacity in making drones". In December, the U.S. placed Albatross on its Entity List.

In early April, the Tatarstan region was targeted by Ukrainian forces. Russian media reported that two drones struck a dormitory in Russia's Alabuga special economic zone, more than 1,200 kilometers from the northeastern Ukrainian city of Kharkiv, near the Russian border, writes Reuters, which confirmed the available images.

"Ukrainian military expert Oleh Zhdanov said Ukraine was likely targeting a new drone production facility at the Alabuga site, predicting such deep strikes inside Russia could become more common given the capabilities of the drones now being produced by Kyiv", reported Radio Free Europe (a media outlet funded by the U.S. Congress and declared an "undesirable organization" by Russia).

This whole story illustrates how different dimensions are intertwined in the war in Ukraine: traditional kinetic warfare, the massive and diversified use of drones by both sides, the military conversion of industries and technologies, cyber-attacks, leaks and propaganda.
In this intertwining, each technological element is never decisive on its own, but can provide tactical or temporary advantages if deployed in the right circumstances. Therefore, the hype generated by some narratives on hybrid warfare a few years ago needs to be tempered.

A recent report by the Geneva Centre for Security Policy, which analyzes the role of emerging technologies in the Ukrainian conflict, makes the same point.
"Technological innovations coupled with the lack of large-scale interstate conflicts, the rise of global competition through other means, and the global focus on counterterrorism and counterinsurgency have led to a large focus on ‘hybrid’ forms of warfare. This has in turn led to an expectation that confrontation in the 21st century would largely take place below the threshold of overt war and would often be waged through surrogates – and increasingly through technological surrogates (such as long-range drones during the so-called ‘War on Terror’ or AI-enabled disinformation activities more recently). These analyses mirrored a world expecting war to become small, peripheral, and hybrid, as well as remote, precise, efficient, and less deadly".

According to the authors, this has led to incorrect predictions: in reality, not only do the traditional elements of warfare (ammunition, artillery, logistics, personnel) remain central, but each technological element is contextually linked to the traditional ones. The technological element becomes a competitive advantage depending on how it fits into the context. Managing this complexity is what makes the difference.

Certainly, "the war in Ukraine shows that drones – of various levels of sophistication, autonomy, and types of functions – have become an essential element of modern warfare", explains the report. Ukraine was able to benefit from the use of drones especially early on, while more recently Russia has also begun to use them extensively. "The early phases of the war were characterized by the lack of widespread use of UAVs (unmanned aerial vehicles) by the Russian side. Some experts indeed argue that Russia’s lack of drone usage for intelligence, surveillance, and reconnaissance contributed to its early invasion blunders, notably due to the lack of situational awareness resulting from the absence of drones".

Drones also served as an effective propaganda tool for the Ukrainians, with videos of successful attacks on Russian troops and tanks circulating on social media and galvanizing support. Today, according to the report, drone reconnaissance provides Ukrainian forces with an estimated 86 percent of all identified targets.

But the most interesting aspect of drones is how Ukraine acquired and developed them. Ukraine was able to successfully leverage the global ecosystem of "big tech", its civilian commercial technology sector, domestic startups, NGOs, and even individual civilians for its "drone war”, shortening the cycle between prototyping, experimentation, testing, production, and deployment.
"While only seven companies were making drones in Ukraine before the war, there are now up to making over 300 types of drones".

Drones immediately lead us to another technological element of this war: the use of AI systems. Artificial intelligence is an area where it is more difficult to assess real uses and outcomes, and where hype and propaganda (including from the vendors of these systems) are an important factor. However, according to the report, news from both Russia and Ukraine seems to indicate that we are approaching nearly autonomous or increasingly autonomous weapons systems.

In any case, Ukraine has understood the need to tap into data, including those collected by the vast number of devices capturing images, audios and videos of the war, or those coming from open source information. In this logic, the Ukrainian authorities have opened Telegram channels or apps where citizens can send videos and photos of Russian troops and materials.

According to a recent article in The Economist, Ukrainian companies like Molfar offer AI systems to identify targets to hit. These systems are also being used in counterintelligence to detect possible traces of spies and traitors. Needless to say, some of the reported examples are quite disturbing.

Finally, there is the element of cyber warfare. Once again, the war in Ukraine has lowered expectations for cyber capabilities. The reasons are many, and the report covers them all, including highlighting the role of the private sector in Kiev's cybersecurity defenses, from Microsoft to Starlink.
"Ukrainian authorities have relied on a rich network of governmental and private-sector actors, both foreign and domestic, to quickly identify and respond to cyber threats".

