Democratic lawmakers are probing SpaceX over Russia’s reported use of Starlink in Ukraine, saying that recent developments raise questions about SpaceX’s “compliance with US sanctions and export controls.”

SpaceX CEO Elon Musk last month denied what he called “false news reports [that] claim that SpaceX is selling Starlink terminals to Russia,” saying that, “to the best of our knowledge, no Starlinks have been sold directly or indirectly to Russia.” But Musk’s statement didn’t satisfy US Reps. Jamie Raskin (D-Md.) and Robert Garcia (D-Calif.), who sent a letter to SpaceX President Gwynne Shotwell yesterday.

“Starlink is an invaluable resource for Ukrainians in their fight against Russia’s brutal and illegitimate invasion. It is alarming that Russia may be obtaining and using your technology to coordinate attacks against Ukrainian troops in illegally occupied regions in Eastern and Southern Ukraine, potentially in violation of US sanctions and export controls,” Raskin and Garcia wrote.

Musk has also stated that “Starlink satellites will not close the link in Russia.” However, the concerns raised by Rankin and Garcia are about whether Russia used the broadband service in Ukraine. Their letter said that Ukraine last month “released intercepted audio communications between Russian soldiers that indicated Russian forces had illegally deployed and activated Starlink terminals in certain Russian-occupied areas in Eastern Ukraine.”

SpaceX compliance with sanctions questioned

Rankin and Garcia say that “Ukrainian intelligence officials assert that Russian forces have obtained Starlink terminals illegally through third-party actors via neighboring countries.” But Musk has denied both direct and indirect sales, and the purchases being made through third parties doesn’t necessarily absolve SpaceX of responsibility, the lawmakers wrote:

Russia’s misuse of Starlink terminals outside Russia’s internationally recognized borders poses a serious threat to Ukraine’s security, Ukrainian lives, and US national security. SpaceX Chief Executive Officer Elon Musk publicly stated that, “[t]o the best of our knowledge, no Starlinks have been sold directly or indirectly to Russia.” However, according to Ukraine, the misuse of Starlink terminals is “systemic,” raising additional questions about the efficacy of your company’s safeguards and compliance with US sanctions and export controls. We are concerned that you may not have appropriate guardrails and policies in place to ensure your technology is neither acquired directly or indirectly, nor used illegally by Russia.

The letter points out that US businesses have been warned about Russia illegally obtaining technology through intermediates. “In 2023, the Departments of Commerce, the Treasury, and Justice repeatedly issued joint compliance notes, alerts, and guidance to US private industry, specifically noting Russian efforts to illegally obtain technology and items through obfuscated third parties,” the letter said. A March 2023 notice issued by those three US government agencies said that companies’ “compliance programs should include controls tailored to the risks the business faces, such as diversion by third-party intermediaries.”

Rankin is the ranking member (i.e. the top Democrat) on the House Oversight Committee, while Garcia is the ranking member on a subcommittee focused on national security and foreign affairs.

Starlink: We don’t sell to Russia gov’t or military

In a February 8 post, Starlink said it “does not do business of any kind with the Russian Government or its military.”

“Starlink is not active in Russia, meaning service will not work in that country. SpaceX has never sold or marketed Starlink in Russia, nor has it shipped equipment to locations in Russia. If Russian stores are claiming to sell Starlink for service in that country, they are scamming their customers,” Starlink said.

SpaceX blocks use of Starlink when it finds that it’s being used by a sanctioned entity, the post said. “If SpaceX obtains knowledge that a Starlink terminal is being used by a sanctioned or unauthorized party, we investigate the claim and take actions to deactivate the terminal if confirmed,” Starlink wrote.

Rankin and Garcia want more detail. They sent a list of questions to Shotwell and asked for answers by March 20, saying the requested information will assist in Committee Democrats’ review of Russia’s Starlink use in Ukraine.

“What actions has SpaceX taken to ensure Starlink users are compliant with US sanctions and export control laws—including US sanctions and export controls related to Russia?” they asked. Rankin and Garcia want the number of reports or complaints that SpaceX has “received regarding possible illegal acquisition, trade, or use of Starlink terminals, including in Russian-occupied territories in Ukraine” and information on how SpaceX investigates them.

The letter asked what SpaceX has done “to eliminate existing or potential security vulnerabilities that actors, such as Russia, may exploit to illicitly acquire, trade or use Starlink terminals, including in Russian-occupied regions in Ukraine.” The lawmakers also asked for details on how SpaceX and its subsidiaries “work with the Departments of Justice, Commerce, and/or the Treasury to prevent illicit acquisition, trade, or use of satellite terminals, including in Russian-occupied territories in Ukraine.”

