We started in 2018 to solve two major problems in fashion and apparel:\n1

WAIR

Monthly subscriptions have become the new norm for accessing online services for individuals and corporations. With the popularity of subscription-based services, online fraudsters have developed different ways of exploiting compromised credentials for financial gain. This article details my personal experiences dealing with Identity Theft and proposes a strategy for dealing with them at large. The most popular form of Identity Theft in an online setting is called Account Takeover fraud. In this format of fraud, a fraudster gains access to a user’s online account through social engineering and makes purchases using the previously saved payment method information. In subscription-based services, these purchases are normally additional licenses to the software. The fraudster then sells it at a cheaper rate to buyers on the dark web. When the owner of the account finds out about this fraud, they normally report it to the company that offers the service, and the company makes a refund to the user in an effort to retain them. This results in financial and reputation loss to the service offering company, and the user loses trust in the security of the service. Furthermore, auditing authorities such as payment gateways threaten to de-list the company as a merchant due to a lack of effective security measures. Personal Account As the Identity Security Architect facing this situation, I had to deal with multiple challenges. First and foremost was to implement measures to detect and prevent fraud. The Second was to do this without worsening the user experience resulting from stricter security measures. Detecting Online Fraud My approach to dealing with these problems began with identifying patterns of fraud. Common patterns that emerged in this analysis were, Suspicious Login Activity: Where the user logs in from an IP address that does not map to the physical address of the account owner or from a device that they do not normally log in from. Suspicious Purchase Activity: Where the user or a small business makes a large purchase for an unjustified number of licenses. For example, an online Yoga teacher makes a purchase of 100 licenses for a video conferencing tool when they normally need just one. Or a user makes multiple purchases of a small number of licenses in succession. Preventing Fraud Through Novel and Adaptive Fraud Prevention Techniques Strict measures to prevent fraud often lead to a poor user experience for legitimate users. In order to avoid this, I employed adaptive fraud prevention techniques. When a user logs in from a new IP address or device, they are challenged with a second-factor authentication by sending them a verification code via text. Upon successful verification, the new IP address or Device ID was added to the list of trusted traffic sources. When the users make an irregular purchase either for large quantities or repeated purchases, they are challenged to re-enter the CVV  from the back of their saved cards. Once these challenges were presented to the users, until they passed the challenge, they were disallowed from making changes to their accounts. Furthermore, the IP addresses and devices that could not pass the challenge are cataloged as high-risk traffic sources, and future activity from these devices is presented with stricter security challenges. These measures largely reduced fraud and prevented legitimate users from being inconvenienced by the stricter safety measures. Addressing the Global Problem of Identity Theft Imagine if, when a stranger attempted to open the door of your parked car, you could instantly alert your entire neighborhood through a community platform, ensuring everyone took precautions to prevent theft. This common practice in physical communities is lacking in the online world, where account takeover and identity theft are rampant. While the measures mentioned in the previous section successfully prevent fraudulent activity in most cases for a given online application, they fail to prevent online fraud from occurring across different applications due to the reuse of login credentials, a very common practice. A server-side solution presents an opportunity to mitigate this risk and prevent account takeovers across multiple platforms. By establishing a centralized index of compromised credentials (CICC), software applications can proactively protect their users. When a login attempt is made, participating applications can cross-reference the credentials with the CICC to verify their integrity. If compromised credentials are detected, the application can prompt the user to undergo additional authentication measures, such as two-factor authentication, to thwart unauthorized access. The account owners are notified of the fraud attempt and asked to change the password to a stronger password across applications. In conclusion, a shared protocol similar to the one presented above is urgently required to prevent identity theft in the online world. Detection and prevention within closed ecosystems fail to solve the problem at a global scale. An open approach to dealing with the problem seems to be a viable future alternative. Monthly subscriptions have become the new norm for accessing online services for individuals and corporations. With the popularity of subscription-based services, online fraudsters have developed different ways of exploiting compromised credentials for financial gain. This article details my personal experiences dealing with Identity Theft and proposes a strategy for dealing with them at large. The most popular form of Identity Theft in an online setting is called Account Takeover fraud. In this format of fraud, a fraudster gains access to a user’s online account through social engineering and makes purchases using the previously saved payment method information. In subscription-based services, these purchases are normally additional licenses to the software. The fraudster then sells it at a cheaper rate to buyers on the dark web. When the owner of the account finds out about this fraud, they normally report it to the company that offers the service, and the company makes a refund to the user in an effort to retain them. This results in financial and reputation loss to the service offering company, and the user loses trust in the security of the service. Furthermore, auditing authorities such as payment gateways threaten to de-list the company as a merchant due to a lack of effective security measures. Personal Account As the Identity Security Architect facing this situation, I had to deal with multiple challenges. First and foremost was to implement measures to detect and prevent fraud. The Second was to do this without worsening the user experience resulting from stricter security measures. Detecting Online Fraud Detecting Online Fraud My approach to dealing with these problems began with identifying patterns of fraud. Common patterns that emerged in this analysis were, Suspicious Login Activity: Where the user logs in from an IP address that does not map to the physical address of the account owner or from a device that they do not normally log in from. Suspicious Login Activity: Where the user logs in from an IP address that does not map to the physical address of the account owner or from a device that they do not normally log in from. Suspicious Login Activity: Suspicious Purchase Activity: Where the user or a small business makes a large purchase for an unjustified number of licenses. For example, an online Yoga teacher makes a purchase of 100 licenses for a video conferencing tool when they normally need just one. Or a user makes multiple purchases of a small number of licenses in succession. Suspicious Purchase Activity: Where the user or a small business makes a large purchase for an unjustified number of licenses. For example, an online Yoga teacher makes a purchase of 100 licenses for a video conferencing tool when they normally need just one. Or a user makes multiple purchases of a small number of licenses in succession. Suspicious Purchase Activity: Preventing Fraud Through Novel and Adaptive Fraud Prevention Techniques Strict measures to prevent fraud often lead to a poor user experience for legitimate users. In order to avoid this, I employed adaptive fraud prevention techniques. When a user logs in from a new IP address or device, they are challenged with a second-factor authentication by sending them a verification code via text. Upon successful verification, the new IP address or Device ID was added to the list of trusted traffic sources. When a user logs in from a new IP address or device, they are challenged with a second-factor authentication by sending them a verification code via text. Upon successful verification, the new IP address or Device ID was added to the list of trusted traffic sources. When the users make an irregular purchase either for large quantities or repeated purchases, they are challenged to re-enter the CVV  from the back of their saved cards. When the users make an irregular purchase either for large quantities or repeated purchases, they are challenged to re-enter the CVV  from the back of their saved cards. Once these challenges were presented to the users, until they passed the challenge, they were disallowed from making changes to their accounts. Furthermore, the IP addresses and devices that could not pass the challenge are cataloged as high-risk traffic sources, and future activity from these devices is presented with stricter security challenges. These measures largely reduced fraud and prevented legitimate users from being inconvenienced by the stricter safety measures. Addressing the Global Problem of Identity Theft Imagine if, when a stranger attempted to open the door of your parked car, you could instantly alert your entire neighborhood through a community platform, ensuring everyone took precautions to prevent theft. This common practice in physical communities is lacking in the online world, where account takeover and identity theft are rampant. While the measures mentioned in the previous section successfully prevent fraudulent activity in most cases for a given online application, they fail to prevent online fraud from occurring across different applications due to the reuse of login credentials, a very common practice. A server-side solution presents an opportunity to mitigate this risk and prevent account takeovers across multiple platforms. By establishing a centralized index of compromised credentials (CICC), software applications can proactively protect their users. When a login attempt is made, participating applications can cross-reference the credentials with the CICC to verify their integrity. If compromised credentials are detected, the application can prompt the user to undergo additional authentication measures, such as two-factor authentication, to thwart unauthorized access. The account owners are notified of the fraud attempt and asked to change the password to a stronger password across applications. In conclusion, a shared protocol similar to the one presented above is urgently required to prevent identity theft in the online world. Detection and prevention within closed ecosystems fail to solve the problem at a global scale. An open approach to dealing with the problem seems to be a viable future alternative.

