Later this month, Google will be rolling out 3D Augmented Reality (AR) in its search results, a change which could allow retailers to show their products online in a way that enables customers to a virtually ‘try’ those products and see them in situ before buying them.

Shown At Phone Launch

Google showed how 3D AR could work in search results to attendees of the launch of its Pixel 3 smartphone at its annual developer’s conference. At the phone launch, Google’s Vice President, Aparna Chennapragada, used a superimposed animation of a shark and a 3D exploration of a pair of New Balance running shoes to illustrate how potential customers could superimpose a 3D AR image of a product on their own chosen backdrop (‘you space’).  This would allow customers to see just how a product would look in situ if they were to purchase it.

Brands

Examples of the brands that Google is reported to have been working with in order to develop optimised links to 3D AR versions of their products in Google’s search results include New Balance, Samsung and Volvo.

Other Uses of AR

Google users may already be used to seeing AR in action as part of Google Maps, where users can switch from map to an AR representation with directional arrows by clicking on the ‘satellite’ link and then by clicking on the route. This feature allows users to follow arrows along a drivers-eye route, change direction, and zoom in and out.

AR and VR

Back in October 2017 Ordinance survey introduced AR to its mobile app so that users could point their smartphone at the world around and see labels about places of interest and get a reading of how far away they are.

In February this year, breakfast cereal manufacturer Kellogg’s announced that it had been working with third-party VR companies to help it determine the best way to display its new products in stores. The pilot scheme used VR to give test subjects an immersive and 360-degree experience of a simulated store environment in which they were able to ‘virtually’ pick products, place items in shopping trolleys and make purchases.

What Does This Mean For Your Business?

Using AR to show 3D AR versions of products in the search results will enable companies to get their product instantly in front of consumers in a way that allows them to engage with those products on-demand, have a good look around the products, and virtually try them out and see how they could fit in with their lives.  This may be particularly important for products linked to self-image and lifestyle perceptions.  This could prove to be a valuable sales tool with considerable potential for all manner of products.

It has been reported that it was a surveillance attack on Facebook’s WhatsApp messaging app that caused the company to urge all of its 1.5bn users to update their apps as an extra precaution recently.

What Kind of Attack?

Technical commentators have identified the attack on WhatsApp as a ‘zero-day’ exploit that is used to load spyware onto the victim’s phone.  Once the victim’s WhatsApp has been hijacked and the spyware loaded onto the phone, it can, for example, access encrypted chats, access photos, contacts and other information, as well as being able to eavesdrop on calls, and even turn on the microphone and camera.  It has been reported that the exploit can also alter the call logs and hide the method of infection.

How?

The attack is reported to be able to use the WhatsApp’s voice calling function to ring a target’s device. Even if the target person doesn’t pick the call up the surveillance software can be installed, and the call can be wiped from the device’s call log.  The exploit can happen by using a buffer overflow weakness in the WhatsApp VOIP stack which enables an overwriting of other parts of the app’s memory.

It has been reported that the vulnerability is present in the Google Android, Apple iOS, and Microsoft Windows Phone builds of WhatsApp.

Who?

According to reports in the Financial Times which broke the story of the WhatsApp attack (which was first discovered earlier this month), Facebook had identified the likely attackers as a private Israeli company, The NSO Group, that is part-owned by the London-based private equity firm Novalpina Capital.  According to reports, The NSO Group are known to work with governments to deliver spyware, and one of their main products called Pegasus can collect intimate data from a targeted device.  This can include capturing data through the microphone and camera and also gathering location data.

Denial

The NSO Group have denied responsibility.  NSO has said that their technology is only licensed to authorised government intelligence and law enforcement agencies for the sole purpose of fighting crime and terror, and that NSO wouldn’t or couldn’t use the technology in its own right to target any person or organisation.

Past Problems

WhatsApp has been in the news before for less than positive reasons.  For example, back in November 2017, WhatsApp was used by ‘phishing’ fraudsters to circulate convincing links for supermarket vouchers in order to obtain bank details.

Fix?

As a result of the attack, as well as urging all of its 1.5bn users to update their apps, engineers at Facebook have created a patch for the vulnerability (CVE-2019-3568).

What Does This Mean For Your Business?

Many of us think of WhatsApp as being an encrypted message app, and therefore somehow more secure. This story shows that WhatsApp vulnerabilities are likely to have existed for some time.  Although it is not clear how many users have been affected by this attack, many tech and security commentators think that it may have been a focused attack, perhaps of a select group of people.

