Letter To Taxi Leaks : Uber Breach Of Data : Andrew Peters Secretary GMB Brighton & Hove Taxi Section

Simon Court

Senior Solicitor

Brighton & Hove Council

Town Hall 

Norton Road

Hove

November 25 2017

Dear Mr Court

Uber Breach of Data 

I write to you with reference to the serious matter of Uber concealing a breach of data and the councils continuous support of Uber being ‘Fit and Proper’ to hold a Brighton & Hove Operators licence. 

Reports have stated that some 57 million account holders and some 600,000 driver details were stolen in 2016 .

It is one matter having such a breach of security in the first place but it is an entirely different matter that such a serious breach in 2016 was never revealed to the public or regulators until one year later in November 2017  when it was revealed that it had paid 'hush money' to the hackers.

When it is considered that Fred Jones of Uber immediately ‘reached out’ to the public to condemn TfL and the Mayor of London Sadiq Khan for refusing to re-licence Uber and yet remained absolutely silent with no warning to the public when data was stolen... such inaction can clearly demonstrate the fitness of an organisation that is fully supported by the council.

It is presumed that Mr Fred Jones gave no indication to the council that Uber tried to hide this serious data breach when applying for the renewal of the Uber Brighton & Hove Operators Licence when presenting the company as ‘Fit  Proper’ to hold such a licence.

TfL Investigation

We have since learnt that TfL are now involved in the investigation and on the principle that Brighton & Hove Council Hove have based the recent re-licensing of Uber on how TfL are managing the refusal of the Uber London Licence we now call on Brighton & Hove Council to act in the same way as TfL and carry out its own investigation into the breach of data and the implications of Uber remaining silent about this for over a year.

We also require the council to justify to the trade that it still considers Uber to be ‘Fit and Proper’ to hold a Brighton & Hove Operators Licence.

For clarity:

Evening Standard - TfL investigates whether massive Uber cyber attack impacted Londoners

“The ride-hailing firm admitted this week to concealing a cyber-attack that affected 57 million customers and drivers last year.

Security services and the information watchdog were left scrabbling to assess the scale of the damage on Tuesday, amid warnings Uber's secrecy could result in "higher fines".

The firm hid the breach by reportedly paying hackers a ransom of £75,000 ($100,000) to delete the data and keep the security lapse quiet.

While Uber said it could not confirm how many customers in the UK had their details compromised, TfL said they are working to establish whether the hack affected Londoners. A TfL spokesman said: “We are working to gain clarity from Uber on whether any of the issues seen in the US have occurred here. 

“We are pressing them for the full details of what has happened so that we can be satisfied that all the right protections are in place for the personal data of drivers and customers in London.”

Stolen information included names, email addresses and mobile phone numbers, in addition to the names and number plates of 600,000 drivers in the US

Prime Minister Theresa May's official spokesman said: "These are obviously concerning reports and the National Cyber Security Centre is working closely with domestic and international agencies, including the National Crime Agency and the Information Commissioner's Office, to investigate if and how this breach has affected people in the UK. "It is a worldwide incident and it is unclear at this stage which countries were affected by the hack.

"What we do know is, based on current information, we have not seen evidence that financial details have been compromised." He added that Uber "did not notify individuals in the UK, the UK Government or UK regulators" at the time the hack was discovered in October last year.

The Information Commissioner's Office (ICO) warned Uber it could face fines, saying the incident raised "huge concerns around its data protection policies and ethics".  The tech company reportedly tracked down the hackers and pressured them to sign non-disclosure agreements so news of the incident did not become public.

Company executives had then dressed up the breach as a "bug bounty", the practice of paying hackers to test the strength of software security, according to The New York Times. James Dipple-Johnstone, deputy commissioner of the information watchdog, said: "Uber's announcement about a concealed data breach last October raises huge concerns around its data protection policies and ethics.

"It's always the company's responsibility to identify when UK citizens have been affected as part of a data breach and take steps to reduce any harm to consumers.

"If UK citizens were affected then we should have been notified so that we could assess and verify the impact on people whose data was exposed.

He added: "Deliberately concealing breaches from regulators and citizens could attract higher fines for companies."

http://ift.tt/2Ao37MX

Please note that I have supplied a copy of this email to various organisations...publications ....individuals  and interested parties and with respect your reply will be made publically available unless you specifically refuse permission.

I look forward to your early reply on such an important matter.

Andrew Peters

Secretary

GMB Brighton & Hove Taxi Section

from Taxi Leaks http://ift.tt/2ndwyeY
via IFTTT

Uber's Data Hack Affects 2.7m Of Their Customers, Not For The First Time.