Battling Identity Theft in Subscription Based Services: A Personal War Story

Tax season is prime hunting time for scammers. While the filing deadline may have come and gone, tax scams are as active as ever. As taxpayers wait for their refunds, they should keep their guard up. It’s easy to see why these scams are so common. Taxes are complicated, involve a lot of sensitive information, and carry hefty consequences. That mix of risks and the added concern that tax sites may make financial data more accessible than users might expect makes for a dangerous combination. Thankfully, tax scams are fairly easy to spot. Here are some common ones to look out for. 1. Unclaimed Refund Scams One of the most common tax scams — especially after the filing deadline — involves unclaimed refunds. In these attacks, cybercriminals pose as the IRS and message people that their refund is ready to claim. Once users click the provided link to get their check, they’ll accidentally install malware or give away sensitive information. These scams are so widespread that the FTC has issued a warning about them ahead of tax season. There’s an easy way to recognize them, though. The IRS will never reach out about a refund via email, text, or social media, so any supposed IRS message that does is a scam. The IRS issues refunds in just two ways — direct deposit and checks in the mail. Don’t trust anything talking about a refund that’s not one of those methods, regardless of how legitimate it seems. 2. Outstanding Debt Scams Outstanding tax debt scams are similar. Like in unclaimed refund cases, these attacks see scammers posing as the IRS. Instead of promising to give users a refund, though, they tell them they owe money and must follow a link to make a payment or dispute it. Americans owed more than $120 billion from delinquent taxes and penalties in 2022 alone, so a warning like this may not immediately appear odd. However, remember the IRS won’t reach out through email, text, social media, or phone calls. Requests for payments through tools like Venmo or Zelle are also red flags. 3. Refund Recalculation Scams Some tax scams try to sound less urgent in hopes that it will make them more believable. That’s the case with refund recalculation scams, where IRS impersonators say they’ve recalculated someone’s taxes and need further review or authorization. These messages often say the user will get a bigger refund or owe money after the recalculation. They’ll then provide a link to a form or ask for details like the user’s Social Security number, address, or bank account info. Actual IRS agents have noticed these scams often target college students or staff members. The IRS does review and correct some returns, but it won’t ask people to fill out forms like this, especially through email. They’ll send checks or paper forms for payment through the postal service. 4. Tax Fraud Scams A similar but more urgent type of scam will tell taxpayers the IRS is investigating them for tax evasion or other fraud. The weight of that issue can make it easier to fall for these schemes. That’s especially true for businesses outsourcing their taxes to CPAs, who often have limited capacity, potentially making them more likely to make errors. Like in other scams, these messages will ask users to follow a link to learn more, pay an outstanding debt or give away personal information. They also often threaten legal action to amp up the urgency. Some even provide fake badge numbers to seem more authentic. However, it’s almost certainly a scam if it comes through anything but the mail. 5. Identity Theft Scams While some tax fraud scams make people think they’ve committed a crime, others convince them they’ve become victims. Some taxpayers have received calls or messages telling them someone has stolen their identity. The scammer then offers a solution that involves giving away personal details or buying gift cards. To be clear, the IRS will never ask for anything involving gift cards or similar payment forms. People worried about identity theft can watch for a few common warning signs and review their free credit reports. 6. IRS Account Scams IRS account-related scams are becoming more common as people use digital tools to handle their taxes. They typically involve scammers providing a link to follow to set up an account, only to steal sensitive data like Social Security numbers. The easiest way to avoid this tax scam is to set up an online account directly on the IRS’s website. Don’t follow any unsolicited links to get to the setup menu. Once taxpayers set up an account, they should go directly to it to handle any account-related issues instead of following links in an email or text. General Tips for Spotting Tax Scams Over time, some of these tax scams may become more or less popular, and new ones will emerge. While it’s good to keep up with these trends as much as possible, no one can predict every kind of fraud out there. After all, new phishing scams appear every minute, but a few best practices can help taxpayers spot them. The most important thing to remember is that the IRS will never ask for information or action over email, text, social media or phone. No matter how official it looks, anything that does is a scam. Never click unsolicited links or give away sensitive information over email or text. Taxpayers worried about outstanding debts or refunds can check on them through their online IRS accounts. Similarly, users find all official IRS forms on their website. Any tax document that doesn’t appear there is not a real tax form and is a scam. Be suspicious about anything that sounds too good to be true or is overly urgent. The IRS won’t make threats or demand immediate payment. It also does not accept gift cards or payment apps or ask for credit card information over the phone. Stay Safe From Tax Scams Scams are a year-round threat, but tax-related ones are particularly prominent around this time of year. Regardless of what month it is, it’s good to know what’s out there and how to stay safe. As common as these threats may be, taxpayers can easily avoid them when they know what to look for. Tax season is prime hunting time for scammers. While the filing deadline may have come and gone, tax scams are as active as ever. As taxpayers wait for their refunds, they should keep their guard up. It’s easy to see why these scams are so common. Taxes are complicated, involve a lot of sensitive information, and carry hefty consequences. That mix of risks and the added concern that tax sites may make financial data more accessible than users might expect makes for a dangerous combination. make financial data more accessible make financial data more accessible Thankfully, tax scams are fairly easy to spot. Here are some common ones to look out for. 1. Unclaimed Refund Scams One of the most common tax scams — especially after the filing deadline — involves unclaimed refunds. In these attacks, cybercriminals pose as the IRS and message people that their refund is ready to claim. Once users click the provided link to get their check, they’ll accidentally install malware or give away sensitive information. These scams are so widespread that the FTC has issued a warning about them ahead of tax season. There’s an easy way to recognize them, though. The IRS will never reach out about a refund via email, text, or social media, so any supposed IRS message that does is a scam. the FTC has issued a warning the FTC has issued a warning The IRS issues refunds in just two ways — direct deposit and checks in the mail. Don’t trust anything talking about a refund that’s not one of those methods, regardless of how legitimate it seems. 2. Outstanding Debt Scams Outstanding tax debt scams are similar. Like in unclaimed refund cases, these attacks see scammers posing as the IRS. Instead of promising to give users a refund, though, they tell them they owe money and must follow a link to make a payment or dispute it. Americans owed more than $120 billion from delinquent taxes and penalties in 2022 alone, so a warning like this may not immediately appear odd. However, remember the IRS won’t reach out through email, text, social media, or phone calls. Requests for payments through tools like Venmo or Zelle are also red flags. more than $120 billion more than $120 billion 3. Refund Recalculation Scams Some tax scams try to sound less urgent in hopes that it will make them more believable. That’s the case with refund recalculation scams, where IRS impersonators say they’ve recalculated someone’s taxes and need further review or authorization. These messages often say the user will get a bigger refund or owe money after the recalculation. They’ll then provide a link to a form or ask for details like the user’s Social Security number, address, or bank account info. Actual IRS agents have noticed these scams often target college students or staff members. often target college students often target college students The IRS does review and correct some returns, but it won’t ask people to fill out forms like this, especially through email. They’ll send checks or paper forms for payment through the postal service. 4. Tax Fraud Scams A similar but more urgent type of scam will tell taxpayers the IRS is investigating them for tax evasion or other fraud. The weight of that issue can make it easier to fall for these schemes. That’s especially true for businesses outsourcing their taxes to CPAs, who often have limited capacity , potentially making them more likely to make errors. often have limited capacity often have limited capacity Like in other scams, these messages will ask users to follow a link to learn more, pay an outstanding debt or give away personal information. They also often threaten legal action to amp up the urgency. Some even provide fake badge numbers to seem more authentic. However, it’s almost certainly a scam if it comes through anything but the mail. 5. Identity Theft Scams While some tax fraud scams make people think they’ve committed a crime, others convince them they’ve become victims. Some taxpayers have received calls or messages telling them someone has stolen their identity. The scammer then offers a solution that involves giving away personal details or buying gift cards. To be clear, the IRS will never ask for anything involving gift cards or similar payment forms. People worried about identity theft can watch for a few common warning signs and review their free credit reports. a few common warning signs a few common warning signs 6. IRS Account Scams IRS account-related scams are becoming more common as people use digital tools to handle their taxes. They typically involve scammers providing a link to follow to set up an account, only to steal sensitive data like Social Security numbers. The easiest way to avoid this tax scam is to set up an online account directly on the IRS’s website. Don’t follow any unsolicited links to get to the setup menu. Once taxpayers set up an account, they should go directly to it to handle any account-related issues instead of following links in an email or text. General Tips for Spotting Tax Scams Over time, some of these tax scams may become more or less popular, and new ones will emerge. While it’s good to keep up with these trends as much as possible, no one can predict every kind of fraud out there. After all, new phishing scams appear every minute , but a few best practices can help taxpayers spot them. new phishing scams appear every minute new phishing scams appear every minute The most important thing to remember is that the IRS will never ask for information or action over email, text, social media or phone. No matter how official it looks, anything that does is a scam. Never click unsolicited links or give away sensitive information over email or text. Taxpayers worried about outstanding debts or refunds can check on them through their online IRS accounts. Similarly, users find all official IRS forms on their website. Any tax document that doesn’t appear there is not a real tax form and is a scam. Be suspicious about anything that sounds too good to be true or is overly urgent. The IRS won’t make threats or demand immediate payment. It also does not accept gift cards or payment apps or ask for credit card information over the phone. Stay Safe From Tax Scams Scams are a year-round threat, but tax-related ones are particularly prominent around this time of year. Regardless of what month it is, it’s good to know what’s out there and how to stay safe. As common as these threats may be, taxpayers can easily avoid them when they know what to look for.

