Blog

Have you recently been on a video confefence call, hit the “mute” button and then offered up some nasty comments about a client or a colleague — or even the boss?

Or maybe while in a conference room with colleagues — muted — and pointed out that some proposed action would violate the terms of a secret acquisition in its final stages?

If you were comfortable that the mute button was actively protecting your secret, you shouldn’t have been.

Thanks to some impressive experimentation and research from a group of academics at the University of Wisconsin-Madison and Loyola University Chicago, utterances made while the app is in mute are still captured and saved into RAM.

On one level, this is something we all already knew. When a user is muted and says something, most videoconferencing apps will display a note alerting the user that they’re talking while muted. How could it say that if it weren’t listening while the mute button is on? 

Just as Apple’s Siri or Amazon’s Alexa are always listening for a command word, so, too, are those “muted” applications. 

The real question is whether those captured utterances are at meaningful risk for being accessed by an attacker or an insider. First, anything saved in volatile memory is lost — theoretically — the instant the machine restarts or shuts down. Therefore, we are looking at the exposure after the utterance is made and before that machine restarts. Depending on the user’s behavior, that timeframe might be a few hours, a couple of days — possibly multiple weeks. 

Generally, stealing data from volatile memory is difficult, but not impossible. As the report authors said in a group interview, if a bad guy gets into volatile memory, the user and the enterprise have a lot bigger concerns than some saved utterances during a mute. Still, it could happen.

The mute issue is solely based on the app and how it handles such data.

One of the lead authors of the report is Kassem Fawaz, an assistant professor in the Electrical and Computer Engineering Department at the University of Wisconsin-Madison who is also affiliated with Wisconsin’s Computer Sciences Department. 

“The main implications have to do with the inherent trust users are placing in these videoconferencing apps,” Fawaz said. “We did not find evidence of audio leaving the user’s devices. The only exception was telemetry data leaving from Cisco Webex, which has been fixed since our disclosure to Ciscom. However, even when the user presses the mute button, the app still has access to the audio stream and the user is trusting that the app is well-behaved. The other implication is that the mute functionality — similar to turning off the camera — should not be left to the app, but should be either OS-controlled or hardware-controlled.”

Fawaz’s point about the camera is that the team found that a camera “off” button truly halted any video from being captured in any way. Not so much with audio. Sometimes, the browser can make a difference.

“On Chrome, mute means mute,” Fawaz said. “We can’t say about Safari or Firefox.”

The university’s report was mostly about trust in the app makers. If the vendors are acting honorably and respecting privacy, cybersecurity, and security compliance issues, then the risk is minimal. If they are not acting that way, users and enterprises could be in trouble.

The report didn’t draw conclusions on how the app makers were behaving, but merely stressed that each one can go in its own direction.

That said, the rules of secrecy and even the rules of being a nice person should apply here. With the imminent-acquisition scenario, if you’re not allowed to discuss certain details, don’t say them in front of a microphone with outsiders regardless of what the mute toggle displays. As for being nice, how about not saying nasty comments about your colleagues or clients at all? 

The cardinal rule of email and security/compliance is, “Before you type an email/message, envision yourself testifying to it in open court. If that makes you uncomfortable, don’t type it.” It’s not a far leap to extend that rule to speaking something in front of a microphone. 

For example, I use an Apple Watch. Several times during a typical day, it will say loudly “I didn’t understand that” or “Here’s what I found on that topic.” Although it is highly annoying and frustrating, it’s an effective reminder that I need to take that watch off before saying anything that I don’t want the world to know.

You need to keep in mind the same thing when using a mobile device or a desktop device — especially while using a videoconferencing app.

Amid the on-going coronavirus pandemic, 2021 followed in the footsteps of its predecessor, continuing to be an unpredictable, and at times incredibly difficult, year. But one thing that stayed constant was the steady flow of mergers and acquisitions (M&A) across the tech sector.

According to research by Global Data, global tech M&A deals had already neared $3 trillion by Q3, largely supported by the tech, media, and telecom sectors. Although nothing rivalled Xilinx’s $35 billion acquisition of Advanced Micro Devices in 2020, last year did see Intuit buy Mailchimp for $12 billion and Square splash out a princely sum — $29 billion — for Afterpay.

