Amazon (sub)Prime? allows any third party to supply inventory into commingled stock. By Izabella Kaminska

Amazon (sub)Prime?

By Izabella Kaminska
Mar 20 2019
<https://ftalphaville.ft.com/2019/03/20/1553085361000/Amazon–sub-Prime-/>

The following is the first in a two-part post about Amazon’s dependence on an obscure process known as commingling, which has become essential to underpinning its instant fulfilment services, especially its Prime offering.

If you work in finance, the concept of commingling and its cost benefits will be instantly recognizable. But so will its risks.

And it’s these sorts of risks that are now creeping into the entire Amazon system due to the online retailer’s open-ended fulfillment structure, which allows any third party to supply inventory into commingled stock.

Not only is commingling becoming a means by which a huge number of sub-par or counterfeited goods are entering the Amazon network, it’s arguably the reason why Amazon is being forced to take increasingly extreme steps to take control of its suppliers.

As it does so, it turns itself back into a conventional vertically-integrated retailer like Tesco or Walmart, losing much of the scaling, and cost advantages, associated with its “Fulfilled by Amazon” model (FBA). This also forces an ever greater “unapproved” seller network to deal in the increasingly cut-throat dynamics of its wider marketplace offering.

The consequences of all this, as we will explain, are glaring.

Unless you make your money from selling stuff on Amazon, chances are you won’t have heard of an FNSKU. The acronym stands for Fulfilment Network Stock Keeping Unit and represents a location identifier for products sitting in Amazon warehouses. This, to all intents and purposes, equates to an Amazon barcode.

If you’re a seller on Amazon’s marketplace who has chosen to be fulfilled by Amazon’s warehouse system (a scenario which sees Amazon dispatching the seller’s products on their behalf from its warehouses) you will always need an FNSKU.

Apart from the times you don’t.

At such times all you need is a manufacturer code. And it’s these instances, sellers tell FT Alphaville, that are introducing a counterfeiting vulnerability into the Amazon system.

Not using an FNSKU is appealing for sellers. It means products sourced from manufacturers do not have to be relabelled, ensuring they can be sent into Amazon’s network directly, saving time and money. Sellers who have chosen to be fulfilled by Amazon otherwise add an additional logistical layer into their operations if they have to relabel the goods independently.

Using manufacture bar codes also means products are more likely to qualify for Amazon Prime classification, pushing them higher up the search rankings.

Sellers tell FT Alphaville that, as it stands, the Amazon system seems to structurally incentivise the use of manufacturer codes over FNSKUs as a result. Indeed, Amazon itself promotes the fact that the process speeds up delivery in its own literature:

If multiple sellers have inventory with the same manufacturer barcode, Amazon may fulfil orders using products with that barcode when those products are closest to the customer.

This happens regardless of which seller actually receives a customer’s order. We use this process to facilitate faster delivery.

COMMINGLING

But there is an important downside. Not using FNSKUs turns sellers’ products into cold, hard commodities which are treated as fungible with equivalent products sent into the system. This happens because of a process called commingling.

How does commingling work and why is it important to the Amazon Prime model?

If you have ever wondered how it is possible for Amazon Prime to guarantee 24, or 48, hour delivery for a hugely diverse range of products, the answer is commingling.

In its simplest and idealised form, commingling allows sellers to share inventory to the mutual benefit of all, especially with respect to speed of dispatch.

The larger the geographic area, the more effective commingling becomes. In the US, for example, a seller who supplies an Amazon warehouse in Florida can — thanks to commingling — fullfil a customer living in Minnesota as easily as customers in their home state.

To explain, consider that the time it might ordinarily take to deliver to a Minnesotan from Florida is bound by the physical limitations of travel. In other words, there’s no way a parcel can arrive more quickly than via a plane. That’s its effective speed of light limit.

However, if the buyer’s parcel can be dispatched from an equivalent commingled stock just around the corner, this theoretical speed of light limit can be broken.