Waiting for Your Tax Refund? Don't Fall for These Scams

আপনার ট্যাক্স রিফান্ডের জন্য অপেক্ষা করছেন? এই স্ক্যামস জন্য পড়া না

Warten Sie auf Ihre Steuerrückerstattung? Fallen Sie nicht auf diese Betrügereien herein

¿Esperando su reembolso de impuestos? No caiga en estas estafas

Vous attendez votre remboursement d'impôts ? Ne tombez pas dans le piège de ces escroqueries

अपने टैक्स रिफंड का इंतजार कर रहे हैं? इन घोटालों के झांसे में न आएं

税金の還付を待っていますか？これらの詐欺に騙されないでください

세금 환급을 기다리고 계십니까? 이런 사기에 속지 마세요

Esperando pela sua restituição de imposto? Não caia nesses golpes

Ждете возврата налога? Не поддавайтесь на эти мошенничества

Vergi İadenizi mi Bekliyorsunuz? Bu Dolandırıcılıklara Kanmayın

Đang chờ hoàn thuế của bạn? Đừng rơi vào những trò lừa đảo này

等待退税？不要上当受骗

Wireshark, the free open-source packet sniffer and network protocol analyzer, has cemented itself as an indispensable tool in network troubleshooting, analysis, and security (on both sides). This blog post delves into the features, uses, and practical tips for harnessing the full potential of Wireshark, expanding on aspects that may have been glossed over in discussions or demonstrations. Whether you're a developer, security expert, or just curious about network operations, this guide will enhance your understanding of Wireshark and its applications. https://www.youtube.com/watch?v=QVWRomT2Ppo&embedable=true As a side note, if you like the content of this and the other posts in this series, check out my which covers this subject. If you have friends who are learning to code, I'd appreciate a reference to my If you want to get back to Java after a while, check out my , Debugging book Java Basics book. Java 8 to 21 book . Introduction to Wireshark Wireshark was initially developed by Eric Rescorla and Gerald Combs and designed to capture and analyze network packets in real-time. Its capabilities extend across various network interfaces and protocols, making it a versatile tool for anyone involved in networking. Unlike its command-line counterpart, tcpdump, Wireshark's graphical interface simplifies the analysis process, presenting data in a user-friendly "proto view" that organizes packets in a hierarchical structure. This facilitates quick identification of protocols, ports, and data flows. The key features of Wireshark are: Eases the analysis of network packets compared to command-line tools. Graphical User Interface (GUI): Displays packet data in a tree structure, simplifying protocol and port identification. Proto View: Supports a wide range of network interfaces and protocols. Compatibility: Browser Network Monitors Firefox and Chrome contain a far superior network monitor tool built into them. It is superior because it is simpler to use and works with secure websites that are out of the box. If you can use the browser to debug the network traffic, you should do that. In cases where your traffic requires low-level protocol information or is outside of the browser, Wireshark is the next best thing. Installation and Getting Started To begin with, Wireshark, visit their for the download. The installation process is straightforward, but attention should be paid to the installation of command-line tools, which may require separate steps. Upon launching Wireshark, users are greeted with a selection of network interfaces, as seen below. Choosing the correct interface, such as the loopback for local server debugging, is crucial for capturing relevant data. official website When debugging a Local Server (localhost), use the loopback interface. Remote servers will probably fit with the en0 network adapter. You can use the activity graph next to the network adapter to identify active interfaces for capture. Navigating Through Noise with Filters One of the challenges of using Wireshark is the overwhelming amount of data captured, including irrelevant "background noise," as seen in the following image. Wireshark addresses this with powerful display filters, allowing users to hone in on specific ports, protocols, or data types. For instance, filtering TCP traffic on port 8080 can significantly reduce unrelated data, making it easier to debug specific issues. Notice that there is a completion widget on top of the Wireshark UI that lets you find out the values more easily. In this case, we filter by port , which is the port typically used in Java servers (e.g., Spring Boot/tomcat). tcp.port == 8080 But this isn't enough, as HTTP is more concise. We can filter by protocol by adding to the filter, which narrows the view to HTTP requests and responses, as shown in the following image. http Deep Dive into Data Analysis Wireshark excels in its ability to dissect and present network data in an accessible manner. For example, HTTP responses carrying JSON data are automatically parsed and displayed in a readable tree structure, as seen below. This feature is invaluable for developers and analysts, providing insights into the data exchanged between clients and servers without manual decoding. Wireshark parses and displays JSON data within the packet analysis pane. It offers both hexadecimal and ASCII views for raw packet data. Beyond Basic Usage While Wireshark's basic functionalities cater to a wide range of networking tasks, its true strength lies in advanced features such as ethernet network analysis, HTTPS decryption, and debugging across devices. These tasks, however, may involve complex configuration steps and a deeper understanding of network protocols and security measures. There are two big challenges when working with Wireshark: Decrypting HTTPS traffic requires additional configuration but offers visibility into secure communications. HTTPS Decryption: Wireshark can be used to troubleshoot network issues on various devices, requiring specific knowledge of network configurations. Device Debugging: The Basics of HTTPS Encryption HTTPS uses the Transport Layer Security (TLS) or its predecessor, the Secure Sockets Layer (SSL), to encrypt data. This encryption mechanism ensures that any data transferred between the web server and the browser remains confidential and untouched. The process involves a series of steps, including handshake, data encryption, and