Acid test...
Find devices from the time period before and during he was employed. He wins.....then the relevant authorities sue the hell out of the company.
A former iRobot employee is suing the manufacturer for firing him after he highlighted alleged failures to comply with regulations. Janusz Pankowski claims the robo-vac specialists unfairly dismissed him from his position as director for compliance back in May 2018 following a row over whether products were erroneously labeled …
The headline says that the products broke "safety, govt regulations". While it seems like it did break government regulations, the article itself didn't mention safety.
So I searched the linked case doc and all I can find is that they didn't test/certify the product under the safety regulations. So it's probably a stretch to say that they broke them, most like "didn't even bother to see"?
From the court document:
"At a subsequent meeting on March 15,2018, Pankowski reiterated the statement he made during the earlier meeting that his team could not approve the product because it did not meet safety requirements and doing so would place consumers of the product at a safety risk and expose iRobot to liability."
And:
"iRobot ... refused to provide required safety and labelling information with the products it sold"
Emphasis mine. Hope this helps.
C.
It is a legal requirement in many jurisdictions to ensure the devices meet safety standards. Not testing means you can't legally sell in that jurisdiction.
I've worked for companies that get one device / one generation of device tested, then change components or release a new product and they don't retest. They are also out of compliance, but they still sell based on the old certificates they received for older models.
Or they put extra things in place to get a certification (IT security), then, as soon as the certificate is issued, the whole "pointless updates and documentation cr*p" is then dropped like a hot potato, until the certificate needs to be re-issued, at which point there is a mad dash to get the documentation to show that the procedures were followed.
"I've worked for companies that get one device / one generation of device tested, then change components or release a new product and they don't retest. They are also out of compliance, but they still sell based on the old certificates they received for older models."
Ah, the Boeing Business Model.
The other side of the coin is when a component unexpectedly becomes unavailable just after getting a huge order, and so the product needs a small modification to use an equivalent component of exactly the same functionality and basic specifications as the unavailable one.
Although the mod is technically minor, it requires a new layout for the PCB and/or change to a plastic moulding (and so gets a new model number), which means tooling changes and a prototype run delays things.
So now the customer is getting pretty tetchy and threatening to cancel. Do you wait another 4 weeks to get everything re-tested, or, knowing that the mod has made bugger-all difference to any aspect that needs testing, just sell it now under the old certificates and test afterwards ?
There is a lot more of it beneath the waves just waiting to do a lot of damage.
How many more products that we posess (i deliberately avoid saying own because with all those subscriptions it is debatable as to who actually owns anything these days) have all those compliance labels but are actually non-compliant?
A few decades ago companies would spend millions making sure that FCC regulations were met. The buzz that my radio makes when I switch on some modern IT kit tells me that someone somewhere is cutting corners.
When my engineering kit's sensors do the electric boogaloo I pull out my pocket dpectrum analyzer and do a sniff test. Yeah not work approved but I'm licensed and it kept me out of other people's trouble.
More times than not it's sparky creativity but every once in a while it's kit broadcasting all over the spectrum at power levels that would make CB abusers drool.
He wasn't hired as director for compliance, he was hired as rubber stamp director for compliance.
The fact that the company spouts the good old "we take ... very seriously" clinches it for me. They will fight the charges vigorously until they settle of court to not be officially noted as guilty.
"rogue engineers" is for when a company is caught cheering.
"lessons will be learned" is for governments. Especially if children/deaths were involved, and usually that lesson is to learn to sweep these things under the rug better.
Cynical? With my reputation?
(pirate icon because they're quite rogue like, no?)
That practice needs to be stopped: no more "we're paying the regulator a large sum of money to make the charges go away."
It needs to be "you're guilty unless a jury says otherwise. You can own up to it and pay a lot, or fight it to the mat and lose your damn shirts."