GlobalData

As for whether 2022 will maintain last year’s pace, early signs seem to suggest there will be no slowing of big deals across the industry, with cybersecurity and collaboration software already proving to be hot areas.

Here are the biggest enterprise technology acquisitions of 2022 so far, in reverse chronological order:

April 25: Elon Musk buys Twitter for $44B

Nine years after going public, and eleven days after billionaire Elon Musk first made an offer to buy Twitter, the social media network announced it would become a privately owned company once again.

The purchase price totals an eye-watering $44 billion and is includes of $21 billion of Musk’s own money, alongside debt funding from Morgan Stanley and other financial institutions. The purchase price represents a 38% premium to Twitter’s closing stock price on April 1.

Despite initially declining Musk’s offer and enacting anti-takeover measures, the board ultimately decided to accept Musk’s offer once it saw confirmed funding for the acquisition.

In a company statement, Bret Taylor, Twitter’s independent board chair, said: “The Twitter Board conducted a thoughtful and comprehensive process to assess Elon’s proposal with a deliberate focus on value, certainty, and financing. The proposed transaction will deliver a substantial cash premium, and we believe it is the best path forward for Twitter’s stockholders.”

April 11: Kaseya buys Datto for $6.2B and takes the company private

Security software company Kaseya has agreed to buy Datto for $6.2 billion and will take the company private again, after it listed on the New York Stock Exchange in 2020. Datto was founded in 2007 and provides data backup and security software, primarily to managed service providers.

“This is exciting news for Kaseya’s global customers, who can expect to see more functional, innovative and integrated solutions as a result of the purchase,” said Fred Voccola, Kaseya’s CEO.

April 5: AMD acquires Pensando for $1.9B

Chipmaker AMD has announced the acquisition of Pensando for approximately $1.9 billion.

Pensado specializes in data processing unites (DPUs), which include intelligent, programmable software to support the software-defined cloud, compute, networking, storage, and security services that could be rolled out quickly to edge, colocation, or service-provider networks.

“There are a wide range of use cases—such as 5G and IoT—that need to support lots of low-latency traffic,” Soni Jiandani, Pensando cofounder and chief business office told Network World last November. “We’ve taken a ground-up approach to giving enterprise customers a fully programmable system with the ability to support multiple infrastructure services without dedicated CPUs.”

March 29: Celonis acquires Process Analytics Factory

Process mining specialist Celonis is acquiring fellow German software firm, Process Analytics Factory, for a reported $100 million.

Up until now, Celonis has been focused on helping enterprises optimize processes around their ERP systems — and more recently has branched out to help them optimize their use of workflow automation platforms, too. Now it is acquiring Process Analytics Factory to improve its process mining offering and help enterprises automate with Microsoft’s Power Platform.

In October 2020 Celonis launched its Execution Management System (EMS) to visualize and design more efficient processes, and in April 2021 it formed a partnership with Microsoft to deliver process analytics through Power BI and to integrate its process improvement tools with Microsoft power Platform. Then, in October 2021, it partnered with ServiceNow to deliver process mining capabilities to the Now platform. It also has technology partnerships with Appian, Coupa, IBM, Oracle, Salesforce, Snowflake, Splunk, and a handful of other software vendors.

March 28: HP to acquire Poly for $3.3B

HP has announced it is acquiring Poly, a company that specializes in video and audio equipment, for a purchase price of $1.7 billion, with a total transaction value of $3.3 billion, including debt. The deal is expected to close by the end of 2022.

The acquisition is set to accelerate HP’s foray into the world of hybrid work, coming eight months after the company purchased remote desktop software provider Teradici.

Founded in 1990 and originally named Polycom, the company was acquired by headset maker Plantronics in 2019, after which the two newly merged companies rebranded themselves as Poly. Since then, the company has focused on providing enterprise-grade collaboration products, such as meeting room speakers and cameras, webcams, headsets, and software.

“The rise of the hybrid office creates a once-in-a-generation opportunity to redefine the way work gets done,” said Enrique Lores, president and CEO of HP. “Combining HP and Poly creates a leading portfolio of hybrid work solutions across large and growing markets. Poly’s strong technology, complementary go-to-market, and talented team will help to drive long-term profitable growth as we continue building a stronger HP.”

