Pete Recommends – Weekly highlights on cyber security issues, March 8, 2025

Subject: Flock Threatens Open Source Developer Mapping Its Surveillance Cameras
Source:  404media.co
https://www.404media.co/flock-threatens-open-source-developer-mapping-its-surveillance-cameras/

The surveillance company Flock sent the creator of a website that maps its license plate-reading cameras a cease and desist letter demanding that he immediately stop using the name “DeFlock” on his website.

404 Media previously wrote about DeFlock, an open source mapping project created by Will Freeman that tracks the locations of automated license plate readers (ALPRs) from Flock and other companies. DeFlock currently maps more than 16,000 ALPRs around the world, which includes both Flock cameras as well as many created by Motorola.

Late last month, Flock’s lawyers sent Freeman a letter demanding that he immediately “Cease and desist all use of the name ‘DEFLOCK’ or any variation thereof, remove all instances of ‘DEFLOCK’ from your Website, advertisements, promotional materials, and any other content, and Refrain from adopting any trademarks, trade names, or branding continue to or likely to cause dilution by blurring, dilution by tarnishment, and false advertising with respect to the Flock Marks in the future.” 404 Media has obtained a copy of the letter and uploaded it here.

Flock did not respond to a request for comment.


Subject: Cellebrite Is Using AI to Summarize Chat Logs and Audio from Seized Mobile Phones
Source: 404media.co
https://www.404media.co/cellebrite-is-using-ai-to-summarize-chat-logs-and-audio-from-seized-mobile-phones/

Cellebrite, the company which makes near ubiquitous phone hacking and forensics technology used by police officers around the world, has introduced artificial intelligence capabilities into its products, including summarizing chat logs or audio messages from seized mobile phones, according to an announcement from the company last month.

The introduction of AI into a tool that essentially governs how evidence against criminal defendants is analyzed already has civil liberties experts concerned.

“When you have results from an AI, they are not transparent. Often you cannot trace back where a conclusion came from, or what information it is based on. AIs hallucinate. If you always train it on data from cases where there are convictions, it will never understand cases where indictments should not be brought,” Jennifer Granick, surveillance and cybersecurity counsel at the American Civil Liberties Union’s (ACLU) Speech, Privacy, and Technology Project, told 404 Media in an email.

According to Cellebrite’s February 6 announcement, the company’s generative AI capabilities can summarize chat threads “to help prioritize which threads may be most relevant,” contextualize someone’s browsing history to show what was searched for, and build “relationship insight.”

The announcement included a quote from Detective Sergeant Aaron Osman with Susquehanna Township, Pennsylvania Police Department, who Cellebrite says piloted the AI capabilities. “It is impossible to calculate the hours it would have taken to link a series of porch package thefts to an international organized crime ring,” he says. “The GenAI capabilities within Guardian helped us translate and summarize the chats between suspects, which gave us immediate insights into the large criminal network we were dealing with.”

Responding specifically to that case, ACLU’s Granick said “The Fourth Amendment does not permit law enforcement to rummage through data, but only to review information for which there is probable cause. To use an example from the press release, if you have some porch robberies, but no reason to suspect that they are part of a criminal ring, you are not allowed to fish through the data on a hunch, in the hopes of finding something, or ‘just in case.’ In a series of cases, we have been advocating for time and data-category limitations on searches, and a number of courts have held that those limits are necessary when searching a cell phone, computer, or social media account.”

Cellebrite’s newly announced capabilities sound somewhat similar to Draft One, a tool from contracting giant Axon. Draft One uses OpenAI’s tech to automatically generate police reports from bodycam audio. In demonstration videos, Axon also stresses the need for officers to proofread any generated result from Draft One.


Subject: The Digital Packrat Manifesto
Source: 404 Media
https://www.bespacific.com/the-digital-packrat-manifesto/

404 Media: “Amazon’s recent decision to stop allowing people to download copies of their Kindle e-books to a computer has vindicated some of my longstanding beliefs about digital media. Specifically, that it doesn’t exist and you don’t own it unless you can copy and access it without being connected to the internet. The recent move by the megacorp and its shiny-headed billionaire CEO Jeff Bezos is another large brick in the digital wall that tech companies have been building for years to separate consumers from the things they buy—or from their perspective, obtain “licenses” to. Starting Wednesday, Kindle users will no longer be able to download purchased books to a computer, where they can more easily be freed of DRM restrictions and copied to e-reader devices via USB. You can still send ebooks to other devices over WiFi for now, but the message the company is sending is one tech companies have been telegraphing for years: You don’t “own” anything digital, even if you paid us for it….


Subject: 89% of enterprise AI usage is invisible to the organization
Source: Help Net Security
https://www.bespacific.com/89-of-enterprise-ai-usage-is-invisible-to-the-organization/

Help Net Security: “71% of connections to GenAI tools are done using personal non-corporate accounts. Among logins using corporate accounts, 58% of connections are done without Single-Sign On (SSO). These interactions bypass organizational identity and access management (IAM) systems, leaving security teams blind to how GenAI tools are used and what data is being shared. Casual GenAI users unaware of data exposure risks. Most GenAI users are casual and may not be aware of the risks of GenAI data exposure…

Abstracted from beSpacific
Copyright © 2024 beSpacific, All rights reserved.

Subject: FBI conclusion about previous (2022) LastPass offline password vaults stolen  and crypto heists
Source: BrianKrebs’ Mastodon toot
https://newsie.social/deck/@[email protected]/114122156886994383

This is really interesting. It’s a forfeiture action by the government in response to the theft last year of ~$23.6M worth of virtual currencies. According to the feds, this is another case where the victim had funds stolen, and they hadn’t suffered any of the usual sorts of bad things that typically presage a large crypto heist, such as targeted phishing, sim-swapping or malware infections, etc. In Sept. 2023, I reported on mounds of evidence gathered by security experts who said they were witnessing six-figure crypto heists between 4-6 times a month that they believed were all the result of crooks cracking the master password for the offline password vaults stolen from LastPass in 2022. The researchers worked with a ton of victims, and found there was no other possible explanation.

Well, the FBI apparently has reached that conclusion as well. Maybe they reached it much sooner, but today’s filing is the first time I’ve seen it in writing. Unless I’m reading this all wrong, which is entirely possible.

krebsonsecurity.com/2023/09/ex

krebsonsecurity.com/wp-content

Posted in: AI, Civil Liberties, Cybercrime, Cybersecurity, Legal Research, Privacy