data integrity checks. Decrypting HTTPS traffic is often necessary for developers and network administrators to troubleshoot communication errors, analyze application performance, or ensure that sensitive data is correctly encrypted before transmission. It's a powerful capability in diagnosing complex issues that cannot be resolved by simply inspecting unencrypted traffic or server logs. Methods for Decrypting HTTPS in Wireshark Decrypting HTTPS traffic should only be done on networks and systems you own or have explicit permission to analyze. Unauthorized decryption of network traffic can violate privacy laws and ethical standards. Important: Pre-Master Secret Key Logging One common method involves using the pre-master secret key to decrypt HTTPS traffic. Browsers like Firefox and Chrome can log the pre-master secret keys to a file when configured to do so. Wireshark can then use this file to decrypt the traffic: Set an environment variable ( ) to specify a file where the browser will save the encryption keys. Configure the Browser: SSLKEYLOGFILE Use Wireshark to capture the traffic as usual. Capture Traffic: Point Wireshark to the file with the pre-master secret keys (through Wireshark's preferences) to decrypt the captured HTTPS traffic. Decrypt the Traffic: Using a Proxy Another approach involves routing traffic through a proxy server that decrypts HTTPS traffic and then re-encrypts it before sending it to the destination. This method might require setting up a dedicated decryption proxy that can handle the TLS encryption/decryption: Tools like Mitmproxy or Burp Suite can act as an intermediary that decrypts and logs HTTPS traffic. Set Up a Decryption Proxy: Ensure the client's network settings route traffic through the proxy. Configure Network to Route Through Proxy: Use the proxy's tools to inspect the decrypted traffic directly. Inspect Traffic: Integrating tcpdump with Wireshark for Enhanced Network Analysis While Wireshark offers a graphical interface for analyzing network packets, there are scenarios where using it directly may not be feasible due to security policies or operational constraints. tcpdump, a powerful command-line packet analyzer, becomes invaluable in these situations, providing a flexible and less intrusive means of capturing network traffic. The Role of tcpdump in Network Troubleshooting tcpdump allows for the capture of network packets without a graphical user interface, making it ideal for use in environments with strict security requirements or limited resources. It operates under the principle of capturing network traffic to a file, which can then be analyzed at a later time or on a different machine using Wireshark. https://www.youtube.com/watch?v=nLXu3_fzHhQ&embedable=true Key Scenarios for tcpdump Usage: In places like banks or government institutions where running network sniffers might pose a security risk, tcpdump offers a less intrusive alternative. High-security Environments: Debugging issues on a cloud server can be challenging with Wireshark due to the graphical interface; tcpdump captures can be transferred and analyzed locally. Remote Servers: Customers may be hesitant to allow third-party tools to run on their systems; tcpdump's command-line operation is often more palatable. Security-conscious Customers: Using tcpdump Effectively Capturing traffic with tcpdump involves specifying the network interface and an output file for the capture. This process is straightforward but powerful, allowing for detailed analysis of network interactions: The basic command structure for initiating a capture involves specifying the network interface (e.g., for wireless connections) and the output file name. Command Syntax: en0 Once the command is run, tcpdump silently captures network packets. The capture continues until it's manually stopped, at which point the captured data can be saved to the specified file. Execution: The file generated by tcpdump can be opened in Wireshark for detailed analysis, utilizing Wireshark's advanced features for dissecting and understanding network traffic. Opening Captures in Wireshark: The following shows the tcpdump command and its output: $ sudo tcpdump -i en0 -w output
Password:
tcpdump: listening on en, link-type EN10MB (Ethernet), capture size 262144 bytes
^C3845 packets captured
4189 packets received by filter
0 packets dropped by kernel Challenges and Considerations Identifying the correct network interface for capture on remote systems might require additional steps, such as using the command to list available interfaces. This step is crucial for ensuring that relevant traffic is captured for analysis. ifconfig Final Word Wireshark stands out as a powerful tool for network analysis, offering deep insights into network traffic and protocols. Whether it's for low-level networking work, security analysis, or application development, Wireshark's features and capabilities make it an essential tool in the tech arsenal. With practice and exploration, users can leverage Wireshark to uncover detailed information about their networks, troubleshoot complex issues, and secure their environments more effectively. Wireshark's blend of ease of use with profound analytical depth ensures it remains a go-to solution for networking professionals across the spectrum. Its continuous development and wide-ranging applicability underscore its position as a cornerstone in the field of network analysis. Combining tcpdump's capabilities for capturing network traffic with Wireshark's analytical prowess offers a comprehensive solution for network troubleshooting and analysis. This combination is particularly useful in environments where direct use of Wireshark is not possible or ideal. While both tools possess a steep learning curve due to their powerful and complex features, they collectively form an indispensable toolkit for network administrators, security professionals, and developers alike. This integrated approach not only addresses the challenges of capturing and analyzing network traffic in various operational contexts but also highlights the versatility and depth of tools available for understanding and securing modern networks. Also published . here