But Ukraine has also been a protagonist in cyber offensives, through the establishment of the IT Army, a kind of volunteer army recruited online to participate in cyber attacks against Russia.
"According to research by the ETHZ Centre for Security Studies, the IT Army has a highly coordinated structure and activities, with a ‘core team’ housed by Ukrainian authorities. While a central coordinating body does exist, the IT Army maintains a decentralized and diffuse organizational structure", the report says, adding that the use of the IT Army and extraterritorial hackers has also contributed to the blurring of legal and normative boundaries.
"For example, if a Ukrainian citizen (or other national) conducts a cyberattack disrupting Russian troop communications or infrastructure, or in any way affects or reduces – even marginally – Russia’s combat capabilities, should they be considered a legitimate target, even in a foreign country?".

In addition to that, the 2022 ETH study also said other interesting things, pointing to a gray area and ambiguity in the cooperation (or indifference) of some Western tech companies in the face of the violation of their terms of service by the IT Army (such as using anti-DDoS services to host DDoS attack tools, etc.).

In conclusion, and returning to the report by the Geneva Center for Security Policy, the authors emphasize that offensive cyber operations, which also require long preparation times, can be more effective in the "pre-war phases", to gather information and analyze enemy systems to identify vulnerabilities that can be exploited later. During a conflict, they are mainly low-intensity tools for disruption and subversion.

TECH AND WORK
Global Profile of the Tech Workforce

As the wave of layoffs continues, what information do we have about the IT workforce, the gender gap, the growth of freelancers and outsourcing, and the countries that are hiring? And why is it so hard to get consistent data?

According to Layoffs.fyi (a site run by entrepreneur Roger Lee that monitors all tech sector layoffs), more than 428,000 people were laid off by thousands of companies between 2022 and 2023, including players like Alphabet, Microsoft, Meta, and X (which laid off 82 percent of its staff in its transition from Twitter to X.com). In the first three months of 2024, there were 58,000 layoffs across 237 companies and startups.

What happened? The volatility shown in this graph shows that the hiring that occurred in the IT market in 2020 to meet the increased demand for digital services during the pandemic was not the beginning of a long-term trend. In fact, due to rising energy costs and a return to post-pandemic normalcy, the data shows that 2020 was the exception, not the rule.
Donata Columbro writes about this on the Guerre di Rete website (Italian only).

IN BRIEF

DEEPFAKE
The abuse of sexual deepfakes - PODCAST - Tech Won’t Save Us

AI AND JOURNALISM
A new study by the Associated Press reveals that generative artificial intelligence is already reshaping the roles and workflow of newsrooms. Nearly 70% of newsroom contributors from various backgrounds and organizations report using technology for creating social media posts, newsletters, and headlines, for translating and transcribing interviews, and for writing stories - Poynter

BOOKS
Algorithms of Resistance - The Everyday Fight against Platform Power - by Tiziano Bonini and Emiliano Treré – MIT Press

Subscribe now

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.6 - 10 April 2024
Authors: Carola Frediani and Andrea Daniele Signorelli

Index:

• The role of AI systems in the Gaza War

• France, the Olympics and the all-seeing electronic eye

• AI-generated garbage books

• Transparent methods to build reader trust

AI AND WAR
The role of AI systems in the Gaza War

Following the Hamas' attack on 7 October and the start of the war in Gaza, the Israeli Defense Forces (IDF) accelerated the identification of targets. To meet the demand for new targets to strike – according to a lengthy report by The Guardian, largely based on an investigation published by two Israeli media outlets critical of their current government, Local Call and +972 Magazine – the IDF allegedly relied on Lavender, a system that generates “a database of individuals judged to have the characteristics” of Hamas or Palestinian Islamic Jihad (PIJ) militants.

According to the investigation, Lavender played a central role in the bombings of Palestinians, especially in the early stages of the war. Lavender’s influence on military operations was such that the military treated the AI system’s decisions "as if it were a human decision", according to +972 Magazine. The investigation was authored by Yuval Abraham, who previously co-authored the documentary "No Other Land" (which won an award at the Berlin International Film Festival).

"During the first weeks of the war, the army almost completely relied on Lavender, which clocked as many as 37,000 Palestinians as suspected militants — and their homes — for possible air strikes", +972 Magazine writes, claiming that the army authorized officers to adopt target lists identified by Lavender without any obligation to thoroughly review the reasons why the system made those choices or examine the raw intelligence data on which they were based.

Lavender's system complements another artificial intelligence system known in the media as "Habsora/Gospel," which has been discussed previously. A key difference between the two systems lies in the definition of targets: while Gospel identifies buildings and structures from which militants would operate, Lavender identifies individuals and places them on a kill list. The investigation also claims that there is an additional system to identify and strike the target when returning home.

In response to this investigation, the IDF issued a press release, stating that its operations comply with the rules of proportionality under international law. Lavender, according to the IDF, is only a database used "to cross-reference intelligence sources" and is not "a list of confirmed military operatives eligible to attack". The IDF also stated that they do not use "an artificial intelligence system that identifies terrorist operatives or tries to predict whether a person is a terrorist". Also, the IDF outright rejected the claim regarding any policy to kill tens of thousands of people in their homes.