<SNIP>

We need to develop nationwide policies and security protocols that would govern how voting machines are secured.

We need to develop nationwide policies and security protocols that would govern how #voting machines are secured.

https://www.edu-cyberpg.com/Technology/vote.html

The fact that information is stored unencrypted on hard drives simply makes no sense in the current threat environment. That they can be left on devices, unencrypted, that are then sold on the open market is malpractice.

Since these machines are for sale online, individuals, precincts, or adversaries could buy them, modify them, and put them back online for sale. Envision a scenario in which foreign actors purchased these voting machines. By reverse engineering the machine like I did to exploit its weaknesses, they could compromise a small number of ballot boxes in a particular precinct. That’s the greatest fear of election security researchers: not wholesale flipping of millions of votes, which would be easy to detect, but a small, public breach of security that would sow massive distrust throughout the entire election ecosystem.

I BOUGHT USED VOTING MACHINES ON EBAY FOR $100 APIECE. WHAT I FOUND WAS ALARMING

AUTHOR: BRIAN VARNERBRIAN

IN 2016, I bought two voting machines online for less than $100 apiece. I didn’t even have to search the dark web. I found them on eBay. Surely, I thought, these machines would have strict guidelines for lifecycle control like other sensitive equipment, like medical devices. I was wrong. I was able to purchase a pair of direct-recording electronic voting machines and have them delivered to my home in just a few days. I did this again just a few months ago. Alarmingly, they are still available to buy online.
reverse-engineered the machines to understand how they could be manipulated. After removing the internal hard drive, I was able to access the file structure and operating system. Since the machines were not wiped after they were used in the 2012 presidential election, I got a great deal of insight into how the machines store the votes that were cast on them. Within hours, I was able to change the candidates’ names to be that of anyone I wanted. When the machine printed out the official record for the votes that were cast, it showed that the candidate’s name I invented had received the most votes on that particular machine.
This year, I bought two more machines to see if security had improved. To my dismay, I discovered that the newer model machines—those that were used in the 2016 election—are running Windows CE and have USB ports, along with other components, that make them even easier to exploit than the older ones. Our voting machines, billed as “next generation,” and still in use today, are worse than they were before—dispersed, disorganized, and susceptible to manipulation.

A recent in-depth report on voting machine vulnerabilities concluded that a perpetrator would need physical access to the voting machine to exploit it. I concur with that assessment. When I reverse-engineered voting machines in 2016, I noticed that they were using a smart card as a means of authenticating a user and allowing them to vote. There are many documented liabilities in certain types of smart cards that are used, from Satellite receiver cards to bank chip cards. By using a $15 palm-sized device, my team was able to exploit a smart chip card, allowing us to vote multiple times.

Karl Auerbach
Date: March 18, 2019
Well more than a decade ago, but after the disastrous Gore vs Bush election the Open Voting Consortium bought a used Diebold DRE (touchscreen) voting machine that had become unclaimed freight. An interesting aspect is that the laws regarding unclaimed freight can potentially extinguish or diminish things like license limitations – or non-disclosures – that might have applied to those taking the items in a normal chain of transfers.

The machine was as heavy as a Diebold vault, but that’s where the security ended. It had a cheap lock that could, and was, picked in just a few seconds. It ran MS Windows CE off of a compact flash. It even still had the votes from the last election in which it was used (in Ohio.)

Subsequently I was part of a team on a project to build a reference implementation of voting systems for the state of California (and anyone else) – from precinct and canvassing (counting) center hardware to vote capture machines to vote counting machines to all of the surrounding procedures. We had buy in for all of the various parts – UCLA and UC Berkeley law on procedures, UC Merced on hardware, UC Santa Cruz on software, etc.