Wireshark & tcpdump: The Debugging Duo For Network Troubleshooting

Q: What do a revolutionary from the 1800s, a supercomputer from the 1980s, and a tech start-up which supports decentralisation have in common? A: They’re all fictional. 🤣 Hilarious, right? Introducing the Luddites Let’s tie these things together. First of all, the revolutionary above refers to the folkloric figure of Ned Ludd, also known variously as General, Captain, and King Ludd. Whether there was ever a real Ned Ludd is very much up for debate. Sadly, since the Luddites were pretty much wiped out a couple of centuries ago by the combination of sending the military after them and executing them when captured (they threatened the almighty profit margin after all), we’re not likely to get an answer any time soon. What’s important for this article is that Ned Ludd was an idea. He was a mythical figurehead of a decentralised movement working to protect the livelihood of the individual worker, safeguarding their autonomy in the face of capitalist mechanical automation which worked to reduce them (or rather their cheaper, unskilled replacements) to cogs in a commercial machine. The Luddites are far from the first decentralised movement, and definitely not the last. They were unique, to my knowledge, in being the first to assemble a decentralised movement to oppose centralisation and concentration of power in the hands of a few. Those few being the capitalists who purchased the machines with the aim of exploiting their workforce by removing the need for expensive expertise. The Luddites were presented then, and are again now, as straightforward anti-progress revolutionaries. Even now the name is used as an insult, suggesting someone obstructs progress for the sake of obstruction. Ironically, those at the cutting edge of technologies designed to protect individual autonomy and identity have more in common with the Luddites than they do with most of the high-tech start-ups who claim to be fighting their corners. And the Supercomputer? In 1983 a film came out which became a cornerstone of hacker culture. No, not , I’m talking about the rightly-famous . Aside from being an innovative film, provides a brilliant illustration both of the danger of centralising power and authority, and of placing too much trust in technological infallibility. Hackers Wargames Wargames At the centre of the film is a supercomputer, Joshua (or more formally the WOPR), which controls the entire US nuclear arsenal and defensive systems. Even if you haven’t seen it, you can probably predict the rest of the film just from that. The centralisation piece is particularly striking when you know three names which deserve to go down in history (and likely others we don’t know): Stanislav Petrov, Vasily Arkhipov, and Sir David Ormsby-Gore. Their stories are worth looking up, but for this article what’s important to know is that it was their individual decision-making, their exercise of their autonomy, that means we’re not living in a nuclear hellscape today. As Joshua famously writes in , when there is only mutually assured destruction the only winning move is not to play. Wargames Obviously this lesson cannot be ascribed to our modern world, where we are completely dependent on massive interconnected systems designed to squeeze all the joy and freedom out of life and turn them into profitable numbers while having us make ‘the right’ decisions (i.e. buying the things advertised to us). Tech Start-Ups Are Fine Though, Right? And that brings us to the modern tech start-up, especially those that preach decentralisation and autonomy. Some, I’m sure, are sincere - it’s a statistical impossibility that all of them are presenting a smokescreen, but it’s definitely a minority. There’s a whole rainbow of -washings (green, pink, etc.) that companies use to publicly show off their credentials, whether social, environmental, diversity, or otherwise, while carrying on as normal behind the scenes, but I’m unsure what colour would apply to autonomy. VC-backed start-ups are funded by investment. Investors are looking for a return on their investment - usually by selling the company to bigger investors later on. Even if the first investors strongly believe in the ideals of the company rather than just the opportunity for profit, success and a sale dilutes everything further and further from those initial aims. Driving and supporting autonomy and decentralisation of power inevitably builds systems where it is harder for a single entity to extract value in the form of profit for themselves. Decentralised systems are resilient, not robust. They’re sustainable, not efficient. They tend towards value-sharing, not profit-making. This is a problem if the key incentives that drive an organisation are monetary returns on investments. What’s the Answer? Is there anything that can be done? Well, to a degree. The system is clearly built in such a way that gathering the resources to change it requires a level of investment which makes it hard to then change it without causing yourself damage. Taking part in these larger systems constrains our choices and autonomy, while opting out of them leaves us with ideological movements. Movements which are often unable to take effective actions, and easy for coordinated efforts to subvert for their own ends. At some point there may be enough smaller entities which aren’t profit-driven pulling in the same direction to make a difference, but until then all we can do is just not play the game. Instead of pursuing the big pay cheques of major tech companies, look to smaller organisations with different motivations. A question I was always told to ask when going to interviews was “why are you in business?” If the answer was “to make money”, it was not a sustainable place to work. For an organisation money should be a means to an end. Treating it as an end in itself is just chasing after a high score that means nothing outside the arcade (80s reference just to tie back to there). Wargames Take a lesson from the Luddites. Yes, they failed. Yes, they were utterly crushed by a system that turned people into nothing more than components in a money-making machine with no autonomy, no power, and no identity beyond ‘worker’. Failure doesn’t mean they were wrong. This article should not be taken as an incentive to or an endorsement of taking direct destructive action against datacentres, infrastructure, technology companies or similar. The author fully endorses the ideals of the Luddites, not their methods, or at least not the methods that will lead to similar reactions to those they faced.