March 23: Apple acquires UK fintech startup Credit Kudos

Apple is acquiring the UK-based fintech startup Credit Kudos for an undisclosed amount. Credit Kudos last raised £5 million ($6.5 million) in funding in April 2020.

Neither Credit Kudos or Apple could be reached to confirm the deal, which was first reported by the crypto-focused publication The Block, citing three sources close to the deal.

Credit Kudos is a challenger credit bureau that uses machine learning and real-time data to build up a fuller picture of a person’s credit score, rather than traditional agencies, which typically rely on older information such as bank and utility statements to build a profile.

The firm has also benefitted from the recent wave of open banking regulations across the globe, which aim to open up consumer financial data via a set of secure application programming interfaces (APIs). Credit Kudos provides this data to clients for services such as affordability and risk assessments.

It is unclear what Apple plans to do with Credit Kudos, but the company has invested significantly in its fintech capabilities over recent years — in particular, its mobile Apple Pay wallet and its Apple Card credit card, which is currently only available in the US and was built in partnership with Goldman Sachs.

March 8: Google buys cybersecurity company Mandiant

Google will acquire cyberdefense and response firm Mandiant for $5.4 billion, in a move to offer an end-to-end security operations suite and advisory services from its cloud platform.

“Cybersecurity is a mission, and we believe it’s one of the most important of our generation,” Mandiant CEO Kevin Mandia said in a statement announcing the acquisition. “Google Cloud shares our mission-driven culture to bring security to every organization. Together, we will deliver our expertise and intelligence at scale via the Mandiant Advantage SaaS platform, as part of the Google Cloud security portfolio.”

March 3: Snowflake buys Streamlit for $800M

Data cloud company Snowflake has acquired Streamlit for $800 million, enabling developers and data scientists to build apps using tools with simplified data access and governance.

Streamlit’s open-source framework allows developers and data scientists to build and share data apps quickly and iteratively, without the need to be an expert in front-end development. According to Streamlit, the platform has had more than 8 million downloads and more than 1.5 million applications have been built using it.

“At Snowflake, we believe in bringing together open standards and open source with industry-leading data governance and security,” Snowflake Co-Founder and President of Products Benoit Dageville said in a statement announcing the acquisition. “When Snowflake and Streamlit come together, we will be able to provide developers and data scientists with a single, powerful hub to discover and collaborate with data they can trust to build next generation data apps and shape the future of data science.”

Feb. 28: Rakuten Symphony acquires Kubernetes platform Robin.io

The recently launched telco-focused arm of Japan’s Rakuten Group, Rakuten Symphony, has acquired Robin.io, a startup offering a Kubernetes platform optimized for storage and complex network applications.

The two companies did not disclose the price of the acquisition. Since first launching, Robin.io has moved beyond its original focus on storage to offer a more full-featured Kubernetes platform, providing large telcos with ways of  automating 5G services applications on Kubernetes and orchestrating private 5G and LTE deployments.

“Robin.io’s technology innovations over the last several years will now get a much bigger canvas to lead the vision for cloud-native transformation for the industry. Our vision to deliver simple to use, easy to deploy hyperscale automation is very well aligned,” said Robin.io CEO Partha Seetala.

Feb. 24: Cloudflare acquires security startup Area 1 Security

Cloudflare announced plans to acquire Area 1 Security for around $126 million, using both cash and stock to fund the acquisition.

Cloudflare has its own suite of zero-trust security products designed to prevent data loss, malware and phishing attacks, even when employees aren’t using their office network or a VPN. This deal will see the company add email security to this portfolio.

Area 1 Security has developed a product that stops phishing attacks sent via email before they reach an inbox. The company claims to have blocked more than 40 million phishing attempts in 2021 alone.

Cloudflare cCo-founder and CEO Matthew Prince said in a statement: “To us, the future of Zero Trust includes an integrated, one-click approach to securing all of an organization’s applications, including its most ubiquitous cloud application, email. Together, we expect we’ll be delivering the fastest, most effective, and most reliable email security on the market.”