We contacted SpaceX today and will update this article if the company provides a response.

https://arstechnica.com/?p=2008729

On Wednesday, authorities arrested former Google software engineer Linwei Ding in Newark, California, on charges of stealing AI trade secrets from the company. The US Department of Justice alleges that Ding, a Chinese national, committed the theft while secretly working with two China-based companies.

According to the indictment, Ding, who was hired by Google in 2019 and had access to confidential information about the company’s data centers, began uploading hundreds of files into a personal Google Cloud account two years ago.

The trade secrets Ding allegedly copied contained “detailed information about the architecture and functionality of GPU and TPU chips and systems, the software that allows the chips to communicate and execute tasks, and the software that orchestrates thousands of chips into a supercomputer capable of executing at the cutting edge of machine learning and AI technology,” according to the indictment.

Shortly after the alleged theft began, Ding was offered the position of chief technology officer at an early-stage technology company in China that touted its use of AI technology. The company offered him a monthly salary of about $14,800, plus an annual bonus and company stock. Ding reportedly traveled to China, participated in investor meetings, and sought to raise capital for the company.

Investigators reviewed surveillance camera footage that showed another employee scanning Ding’s name badge at the entrance of the building where Ding worked at Google, making him look like he was working from his office when he was actually traveling.

Ding also founded and served as the chief executive of a separate China-based startup company that aspired to train “large AI models powered by supercomputing chips,” according to the indictment. Prosecutors say Ding did not disclose either affiliation to Google, which described him as a junior employee. He resigned from Google on December 26 of last year.

The FBI served a search warrant at Ding’s home in January, seizing his electronic devices and later executing an additional warrant for the contents of his personal accounts. Authorities found more than 500 unique files of confidential information that Ding allegedly stole from Google. The indictment says that Ding copied the files into the Apple Notes application on his Google-issued Apple MacBook, then converted the Apple Notes into PDF files and uploaded them to an external account to evade detection.

“We have strict safeguards to prevent the theft of our confidential commercial information and trade secrets,” Google spokesperson José Castañeda told Ars Technica. “After an investigation, we found that this employee stole numerous documents, and we quickly referred the case to law enforcement. We are grateful to the FBI for helping protect our information and will continue cooperating with them closely.”

Attorney General Merrick Garland announced the case against the 38-year-old at an American Bar Association conference in San Francisco. Ding faces four counts of federal trade secret theft, each carrying a potential sentence of up to 10 years in prison.

https://arstechnica.com/?p=2008627

For months, some of the biggest tech companies have been wrapped up in discussions with the European Commission (EC), seeking feedback and tweaking their plans to ensure their core platform services comply with the Digital Markets Act (DMA) ahead of that law taking force in the European Union tomorrow.

Under the DMA, companies designated as gatekeepers—Alphabet/Google, Amazon, Apple, ByteDance, Meta, and Microsoft—must follow strict rules to ensure that they don’t engage in unfair business practices that could limit consumer choice in core platform services. These include app stores, search engines, social networking services, online marketplaces, operating systems, web browsers, advertising services, cloud computing services, virtual assistants, and certain messaging services.

At its heart, the DMA requires more interoperability than ever, making it harder for gatekeepers to favor their own services or block other businesses from reaching consumers on their platforms.

Each gatekeeper will publish compliance reports in the coming days, detailing for the first time what changes they’ve made to comply with the DMA. All companies have already previewed changes coming in the buildup to the deadline. Some companies, like Google, have announced various changes impacting businesses and users, while others, like TikTok-owner ByteDance, are begrudgingly updating services now while still contesting their gatekeeper status.

Although the EC has said that the DMA is intended to protect fair and open markets—theoretically offering users more choices to enhance transparency, privacy, security, and competition online—some tech companies have warned that some of the changes coming under the DMA may increase risks or decrease choices for their users.

Last January, Apple warned that complying with the DMA required the company to take additional new steps “to reduce privacy and security risks the DMA creates.” According to Apple, DMA requirements linked to user choice—such as options to choose an alternative default contactless payment method other than Apple’s—could introduce new threats, like malware or malicious code used to scam users, that Apple can’t promise to protect against.

So far, all gatekeepers except for ByteDance have specified that changes coming soon will only impact users in the EU, the European Economic Area (EEA), and Switzerland. In a TikTok blog, ByteDance announced in March that new functionality added for DMA compliance will “roll out globally in the near future.”