Uber's Data Hack, Has Affected 2.7m Of Their Customers And Also Their Drivers. 

In October 2016, Uber experienced a data security incident that resulted in the hacking of information related to riders and drivers accounts. 

For riders, this information included the names, email addresses and mobile phone numbers related to accounts globally. 

Uber said their outside forensics experts have not seen any indication that trip location history, credit card numbers, bank account numbers or dates of birth were downloaded, but customers have been all over social media, saying they've been charged for expensive journeys they never booked.

This is a global issue, but in the United Kingdom alone, this involves approximately 2.7m riders and drivers. 

Uber again say this is an approximation rather than an accurate and definitive count, because sometimes the information we get through the app or our website that we use to assign a country code is not the same as the country where a person actually lives. 

Again proof that this company takes little regard of complaints made on Twitter or Facebook. As they don't have a complaints land line number (a requirement for operators, under the PHV act 1998) this would be the majority of camp,aunts made. 

When this happened, we took immediate steps to secure the data, shut down further unauthorised access, and strengthen our data security.

They also decided to say nothing to regulators or customers and have Bly spoken now as this breach has been publicly exposed. 

DO I NEED TO TAKE ANY ACTION? 
Best advice to customers is to delete their account and contact their bank, informing them not to pay any Uber trips charged to their account. 

Uber have made a statement that they encourage all users to regularly monitor their accounts for any issues. 

They say customers should let them know via the Help Centre if anything unexpected or unusual related to your Uber account. You can do this by tapping "Help" in your app, then "Account and Payment Options" > "I have an unknown charge" > "I think my account has been hacked".

Funny they should put this out after stating that no customers (to their knowledge) have been hacked! 

It also appears that their own drivers are now complaining that money has been taken from their accounts!

NCSC advice for Uber customers and drivers

The NCSC has also provides guidance which can be found below..

http://ift.tt/2Aq5Sxl

Mayor Khan has turned a blind eye to all the scandal that's hit the media over the past few weeks. The rise in UberRape, the escalation of road traffic accidents, the allegations of industrial espionage of competitors and the Data hacking. 

Khan made his feelings about Uber clear in the Osbourne's Evening Standard

THIS IS NOT THE FIRST TIME UBERS CUSTOMER SERVERS HAVE BEEN HACKED !

In addition to failing to notify users and the public about the information that was exposed, the company paid the hackers $100,000 to delete the data and subsequently had them sign nondisclosure agreements. The city further alleges that the ride-hail company failed to correct security vulnerabilities that led to a previous data breach in 2014. 

The complaint reads:

“After the details of Uber’s May 12, 2014 data breach were revealed to the public, Uber was investigated by a number of state and federal regulators that were concerned about its inadequate data security practices. Uber ultimately promised to bolster its data security policies by, inter alia, adopting protective technologies for the storage, access, and transfer of private information ... less than a year later the same failures led to a breach that was one thousand times worse.”

from Taxi Leaks http://ift.tt/2j1Kd4b
via IFTTT

Uber’s Claim That Hackers Have Fully Deleted Stolen Data Is “Nonsensical”

Uber's been sued at least 11 times in just 1 week, faces new scrutiny from Senate.

It’s now been a full week since the jaw-dropping revelations that Uber sustained a massive data breach in 2016, which affected over 57 million people.

Since November 21, the company has been hit with 10 federal lawsuits (including the two Ars reported on last week). On Monday, the City of Chicago and Cook County also sued Uber in Illinois state court, while numerous senators are now demanding answers as well.

The cases allege substantial negligence on Uber’s part: plaintiffs say the company failed to keep safe the data of the affected 50 million customers and 7 million drivers.

Uber reportedly paid $100,000 to delete the stolen data and tried to keep news of the breach quiet by having the hackers sign non-disclosure agreements.

In the case of City of Chicago v. Uber, city and Cook County lawyers wrote that in October 2016, then-CEO Travis Kalanick was contacted by two hackers who claimed to have millions of individual Uber customers’ records.

"In striking resemblance to the 2014 breach, the hackers had accessed a private GitHub repository and found database login credentials," Chicago's attorneys argued.

"While the repository was password-protected, hackers were still able to breach it—indicating either a very weak password or the fact that the user credentials for the repository were found in a previous unrelated data breach. And even though Uber specifically promised regulators that it would use two-factor authentication on services like GitHub, it clearly failed to implement that promise. Once inside the GitHub repository, the attackers once again found AWS login credentials, which the attackers then used to access and extract the personal information of over 50 million people, including Chicago and Illinois residents."

Last Tuesday, CEO Dara Khosrowshahi wrote: "None of this should have happened, and I will not make excuses for it."