We did not find “open source” to be necessary. Rather we felt that the public would be best served by systems that could be inspected by anyone (including inspection of code), full testing by any interested party (of all components), and open publication of test results. We did not feel that it was necessary to take the step to require free distribution (or re-distribution) of parts: we wanted to encourage private vendors to produce this stuff and we had to leave them some incentive to do so.

The key element was that all of the devices would be totally open for inspection and testing – and that at the precinct all inter-machine APIs would be in the form of paper that could be reliably read by both humans (with normal eyesight) and machines.

Some precinct machines would gather voter intent – with different machines for different kinds of human frailties ranging from bad eyesight to inability to accurately use a finger on a touch screen. All would produce that paper ballot. Separate machines would record those ballots.

Most people have tended to forget that often the easiest place to steal an election is in the transfer of ballots/tallies from precincts to the counting/canvassing center or at the counting center itself, especially as we move towards instant runoff style ballots. So we designed all of that stuff, and procedures, as well.

One surprising obstacle was from county clerks: they are tasked with the very difficult jobs of delivering a believable election on a small budget. They have to deal with all of the practical things like warehousing voting machines and training precinct workers. They have a real concern about the costs of storing paper ballots; they are not equipped to become local versions of Iron Mountain.

In addition various states have old laws that have to be rewritten. For example, California has very strict limits on how long voting materials – such as cast ballots – can be retained after an election.

Unfortunately the project died before it was launched due to a sex (I think) scandal involving the California Secretary of State that broke on the day he was to sign the papers to launch the project.)

I think that it is a project that deserves to be resurrected.

THEY ALREADY KNOW WHO YOU ARE WHEN YOU #VOTE

Exactis, as the source of a leak of the personal records of nearly everyone in the United States.

The result is a cautionary tale about the liability that a massive dataset can create for a tiny company like Exactis. It also hints at just how easy it’s become for small firms to wield massive, leak-prone databases of personal information—without necessarily having the resources or know-how to secure them.

https://www.wired.com/story/exactis-data-leak-fallout/

WIRED had revealed that Exactis exposed a database of 340 million records on the open internet, as first spotted by an independent security researcher named Vinny Troia.

Using the scanning tool Shodan, Troia identified a misconfigured Amazon ElasticSearch server that contained the database, and then downloaded it. There he found 230 million personal records and another 110 million related to businesses—more than two terabytes of information in total. Those files didn’t include credit card information, passwords, or Social Security numbers. But each one enumerated hundreds of details on individuals, ranging from the value of people’s mortgages to the age of their children, as well as other personal information like email addresses, home addresses, and phone numbers.

Exactis licensed that information to marketing and sales customers, so that they could integrate it with their existing databases to build more comprehensive profiles. But privacy advocates have warned that those same details, left open to the public, could just as easily allow spammers or scammers to profile targets.

the most painful breaches, like the Office of Personnel Management or Anthem health insurance incidents that involved stolen Social Security numbers and other hard-to-change personal data, are naturally the most valuable targets for attackers. Don’t forget the massive credit reporting agency Equifax to that list.

The Rich and Educated like Rand Paul and Robert Kennedy Jr., both vaccine skeptics put society at risk

FACT: There is NO link between autism and childhood vaccines. If you do not wish to be vaccinated then there should be a consequence and that is that you cannot infect other people.”

https://www.c-span.org/video/?c4784301/senator-bill-cassidy-challenges-senator-rand-paul-flu-vaccine-immunization

FACT: There is a link between not getting vaccinated dying from measles, mumps, and rubella (MMR).

Not vaccinated? then you’ll die and nature weeds out the ignorant.

Rand Paul is vaccinated and vaccinated my kids. For myself and my children I believe that the benefits of vaccines greatly outweighing the risks.

Virtually all medical literature shows that the benefits of vaccines dramatically outweigh the limited risks.

A lack of vaccinations fueled a measles outbreak that has sickened 69 people in Washington and Oregon and more than 200 in New York. In 2015, an outbreak that began at Disneyland sickened 147 people.