However, it’s possible that other gatekeepers adjusting services may end up doing a cost-benefit analysis and, like ByteDance, eventually updating services in other parts of the world. This would potentially extend the DMA’s reach beyond the EU’s borders.

It also seems possible that other regions will quickly adopt the DMA’s standards. The EU and the US, for example, formed the EU-US Trade and Technology Council in 2021, which has been meeting more consistently in the ramp-up to DMA enforcement. Partly formed to cooperate on setting best practice technology standards, the next meeting is scheduled for this spring, just after the EC publishes summaries of gatekeepers’ compliance reports. Other countries, including Turkey, Australia, Brazil, India, and the United Kingdom, have already embraced the DMA model, according to the nonprofit tech policy think tank the Information Technology and Innovation Foundation (ITIF).

Some critics of the DMA, including ITIF, have urged countries to “carefully consider the full implications before copying the EU’s digital regulatory system,” warning of potentially burdensome restrictions possibly hampering innovation and distorting competition.

Now that the EC is preparing to enforce the DMA officially, its impact will soon become clearer. However, the EC does not expect the online world to immediately look different tomorrow in the EU than it does today.

Some companies, like Microsoft, have estimated that DMA updates may not be available to all EU users until April, while other companies may fall short of DMA standards and be ordered to make more changes after submitting their first compliance reports.

Gatekeepers are expected to share compliance reports starting this afternoon, but for now, here’s a brief overview of changes coming to core services offered in the EU by all six gatekeepers.

Apple warns DMA creates potential risks

In January, Apple announced changes coming to iOS, Safari, and the App Store that will “become available to users in the 27 EU countries beginning in March 2024.”

Some changes are small. The only change in Safari, for example, is that users will be prompted to choose a default browser when they first open Safari in iOS 17.4 or later.

But changes to the App Store and iOS are more significant.

In the App Store, developers can expect extensive changes “affecting apps across Apple’s operating systems, including iOS, iPadOS, macOS, watchOS, and tvOS.” These include new options to process payments for digital goods with alternative service providers or by linking out to a website. Developers can now offer deals, discounts, and promotions outside their apps, too.

To help developers navigate these options, Apple also developed business tools to estimate fees or potentially reduced commissions.

Specifically for iOS, updates include new options to distribute iOS apps in alternative marketplaces and new APIs enabling developers to create alternative app marketplaces, use alternative web browser engines for in-app browsing, and “submit additional requests for interoperability with iPhone and iOS hardware and software features.”

Perhaps more significantly for users, Apple introduced “new controls that allow users to select a third-party contactless payment app—or an alternative app marketplace—as their default.”

Using these alternatives, Apple warned, may diminish the user experience by impacting system performance or draining battery life. And some features, like Family Purchase Sharing and Ask to Buy, won’t work “with apps downloaded from outside of the App Store.”

https://arstechnica.com/?p=2008325

Apple and other major tech companies don’t have to compensate victims of forced child labor that provided cobalt for the lithium-ion batteries used in many electronic devices, a US appeals court ruled. The lawsuit filed by former miners from the Democratic Republic of the Congo alleged that Apple, Alphabet, Dell, Microsoft, and Tesla violated a trafficking law that makes it illegal to participate in a “venture” that engages in forced labor.

“The plaintiffs allege the technology companies participated in a venture with their cobalt suppliers by purchasing the metal through the global supply chain,” the US Court of Appeals for the District of Columbia Circuit noted in its ruling issued yesterday.

A US District Court previously dismissed the lawsuit, and a panel of three appeals court judges unanimously affirmed the dismissal yesterday. “Purchasing an unspecified amount of cobalt through the global supply chain is not ‘participation in a venture’ within the meaning of the TVPRA [Trafficking Victims Protection Reauthorization Act of 2008],” the ruling said. “We therefore affirm the district court’s dismissal of the complaint.”

The plaintiffs in John Doe 1, et al. v. Apple Inc., et al. include four former miners, seven legal representatives of former miners who are still children, and five representatives of child laborers who were killed in cobalt mining operations, the ruling said. The miners were “recruited as children to engage in dangerous mining operations and suffered tunnel collapses, falls, and other accidents that left them paralyzed, disfigured, or worse,” the ruling said.