However, if confirmed in detail, this investigation raises enormous and troubling questions about the role that AI systems are playing or could play in warfare. These systems tend to be black boxes in how they are designed and operate. Especially in conflict scenarios, they become even more opaque, with no external controls or audits. We know that, on many occasions, claims about the accuracy of these systems have been refuted as soon as they have been subjected to independent verification.

All of this has caught the attention of the online tech community. Some have called for immediate attention to the use of AI in the military. Others demand information about the IDF’s vetting process for these systems. Brian Merchant, on the other hand, comments that "AI is not terrifying because it's too powerful, but because it lets operatives defer responsibility to the system, and lets leaders use it to justify nearly any level of violence they already desired to undertake".
"AI as a pretext for deadly violence", linguist and critic of AI hype Emily Bender also commented. Claudio Agosti, from the non-profit AI Forensics, also warns against falling into the narrative that "the AI is doing the job, not your fault". Likewise, for Meredith Whittaker (Signal), "we MUST ensure that AI is not used to facilitate computational escape from culpability".§

The use of AI technology, according to an analysis by the WashPost, is “still only a small part of what has troubled human rights activists about Israel’s conduct in Gaza. But it points to a darker future”.

Mona Shtaya, a non-resident fellow at the Tahrir Institute for Middle East Policy, told The Verge that "the Lavender system is an extension of Israel’s use of surveillance technologies on Palestinians in both the Gaza Strip and the West Bank. Shtaya, who is based in the West Bank, (says) that these tools are particularly troubling in light of reports that Israeli defense startups are hoping to export their battle-tested technology abroad".

The Stop Killer Robots coalition (which calls for an international law on autonomous weapon systems and to maintain human control over the use of force) stated that the "reports of Israeli use of target recommendation systems in the Gaza strip (are) deeply concerning from a legal, moral and humanitarian perspective. Although the Lavender system, like the Habsora/Gospel system, is not an autonomous weapon, both raise serious concerns over the increasing use of artificial intelligence in conflict, automation bias, digital dehumanization, and loss of human control in the use of force".

AI AND SURVEILLANCE
France, the Olympics and the all-seeing electronic eye

The Olympic Torch will arrive in Marseille on 8 May. From there, it will begin to cross the entire French territory (including overseas territories) to arrive in Saint-Denis, the Paris suburb where the Olympic Village is located, on 26 July. On the same day, the Paris 2024 Opening Ceremony will take place on the banks of the Seine: a ceremony that has always celebrated brotherhood and peace between peoples.
But there is little hope that peace will be the protagonist again by then. On the contrary, the prevailing feeling is that the two Olympic weeks will be enveloped in a climate of tension that is already beginning to permeate the French capital.

A tension exacerbated by France's demographic characteristics. France is the European nation with the largest number of Muslim inhabitants (5.7 million, over 8% of the population) and also home to the largest Jewish community (750,000 people). "Certain groups could use (the ceremony) to send a message", Lukas Aubin, a sports geopolitics expert, told Politico. "It’s going to be a very tense moment".
It won't be the only one either, considering that Paris will be the center of the world for the next weeks, with an estimated 3.5 million people expected to visit.

Authorities have announced that Paris will be subject to "unprecedented" security measures. During the Olympics, 30,000 police officers will be deployed in the French capital, joined by 20,000 soldiers and as many private security guards. In some areas of the city, it will be necessary to show a QR code in order to move freely.

The city will also be kept under control by the surveillance tool in which the institutions are placing their greatest hopes: artificial intelligence. Specifically, Paris will be constantly monitored by hundreds of electronic eyes, equipped with image recognition software capable of alerting law enforcement in case of anything out of the ordinary.
These software programs – developed by companies such as Videtics, ChapsVision, and Wintics – have been trained to detect eight types of events: vehicles traveling in the opposite direction of traffic, the presence of people in prohibited areas, abandoned packages, sudden movements of crowds, the use of firearms, overcrowding, fires, and bodies lying on the ground.

Thanks in part to pressure from civil rights groups, facial recognition will not be used. Because of its invasion of privacy, frequent errors, and potential for abuse, facial recognition is considered a red line that should not be crossed. In fact, it should have been blocked by the nascent AI Act (the European law on artificial intelligence) before exceptions were introduced, including for the "prevention of terrorist attacks".
These exceptions have also been requested by France, raising concerns that the crossing of the "red line" of facial recognition is only a matter of time: "Software that enables AI-powered video surveillance can easily enable facial recognition. It's simply a configuration choice", explained Katia Roux of Amnesty International France.

France seems unwilling to deprive itself of this technology, especially as it is said to have popular support. A recent survey – reported by the Washington Post – claimed that 74% of French people support the use of AI-based surveillance tools even on the streets; a percentage that rises to 89% in the case of stadiums.