Temple University

At least 54 cases of mumps tied to Temple University, according to health officials. The effectiveness of the mumps vaccination tends to wane over time so it’s not necessarily a case of unvaccinated people, according to health officials

https://www.nbcnews.com/health/kids-health/least-16-diagnosed-mumps-temple-university-n980641

After Mumps Outbreak, Temple to Require New Students to Get Vaccinated
At least 15 mumps cases have been reported at Temple. For those wondering “Aren’t we supposed to get anti-mumps vaccines in elementary school?,” here’s an explainer.

State Vaccination Requirements

Studies have shown that vaccine exemptions tend to cluster geographically, making some communities at greater risk for outbreaks

State School and Childcare Vaccination Laws

How Cambridge Analytica got away with it Investigate Facebook

This is why GDPR had no minimum size of business or turnover, or exemptions for small businesses: a 10-person startup in Florida leaked data on 230 million people.

The rhetoric: Compliance will be too expensive for startups.
The reality: A startup that makes data compliance cheap for startups.

The Case for Investigating Facebook

Why I am calling on the Federal Trade Commission to investigate Facebook for violating antitrust laws.

@davidcicilline David N. Cicilline, a member of the House of Representatives, is chairman of the House Subcommittee on Antitrust, Commercial and Administrative Law.

Mr. Cicilline, a member of the House of Representatives from Rhode Island, is chairman of the House Subcommittee on Antitrust, Commercial and Administrative Law.

A year ago, the world learned that Facebook allowed a political consulting company called Cambridge Analytica to exploit the personal information of up to 87 million users, to obtain data that would help the company’s clients “fight a culture war” in America. Since then, a torrent of reports has revealed that the Cambridge Analytica scandal was part of a much broader pattern of misconduct by Facebook.

The commission has the authority to impose substantial fines on Facebook. Given that the corporation had more than $55 billion in revenue in 2018 alone, even a fine in the low billions of dollars will amount to a slap on the wrist, a mere cost of doing business. Moreover, because Facebook is a repeat offender, it is critical that the commission’s response is strong enough to prevent future violations. America’s laws are not suggestions.

When a company has repeatedly shown contempt for its legal commitments, the remedy must change how the company operates. Enforcement agencies can do this through deep reforms of the company’s structure. This includes removing members of the company’s board, or even top executives, along with other changes to the company’s business model to address dysfunction at the top.

Facebook recently announced plans to merge Instagram, WhatsApp and Facebook into one integrated product, furthering its monopoly power.

–//–

Here’s What It’s Like to Accidentally Expose the Data of 230M People
https://www.wired.com/story/exactis-data-leak-fallout/

Exactis, the source of a leak of the personal records of nearly everyone in the United States.

The Exactis Data Breach: What Consumers Need to Know

By Gary Davis on Jun 28, 2018

There are data breaches, and then there are data breaches. For example, who could forget the Equifax data breach, which compromised the personal information of over half of the citizens of the United States? And now, a breach of similar magnitude has emerged, as a security researcher has discovered that marketing firm Exactis’ database was sitting on a publicly accessible server. Specifically, there were two versions of the database exposed online, each with around 340 million records—roughly two-thirds on consumers and the rest on businesses.

So how did Exactis have this much data in the first place? The Florida-based marketing firm collects and trades consumer data in order to refine the accuracy of targeted ads. Which is precisely what makes this breach so crucial, as the information exposed is highly personal. The leaked data includes people’s phone numbers, home and email addresses, interests, and the number, age, and gender of their children. As of now, credit card information and Social Security numbers don’t appear to have been leaked.

The behavioral data involved in this leak, alongside the personal information, makes this breach particularly concerning because of how this information can be used by cybercriminals to improve the success of socially engineered attacks. For instance, crooks can use such personal information in phishing attacks over email or social media. Now, cybercriminals can enact highly personalized attacks against consumers, who will already be faced with potentially fraudulent activity against their names.