“The forced labor was organized or overseen by agents or subsidiaries of the Tech Companies’ cobalt suppliers,” judges wrote. Plaintiffs “began mining at a young age to avoid starvation and to support their families,” and say they were pressured to remain in the mines despite unsafe and exploitative working conditions.

Buying cobalt doesn’t create a “venture”

Companies such as Glencore, Huayou, and Eurasian Resources Group obtain cobalt from subsidiaries in the DRC. Glencore sells cobalt to Umicore, which “refines the cobalt and sells it to Apple, Alphabet, and Microsoft, as well as to intermediaries that in turn sell to Dell and Tesla,” the ruling said. Huayou sells processed cobalt to Apple, Dell, and Microsoft, and Eurasian Resources owns a mine from which it sells cobalt to Tesla.

“Several plaintiffs insist they were trapped in a ‘debt bondage situation’ where ‘sponsors’ gave out food and funds as an advance but deducted the amount of the advance, along with other costs, from the plaintiffs’ earnings when the cobalt was sold,” the ruling said. “Other miners were told that if they did not continue working in the mines, they would be blacklisted and barred from working at any other mines in the region.”

In a brief, tech companies said the lawsuit targeted “five purchasers of refined cobalt far removed from the labor abuses allegedly occurring at cobalt mines.” The brief said the defendants “have established policies and due-diligence practices to eradicate child labor in the international network of their suppliers,” and that the “alleged injuries are not fairly traceable” to any of the defendants’ conduct.

Plaintiffs argued that the global cobalt supply chain is a “venture” as defined in the US law and that tech companies “participated in that venture with the full knowledge that cobalt suppliers and their subsidiary mining companies employed and trafficked in forced labor,” the ruling said. They sought financial damages, injunctive relief, and other remedies on behalf of themselves and “a class of similarly situated child miners in the DRC.”

Appeals court judges ruled that the plaintiffs have standing to pursue damages claims for injuries and deaths, but they didn’t agree with plaintiffs that the US tech companies are liable:

The plaintiffs have not adequately alleged the Tech Companies participated in a venture because there is no shared enterprise between the Companies and the suppliers who facilitate forced labor. The Tech Companies own no interest in their suppliers. Nor do the Tech Companies share in the suppliers’ profits and risks. Although a formal business relationship is not necessary to be a participant in a venture, something more than engaging in an ordinary buyer-seller transaction is required to establish “participation” in an unlawful venture.

https://arstechnica.com/?p=2008307

Bitcoin’s price hit a record high Tuesday, surging above $69,000 and notching past its prior peak price of $68,991.85 recorded in 2021.

After bitcoin’s price sunk in 2022 amid a cryptocurrency industry crash, bitcoin’s comeback began in early 2023, Bloomberg reported. But this week’s record price owes a lot to the US Securities and Exchange Commission (SEC) approving spot-bitcoin exchange-traded funds (ETFs) in early January, which funneled more than $7 billion into various bitcoin investment products in less than two months, The New York Times reported.

These ETFs are offered by trusted financial institutions like BlackRock and Fidelity, making it more enticing for the crypto-curious to invest in bitcoin without owning any of the cryptocurrency or understanding any of the associated technology. Instead, they can just buy shares of a collection of digital assets with SEC-required protections against fraud or manipulation.

“Traditional institutions were once sitting out; today, they are here in full force as the principal drivers of the crypto bull market,” Nathan McCauley, CEO and co-founder of Anchorage Digital, told Bloomberg.

Investors already have varied options when choosing between ETFs. According to Coindesk, 11 spot bitcoin ETFs “amassed more than 192,000 bitcoin in holdings” in the month after SEC approvals, on top of 420,000 in holdings owned by Grayscale and nearly 200,000 owned by MicroStrategy, Business Insider reported.

This spares investors risks associated with cryptocurrency exchanges mired by 2022 scandals and bankruptcies, from FTX’s collapse, which led to prison time for co-founder Sam Bankman-Fried, to the SEC’s larger crackdown on exchanges like Coinbase and Binance.

While demand in bitcoin investment products spikes—perhaps pushing bitcoin’s value as high as $500,000, analysts told Business Insider—the amount of available bitcoin is about to drop during a halving event expected to take place April 19, Marketwatch forecasted.

Bitcoin halving events happen approximately every four years. They occur after 210,000 blocks are mined, slashing the reward for mining in half and intended to control the total supply until the maximum number of coins are released, Marketwatch explained.

“The prospect of scarcer bitcoin supply has helped drive up its price,” The Times reported.

