Bonum Certa Men Certa

The ISO Delusion: Sirius Corporation Demonstrates a Lack of Understanding of Security and Privacy

2FA with 'mobile phone' is not proper security
Especially not when you send passwords and private keys to dodgy third parties that suffer security breaches and lie about it



Summary: Sirius 'Open Source', emboldened by ISO 'paperwork' (certification), lost sight of what it truly takes to run a business securely, mistaking worthless gadgets for "advancement" while compelling staff to sign a new contract in a hurry (prior contract-signing scandals notwithstanding)

A part devoted purely to ISO was last week's focus/work and this week we show some of the company's awful practices when it comes to security. This is the most recent example. It's from this past October and it's likely what got me "flagged" for bollocking. In short, after the contract-signing scandals of 2019 I was apprehensive about signing another unknown contract and moreover consenting to a company-provided spying device (with camera and microphone) being inside my home. My wife was also hesitant; she expressed very strong opposition to this even before I did. "What next?" she said...



"This "mobile phones" strategy it is not about saving money..."My E-mails about company "mobile phones" were discussed with a friend in IRC (personal channel), albeit only after careful redaction. Polite language was used. Facts were adhered to all along. At the bottom of this post the communications are reproduced in full, with clients' names and colleagues' names redacted.

This "mobile phones" strategy it is not about saving money; outsourcing never saves money, it adds a trap for short-term savings. The bills, in turn, gradually increase by a lot and services stop working or get shut down. They cannot even be debugged because they are proprietary (AWS and Google in mind).

"The messages were sent less than 10 minutes apart, obviously coordinated for effect, and there was no room for debate."As the communication below shows, first they sent some 'enticing' message and later they sent an "ASAP" for a contract to sign (for "smart" "phone"). It was likely some sort of waiver. The messages were sent less than 10 minutes apart, obviously coordinated for effect, and there was no room for debate. If the company wants to buy brand new phones while deprecating existing Cisco phones of all staff -- and it won't settle for low-cost phones while at the same time admitting to employees that the company is tight on budget -- then what gives?

But there are deeper, more profound issues at stake here. To give some background, consider what the EFF published last month in relation to NLRB (unions):

How does this work? The NLRB protects the right of workers under Section 7 of the National Labor Relations Act to organize and discuss joining unions with their coworkers without retaliation and the board’s General Counsel rightly suggests that surveillance of workers by their bosses can lead to unlawful retaliation, as well as a chilling effect on workplace speech protected by the NLRA.

“It concerns me that employers could use these technologies to interfere with the exercise of Section 7 rights … by significantly impairing or negating employees’ ability to engage in protected activity—and to keep that activity confidential from their employer,” General Counsel Jennifer Abruzzo said in her letter. She added she will urge the board to act to "protect employees from intrusive or abusive electronic monitoring and automated management practices" that interfere with organizing rights.€  The general counsel's memo serves as a marker for future cases considered by the NLRB. Traditionally, the opinion of the NLRB's general counsel has a significant effect on how the board rules on cases it considers. This means that, should workers wish to file a claim with the NLRB along these lines, the board would take this opinion into account.

While worker privacy has been considered within general consumer privacy bills, workplace privacy rights function differently than those in many other contexts. A worker often cannot walk away from a camera pointed at their workstation. And while a consumer may feel they aren’t really “consenting” to data collection when they use a product or service, they generally have the option to go to a competing product. Workers don’t; saying “no” could cost them their livelihood. Therefore workers are set up to potentially lose certain rights during the workday.€ € € 



At the end of the month the EFF revisited this issue:

Since then, EFF has joined with those in the labor community to learn more about surveillance in the workplace and on work devices, and the effect it has on employees. Particularly as regulators start to pay more attention, and legislators include workers’ privacy in general consumer privacy bills, it’s important to understand the ways that the workplace presents unique challenges in this arena.