Once the network of smart cameras is in place, it is highly unlikely that French authorities will decide to dismantle it once the big Olympic event is over. Activists fear that, regardless of the use of facial recognition, surveillance tools that have an excessive impact on civil liberties will be irreversibly deployed. In a country like France, which has been hit by numerous and serious terrorist attacks and is aware of the chaos unleashed by the Gilets Jaunes (Yellow Vests), the temptation to exploit the Olympics and citizens' fears to introduce extensive digital surveillance may be too strong to resist.

AI AND GOOGLE BOOKS
AI-generated garbage books

After ads on Amazon, academic papers, and online articles, texts generated by AI are now filling Google Books, the tool developed by the tech company to allow text searches in digitized old books or books on the market. This was noticed by the 404Media outlet, which conducted a series of searches using a very simple system. They searched on Google Books for the phrase: "As of my last knowledge update", which is associated with answers generated by ChatGPT. The search returned dozens of books containing that phrase, most of which were generated by AI.

In addition to flooding the internet with garbage, one of the side effects of this phenomenon – according to 404Media – is that it could have an impact on the Google Ngram Viewer, a tool used in research to track the frequency of words or phrases present in a given period in books published and scanned by Google, books ranging from 1500 to 2019. In practice, it is a tool that academics use to research culture and human language.

”If AI-generated books start informing Ngram viewer results in the future, the meaning of these results will change entirely. Either they will be unreliable for teaching us about human-made culture, or they say something perhaps more bleak: that human-made culture is being replaced by AI-generated content", the author writes.

JOURNALISM
Transparent methods to build reader trust

The Reuters Institute has an interview with Julia Angwin (formerly of ProPublica and now founder of Proof News) about journalism in this period of intense technological change: "I wanted to put the methods – and not the topic – first", says Angwin, "because the methods are increasingly important in an era where no one trusts journalism. It's just not enough to just say ‘I'm a tech journalist, and you should trust what I say’".

Making methods transparent is something we need, the renowned investigative journalist continues, "in an era where AI is creating all kinds of plausible text, where we have all sorts of misinformation purveyors, and where some newsrooms are writing press releases as news articles. This information landscape is very polluted, so focusing on the methods is a way to build trust with the audience. (...) the default position for smart people these days is not to trust anything unless they can find a way to trust it”.

Angwin also argues something I strongly agree with: that journalism should focus less on witnessing and more on analysis.
In her founding letter, she writes: “Awash in information, people need help making sense of all this witnessing and storytelling. Are the stories on their news feeds actually representative of what is happening in the world? Are they outliers being blown out of proportion? Analysis is particularly important in today’s world where power is so often cloaked in opaque and complex systems that require hard work to unravel”.

Regarding the lawsuit filed by The New York Times against Microsoft and OpenAI (creator of ChatGPT) for alleged copyright infringement, Angwin says: "I really appreciate the Times’ lawsuit. It’s a move that will benefit everyone in journalism, if they set a precedent and there’s not a settlement. Other outlets just sold off their archive for money. If you think about the benefits these companies are going to get from years and years worth of journalistic labour and effort, I don’t think it’s worth it. So I’m happy the Times is doing that, because somebody needed to take a stand. Back in September I wrote a guest essay in the New York Times about this. I'm really concerned about the commons being overgrazed by rapacious tech companies, stealing everything that’s in the public sphere. I’m worried about what this will actually mean – that there’ll be no incentive to put anything into the public sphere”.

Unless they will reach an agreement.

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.5 - 20 March 2024
Authors: Carola Frediani and Andrea Daniele Signorelli

Index:

- The European Union Has Its Own Artificial Intelligence Law
- AI Researchers: Where is AI talent coming from and where is it going?
- LLM and Racial Bias
- The Ukrainian incubator of military technology
- In Brief

AI ACT
The European Union Has Its Own Artificial Intelligence Law

On 13 March, the European Parliament approved the AI Act: the European regulation on artificial intelligence. Here's what you need to know.

After the final formalities, the AI Act will officially enter into force by May or June.

Its provisions will gradually come into effect:

- Within six months: countries will be required to prohibit banned AI systems.

- Within one year: rules for general-purpose AI systems will begin to apply.

- Within two years: most of the AI Act will apply.

- Within 3 years: the obligations for high-risk systems come into effect.

Fines for non-compliance could be up to €35 million or 7% of the company's annual global turnover.

Prohibited:
- Exploitation of vulnerabilities of individuals or groups based on age, disability, or socio-economic status.
- Manipulative and deceptive practices, such as systems that use subliminal techniques to materially distort a person's decision-making ability.
- Biometric categorisation systems based on sensitive characteristics, which classifies individuals based on biometric data to infer sensitive information such as race, political opinions, or sexual orientation (exceptions are provided for law enforcement activities).
- Social scoring (evaluating individuals or groups over time based on their social behaviour or personal characteristics).
- Untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases.
- Emotion recognition in workplaces and educational institutions (with exceptions for medical or security reasons).
- Predictive policing (when it is based solely on profiling a person or assessing their characteristics)

Real-time biometric identification (RBI) in public spaces by law enforcement is not completely banned, but limited. Identification is permitted in defined circumstances (permitted uses include searching for a missing person or preventing a terrorist attack), subject to judicial or independent authority approval.