For example the FDA required that devices used for medical diagnosis and data collection meet patient safety regulations, this is called "FDA Approval" but you can build devices that don't meet the standards for medical use and sell them as "FDA Approved" because the FDA has a much lower standard for biofeedback devices that are not designed for medical use. These devices are marketed everywhere as "FDA Approved". Read the small print in the user manual and somewhere it will mention that it has the biofeedback approval but never that it doesn't meet patient safety standards.
I wonder how many realize the irony of being forced to test to one out-of-date standard in order to meet a different standard? Though most (all?) test houses are happy to issue certificates for multiple standards based on the data provided by one set of tests. So there is little or no additional charge.
Do you have any idea how difficult it is to meet regulations globally with the same product? If you want to meet KC, CE, CEC, NEC, PSE, etc. all at the same time, it can be nearly impossible. As an example, all those fancy locking IEC power cables sold for datacenter use so kit doesn't come unplugged? Yeah... not eligible for KC (Korea) cert because they deviate from the official IEC specs for a C13 connector. Are they unsafe? Not at all. Are they electrically inferior? Nope. They just added a locking mechanism, and KC only accepts IEC, and IEC standard doesn't include a locking mechanism.
I've been in the corporate world for a couple of decades now, and it has been my experience time and again that virtually nobody cares about safety, security, or laws.
In the past I have followed the route of Pankowski and the number of times the outcome was positive were few and far between.
I have concluded that the only way to address issues and get results is to go straight to the authorities (or the media) - preferably anonymously. However, once you have the reputation of being a troublemaker (i.e. someone who actually cares about safety, security, laws, or even corporate liability) you'll be the first one suspected of 'ratting' on the company.
On the other hand, many authorities also don't care either...
We expect a certain amount of cookie-based tracking on retail websites and social networks, but in some countries up to 90 percent of government sites have implemented trackers – and serve them seemingly without user consent.
A study by IMDEA, a research facility in Madrid, Spain, evaluated more than 118,000 URLs of 5,500 government websites – think .gov, .gov.uk. .gov.au, .gc.ca, etc. – hosted in the twenty largest global economies (the G20) and discovered a surprising tracking cookie problem, even among countries party to Europe's GDPR and those with their own data privacy regulations.
On average, the study found, more than half of cookies created on G20 government websites were third-party cookies, meaning they were created by outside entities typically to collect information on the user. While the proportion of cookies issued by third-party trackers ought to be zero on a government web site, some (in Russia for example) had as many as 90 percent of the cookies come from known third-party cookies or trackers.
Oracle has been sued by Plexada System Integrators in Nigeria for alleged breach of contract and failure to pay millions of dollars said to be owed for assisting with a Lagos State Government IT contract.
Plexada is seeking almost $56 million in denied revenue, damages, and legal costs for work that occurred from 2015 through 2020.
A partner at Plexada, filed a statement with the Lagos State High Court describing the dispute. The document, provided to The Register, accuses Oracle of retaliating against Plexada and trying to ruin the firm's business for seeking to be paid.
Updated After nearly two years of legal wrangling, the European Parliament on Tuesday passed the Digital Markets Act and the Digital Services Act, teeing up a showdown between the continent and US tech giants.
With the two sets of laws approved, the measures move to the European Council for passage. If green-lit, as is expected over the next few months, the DMA and DSA will go to EU nations to implement and put into action. We note that neither act will be enforceable until January 1, 2024 at the earliest.
Both acts place restrictions on the behavior of large tech companies. The DMA aims to rein in the power of "gatekeepers" that are too large to be avoided, while the DSA operates under the assumption that "what is illegal offline, should be illegal online," as the EU Parliament describes it.
Comment For all their differences, the biggest tech companies share one thing in common: They don't like to stay in their lane.
In the more than 20 years we've evolved alongside Apple, Google and Amazon, and the slightly less than 20 we've lived with Facebook, each has branched into areas different from their founding purpose.
Cloud services, ecommerce, hardware and advertising have variously cropped up to displace original businesses, and in recent years, the news has shifted to will-they-won't-they discussions of whether big tech is looking to enter the financial services space.