Bossware has Real Effects on Workers

As white collar remote workers felt bossware breathing down their necks, there was€ more coverage than ever of how employers are monitoring the workforce, and the lasting effects it has on workers' health, safety, livelihood, and collective bargaining rights. Even for remote staff, these stresses affected their mental health and family responsibilities. But it is workers across all fields that have increasingly felt the heat of surveillance, and some of the coverage was propelled by blue collar workers who fought back, from meatpacking facilities to service workers to delivery drivers who experienced increased surveillance as a form of retaliation for wage demands. Neither the ineffectiveness nor the impact on real people calmed employers' desires for increasing means to monitor and control worker behavior, with some even floating a database on worker productivity. Courts and agencies in other countries, like the Netherlands, have been quicker to take on U.S. firms who they allege have violated the human rights of foreign remote workers with demands on their acquiescence to invasive monitoring.



One lingering concern was, those "phones" can be used for spying and we already know the company was spying on workers, as we've demonstrated for nearly 2 months already.

The manager did not bother explaining the decision or how it had been reached; he went completely silent. He was trying to force us to sign something in a rush. Yet again... like in 2019. He also sent us nothing and instead went on a fishing expedition in IRC logs (it seems like nobody gave him a heads-up, as we showed before), only to find nothing but gossip that mentions no names, not even "Sirius". Such stalking by a "thug" isn't acceptable and it's easy to get the impression that it was an act of retaliation in a company where managers are immune or exempted from enforcement (like EPO management). A "phone" would likely become just a tool to "manage" people and there's already years-old track record of bullying by management. A "phone" would be a blunt instrument of coercion by intimidation and humiliation. All the stalking further justifies workers being apprehensive about "mobile" phones at home. In retrospect, we made the right decision when we antagonised/rejected the proposal.

Here is the full correspondence:

Introduction of Company Mobile Phones for the Support Team

Dear All,

This is just to update you that as part of our on-going development and improvement, we will imminently be introducing company mobile telephones for Support Team staff.

Whilst we are also constantly seeking cost savings and efficiency improvements and consequently as you know are looking at significant structural changes in the organisation, we also have significant security obligations for our own compliance and business requirement obligations to our clients.

However, as well as helping with our security compliance we believe this will be a very positive improvement in the ease of use for support telephony. xxxxx will distribute full details and instructions shortly.

Thank you in advance for helping with the smooth introduction of these devices!

Kind regards,

xxxx


9 minutes later another colleague wrote:

Introduction of Company Mobile Phones for Support

Hello Support Team,

With more customers demanding tighter security, the upcoming ISO audit requirements being more strict this coming November, and a general need to ensure you have the right tools for the job, Sirius will now be issuing work mobile phones to Support staff.

This has been under consideration for several years pending the right combination of business, customer, and financial requirements being met for deployment. Whilst the company continues to need to make overall financial savings and to achieve better efficiency, a number of pressing factors have become primary drivers to make this change happen now. (For example, you will be aware of xxxx becoming an increasingly important client of late and the imminent expansion of the support contract with them is key.)

We expect this to be a very positive step for Support Staff and should make a number of key processes more straight forward whilst also enabling key business benefits and security improvements.

Key purposes/benefits of introducing support mobile phones: 1. To enable 2FA and secure authentication for both Sirius and customer environments 2. Separating work and personal devices as a benefit for both work (security) and life-balance (you can turn it off when not on shift) 3. A step towards replacing the legacy Cisco handsets 4. The devices will integrate with the native platform for Google Voice and be a backup/forwarding target for that 5. A backup data connection to work from in case of local internet outage

The company policy on mobile devices and security is currently being updated to reflect this new tool, but please pay particular attention to the following key notes: * The devices will remain the property of the company * The devices must be used solely for work purposes and only by yourself * The devices will be controlled centrally by Sirius, usage will be visible to management * The devices must not leave the UK without prior specific permission from management

You have already agreed to abide by the Sirius IT policy and all usage of the device should be in accordance with this.

Devices will be distributed shortly and will include a Mobile Device Guide to allow a quick set-up. Please read through the Mobile Device Guide asap once available (which will be assigned to you in xxxx) and then agree to the contents and terms, after which your device will be sent out.