But while it’s common for bitcoin’s price to rise around halving events, Marketwatch noted that historically, the months before a halving do not see the spikes in prices occurring now. In what Bloomberg described as an “ironic twist,” it would appear that the SEC—which typically restricts cryptocurrency flows—could become the force helping the crypto industry “turn the page” from a crypto winter that some skeptics predicted cryptocurrencies may never recover from.

Of course, other more optimistic analysts predicted that ETFs would drive bitcoin to these new heights, Business Insider reported.

Prices of other cryptocurrencies, including ether, solana, and dogecoin, have also risen this year, Business Insider reported, with spiking interest potentially driven by the possibility that the SEC could approve investment products tied to other cryptocurrencies. Optimism has seemingly remained high since February, when the value of the cryptocurrency market bounced back to $2 trillion—conditions last seen in April 2022, Business Insider reported.

If the SEC does end up approving more cryptocurrency investment products, it likely won’t be because SEC chair Gary Gensler is in any rush to do so, though.

In a press release announcing the approvals last January, Gensler noted that the SEC had resisted “the listing and trading of a number of spot bitcoin exchange-traded product (ETP) shares.” It was only after a court ruling where “the Commission failed to adequately explain its reasoning in disapproving” a “listing and trading of Grayscale’s proposed ETP” that the SEC felt that approving these investment funds and products would be “the most sustainable path forward.”

Despite immediately granting approvals for 10 ETPs, Gensler warned investors that the SEC still views bitcoin as a “volatile asset” linked to “illicit activity” like ransomware, money laundering, sanction evasion, and terrorist financing.

“While we approved the listing and trading of certain spot bitcoin ETP shares today, we did not approve or endorse bitcoin,” Gensler said. “Investors should remain cautious about the myriad risks associated with bitcoin and products whose value is tied to crypto.”

https://arstechnica.com/?p=2007984

Elon Musk and X Corp. were sued yesterday by four former Twitter executives who say they were cheated out of more than $128 million in severance when Musk bought the social network and fired them.

Former Twitter CEO Parag Agrawal, former CFO Ned Segal, former Chief Legal Officer Vijaya Gadde, and former General Counsel Sean Edgett filed the lawsuit in US District Court for the Northern District of California. They say they are owed one year’s salary, stock awards, and health insurance premiums.

“If anyone around Musk had been willing to tell him the truth, he would have learned that his scheme to deny Plaintiffs their contractual severance payments was a pointless effort that would not withstand legal scrutiny,” the lawsuit said.

Still, Musk has so far avoided making the payments. Musk and X Corp. stonewalled the plaintiffs’ attempts to obtain their severance over the past year by “wrongfully withholding documents, needlessly prolonging any decisions, and generally playing out the ERISA [Employee Retirement Income Security Act] administrative process for all it’s worth,” the lawsuit said. “This is the Musk playbook: to keep the money he owes other people, and force them to sue him. Even in defeat, Musk can impose delay, hassle, and expense on others less able to afford it.”

Musk’s company is separately facing lawsuits seeking severance payments for laid-off employees.

Musk “made up fake cause”

The former executives’ lawsuit cites passages from the Walter Isaacson-written biography in which Musk described his plan to avoid paying severance. “Musk bragged to Isaacson specifically how he planned to cheat Twitter’s executives out of their severance benefits in order to save himself $200 million,” the complaint said. The court filing points to a passage describing how Musk closed the October 2022 purchase in time to “fire Agrawal and other top Twitter executives ‘for cause’ before their stock options could vest.”

“There’s a 200-million differential in the cookie jar between closing tonight and doing it tomorrow morning,” the book quoted Musk as saying hours before the $44 billion acquisition was finalized.

The amounts allegedly owed to the four plaintiffs are less than $200 million. Agrawal says he is owed $57.4 million, Segal is seeking $44.5 million, Gadde is seeking $20 million, and Edgett is seeking $6.8 million.

“Because Musk decided he didn’t want to pay Plaintiffs’ severance benefits, he simply fired them without reason, then made up fake cause and appointed employees of his various companies to uphold his decision,” the lawsuit said. “He claimed in his termination letters that each Plaintiff committed ‘gross negligence’ and ‘willful misconduct’ without citing a single fact in support of this claim. Musk’s employees then spent a year trying to come up with facts to support his preordained conclusion, to no avail.”