It is interesting that we are now hearing about the dangers of many attacks being perhaps linked in some way to states and state-sponsored groups rather than individual actors, and the pressure is now on big tech companies to be able to find ways to guard against these more sophisticated and evolving kinds of attacks and threats that are potentially on a large scale.  It is also interesting how individuals could be targeted by malware loaded in a call that the recipient doesn’t even pick up, and it perhaps opens up the potential for new kinds of industrial espionage and surveillance.

A human kidney for transplant has been delivered by drone to a Medical Centre in Baltimore in the first flight of its kind.

Cutting Edge Technology

The drone transportation of the living organ over a one-mile journey used cutting-edge technology in the form of an AI-powered drone that had been specifically designed to maintain and monitor the organ during the journey.  As well as having a specially designed compartment to keep the organ in the right condition for transplant, the drone had onboard communications and safety systems to enable a safe flight over densely-populated/urban areas, and a parachute recovery system in case the drone failed.

Collaboration

The drone’s creation was the product of a collaboration between the aviation and engineering experts at the University of Maryland (UMD), transplant specialists and researchers at the University of Maryland School of Medicine (UMSOM), and others at the Living Legacy Foundation of Maryland.  Joseph Scalea, assistant professor of surgery at University of Maryland School of Medicine (UMSOM) who was one of the surgeons who carried out the transplant has also acknowledged the collaborative efforts of the surgeons, engineers, the Federal Aviation Administration (FAA), the organ procurement specialists, the drone pilots, nurses at the hospital, and the patient.

Solves Problems

The ability to deliver transplant organs by drone solves the problems caused primarily by traffic problems identified by the United Network for Organ Sharing, which reported that in 2018 there were nearly 114,000 people on waiting lists, with 1.5% of organs not making it to the destination and nearly 4% being delayed by two hours or more.

Medical Sample Delivery Too

There has also been a recent report in North Carolina of a hospital, in partnership with UPS, using a drone delivery program to speed up the delivery of critical medical samples across a hospital campus, thereby cutting 41 minutes off the usual on-foot journey.

Potential

The fact that the organ drone flight and the transplant operation were safe and successful has led to the recognition of the potential of this method e.g. unmanned transportation of organs over greater distances, minimising the need for multiple pilots and flight time and addressing safety issues.

What Does This Mean For Your Business?

This world-first in organ transportation is an important first step in what could be (if proven to be safe and reliable over multiple flights) an important new technological improvement to the provision of life-saving medicine.

Business owners may also be thinking that if this can be done successfully with something as important and delicate as a human organ for transplant, this system could potentially be scaled up and used to ensure the fast, safe delivery of other items. Amazon, for example, has been testing delivery drones for parcels since 2013 with a view to making its ‘Prime Air’ service a regular reality in the future.

As shown by UPS’s involvement with medical sample delivery, other major delivery companies are also investing in drones and their potential to combat the challenges posed by traffic congestion and labour-intensive and time-consuming on-foot journeys.

Also, the US Federal Aviation Administration has just authorised Alphabet’s (Google’s) Wing Aviation to start delivering goods via drones later this year.  This is the first time that the FAA has granted an “air-carrier” the certification for drone delivery of items such as food, medicine, and other small consumer products.

Drone transportation is clearly moving forward and starting to prove that it offers great potential in many different sectors in the not-too-distant future.

In a recent interview with CBNC, Microsoft’s Corporate Vice President and Chief Information Officer Bret Arsenault signalled the corporation’s move away from passwords on their own as a means of authentication towards (biometrics) and a “passwordless future”.

Passwords – Not Enough On Their Own

Many of us are now used to two-factor authentication e.g. receiving a code via text or using apps such as Google Authenticator as a more secure way of using passwords.  Mr Arsenault also notes that hacking methods such as “password spraying”, where attackers attempt to access large numbers of accounts at once using some of the most commonly used passwords, are still effective and highlight the weakness of relying on passwords being used on their own.  Mr Arsenault highlights how damaging this can be for businesses where a hacker can get password/employee identity and use this to gain access to a whole network. This is one of the reasons why many businesses, including Microsoft, are moving away from the whole idea of passwords.

Setting Example – Biometrics

Microsoft is one of the most-attacked companies in the world, and this, combined with reports of the billions of password hack incidents worldwide, have driven the company to move beyond passwords.

For example, 90% of Microsoft’s 135,000 workforce can now log into the company’s corporate network without passwords using biometric technology such as facial recognition and fingerprint scanning via apps such as ‘Windows Hello’ and the ‘Authenticator’ app.

Also Uses Federated Cybersecurity

In addition to rejecting passwords for biometrics, Microsoft also uses a federated cybersecurity model.  This means that each Microsoft product has its own head of cybersecurity and that ethical hackers are actively encouraged to attack the company’s networks and products to test for flaws.