Biometric identification systems post-facto (“post-remote RBI”) is considered a high-risk use case, requiring judicial authorisation being linked to a criminal offence.

The following areas are not prohibited but are considered “high risk". Systems operating in these areas will be assessed both before being placed on the market and during their lifecycle. Citizens will be able to submit complaints to national authorities.

High-risk areas include not only critical infrastructures or security components but also education (for determining access or admission, assigning individuals to institutions or training programs at all levels, assessing the learning outcomes of individuals, assessing the appropriate level of education for an individual and influencing the level of education they can access, monitoring and detecting prohibited student behaviours during tests); employment (for hiring and selecting individuals, making decisions about terms and conditions of employment contracts, assigning tasks based on individual behaviours, traits, or personal characteristics, and monitoring or evaluating individuals); essential services including health care, social security benefits, social services, and credit rating; administration of justice (including alternative dispute resolution bodies); migration and border management (such as examining applications for asylum, visa, and residence permits and related claims).

General purpose AI (GPAI) systems and the models on which they are based (including large generative AI models) will have to comply with a number of transparency requirements, such as: disclosing that the content is generated by AI, ensuring that models do not generate illegal content; compliance with EU copyright law and publishing detailed summaries of the content used for training.
The most powerful models that could pose systemic risks will also have to comply with other obligations, such as conducting model assessments, assessing and mitigating systemic risks, and reporting incidents.

EU countries must create and make available at the national level regulatory sandboxes and real-world testing to allow SMEs and startups to develop AI systems before they enter the market.
(Compiled from the final text, the European Parliament document, and comments by Luiza Jarovsky and Barry Scannel)

Reactions
There is a myriad of reactions to the AI Act, many positive and celebratory, but for now I'll only mention a couple of statements from those who wanted a stricter AI Act in protecting certain rights.
"While the AI Act may have positive aspects in other areas, it is weak and even enables the use of risky AI systems when it comes to migration", writes the #ProtectNotSurveill coalition.
The AI Act, according to the NGO Access Now, "fails to properly ban some of the most dangerous uses of AI, including systems that enable biometric mass surveillance".

AI RESEARCHERS
Where is AI talent coming from and where is it going?

The United States remains a “net importer” of artificial intelligence researchers. While the USA is the main destination for high-level AI talent to study and work, China is gradually increasing its national pool. In addition to the United States and China, the United Kingdom and South Korea, along with continental Europe, have slightly increased their status as work destinations for top AI researchers. France and Germany stand out among the European countries that produce a significant number of top AI researchers, and are partially successful in retaining or attracting them.

These are some of the recently updated data from the Global AI Talent Tracker 2, based on the analysis of job profiles.
According to the Tracker, the "leading countries of origin of the most elite AI researchers (top ~2%, based on undergraduate degrees)" are distributed as follows: USA 28%, China 26%, India 7%, France 5%, Germany 4%, Canada 2%, Others 28%.

But if we look at where they work, the distribution changes: the USA grows to 57%, China decreases to 12%, the UK appears at 8%, Germany and France remain almost stable at 4%, Canada at 3%, and Others at 12%.

AI AND BIAS
LLM and Racial Bias

Bias in algorithmic systems of various kinds has been studied for years. Even the latest language models (such as GPT-4) have been the subject of these studies. Recently, a paper has been published (by various researchers from the Allen Institute, Oxford, Stanford, LMU Munich, Chicago) that examines racial bias against African Americans, focusing on the most subtle and hidden forms. It used linguistic forms typical of African American communities, and compared them with texts written in standard American English (SAE).

The research would demonstrate, to quote its authors, that "Americans hold raciolinguistic stereotypes about speakers of African American English". These stereotypes are also present in the linguistic models but show "covert stereotypes that are more negative than any human stereotypes about African Americans ever experimentally recorded, although closest to the ones from before the civil rights movement. By contrast, the language models' overt stereotypes about African Americans are much more positive".

In practice, there would be a discrepancy between what linguistic models openly say about African Americans and what they less visibly associate with them. Furthermore, the authors argue, not only do linguistic models suggest that those who speak African-American English get less prestigious jobs or are more likely to be convicted of crimes, but existing methods to mitigate racial bias in linguistic models, such as human feedback training, do not mitigate such linguistic bias. In fact, they can exacerbate the discrepancy between covert and overt stereotypes by teaching linguistic models to superficially hide racism that they continue to perpetuate at a deeper level.

The risk, writes on Twitter Valentin Hofmann, one of the authors, is that "users mistake decreasing levels of overt prejudice for a sign that racism in LLMs has been solved, when LLMs are in fact reaching increasing levels of covert prejudice".