Musk’s letters of termination additionally accused Agrawal, Gadde, and Edgett of “failure to cooperate in good faith with a governmental or internal investigation of the Company,” the lawsuit said. Seven months later, Twitter denied all four of the plaintiffs’ requests for payment. The denial letters alleged that several of the executives “committed gross negligence due to the Company’s alleged corporate waste,” but “made no attempt to address Musk’s claim in the termination letters that some of the Plaintiffs had failed to cooperate with an investigation,” the lawsuit said.

https://arstechnica.com/?p=2007909

Jack Teixeira, the National Guard airman who leaked confidential military documents on Discord, agreed Monday to plead guilty, promising to cooperate with officials attempting to trace the full extent of government secrets leaked.

Under the plea deal, Teixeira will serve a much-reduced sentence, The Boston Globe reported, recommended between 11 years and 16 years and eight months.

Previously, Teixeira had pleaded not guilty to six counts of “willful retention and transmission of national defense information,” potentially facing up to 10 years per count. During a pretrial hearing, prosecutors suggested he could face up to 25 years, The Globe reported.

By taking the deal, Teixeira will also avoid being charged with violations of the Espionage Act, The New York Times reported, including allegations of unlawful gathering and unauthorized removal of top-secret military documents.

According to prosecutors, it was clear that Teixeira, 22, was leaking sensitive documents—including national security secrets tied to US foreign adversaries and allies, including Russia, China, Ukraine, and South Korea—just to impress his friends on Discord—some of them teenage boys. Investigators found no evidence of espionage.

US District Judge Indira Talwani will decide whether or not to sign off on the deal at a hearing scheduled for September 27.

Discord leaker “significantly remorseful”

Teixeira has been in custody after his arrest last April when Discord helped the FBI track down the source of leaked documents.

The controversy has raised questions about who gets access to the US government’s most sensitive documents. According to an FBI special agent’s affidavit, Teixeira was granted access to top-secret documents at 19, when he was working as a low-level computer tech at a Massachusetts military base. Business Insider estimated that more than 2 million workers have similar clearance.

Teixeira reportedly grew up in a military family in a small, conservative Massachusetts town, developing an obsession early on with the military. Some of his childhood classmates found his obsession with guns and the military “unnerving,” and at least at school, Teixeira developed a reputation for doing “crazy stuff” to get attention.

Once he was stationed in Massachusetts, he started leaking documents by transcribing confidential information and sharing it online, but when that didn’t elicit the response he hoped, he began printing documents and bringing them home. According to The Times, Teixeira was warned at least once by a superior to stop, but this did not deter him.

Hoping to impress a tight-knit community of about 25 members as the admin of a Discord server called “Thug Shaker Central,” Teixeira would photograph the confidential documents he stole, then upload them to Discord. That community—which The Times found was “fixated on weapons, mass shootings, and shadowy conspiracy theories”—was expected not to share the documents. Ultimately, Bellingcat found that Teixeira’s friends spread the documents widely, first to other Discord servers, then to Telegram, 4Chan, and Twitter (now called X).

Teixeira also reportedly used his access to try to figure out if he was suspected of leaking documents. And once he felt the FBI on his trail, he reportedly took extreme measures to avoid drawing attention, switching Discord servers to throw off the FBI’s manhunt and telling his friends to delete anything “that could possibly relate to him.”

When Teixeira was arrested last year, his mother, Dawn, told The Times that Teixeira often worked late at the base, where his stepfather, a retired master sergeant, had also once worked. The arrest seemed to surprise the family, who supported him Monday with encouraging nods and smiles as he entered his guilty plea, The Globe reported.

“Do you understand if I accept your plea, you’ll be judged guilty of these offenses?” Talwani asked Teixeira.

“Yes, I do, your honor,” Teixeira replied.

“Are you in fact guilty of the facts charged?” Talwani asked.

“Yes, your honor,” he said.

A lawyer for Teixeira, Michael Bachrach, described the airman as “significantly remorseful” and indicated that Teixeira hoped for the lightest sentence possible under the plea deal, The Globe reported.

“We believe there is going to be substantial mitigation that we’re going to be able to establish as to why a sentence of no more than 11 years is, in fact, the just and reasonable sentence in this case,” Bachrach said.

Scrutiny of Teixeira may not end when this trial ends, though. According to a Department of Defense official, “Teixeira remains in unpaid active military status” and “could still face a military judicial process” if the Air Force pursues additional military legal action, The Globe reported.

https://arstechnica.com/?p=2007635

Amid safety scandals involving “many loose bolts” and widespread problems with Boeing’s 737 Max 9s, Boeing is apparently considering buying back Spirit AeroSystems, the key supplier behind some of Boeing’s current manufacturing problems, sources told The Wall Street Journal.