Scrapping Password Expiration Policies

Microsoft has announced that it is scrapping its password expiration policies in Windows 10 arguing that password expiration is an out of date method of data protection.  Users will now effectively be forced to update their passwords every few months once the Windows 10 May 2019 has been rolled out.

Other Tech Companies Moving Away From Passwords

Other tech companies that are known to be moving away from passwords towards biometrics and other methods include Google which has been testing USB key fobs which plug into customers’ computers and provide a second factor of authentication and Cisco which acquired dual-factor authentication start-up Duo in 2018.

What Does This Mean For Your Business?

As Microsoft points out, multi-factor authentication is more secure than relying on just a password for authentication, as password spraying and credential stuffing are widely in use and are still yielding good results for hackers.  As a recent National Cyber Security Centre (NCSC) survey has shown, many people still rely upon weak passwords, with ‘123456’ featuring 23 million times, making it the most widely-used password on breached accounts. There is a strong argument, therefore, for many businesses to look, as Microsoft is looking, towards more secure biometric methods of authentication, and towards a “passwordless future”.

Even though biometrics has been shown to make things incredibly difficult for cybercriminals to crack it, biometrics has not proven to have been 100% successful to date.  For example, a Reddit user recently claimed to have used a 3D printer to clone a fingerprint and then use that fake fingerprint to beat the in-display fingerprint reader on a Samsung Galaxy S10. Also, there was the report of the Twitter user who claimed to have fooled Nokia 9 PureView’s fingerprint scanner by using somebody else’s finger, and then just a packet of chewing gum, and of the incident back in May 2017 where a BBC reporter said that he’d been able to fool HSBC’s biometric voice recognition system by passing his brother’s voice off as his own.

There is no doubt that the move away from passwords to biometrics is now underway, but we are still in the relatively early stages.

The Information Commissioner’s Office (ICO) has concluded that HMRC has breached GDPR in the way that it collected the biometric voice records of users and now must delete five million biometric voice files.

What Voice Files?

Back in January 2017, HMRC introduced a system whereby customers calling the tax credits and Self-Assessment helpline could enrol for voice identification (Voice ID) as a means of speeding up the security steps. The system uses 100 different characteristics to recognise the voice of an individual and can create a voiceprint that is unique to that individual.

When customers call HMRC for the first time, they are asked to repeat the vocal passphrase “my voice is my password” to up to five times to register before speaking to a human adviser.  The recorded passphrase is stored in an HMRC database and can be used as a means of verification/authentication in future calls.

It was reported that in the 18 months following the introduction of the system, HMRC acquired 5 million peoples’ voiceprints this way.

What’s The Problem?

Privacy campaigners questioned the lawfulness of the system and in June 2018, privacy campaigning group ‘Big Brother Watch’ reported that its own investigation had revealed that HMRC had (allegedly) taken the five million taxpayers’ biometric voiceprints without their consent.

Big Brother Watch alleged that the automated system offered callers no choice but to do as instructed and create a biometric voice ID for a Government database.  The only way to avoid creating the voice ID on calling, as identified by Big Brother Watch, was to say “no” three times to the automated questions, whereupon the system still resolved to offer a voice ID next time.

Big Brother Watch highlighted the fact that GDPR prohibits the processing of biometric data for the purpose of uniquely identifying a person, unless there is a lawful basis under Article 6, and that because voiceprints are sensitive data but are not strictly necessary for dealing with tax issues, HMRC should request the explicit consent of each taxpayer to enrol them in the scheme (Article 9 of GDPR).

This led to Big Brother Watch registering a formal complaint with the ICO.

Decision

The ICO has now concluded that HMRC’s voice system was not adhering to the data protection rules and effectively pushed people into the system without explicit consent.

The decision from the ICO is that HMRC now must delete the five million records taken prior to October 2018, the date when the system was changed to make it compliant with GDPR.  HMRC has until 5th June to delete the five million voice records, which the state’s tax authority says it is confident it can do long before that deadline.

What Does This Mean For Your Business?

Big Brother Watch believes this to be the biggest ever deletion of biometric IDs from a state database, and privacy campaigners have hailed the ICO’s decision as setting an important precedent that restores data rights for millions of ordinary people.

Many businesses and organisations are now switching/planning to switch to using biometric identification/verification systems instead of password-based systems, and this story is an important reminder that these are subject to GDPR. For example, images and unique Voiceprint IDs are personal data that require explicit consent to be given, and that people should have the right to opt out as well as to opt-in.