Commenting on the paper, Margareth Mitchell, Chief Ethics Scientist at Hugging Face, writes that "as developers continue to prioritize post-training techniques to handle racism, as opposed to pre-training work, it will be harder and harder to identify how systems that have already encoded racism will disproportionately harm marginalized subpopulations once deployed".

Bias and Work

There is a widespread misconception that AI tools are less biased than humans because they work on a broader set of data, said Abeba Birhane, senior AI accountability advisor at the Mozilla Foundation. The problem is that this assumption is rarely verified, and models are not carefully vetted and tested. But there is growing evidence that "these systems stereotype," Birhane said.

This comment appears in an investigation by Bloomberg, which looked at a different aspect of the presence of bias in LLMs, for example in relation to their potential use in recruitment. According to Bloomberg's analysis, GPT 3.5 (OpenAI's language model) "systematically produces biases that disadvantage groups based on their names". The issue is complex, and I encourage you to read the details directly here.

Gender Bias Research

In recent days, a UNESCO and IRCAI study into bias against women and girls in large language models has been published. The study analyses three models – GPT-2 and ChatGPT from OpenAI, and Llama 2 from Meta – and argues that bias emerges in the generated text through gender-related word associations.

For example, British men were associated with a wide range of roles, from driver to teacher, highlighting the diversity of their occupational representations. Conversely, British women were often associated with more stereotypical roles – and I quote from the paper – "such as prostitute, model, and waitress, appearing in approximately 30% of the total texts generated".

WAR AND TECH
The Ukrainian incubator of military technology

The Russian invasion has given a strong boost to the Ukrainian technology sector. The BRAVE1 incubator aims to transform Ukraine into an advanced weapons producer.
"This activism has led the American magazine Wired to compare the organization of a startup to the way Minister of Digital Transformation Fedorov conducts war in his field of expertise. The comparison is fitting because, over the past two years, innovation in the defence sector has been driven mainly by private companies that have adopted an agile approach to the task, far removed from the top-down approach that Ukrainian military institutions have inherited from their Soviet heritage. This is the context in which the BRAVE1 defence technology cluster was born”.
Read the full article here [Italian version only]

IN BRIEF

AI AND THE ENVIRONMENT
Karen Hao writes on the Atlantic: "Microsoft’s own environmental reports show that, during the initial uptick in the AI platform’s growth, the company’s resource consumption was accelerating. In fiscal year 2022, the most recent year for which Microsoft has released data, the tech giant’s use of water and electricity grew by about a third; in absolute terms, it was the company’s largest-ever reported increase, year to year".

PROMPT ENGINEERING
New research suggests that prompt engineering is better done by the model itself, not by a human – Spectrum.ieee

JOURNALISM AND SOCIAL MEDIA
LinkedIn focuses on news as social media rivals retreat - Axios

Digital Conflicts is a bi-weekly briefing on the intersections of digital culture, AI, cybersecurity, digital rights, data privacy, and tech policy with a European focus.

Brought to you with journalistic integrity by Guerre di Rete, in partnership with the University of Bologna's Centre for Digital Ethics.

New to Digital Conflicts? Subscribe for free to receive it by email every two weeks.

Subscribe now

N.4 - March 4,  2024
Authors: Carola Frediani and Andrea Daniele Signorelli

Index:

• Freezing Mistral

• Amazon and the EU

• The Sora Effect

• In Brief

AI
Freezing Mistral

This week we have to talk about Mistral: a French startup founded in Paris less than a year ago – in April 2023 – which raised 500 million euros in its first 8 months, with a valuation of around $2 billion last December. Mistral is the second European AI startup to raise such a substantial amount of funds, after the German Aleph Alpha.

The founders come from DeepMind (CEO Arthur Mensch) and Meta (Guillaume Lample and Timothée Lacroix). Important investors come from Silicon Valley. But Mistral's founders (co-founding advisors) also include Cédric O, the former French digital minister, who has excellent relations with President Macron. "When a draft of the EU’s AI Act last year threatened to force Mistral to divulge its data recipe, Cédric O co-ordinated, with Mr Macron’s backing, a Franco-German effort to oppose such provisions. These were duly excised from the bill", writes The Economist.

This techno-political and Franco-American mix partly explains why, although Mistral presents itself as a champion of open-source AI (as opposed to the increasingly closed and proprietary approach of OpenAI) and of an emerging European tech industry, the agreement with Microsoft is the chronicle of an untold (and, as we shall see, controversial) partnership, but not an unpredictable one.

On February 26, Microsoft and Mistral announced a "multi-year partnership" that will see the startup make its language models available on Microsoft's Azure AI platform. It is the second company to do so after OpenAI. In addition, the two companies will explore collaboration around training purpose-specific models for selected customers, including European public sector workloads. 

As part of the deal, Microsoft said it would invest in Mistral, although financial details were not disclosed, reports the Financial Times. However, Bloomberg mentions an investment of €15 million, which will be converted into shares in the startup's next funding round.