Warm regards,


To the first message I responded: "If this is about facilitating MFA, please provide phones with batteries that can be detached/removed in order to ensure the risk introduced isn't greater than the risk lowered."

The response was:

Hi Roy,

What risk are you suggesting we address by opting for mobile phones with a removable battery?

These devices are almost extinct, with only a few options. They also tend to be lower spec'd and poorer performing as you can see here: https://www.androidauthority.com/best-android-phones-removable-battery-697520/

Further to our discussion this morning, I cannot see a reason for us to make this a priority at this point.

Regards, xxxx


I responded to the longer message as follows:

> Hello Support Team,

Hi,

> With more customers demanding tighter security, the upcoming ISO audit > requirements being more strict this coming November, and a general need > to ensure you have the right tools for the job, Sirius will now be > issuing work mobile phones to Support staff. > > This has been under consideration for several years pending the right > combination of business, customer, and financial requirements being met > for deployment. Whilst the company continues to need to make overall > financial savings and to achieve better efficiency, a number of pressing > factors have become primary drivers to make this change happen now. (For > example, you will be aware of xxxx becoming an increasingly > important client of late and the imminent expansion of the support > contract with them is key.)

We still need a wiki page for them. ;-)

> We expect this to be a very positive step for Support Staff and should > make a number of key processes more straight forward whilst also > enabling key business benefits and security improvements. > > Key purposes/benefits of introducing support mobile phones: > 1. To enable 2FA and secure authentication for both Sirius and customer > environments

When I saw the previous message I responded with "If this is about facilitating MFA, please provide phones with batteries that can be detached/removed in order to ensure the risk introduced isn't greater than the risk lowered."

It's understandable that some of these schemes do not support a landline.

> 2. Separating work and personal devices as a benefit for both work > (security) and life-balance (you can turn it off when not on shift)

Not applicable to me as I don't use such a device.

> 3. A step towards replacing the legacy Cisco handsets

The Cisco handsets have worked well for almost a decade. They were always more reliable than Google Voice.

> 4. The devices will integrate with the native platform for Google Voice > and be a backup/forwarding target for that

We already have a dedicated computer for Google Voice. Plus, it has several fallbacks in place.

> 5. A backup data connection to work from in case of local internet outage

I think we still have a USB dongle for this somewhere. A SIM card should be enough to facilitate it. Our connection has generally been reliable for years.

> The company policy on mobile devices and security is currently being > updated to reflect this new tool, but please pay particular attention to > the following key notes: > * The devices will remain the property of the company > * The devices must be used solely for work purposes and only by yourself > * The devices will be controlled centrally by Sirius, usage will be > visible to management

It seems like sole purpose of it will be 2FA. Any simple phone that can do SMS can handle robust 2FA. Anything "apps" can introduce more risks.

> * The devices must not leave the UK without prior specific permission > from management > > You have already agreed to abide by the Sirius IT policy and all usage > of the device should be in accordance with this. > > Devices will be distributed shortly and will include a Mobile Device > Guide to allow a quick set-up. Please read through the Mobile Device > Guide asap once available (which will be assigned to you in xxxx) > and then agree to the contents and terms, after which your device will > be sent out.

If, as stated above, I "already agreed to abide by the Sirius IT policy and all usage of the device should be in accordance with this," then why do I need to sign an additional document? Anyway, I think this needs to be discussed with staff. I wasn't told anything about this until today and it seems like a lot of resources are spent on just an MFA appliance.

Regards.


I tried to speak to them over the telephone, knowing from experience that they would likely not bother replying.

First colleague: Managed to get to him over the phone to discuss the matter.

Second colleague: Tried to avoid talking to me about it over the phone, using obviously fake excuses.

But the point isn't about a "phone" per se. As we'll show over the next few days, the company was failing at the very basics and putting not only its own systems at risks but also clients'.