TikTok, owned by Chinese outfit ByteDance, last month said it was making an effort to minimize the amount of data from US users that gets transferred outside of America, following reports that company engineers in the Middle Kingdom had access to US customer data.
"100 percent of US user traffic is being routed to Oracle Cloud Infrastructure," TikTok said in a June 17, 2022 post, while acknowledging that customer information still got backed up to its data center in Singapore. The biz promised to delete US users' private data from its own servers and to "fully pivot to Oracle cloud servers located in the US."
That pivot has not yet been completed. According to a June 30, 2022 letter [PDF] from TikTok CEO Shou Zi Chew, obtained by the New York Times on Friday, some China-based employees with sufficient security clearance can still access data from US TikTok users, including public videos and comments.
A Moscow court has fined Airbnb, Twitch, UPS, and Pinterest for not storing Russian user data locally, according to Russian regulator Roskomnadzor.
The decision was handed down by the Tagansky District Court of Moscow after the four foreign companies allegedly did not provide documents confirming that the storage and processing of Russian personal data was conducted entirely in the country.
Twitch, Pinterest and Airbnb were fined approximately $38,500 while UPS received a fine of roughly $19,200.
A US congressional hearing on "combating tech bro culture" in the venture capital world is will take place this week, with some of the biggest names in startup funding under the spotlight.
The House Financial Services Committee's Task Force on Financial Technology is scheduled to meet on Thursday. FSC majority staff said in a memo [PDF] the hearing will focus on how VCs have failed to invest in, say, fintech companies founded by women and people of color.
We're told Sallie Krawcheck, CEO and cofounder of Ellevest; Marceau Michel, founder of Black Founders Matter; Abbey Wemimo, cofounder and co-CEO of Esusu; and Maryam Haque, executive director of Venture Forward have at least been invited to speak at the meeting.
Google has reportedly asked the US Federal Election Commission for its blessing to exempt political campaign solicitations from spam filtering.
The elections watchdog declined to confirm receiving the supposed Google filing, obtained by Axios, though a spokesperson said the FEC can be expected to publish an advisory opinion upon review if Google made such a submission.
Google did not immediately respond to a request for comment. If the web giant's alleged plan gets approved, political campaign emails that aren't deemed malicious or illegal will arrive in Gmail users' inboxes with a notice asking recipients to approve continued delivery.
Updated The latest version of OpenSSL v3, a widely used open-source library for secure networking using the Transport Layer Security (TLS) protocol, contains a memory corruption vulnerability that imperils x64 systems with Intel's Advanced Vector Extensions 512 (AVX512).
OpenSSL 3.0.4 was released on June 21 to address a command-injection vulnerability (CVE-2022-2068) that was not fully addressed with a previous patch (CVE-2022-1292).
But this release itself needs further fixing. OpenSSL 3.0.4 "is susceptible to remote memory corruption which can be triggered trivially by an attacker," according to security researcher Guido Vranken. We're imagining two devices establishing a secure connection between themselves using OpenSSL and this flaw being exploited to run arbitrary malicious code on one of them.
The world's governments are eager to let someone else handle their IT headaches, according to a recent Gartner report, which found a healthy appetite for "anything-as-a-service" (XaaS) platforms to cut the costs of bureaucracy.
These trends will push government IT spending to $565 billion in 2022, up 5 percent from last year, the analyst house claims. Gartner believes the majority of new government IT investments will be on service platforms by 2026.
"The pandemic sped up public-sector adoption of cloud solutions and the XaaS model for accelerated legacy modernization and new service implementations," Gartner analyst Daniel Snyder said in a release. "Fifty-four percent of government CIOs responding to the 2022 Gartner CIO survey indicated that they expect to allocate additional funding to cloud platforms in 2022, while 35 percent will decrease investments in legacy infrastructure and datacenter technologies."
Biting the hand that feeds IT © 1998–2022