Microsoft has already invested around $13 billion in OpenAI, an investment that is being scrutinised by competition authorities in the US, EU and UK. The European Commission has said that regulators will analyse Microsoft's investment in Mistral AI and, according to Bloomberg, the move could lead to a formal investigation. "The Commission is looking into agreements that have been concluded between large digital market players and generative AI developers and providers", European Commission spokeswoman Lea Zuber told Politico.

But the issue is more complex than it first appears. In the European Parliament, some politicians are described by Euronews as "furious", particularly because the European regulation on artificial intelligence (AI Act) has been partially amended to accommodate the demands of companies such as Mistral, which represented the interests of both open source models and European industry.

"On a technical level and a political level, in the [European] Parliament we are extremely furious because the French government for months was making this argument of European leadership, meaning that those companies should be able to scale up without help from Chinese or US companies", said Kai Zenner, head of office and digital policy adviser for Axel Voss, MEP for the European People’s Party (EPP). "They were always blaming the Parliament that we are making it kind of impossible, for those national champions, unicorns to try to compete with their global competitors", he told Euronews. Mistral AI – Zenner added – had argued that if its demands were not met, it would be forced to work with companies such as Microsoft. "Now they have obtained all their requests, and they are still doing it, and I just find it ridiculous".

Given the timeframe required to finalise such an agreement, and the fact that the trilogue (the political negotiations between European authorities) was still ongoing in December, it is understandable that some politicians feel betrayed.

"This is a mind-blowing announcement", tweeted journalist Luca Bertuzzi, who closely followed the negotiations on the AI Act. "Mistral AI, the French company that has been fighting tooth and nail to water down the AI Act's foundation model rules, is partnering up with Microsoft. So much for 'give us a fighting chance against Big Tech’”. 

“The first question that comes to mind is: was this deal in the making while the AI Act was being negotiated? That would mean Mistral discussed selling a minority stake to Microsoft while playing the 'European champion' card with the EU and French institutions. (...) The other question is how much the French government knew about this upcoming partnership with Microsoft. It seems unlikely Paris was kept completely in the dark, but cosying up with Big Tech does not really sit well with France's strive for 'strategic autonomy'", Bertuzzi concludes.

The French government, however, rejects the allegations. The Secretary of State for Digital Affairs, Marina Ferrari, said that France was not aware of the discussions between Microsoft and Mistral, according to the French newspaper La Tribune.

As if that weren't enough, almost simultaneously Mistral announced a new language model, Mistral Large. "It’s designed to more closely compete with OpenAI’s GPT-4 model. Unlike some of Mistral’s previous models, it won’t be open source", writes The Verge.

"The decision by Mistral's founders shows that the Americans have already achieved a dominant position in the race for artificial intelligence," writes La Tribune. "It brutally exposes a reality that governments don't want to see, namely that European technological independence remains, at least for the moment, an illusion."

An interesting aspect of Mistral Large, especially for European users, is that, according to the startup itself, it is “natively fluent in English, French, Spanish, German, and Italian, with a nuanced understanding of grammar and cultural context".

Finally, Mistral has also released a new conversational chatbot, Le Chat, based on several of its models.

(I'm going to digress here, perhaps a little pedantic, but I think it's necessary. I have tried Mistral, and it writes well in Italian, but like other LLMs, it is subject to hallucinations. When I asked for information about a famous historical monument in Genoa, not only did it confuse the details, it also provided a non-existent link to a non-existent municipality. A non-local person would have had a hard time figuring out that it was a hallucination. This is a warning, not specifically about Mistral, but to emphasise that this is how language models behave. If I were a teacher, I would take the answers it gave me back to school and ask the class to identify all the hallucinated information and explain how they reconstructed the correct information).

AMAZON AND THE EU
The European Parliament kicks out Amazon lobbyists

Amazon lobbyists have been banned from the European Parliament until further notice after an internal body unanimously decided on 27 February to strip them of their badges, reports EUObserver. The ban follows a request from the parliament's employment committee, where MEPs decided to take action against the US company for failing to cooperate with them on various occasions since 2021.

The petition was supported by 30 trade unions and civil society organisations who, in a letter dated 12 February, described Amazon's lack of cooperation as a "willful obstruction of the democratic scrutiny of the company’s activities".

According to the letter, Amazon has repeatedly failed to attend hearings on working conditions in its warehouses and cancelled visits by European parliamentarians to its warehouses in Germany and Poland. The company, the letter continues, has also failed to declare its links with various think tanks and has declared a lobbying budget “seemingly too low”.

This is only the second time in the history of the European Parliament that a company has been banned from lobbying. The first time was for Monsanto in 2017, also for failing to attend hearings. Such decisions are provided for in the EU Parliament's rules, which state that a badge can be withdrawn if a party "has refused, without offering a sufficient justification, to comply with a formal summons to attend a hearing or committee meeting or to cooperate with a committee of inquiry".