Feb. 15: Intel to acquire Tower Semiconductor

Intel announced plans to acquire Tower Semiconductor for $5.4 billion, giving it access to more specialized production as it looks to take advantage of growing demand for semiconductors. The deal has been approved by both company boards, but is expected to take as long as 12 months to move through the normal regulatory channels.

Intel announced last year that it was planning to enter the foundry market to produce chips designed by their customers. Tower has been investing in multiple locations in recent years to boost capacity for 200- and 300-millimeter chips. It serves “fabless” companies, who design chips but outsource manufacturing, and integrated device manufacturers.

Intel CEO Pat Gelsinger sees the move as a good fit for the company’s vision. “Tower’s specialty technology portfolio, geographic reach, deep customer relationships and services-first operations will help scale Intel’s foundry services and advance our goal of becoming a major provider of foundry capacity globally,” he said in a statement.

Feb. 15: Akamai acquires Linode for $900M

Akamai has entered into an agreement to acquire Linode, an infrastructure-as-a-service (IaaS) platform provider, for approximately $900 million. Akamai reportedly expects Linode to add about $100 million in revenue for FY22.

Founded in 2003, Linode has positioned itself as an IaaS alternative to public cloud providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud. Unlike many of its competitors, Linode says it had not raised outside funding, boasting it “has successfully run a profitable business since [its] inception.”

“The opportunity to combine Linode’s developer-friendly cloud computing capabilities with Akamai’s market-leading edge platform and security services is transformational for Akamai,” Akamai CEO and co-founder Tom Leighton said  in a statement. “Akamai has been a pioneer in the edge computing business for over 20 years, and today we are excited to begin a new chapter in our evolution by creating a unique cloud platform to build, run and secure applications from the cloud to the edge.”

Jan 31: Citrix to be acquired by private equity firms for $16.5B

Cloud computing and virtualization company Citrix is being acquired by private equity firms Vista Equity Partners and Evergreen Coast Capital for $16.5 billion. It’s been reported that Vista plans to combine Citrix with Tibco, which it acquired in 2014 for $4.3 billion.

The all-cash deal will see the publicly traded Citrix go private and will include the assumption of Citrix’s debt, the companies said.

Apple will discontinue the Fleetsmith Mobile Device Management (MDM) service in October and is warning businesses using the service to find another MDM provider.

Apple and Fleetsmith, a short history

Apple acquired Fleetsmith in June 2020. At the time, it was understood the company wanted to improve what it offered to small business users. “The weakest spot for Apple in business has always been for the small businesses who just want to get started,” Jamf CEO Dean Hager told me soon after Apple Business Essentials was revealed.

When I spoke with Fleetsmith co-founder Zack Blum in 2018, he said:

“Apple’s biggest accomplishment and contribution to enterprise technology has been bringing mobile to the enterprise. Apple has raised the bar in delivering well-designed product experiences, as well as hardware and OS security.”

Replacing Fleetsmith

Many small and mid-sized business (SMB) users might be served by Apple Business Essentials, which leverages some of the technologies Apple took from Fleetsmith. However, for more complex deployments, there’s a rich industry of sophisticated MDM systems.

Thankfully, following more than a decade of steady growth in Apple deployments in the enterprise, Fleetsmith customers seeking an alternative MDM vendor are increasingly spoiled for choice.

Founded in 2002 and used at SAP, IBM and perhaps even at Apple, Jamf was early to identify the emerging Apple in business opportunity and remains the clear market leader with a range of services, including powerful Zero Trust solutions.

But Jamf isn’t the only game in town. Reflecting Apple’s growth in the sector, the stable of Apple-focused MDM providers is expanding quite rapidly.

That’s great, as many businesses have quite unique needs, so the plethora of choices means even the most unique business has an opportunity to identify a vendor suitable for the business they run. Companies including Jumpcloud, Addigy, Hexnode, Kandji, Citrix, MobileIron and many others are all competing with Jamf to support the enterprise.

What is driving Apple in the enterprise?

This growing network of players has emerged in response to the consumerization of IT, which continues to transform business technology. A new 451 Research study I’ve seen claims that about 25% of SMBs plan to invest in their digital transformation strategy moving forward, following substantial hardware investments across the last two years.

MDM is a critical element to any such strategy.