Spirit was initially spun out from Boeing Commercial Airplanes in 2005, and Boeing had planned to keep it that way. Last year, Boeing CEO Dave Calhoun sought to dispel rumors that Boeing might reacquire Spirit as federal regulators launched investigations into both companies. But now Calhoun appears to be “softening that stance,” the WSJ reported.

According to the WSJ’s sources, no deal has formed yet, but Spirit has initiated talks with Boeing and “hired bankers to explore strategic options.” Sources also confirmed that Spirit is weighing whether to sell its operations in Ireland, which manufactures parts for Boeing rival Airbus.

Perhaps paving the way for these talks, Spirit replaced its CEO last fall with a former Boeing executive, Patrick Shanahan. In a press release noting that Spirit relies “on Boeing for a significant portion of our revenues,” Spirit touted Shanahan as a “seasoned executive” with 31 years at Boeing, and Shanahan promised to “stabilize” Spirit’s operations.

If Boeing reacquired Spirit, it might help reduce backlash over Boeing outsourcing manufacturing of its planes, but it likely wouldn’t help Boeing escape the ongoing scrutiny. While the WSJ reported that “Spirit parts frequently arrive” at the Boeing factory “with defects,” it was “a snafu at Boeing’s factory” that led Alaska Airlines to ground 65 Boeing aircraft over safety concerns after a mid-aircraft door detached mid-flight, endangering passengers and crew.

Sources later revealed that it was Boeing employees who failed to put bolts back in when they reinstalled a door plug, reportedly causing the malfunction that forced Alaska Airlines to make an emergency landing. As a result, Boeing withdrew from a safety exemption that it had requested “to prematurely allow the 737 Max 7 to enter commercial service.” At that time, US Sen. Tammy Duckworth (D-Ill.) accused Boeing of a “bold-face attempt to put profits over the safety of the flying public.”

Purchasing Spirit would appear to be a last resort for Boeing, the WSJ reported, noting that so far, “Boeing has done everything short of acquiring Spirit in an effort to gain control over the supplier.”

But Reuters confirmed the WSJ’s report with an industry source, so it seems like perhaps Boeing increasingly feels it has no other options left despite working closely with Shanahan for the past few months to keep Spirit’s troubles from impacting Boeing’s bottom line. One industry source told Reuters that in the time since Boeing spun off Spirit, “the optics of buying at a higher price were among the factors that discouraged such a move.”

For Spirit, which attributes nearly two-thirds of its revenues to Boeing, the WSJ reported, being brought back into the Boeing fold could be the only way to survive these turbulent times. Currently valued at about $3.3 billion, Spirit has struggled for months to shore up a commercial agreement with Airbus and notably failed to stabilize after receiving a “$100 million cash infusion from Boeing” last year, the WSJ reported.

But for Boeing, the obvious downside of the purchase would be taking on Spirit’s mess at the same time Boeing is trying to clean up its own image.

https://arstechnica.com/?p=2007384

WhatsApp will soon be granted access to explore the “full functionality” of the NSO Group’s Pegasus spyware—sophisticated malware the Israeli Ministry of Defense has long guarded as a “highly sought” state secret, The Guardian reported.

Since 2019, WhatsApp has pushed for access to the NSO’s spyware code after alleging that Pegasus was used to spy on 1,400 WhatsApp users over a two-week period, gaining unauthorized access to their sensitive data, including encrypted messages. WhatsApp suing the NSO, Ars noted at the time, was “an unprecedented legal action” that took “aim at the unregulated industry that sells sophisticated malware services to governments around the world.”

Initially, the NSO sought to block all discovery in the lawsuit, “due to various US and Israeli restrictions,” but that blanket request was denied. Then, last week, the NSO lost another fight to keep WhatsApp away from its secret code.

As the court considered each side’s motions to compel discovery, a US district judge, Phyllis Hamilton, rejected the NSO’s argument that it should only be required to hand over information about Pegasus’ installation layer.

Hamilton sided with WhatsApp, granting the Meta-owned app’s request for “information concerning the full functionality of the relevant spyware,” writing that “information showing the functionality of only the installation layer of the relevant spyware would not allow plaintiffs to understand how the relevant spyware performs the functions of accessing and extracting data.”

WhatsApp has alleged that Pegasus can “intercept communications sent to and from a device, including communications over iMessage, Skype, Telegram, WeChat, Facebook Messenger, WhatsApp, and others” and that it could also be “customized for different purposes, including to intercept communications, capture screenshots, and exfiltrate browser history.”