According to the Wall Street Journal, Khosrowshahi learned of the breach two weeks after he took over the company’s top job on September 6, and yet he kept quiet for over two months.

Chicago attorneys also wrote that the company’s claims that the stolen data has been fully expunged is "nonsensical."

"It has not demonstrated, in any way, how or why it knows the data was actually deleted," they wrote. "No matter what documents the hackers signed, or representations they made, Uber is saying little more than that they trust the word of criminals."

"Integrity"

The broadly-similar proposed 10 class-action suits were filed in several federal courts across the country: in San Francisco; Los Angeles; Allentown, Pennsylvania; Portland, Chicago; and even Huntsville, Alabama.

On Monday, a group of senators, lead by Sen. John Thune (R-South Dakota) and Sen. Orrin Hatch (R-Utah), specifically asked for a "detailed timeline" of the incident, among other demands due by December 11.

Similarly, Sen. Mark Warner (D-Virginia) also had an even more damning question.

"To the extent Uber had lawfully acquired information enabling it to identify the hackers who had compromised its systems, ensure they would abide by agreements to delete the data and not to disclose the breach, and transfer them $100,000, it conceivably had enough information at hand to assist law enforcement in the apprehension of these criminals," he wrote.

"Why did Uber choose not to provide relevant forensic information to law enforcement and has this information been provided to law enforcement in the last week?"

Uber spokeswoman Molly Spaeth sent a statement to other media, including the Chicago Tribune, which read: "We are committed to changing the way we do business, putting integrity at the core of every decision we make, and working hard to regain the trust of consumers."

Uber has not responded to Ars’ multiple requests for comment.

Source : ars technica 

from Taxi Leaks http://ift.tt/2ieiXlD
via IFTTT

TfL...Architects Of Their Own Demise : None So Blind As Those Who Will Not See.

There's and old saying, which has never been truer than today.....none so blind as those who will not see!

Instead of looking closer to home, as passengers choose Uber over buses and trains, TfL has put the blame of an unexpected fall in passenger numbers on .... Brexit. 

TfL said:

We have seen lower growth in demand for our services than previously forecast for this year, largely owing to economic factors affecting the whole of the UK, including the uncertainty of Brexit.

Lower consumer confidence, GDP growth stagnating, real wage growth and a softening housing market are all affecting services and retail in London, leading to lower than forecast passenger numbers.

Current patterns in rail journeys show a year-on-year reduction in trips within Zone 1, which TfL said was reflected in its lower passenger income, and that the economic headaches had also buffeted its commercial revenue.

Operation Horizon back on the table.....

With Uber allegedly expanding its fleet of minicabs to over 40,000,  plus private hire licenses dished out like sweets to all comers, TfL expect negative pressure on demand for London's public transport to continue for the first half of its five-year business plan. 

The transport body's overall income for 2016/17 was £6.8bn, and for 2017/18 it is expected to drop to £6.5bn, while passenger income is expected to dip from £4.7bn for 2016/17 to £4.6bn for 2017/18.

TfL is also having to contend with the grant cut from central government. Its grant funding from the Department for Transport has been reduced by £2.8bn from 2015/16 to 2020/21.

Mayor Sadiq Khan said in the plan: "Our spending decisions become even more important in today's economic climate. While all other major transport operators in the world receive some form of central government subsidy, the government has taken £2.8bn away from TfL's operational funding."

TfL announced last month that upgrades for the Jubilee Line and Northern Line have been shelved after a surprise dip in passenger numbers on the Tube.

Out of desperation, TfL have flooded central London with an excess of buses, many remain empty most of the time, with the Tube the only part of the network still making a small profit. The transport body has been left facing an "investment prioritisation process".

The Mayor's fare freeze has had a major impact.

Critics have pointed their finger at mayor Sadiq Khan's fare freeze, with London Assembly Conservative member, Keith Prince, saying earlier this month: “In just 12 months, Sadiq Khan’s con of a ‘fares freeze’ has eluded millions of travelcard users and cost TfL hundreds of millions of pounds."

But in its business plan, TfL said early indications were that the fare freeze "has helped to dampen the effect of these negative economic factors". Putting up fares will encourage more people to Use cheaper services such as Uber.  

Where fares have been increased on the National Rail network, this has led to "much sharper reductions in passenger numbers for those operators", TfL added.

TfL are hoping people will turn away from cars and Taxis. They are hoping to bring new passengers from outside London in on the Tube.

In their planned fight back, TfL have fully backed plans to disrupt surface transport with pedestrianisation of major streets in WI, unreasonably quick green light phasing, segregated cycle lane's congestion, numerous unmanned road works...etc, banking on the Elizabeth Line to bring a considerable much needed boost to their economy. 