Luddites, WarGames, and the Lost Battle for Autonomy

) continues to develop as a transformative force across many spheres of life, already beginning to revolutionize industries and reshape the way we live and work. The topic of AI in warfare will require increasing attention from governments, policymakers, and international organizations. A large part of this is due to significant advancements in the development of autonomous weapons systems (AWS), which use algorithms to operate independently and without human supervision on the battlefield. More broadly, AI in its many forms has the potential to enhance a range of military activities, from the likes of robotics and weaponry to intelligence gathering and decision-making. Artificial Intelligence (AI With such a diversity of potential applications comes a unique set of ethical dilemmas. The benefits of AI in warfare are increased precision, reduced human casualties, and even deterrence against entering into armed conflict in the first place akin to the threat of nuclear war. However, this would mean giving machines the ability to make deliberate life-and-death decisions, blurring the lines of accountability, and possibly going against the fundamental principles of morality in warfare. A Brief Overview of AI in Warfare As the Stockholm International Peace Research Institute outlines, AI has become a crucial part of military strategies and budgets, contributing to the wider ‘arms race’[1]. Combined with the likes of nuclear and atomic threats, geopolitics must therefore question the ethics of the continued weaponization of technology. Some believe that these advancements will ultimately lead to zero-sum thinking dominating world politics. This logic is not new; Alfred Nobel hoped the destructive power of dynamite would put an end to all wars[2]. AI has already started to be incorporated into warfare technology such as in drone swarms, guided missiles, and logistical analysis. Autonomous systems have been incorporated into defensive weaponry for even longer, e.g. antivehicle and antipersonnel mines. Future developments will continue to aspire to increasing levels of autonomy. The US is testing AI bots that can self-fly a modified version of the F-16 fighter jet; Russia is testing autonomous tanks; and China too is developing its own AI-powered weapons[3]. The goal is to protect human life by continuing to mechanize and automate battlefields. “I can easily imagine a future in which drones outnumber people in the armed forces pretty considerably[3]” said Douglas Shaw, senior advisor at the Nuclear Threat Initiative. So, instead of soldiers being deployed on the ground we saved lives by putting them in planes and arming them with missiles. Now with AI, militaries hope to spare even more human life from its forces. Moral Implications of AI in Warfare This sounds great so far. Save lives by using AI to direct drones. Save lives by using AI to launch missiles. The difference between this technological jump in warfare and past innovations is the lack of human input in decision-making. With AWS and lethal autonomous weapons systems (LAWS), we are handing the power to kill a human being over to an algorithm that has no intuitive humanity. Several ethical, moral, and legal issues arise here. Is it fair that human life should be taken in war without another human being on the other side of that action? Does the programmer of an algorithm in a LAWS have the same responsibility in representing their country as a fighter pilot, and/or the same right to contribute to taking enemy life? Like with the ethical dilemmas surrounding autonomous vehicles[4], is it morally justifiable to delegate life-and-death decisions to AI-powered algorithms? From a technological point of view, this will come to depend in part on the transparency of the programming of AWS: training, datasets used, coded preferences, and errors like bias, in these models. Even if we reach an adequate level of accuracy and transparency, should AWS and LAWS be considered moral in warfare? Moral Implications of Just War Theory Just War Theory, credited to St Augustine and Thomas Aquinas in the 13th century[5], evaluates the morality of warfare and ethical decision-making in armed conflict. Across guidelines for (justice of war) and (justice in war), the most notable considerations are: jus ad bellum jus in bello Proportionality: The use of force must be proportional to the objective being pursued and must not cause excessive harm or suffering relative to the anticipated benefits. Discrimination: Also known as non-combatant immunity, this principle requires that combatants distinguish between combatants and non-combatants, and only target the former while minimizing harm to the latter. It could be argued that the use of AI-powered weapons and LAWS do not guarantee adherence to these conventions. On proportionality, AI-backed weaponry would possess the ability to deliver force with greater speed, power, and precision than ever before. Would this level of force necessarily match the threat posed/military objective, especially if used against a country with less technologically advanced weaponry? Similarly, what if a LAWS is fed erroneous intel, or hallucinates and creates an inaccurate prediction? This could lead to the formation and execution of unnecessary military force and disproportionate actions. On the point of discrimination, these technologies are not 100% accurate. When firing a missile at an enemy force, what happens if facial recognition[6] technologies cannot distinguish civilians from combatants? This would undermine the moral distinction between legitimate military targets and innocent bystanders. Case Study A Panel of UN Experts reported the possible use of a LAWS - STM Kargu-2 - in Libya in 2020, deployed by the Turkish military against the Haftar Affiliated Forces (HAF)[7]. Described as being “programmed to attack targets without requiring data connectivity between the operator and the munition” [8], the drone units were eventually neutralized by electronic jamming. The involvement of this remote air technology though changed the tide for what had previously been “a low-intensity, low-technology conflict in which casualty avoidance and force protection were a priority for both parties”[7]. While causing significant casualties, it is not clear whether the unmanned attack drones caused any fatalities[8]. Still, it highlights issues with unregulated, unmanned use of combat aerial vehicles and drones. HAF units were not trained to defend against this form of attack, had no protection from the aerial attacks (which occurred despite the drones being offline), and even in retreat continued to be harassed by the LAWS. This alone begins to breach the principle of proportionality, and even more so when considering that the STM Kargu-2s changed the dynamic of the conflict. Reports go so far as to suggest that “the introduction by Turkey of advanced military technology into the conflict was a decisive element in the… uneven war of attrition that resulted in the defeat of HAF in western Libya during 2020”[7]. International Cooperation and Regulation of AI in Military Applications Since 2018, the UN Secretary-General António Guterres has maintained that LAWS are both politically and morally unacceptable[9]. In his 2023 New Agenda for Peace, Guterres has called for this to be formalized and actioned by 2026. Under this, he suggests a complete ban on the use of AWS which functions without human oversight and does not comply with international law, and regulation of all other AWS. This type of international cooperation and regulation will be necessary to help overcome the ethical concerns we have discussed. For now, the use of AWS without human oversight will cause the most immediate issues. The lack of a human decision-maker creates issues of responsibility. Without a chain of command who takes responsibility for the malfunctioning or general fallibility of an AI-powered system? Moreover, there would be an ensuing lack of accountability. Especially in traditional warfare where there are defined moral principles like the Just War Theory, here there would be no culpable agent for actions taken by autonomous systems. Finally, while there are benefits to increasingly adopting AI in military applications, how these technologies end up being used will define whether it becomes a utopic solution or a proliferation of the already politically destabilizing arms race. Therefore, continued discussion around international, legally binding frameworks for ensuring accountability in AI warfare will arguably be one of the most crucial areas of AI regulation in the near future. References Weaponizing Innovation: Mapping Artificial Intelligence-enabled Security and Defence in the EU War and Technology - Foreign Policy Research Institute How AI Will Revolutionize Warfare Ethical AI and Autonomous Vehicles: Championing Moral Principles in the Era of Self-Driving Cars | HackerNoon Just War Theory | Internet Encyclopedia of Philosophy Bias in Facial Recognition Tech: Explore How Facial Recognition Systems Can Perpetuate Biases | HackerNoon Libya, The Use of Lethal Autonomous Weapon Systems | How does law protect in war? - Online casebook The Kargu-2 Autonomous Attack Drone: Legal & Ethical Dimensions - Lieber Institute West Point Lethal Autonomous Weapon Systems (LAWS) – UNODA

The Ethics of AI in Modern Warfare: Balancing Innovation with Moral Accountability

আধুনিক যুদ্ধে এআই-এর নীতিশাস্ত্র: নৈতিক জবাবদিহিতার সাথে উদ্ভাবনের ভারসাম্য

Die Ethik der KI in der modernen Kriegsführung: Innovation und moralische Verantwortung in Einklang bringen

La ética de la IA en la guerra moderna: equilibrar la innovación con la responsabilidad moral

L'éthique de l'IA dans la guerre moderne : équilibrer l'innovation et la responsabilité morale

आधुनिक युद्ध में एआई की नैतिकता: नैतिक जवाबदेही के साथ नवाचार का संतुलन

現代の戦争における AI の倫理: イノベーションと道徳的責任のバランス

현대전에서의 AI 윤리: 혁신과 도덕적 책임의 균형

A Ética da IA na Guerra Moderna: Equilibrando Inovação com Responsabilidade Moral