Recent Techrights' Posts

Why Techrights Cannot be Vilified (and Instead It Gets SLAPPed Repeatedly by Microsoft People)
Attack dogs are all "bark"; because they have no actual "bite"
Links 25/06/2025: Elon Musk’s Lawyers Caught Lying, WhatsApp Faces More Bans
Links for the day
Wayland Pushers Lose the Argument, Use LLM Slop and Chatbots to Make Up Arguments for IBM
Another new low and low blow
What is "MATA"?
Think of it as GAFAM or "Meta"
WebProNews is a Slopfarm
Please avoid linking to WebProNews
Another "Told You So!": XBox Mass Layoffs at Microsoft (Many Recent Reports Were Chaff and Spin), Many Other Divisions Affected
With mass layoffs at Microsoft the world would be much better
 
The 'Case' of the Serial Strangler From Microsoft is a Lot of Copypasta (Maybe Also LLM Slop) From the Matthew Garrett 'Case'
5RB deserves to know and the matter shall be properly reported in due course (when the time is right)
Austrian GNU/Linux Usage Up to About 5% as More of Europe Abandons Microsoft
Since inauguration day the Austrian people have adopted more and more of GNU/Linux
Why the "Wayland People" and "Rust People" Will Lose Hearts and Minds (Same Reasons)
Wayland pushers are fast becoming like "Rust People"
5,600 Pages/Articles Per Year
So far this year we've kept all the promises
BetaNews Beginning to Show What Its True Goals Are
The 'new' BetaNews won't be about journalism. It's trying to sell things.
Microsoft Has Lost "The War"
We'll soon see the 9th or 10th wave of Microsoft layoffs in 2025 alone
Slopwatch: A Wreck and a Dreck, "Flooding the Zone With Dreck" or Flooding the Web With Junk
"Slopwatch" continues today because we have many new examples
Links 25/06/2025: Thwarting More Software Patents, Overlap Grows Between EPO Corruption and Illegal Kangaroo Patent Courts in EU
Links for the day
Brian Fagioli Created Another Slopfarm Targeting "Linux" After BetaNews Became a Slopfarm of Phantom Accounts and Pseudonyms
Mr. Fagioli even had slop about a dead Torvalds (hypothetical) as clickbait
Wayland is Perfect, Nobody Can Escape Its Perfection! (Or Not)
Do not form on opinion on Wayland based on politics
Moral Duty for "Linux Sites" to Speak Out Against LLM Slop
My wife has long complained about "Linux bloggers" keeping quiet and thus passive about a growing problem: slop
In Recent Hours Google News Promoted at Least 3 Slopfarms That Relayed Linux Foundation Propaganda Made by Bots or LLM "Bullshit Generators" (as Dr. Stallman Dubbed Them)
Google is circling down the drain and Google News too is hopeless
Linux Journal is a Slopfarm, It's Experimenting With LLM 'Authors'
Is Slashdot next?
Microsoft LinkedIn is Dying and Many More Layoffs Are on the Way
LinkedIn is just a failed acquisition of Microsoft. It causes losses and debt.
Gemini Links 25/06/2025: Combinatorial Music and Self Hosting
Links for the day
Richard Stallman Coming Back to Europe This Autumn to Give More Talks
His last talk in Europe attracted about 400-450 people
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, June 24, 2025
IRC logs for Tuesday, June 24, 2025
Social Control Media, Technology & Catholicism: Synod on Synodality review and feedback
Reprinted with permission from Daniel Pocock
How Many More Women Will Managers at Microsoft Strangle and Tell to Kill Themselves (or Try to Kill)?
The world needs to know what happened
The New BetaNews: 7 New 'Articles', All of Them LLM Slop
BetaNews is basically defunct. Nobody writes there anymore.
statCounter Estimates Only 1 in 300 Iranians Would Use Microsoft for Search
Iranians don't quite trust Microsoft
Gemini Links 24/06/2025: ftpd on FreeBSD and Online Small Web Magazine
Links for the day
Google News Does Great Harm by Promoting Slopfarms as Legitimate News Sites
Slopfarms are sites which are 100% LLM slop
Links 24/06/2025: Trouble at "Open" "AI" and ‘Siarhei is Free’
Links for the day
Gemini Links 24/06/2025: Stimulants and Subscription Costs for DRM
Links for the day