THE SORA EFFECT
How to adapt to the wave of increasingly realistic synthetic content

Sam Gregory, executive director of the NGO WITNESS, which uses video to document human rights abuses around the world, conducted an early analysis of how a technology like Sora could affect trust in what we see. Sora is OpenAI's new text-to-video model, which can create highly realistic synthetic videos from text instructions. Although not yet available to the public, OpenAI has released several examples of videos produced using this technology (you can see them here).

Until now, Gregory explains in various social media posts, multiple viewpoints have been a good starting point for assessing whether an event actually occurred and the context in which it took place. For example, in almost all cases of state or police violence, there is a dispute about what happened before/after the camera started recording an action or perceived reaction. On the other hand, a shaky mobile phone shot is a "powerful indicator of emotional credibility", of authenticity.

But now we are faced with photorealistic synthetic videos that can take on different styles, even an amateurish one, or multiple angles, simultaneously creating multiple camera perspectives and angles on the same scene. Sora also has the ability to "add video (essentially outpainting for videos) back and forth in time from an existing frame". [Outpainting is a function found in image generators such as DALL-E to expand an image beyond its original boundaries].

"Sora’s most concerning ability from the tech specs", says researcher Eryk Salvaggio, "is that it can depict multiple scenarios that conclude at a given image. That is gonna be a disinfo topic at a few conferences in the near future, I’d guess”. [...] In theory, let’s assume you have a social media video of police that starts from the moment the police start using unwarranted force against a person on the street. This says they can seamlessly create up to 46 seconds of synthetic video that would end where the violence clip starts. What happens in that 46 seconds is guided by your prompt, whether it’s teenager throws hand grenade at smiling policeman or friendly man offers flowers to angry police".

In a sense, Gregory adds, "realistic videos of fictitious events align well with existing patterns of sharing shallowfake videos and images (e.g. mis-contextualized or lightly edited videos transposed from one date or time to another place), where the exact details don't matter as long as they are a convincing enough fit with assumptions. In realistic videos of events that never happened, we'd be missing the ability to search for the referent - i.e. what we do now with shallowfake search, use a reverse image search to find the original, or use Google About this Image".

"As text-to-video and video-to-video etc expand”, concludes Gregory, “we must work out how to reinforce trust and ensure media transparency, deepen detection capabilities, restrict out-of-line-usages and enforce accountability across the AI pipeline".

Media literacy starts with teachers

Related to this discussion is also the importance of media literacy. Specifically, the importance of teaching how to recognize and analyze online content in schools. Giancarlo Fiorella (Bellingcat) discusses this in a podcast, explaining how they developed a curriculum to train teachers in the UK.

How to promote AI awareness among young people

This is another initiative aimed at British students. The Royal Society has organized a series of conferences on the theme "The Truth about Artificial Intelligence." In the video below, Professor Mike Wooldridge explains how learning in AI works and what this technology can do, using a series of entertaining experiments and demonstrations. It's a high-quality science communication video aimed at young people, and highly recommended for everyone.

IN BRIEF

The UK Is GPS-Tagging Thousands of Migrants

"In England and Wales, since 2019, people convicted of knife crime or other violent offenses have been ordered to wear GPS ankle tags upon their release from prison", reports Wired.com. "But requiring anyone facing a deportation order to wear a GPS tag is a more recent and more controversial policy, introduced in 2021. Migrants arriving in small boats on the coast of southern England, with no previous convictions, were also tagged during an 18-month pilot program that ended in December 2023. Between 2022 and 2023, the number of people ordered to wear GPS trackers jumped by 56 percent to more than 4,000 people".

There’s More Than Just Shadowbanning on Instagram

The Markup reviewed hundreds of screenshots and videos from Instagram users who documented behavior that looked like censorship, analyzed metadata from thousands of accounts and posts, spoke with experts, and interviewed 20 users who believed their content had been blocked or demoted. Using the information gathered, The Markup then manually tested Instagram’s automated moderation responses on 82 new accounts and 14 existing accounts.

The investigation found that Instagram heavily demoted nongraphic images of war, deleted captions and hid comments without notification, erratically suppressed hashtags, and denied users the option to appeal when the company removed their comments, including ones about Israel and Palestine, as “spam”.

AI & Environmental Impact

“It remains very hard to get accurate and complete data on environmental impacts. The full planetary costs of generative AI are closely guarded corporate secrets. Figures rely on lab-based studies by researchers such as Emma Strubell and Sasha Luccioni; limited company reports; and data released by local governments. At present, there’s little incentive for companies to change”, writes Kate Crawford (author of Atlas of AI) in Nature.

This article from The Verge tries to give you the numbers, or at least some partial estimates.

Journalism

Julia Angwin (formerly of ProPublica) has launched a new publication, Proof News. It aims to conduct "methodologically precise investigations, build public datasets, collaborate with journalists, researchers, and influencers worldwide, and promote best practices in evidence collection."

In their first investigation, they tested various AI language models to see how accurate electoral information was. Spoiler: it wasn't.

Paper

Hallucination is inevitable - arXiv