Этика ИИ в современной войне: баланс между инновациями и моральной ответственностью

Modern Savaşta Yapay Zeka Etiği: İnovasyonu Ahlaki Sorumlulukla Dengelemek

Đạo đức của AI trong chiến tranh hiện đại: Cân bằng giữa đổi mới với trách nhiệm đạo đức

现代战争中的人工智能伦理：平衡创新与道德责任

Following its breakout year in 2023, generative AI (genAI) is finding increasing applications across various industries, including fashion. However, while this is a significant technology, it's only one aspect of the changes happening in the field. Some innovations may not appear on the catwalks or make headlines but could be essential during mountain expeditions or camping trips. I spoke with Vladislav Moroz, the founder of - a brand of equipment and apparel for extreme sports and outdoor activities - who revealed the products and innovations that keep you warm and dry in severe weather. RedFox The Rise of Electronic Jackets RedFox strives to stay ahead of the game by experimenting with new technologies. In 2021, the company initiated a collaboration with . Together, they conceived the idea of electronically heated clothing capable of replacing ten layers of sweaters under a winter coat. ITMO University “Equipped with printed electronics, this clothing can keep the wearer warm even in extremely cold temperatures down to -70°C,” Moroz said. “The first garment prototype is a jacket, with the electronics distributed throughout the item. These electronics can operate for up to six hours without needing to be recharged. To activate them, users simply need to press a button on the surface of the garment.” The Ultimate Shield Picture yourself embarking on a mountain expedition or camping trip, where unpredictable weather can quickly turn an adventure into a test of endurance. In such scenarios, the importance of waterproof clothing cannot be overstated. “Outdoor brands like RedFox are harnessing the power of cutting-edge materials such as to create garments that not only block out moisture but also allow for breathability, ensuring comfort even during unexpected downpours,” Moroz said. “This membrane material was invented in 1969 by Wilbert L. Gore and his son, Robert W. Gore. In 2006, the latter was inducted into the U.S. National Inventors Hall of Fame for their discovery.” Gore-Tex No Seams Allowed But it's not just about keeping dry; staying warm in extreme conditions is equally crucial. Imagine yourself strolling through a snowstorm. Numerous jackets are touted for their ability to withstand extreme cold, but the reality often falls short of the claim. “Many of these jackets feature seams that create minuscule holes in the fabric, allowing chilly air to infiltrate and leaving the wearer vulnerable to the elements,” Moroz said. “Recognizing this flaw, certain outdoor brands are turning to seamless technology. It allows them to craft garments without stitches and superior thermal insulation.” Moroz’s brand also used it to create sleeping bags. They were tested by the International Center for Quality Certification and showed stunning results: according to Moroz, they braved temperatures of up to -91 °C. Goose Down Gets an Upgrade Of course, no winter jacket is complete without the coveted warmth of goose down. It is prized for its excellent heat retention features. While it is a natural material, nobody uses it in its raw state. “Before filling a jacket, down undergoes rigorous testing with water, soap, and high temperatures,” Moroz said. “These steps allow us to get rid of dust and parasites, making the material wearable for everyone, especially for people with allergies. However, during this process, it loses some of its original qualities, such as waterproofing.” To restore it, brands use different methods. One of the most effective is waterproofing. It helps to make the material water-resistant while remaining soft and pleasant to the touch. Nikwax Little Innovation That Makes a Big Difference But it's not just about jackets; even accessories are getting a technological makeover. Let’s say you have to check directions or make the radio call. But it is freezing and potentially dangerous to take your mittens off. “Well, you do not have to if you wear a top mitten with a side zipper,” Moroz said. “It enables people to quickly expose their fingers without having to remove the whole mitten, thus preventing frostbite. Moreover, the zipper can be easily manipulated with one's teeth. Simple yet ingenious, this innovation epitomizes the marriage of fashion and function in extreme weather conditions.” As we look to the future, one thing is certain: the intersection of fashion and technology will continue to inspire creativity and drive progress, ensuring that we're always equipped to face whatever challenges Mother Nature throws our way. So whether you're scaling a mountain or simply navigating the urban jungle, rest assured that the latest innovations in fashion have you covered, both literally and figuratively.

Outdoor Tech That Works: Stay Warm and Dry in the Harshest Conditions

This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. Authors: (1) Pascal Baumann, Max Planck Institute for Software Systems (MPI-SWS), Germany; (2) Rupak Majumdar, Max Planck Institute for Software Systems (MPI-SWS), Germany; (3) Ramanathan S. Thinniyam, Max Planck Institute for Software Systems (MPI-SWS), Germany; (4) Georg Zetzsche, Max Planck Institute for Software Systems (MPI-SWS), Germany. Table of Links Introduction Dynamic Networks of Concurret Pushdown Systems (DCPS) Warm-up: Non-Termination Fair Non-Termination From Progressive Runs for VASSB to Reachability Starvation Conclusion, Acknowledgment & References A. Strengthening Fairness to Progressive Runs B. Proofs from Section 4.1 C. Proofs for Section 5 D. Proofs for Section 5.3 E. Proofs for Section 6 3 WARM-UP: NON-TERMINATION In this section, we prove Theorem 2.2. The theorem follows easily from previous results for safety verification [Atig et al. 2011; Baumann et al. 2020]. We recall the main ideas as a step toward the more complex proof for fair termination. DCPS DCFS Downward Closures: From to The DCFS simulates the downward closure of the DCPS by simulating the composition of the automata for each downward closure. The construction is identical to [Atig et al. 2011, Lemma 5.3]. Thus, we can conclude with the following lemma. Lemma 3.1. TheK-bounded non-termination problem for DCPS can be reduced in exponential time to the non-termination problem for DCFS. The resulting DCFS is of size at most exponential in the size of the DCPS. DCFS VASS From Non-Termination to Non-Termination Proof of Theorem 2.2. The 2EXPSPACE upper bound follows by combining Lemmas 3.1, 3.2, and the EXPSPACE upper bound for the non-termination problem for VASS [Rackoff 1978]. The 2EXPSPACE lower bound follows from the observation made already in [Baumann et al. 2020] that the 2EXPSPACE-hardness of K-bounded reachability already holds for terminating DCPS, in which every run is terminating. It is now a simple reduction to take an instance of the 퐾-bounded state reachability problem for a terminating DCPS and add a “gadget” that produces an infinite run whenever the target global state is reached.