When the Microsoft Aggressors Rely on Several Law Firms ('Attack Dogs', 'Guns for Hire'), Not Just One, Lawyering Up Against Techrights (Acting on Behalf of Americans Against UK Publishers)
From serving customers at some restaurant he has moved on to bullying people with demand letters
Links 24/06/2025: OpenAI [sic] May Soon Die (Too Much Debt) and Social Control Media Accused of Being Misinformation/Disinformation/Propaganda Amplifier
Links for the day
Nirbheek Chauhan in Planet GNOME Explains Why Wayland Pushers Are Losing
"A strange game. The only winning move is not to play."
Polygamy, from Catholic Synod on Synodality to Social Control Media & Debian CyberPolygamy
Reprinted with permission from Daniel Pocock
Only a Third of or 1 in 3 Web-Connected Devices is a Desktop or Laptop, According to statCounter
we can expect Android to widen its lead
The Days Are Getting Shorter, the First Half of 2025 is Almost Over
We're gratified to see significant increase in traffic and also positive feedback on the work we do
Turning GNU/Linux Into a Political Football
X (not the site) is Free software
X Server Still Works for Many People
A lot of people will grow suspicious of Wayland boosters/pushers if they persist and insist on using these tactics
Exactly a Week Ago "BetaNews Staff" Said "Betanews Is Growing Alongside You". Since Then Every Article (All by "Camila Nogueira") Has Been LLM Slop.
BetaNews is basically a slopfarm
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, June 23, 2025
IRC logs for Monday, June 23, 2025
The "Tarzan Effect" in Compilers and Software
What happens when you forcibly make things 'work', either by hacks or by disregarding warnings (like those that compilers tend to issue)?
Gemini Links 23/06/2025: Mass Tourism, Hair Love, and Google Gemini as a Googlebomb
Links for the day
Law Firm Burgess Mee Does Not Fully Deny Participating in Abusive Litigation for Serial Strangler From Microsoft
I am not unfamiliar with these tactics
The Modus Operandi of Wayland Pushers: Make It Political
do what I say or you're a nazi...
Links 23/06/2025: RFE/RL Contributor Vladyslav Yesypenko Released, Recording Industry Cutbacks
Links for the day
Brett Wilson LLP Solicitors (M): Over 99.9% of Our E-mail is Self-Marketing, We Send You 3.5MB E-mails for Less Than 1KB of Text
Why would tech people entrust legal matters to such people?
Peter Moon's (Computerworld) Interview With Richard Stallman
Stallman: If you want freedom don't follow Linus Torvalds
At What Point Does Outsourcing Constitute Malpractice?
Brett Wilson LLP's new staff page is misleading
United Arab Emirates (UAE) Sailing to GNU/Linux, According to statCounter
countries in that region will quickly learn the price of neglecting digital sovereignty
From Do Your Own Research to Do Your Own Search
The Web is full of garbage; search engines amplify this garbage
More People Moving to Geminispace?
at age 6+ Gemini Protocol seems to have gained some maturity and it seems like more people use it
Permutation in LLMs Does, Inevitably, Change Meanings and Therefore LLMs Cannot Properly Rephrase or Summarise Texts
LLMs lack actual grasp or comprehension of what they spew out
Links 23/06/2025: Many Security Breaches, Population Declines
Links for the day
Gemini Links 23/06/2025: "America at the Crossroads" and OpenWRT Surgery
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, June 22, 2025
IRC logs for Sunday, June 22, 2025
Pure Dove
Different means different, and sometimes those who "deviate" from "the norm" have a point
Censorship is a Sign of Weakness Which Invites More Censorship Attempts
revolutionaries don't succumb to pressure from bullies
Why It's Unlikely That LLM Slop Will Dominate the Web in the Long Run
Slopfarms will eventually perish (they have no actual value) and "survivors" on the Web will be sites that never depended on search engines and social control media
GNU/Linux in Argentina Now Measured Near 5%
Like in central Europe, they must be seeing an increasingly hostile US
BetaNews is Fake News, Composed by LLM Slop
nothing in BetaNews is written by humans anymore