Of course, when it comes to the proliferation of Apple kit in enterprise IT, you can justifiably argue this first began to accelerate following introduction of the iPhone in 2007, which soon spawned the BYOD (Bring Your Own Device) trend. As the Apple smartphone became more widely used in the enterprise, iPad and Mac deployment soon followed.

This desire for a consumer-simple experience in enterprise IT has also nurtured the emergence of employee-choice schemes, as discussed here, here, and here.

One recent survey (commissioned by Jamf) claimed Apple users had a better experience with their chosen platform, reporting improvements in productivity (87%), self-sufficiency (87%), and creativity (86%).

Ways of seeing

The way business leaders see Apple kit has changed dramatically in the last decade or so. The days when tech leaders could mock the company’s offerings really came to an end when Microsoft’s then-CEO, Steve Ballmer faced a room full of Mac-using journalists at a press event.

Today, while business leaders continue to see Apple hardware as a more expensive initial investment, it has become crystal clear that the cost of ownership over the usable lifecycle more than makes up for that.

In other words, this side of the market has grown and will continue to grow, and with almost every Fortune 500 firm now supporting Apple devices, it’s unlikely to decline any time soon.

Farewell Fleetsmith, hello new world of enterprise IT

Apple knows this, of course, and while the shuttering of Fleetsmith suggests the company will continue to nurture the third-party MDM services market, it still means existing Fleetsmith customers must now prioritize finding an alternative MDM provider.

As explained in this Apple tech support note, Fleetsmith will cease on Oct. 21, after which devices will no longer receive configuration profiles. The service no longer accepts new customers.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

The California State Assembly is considering new rules that would offer workers greater protection from the use of digital monitoring tools by employers.

The “Workplace Technology Accountability Act” (AB 1651), introduced by Assemblymember Ash Kalra, would create a way to protect workers against the use of technologies that can negatively affect privacy and wellbeing.

The bill would “establish much needed, yet reasonable, limitations on how employers use data-driven technology at work,” Kalra told the Assembly Labor and Employment Committee on Wednesday. “The time is now to address the increasing use of unregulated data-driven technologies in the workplace and give workers — and the state — the necessary tools to mitigate any insidious impacts caused by them.”

The use of digital surveillance software grew during the pandemic as employers sought to track employees’ productivity and activity when working from home, installing software that uses techniques such as keystroke logging and webcam monitoring.

Digital monitoring and management is being used across a variety sectors, with warehouse staff, truck drivers and ride-hailing drivers subject to movement and location tracking for example, with decisions around promotions, hiring and even firing made by algorithms in some cases.

The bill, which was approved by the committee on a 5-2 vote and now moves to the Appropriations Committee for more debate, makes three core proposals:

• To ensure employees are notified prior to the collection of data and use of monitoring tools and deployment of algorithms, with the right to review and correct collected data.
• To limit the use of monitoring technologies to job-related use cases and valid business practices.
• To require employers to conduct impact assessments, with worker input, on the use of algorithms and data collection to identify potential harms and discriminatory impacts.

Kalra said the bill would not result in a widespread ban of technologies, only “dangerous” tools such as facial and emotion recognition. His concerns echo those of a UK union group, The Trades Union Congress, which surveyed workers about the prospect of monitoring and raised reg flags about the tactic.

“Worker surveillance tech has taken off during this pandemic – and now risks spiralling out of control,” Frances O’Grady, TUC general secretary, said in a statement last month.

Among those opposing the measure is the California Chamber of Commerce.

“Based on our initial review…, quite frankly the bill is unworkable,” said Ashley Hoffman, policy advocate at the California Chamber of Commerce. The business group argues it would place unnecessary demands on employers to store and review collected data and ensure technologies are compliant, while potentially hitting small business employers with penalties up to $20,000 for violations.

Regulating workplace management and monitoring technologies is an growing priority for lawmakers in the US and in Europe. Although though the General Data Protection Regulation put in place some rules against the misuse of worker data by employers, the European Commission recently drafted proposals that would offer greater protection to gig workers that are supervised by algorithms.

The bill’s prospects for passage by the full Assembly were not immediately clear. If passed and signed into law, it would apply to all businesses that use monitoring tools and could have ripple effects beyond just California. The state is home to many big tech firms and often adopts worker protection measures that could similar legislation in other states.