Context-Bounded Verification of Liveness: Warm-up: Non-Termination

The New York Times Company v. OpenAI Update Court Filing, retrieved on February 26, 2024 is part of . You can jump to any part in this filing . This part is 14 of 15. HackerNoon’s Legal PDF Series here D. The “Misappropriation” Claim Is Preempted by the Copyright Act Count VI, for “misappropriation” under New York law, appears to raise two distinct theories. The first suggests that OpenAI engages in “unfair competition” by using “Times content to train models that produce informative text of the same general type and kind that [t]he Times produces.” Compl. ¶ 195 (the “Text Claim”). The second suggests that OpenAI harms the Times because ChatGPT can respond to user queries about Wirecutter recommendations. Id. ¶ 194 (the “Recommendations Claim”). Both are preempted by the Copyright Act. 17 U.S.C. § 301(a). 1. The Text Claim Fails The Text Claim is preempted by Section 301 of the Copyright Act, which “oust[s] the states from imposing any control of the area” governed by federal copyright law. In re Jackson, 972 F.3d 25, 42 (2d Cir. 2020). Preemption applies if two conditions are met: (1) the claim relates to “works of authorship . . . within [copyright’s] subject matter” (“subject matter” condition); and (2) the rights asserted are “equivalent to any of the exclusive rights within [copyright’s] general scope” (“general scope” condition). 17 U.S.C. § 301(a). Here, the subject matter condition is satisfied because the claim is based on OpenAI’s use of (1) Times articles, which are “literary works,” 17 U.S.C. § 102(a), and (2) facts from those articles which, while unprotectable, fall “within the subject matter of copyright for the purposes of [] preemption,” Barclays Capital Inc. v. Theflyonthewall.com, Inc., 650 F.3d 876, 893 (2d Cir. 2011). And the general scope condition is satisfied because the rights asserted are not “qualitatively different from a copyright [] claim.” In re Jackson, 972 F.3d at 43–44. One aspect of the Text Claim is based on the use of content to “train models,” Compl. ¶ 195, which is one of the stated bases of the copyright claim, id. ¶¶ 64, 161–62. The other is based on outputs that are “the same or similar to content published by [t]he Times,” id. ¶ 194–95, which is the other stated basis of the copyright claim, see id. ¶ 163. Because the Text Claim is based on the same allegations as the copyright claims, the claim is preempted.[47] 2. The Recommendations Claim Fails The Recommendations Claim focuses on Wirecutter, a Times-owned website that publishes articles to guide readers through difficult purchase decisions. See, e.g., Compl. ¶¶ 130, 134. Wirecutter makes “the vast majority of its revenue” through “commission[s],” which it earns when users click “affiliate links” in its articles and purchase a product. Id. ¶¶ 128–29. According to the Times, by complying with requests to identify Wirecutter-recommended products, ChatGPT reduces the need for users to “visit the [] Wirecutter article and click on [these] links,” id., thus “depriving [t]he Times of the opportunity to receive referral revenue,” id. ¶ 194. This claim is almost identical to the “misappropriation” claim the Second Circuit rejected in Barclays. 650 F.3d 876 (2d Cir. 2011). That case concerned stock recommendations which banks provided to paying clients as a mechanism for generating commissions. Id. at 880–82. The defendant “compile[d]” those recommendations and provided them “to their own subscribers for a fee.” Id. at 882. The banks brought a “misappropriation” claim, stressing that they “spend hundreds of millions of dollars annually” generating the recommendations, and that the defendant “seriously threatens their ability to justify [that] expense.” Id. at 881, 885–86. The Second Circuit first held that the claim satisfied the conditions for Copyright Act preemption: (1) the “facts of the Recommendations,” while unprotectable, fell within the subject matter of copyright; and (2) the banks claimed the right to control the reproduction of those recommendations, which falls within the “general scope” of copyright. Id. at 902. The Court, however, explained that its precedents recognized a “narrow” preemption exception for “hot news” claims endorsed by the Supreme Court in the Int’l News Serv. v. Associated Press (INS), 248 U.S. 215 (1918) case. Barclays, 650 F.3d at 896–98.[48] Accordingly, the merits of the claim depended on whether it fell into the “narrow” category of “INS-type non-preempted claims.” Id. at 902–03. The Circuit held it did not. First, while “INS-type” claims involve defendants who “sell [purloined] news as though the defendant itself had gathered it,” the Barclays defendant was “selling the information with specific attribution to the issuing [bank].” Id. (emphasis added). For that reason, there was no “meaningful difference” between the defendant’s republication of the recommendations and a “member[] of the traditional news media” reporting on information “with proper attribution.” Id. at 903–04. Second, INS-type claims concern defendants who appropriate material (e.g., news) that the defendants “acquire through efforts akin to reporting.” Id. at 903. But the banks’ claim sought “only to protect their Recommendations, something they create using their expertise and experience”—which brought the claim closer to copyright’s exclusive domain. Id. For those reasons, the defendant’s “service—which collects, summarizes, and disseminates the news of the [banks’] Recommendations—[was] not the kind of ‘INS-like’ product that could support a non-preempted cause of action for misappropriation.” Id. at 905. The Recommendations Claim fails for the same reasons. First, it satisfies the preemption conditions: it (1) relates to facts within copyright’s “subject matter;” and (2) asserts the right to control reproduction of those facts, which falls within copyright’s “general scope.” Id. at 902. Second, to the extent the Times has attempted to plead an “INS-type non-preempted claim[]” for misappropriation, id. at 902, it has failed to do so for the reasons discussed in Barclays. OpenAI is not “selling the Recommendation[s] ‘as its own.’” Id. at 903. It provides “specific attribution to” Wirecutter, which means this is not an INS claim. Id. Moreover, Wirecutter recommendations are not facts that the Times “acquire[s] through efforts akin to reporting;” rather, the Times “seek[s] only to protect [its] Recommendations, [which it] create[s] using [its] expertise and experience.” Id. The claim is therefore governed exclusively by copyright law, under which the quantum of the Times’s “investment” is irrelevant to its right to monopolize the results. Compl. ¶ 196; Moody’s, 808 F.2d at 207 (“[T]o grant copyright protection based merely on the ‘sweat of the author’s brow’ would risk putting large areas of factual research material off limits and threaten the public’s unrestrained access to information.”); Barclays, 650 F.3d at 886 (rejecting claim despite allegation that defendant “seriously threatens [banks’] ability to justify the expense of maintaining [] extensive research operations”). Continue Reading . Here [47] Financial Information, Inc. v. Moody’s Investors Serv., Inc., 808 F.2d 204, 206, 208–09 (2d Cir. 1986) (misappropriation claim based on allegation that defendant “copied 40–50% of [plaintiff’s] information” preempted). [48] INS concerned a news service that “lift[ed] factual stories from AP bulletins and sen[t] them by wire to INS papers” for republication without attribution to the AP. Barclays, 650 F.3d at 894, 896–98 (quoting INS). About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings. This court case retrieved on February 26, 2024, from is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. fingfx.thomsonreuters.com

WAIR

getwair.com

-- employees

Since n.d.

COMPANY RANKING

WAIR

EVERGREEN INDEX #11593

Representing this company? Click here to claim and customize this page!

WAIR WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

WAIR

getwair.com

-- employees

Since n.d.

COMPANY RANKING

WAIR

EVERGREEN INDEX #11593

RELATED COMPANIESRANK

STORIES ABOUT WAIR

Representing this company? Click here to claim and customize this page!

WAIR WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!