TfL also plan to ramp up income from commercial activities such as interactive advertising at bus stops as well as Tube and Coach Stations. 

from Taxi Leaks http://ift.tt/2zLdjPA
via IFTTT

#UberRape, Driver Sentencing Is Just The Latest Controversy For Company

Alejandro Done will serve up to 12 years in prison for raping a young female passenger.

Sebastian Murdock

A former Massachusetts Uber driver has been sentenced to 10 to 12 years in prison after raping a female passenger, adding to a growing list of Uber drivers accused of sexual assault.

Boston native Alejandro Done, 47, who pleaded guilty, was sentenced last Friday on charges including kidnapping, assault and battery, and aggravated rape, according to USA Today.

Ex-Uber driver Alejandro Done was sentenced to at least 10 years in prison for raping a female passenger.

On Dec. 6, 2014, Done picked up a woman heading to her home in Cambridge. Done told the woman that she would have to pay him in cash. The two went to an ATM to withdraw money, then Done drove her to a secluded location, reported the Star Tribune.

Done kept the victim trapped in the car as he strangled and sexually assaulted her. 

The felon has previously been charged with five other unsolved sexual assaults that happened in the Boston area between 2006 and 2010. That case is still pending. Uber told USA Today that Done had passed a background check, and had no prior criminal record.

“The defendant preyed upon a young woman who trusted that he was who he portrayed himself to be,” District Attorney Marian Ryan said in a statement. “I encourage the public to take precautions when using any ride-sharing service.”

In another recent case, in South Carolina, a sixth-grade teacher, who was moonlighting as an Uber driver was arrested on charges of kidnapping and forcible rape. Patrick Aiello, 39, was accused of assaulting a 23-year-old woman in August. The woman managed to escape from the car and was struck by another one in the process. Aiello later pleaded guilty to misdemeanor charges, and authorities dropped felony charges of kidnapping and criminal sexual assault against him, according to the Post and Courier.

A former Uber driver in India, Shiv Kumar Yadav, was convicted of raping a female passenger Tuesday. 

Many states in the U.S. are demanding that Uber ensure its background checks are more thorough. Last year, prosecutors in California filed a complaint against the ride-hailing service for failing to adequately vet drivers, some of whom have been convicted sex offenders, kidnappers and murderers.

Last April, Massachusetts Gov. Charlie Baker proposed a bill giving his state oversight in background checks. Uber has backed the legislation proposal, and hosts a petition on its website in favor of the governor’s plan, which has more than 30,000 signatures.

Uber faces a litany of other problems. Last weekend, drivers called for a strike and demanded better pay and higher fares. The service has been suspended in Spain for creating unfair competition and it is banned in Italy for not adhering to licensing rules. French taxi drivers, who were upset by having to compete with Uber, took to the streets last summer, smashing cars and setting tires on fire.

from Taxi Leaks http://ift.tt/2n7NMdo
via IFTTT

Mexican Authorities Seek Information From Uber About Massive Data Breach.

UberPool Car Sharing Banned From Operating In Israel From 10am Tomorrow

Uber will have to stop providing its car-sharing service in Israel as of 10 AM Wednesday, after the courts ruled in favor of competing companies. A Tel Aviv judge issued an injunction to that effect on Monday.

Judge Eitan Orenstein explained that because the drivers in question lacked appropriate insurance for passengers, he could not allow Uber to continue to operate run Uber Day and Uber Night ride-sharing services using private household cars in Israel. 

The Uber taxi service, however, may continue, the judge ruled.  

Uber had been successfully sued by an Isreally Taxi drivers association.  Separately, the Transportation Ministry sued Uber in May, on the grounds that Israeli regulation forbids taking passengers for money unless one has a taxi license. That case is still pending. 

The ministry claims that not only the driver, but even passnengers are in violation of the law. In the suit they name Uber's local manager, Yoni Greifman, and six drivers as those who are accused of taking passengers for pay.

Uber began operating in Israel in late 2016, on a small pilot basis. It expanded its carpooling operations over a month ago despite objections from the government.

A source at the Transportation Ministry speaking on condition of anonymity told TheMarker, "Someone boarding an Uber car is a criminal - both driver and passenger."

"The ministry is conducting a legal petition against the company, and there is the possibilty of filing of an interim injunction against its activities and the opening of a full criminal proceeding.  A criminal proceeding will be conducted against anyone who provides the service or is a passenger and against the company itself. The legal counsel of the transportation ministry is working with all the relevant parties to find the most appropriate path forward." the source said. 

from Taxi Leaks http://ift.tt/2zuTqrJ
via IFTTT