To prove this, WhatsApp needs access to “all relevant spyware”—specifically “any NSO spyware targeting or directed at WhatsApp servers, or using WhatsApp in any way to access Target Devices”—for “a period of one year before the alleged attack to one year after the alleged attack,” Hamilton concluded.

The NSO has so far not commented on the order, but WhatsApp was pleased with this outcome.

“The recent court ruling is an important milestone in our long running goal of protecting WhatsApp users against unlawful attacks,” WhatsApp’s spokesperson told The Guardian. “Spyware companies and other malicious actors need to understand they can be caught and will not be able to ignore the law.”

But Hamilton did not grant all of WhatsApp’s requests for discovery, sparing the NSO from sharing specific information regarding its server architecture because WhatsApp “would be able to glean the same information from the full functionality of the alleged spyware.”

Perhaps more significantly, the NSO also won’t be compelled to identify its clients. While the NSO does not publicly name the governments that purchase its spyware, reports indicate that Poland, Saudi Arabia, Rwanda, India, Hungary, and the United Arab Emirates have used it to target dissidents, The Guardian reported. In 2021, the US blacklisted the NSO for allegedly spreading “digital tools used for repression.”

In the same order, Hamilton also denied the NSO’s request to compel WhatsApp to share its post-complaint communications with the Citizen Lab, which served as a third-party witness in the case to support WhatsApp’s argument that “Pegasus is misused by NSO’s customers against ‘civil society.’”

It appeared that the NSO sought WhatsApp’s post-complaint communications with Citizen Lab as a way to potentially pressure WhatsApp into dropping Citizen Lab’s statement from the record. Hamilton quoted a court filing from the NSO that curiously noted: “If plaintiffs would agree to withdraw from their case Citizen Lab’s contention that Pegasus was used against members of ‘civil society’ rather than to investigate terrorism and serious crime, there would be much less need for this discovery.”

Ultimately, Hamilton denied the NSO’s request because “the court fails to see the relevance of the requested discovery.”

As discovery in the case proceeds, the court expects to receive expert disclosures from each side on August 30 before the trial, which is expected to start on March 3, 2025.

https://arstechnica.com/?p=2007345

The screenwriter who penned the original screenplay for the 1989 cult classic film Road House, R. Lance Hill, is suing Amazon over its remake due out this March.

Hill, whose Hollywood pen name is David Lee Henry, has alleged that Amazon, MGM Studios, and United Artists (UA) failed to pay him licensing fees after the copyright to Road House was reverted back to Hill in November 2023. The studios, Hill claimed, have refused to recognize that Hill has recovered the copyright, instead moving forward with an allegedly “unauthorized remake.”

According to Hill, he transferred the copyright to UA in 1986 after writing the Road House screenplay “on spec”—which means “that he wrote it on his own volition, in the hope of finding an interested motion picture studio once the work was completed.”

But in the form granting UA the copyright, UA allegedly included “boilerplate” language in a “form recitation” that indicated that the screenplay was not considered a spec screenplay but rather a “work made for hire” by an entity called Lady Amos Literary Works.

Under the Copyright Act, a work made for hire would ordinarily mean that the screenplay was either created by a Lady Amos employee or commissioned by Lady Amos, neither of which, Hill alleged, applied to the Road House screenplay.

Hill is the sole owner of Lady Amos, Hill argued, which “merely served as Hill’s alter ego for doing business” and has no employees. Lady Amos never paid Hill a salary or compensated Hill in any way for the screenplay, Hill said, nor did Lady Amos commission Hill to write the screenplay.

This hasn’t stopped studios from claiming today that Road House was a work made for hire, Hill’s complaint said.

“Road House has become a worldwide cult phenomenon since I wrote it as a spec script in 1986,” Hill told Ars. “But recently, when I recovered my copyright, MGM/Amazon tried to hand-wave me away” by allegedly claiming that MGM retains the copyright.

Studios’ “contention that United Artists’ form recitation in the 1986 grant retroactively converted Hill’s pre-existing spec screenplay into a work made for hire is contrary to law and, as such, United Artists’ post-facto boilerplate is of no legal force and effect,” Hill argued.

Hill is not attempting to stop Amazon from releasing the remake, telling Ars in a statement that he’s “elated that Doug Liman’s Road House remake is considered to be his and Jake Gyllenhaal’s best work to date.” The screenwriter expressed enthusiasm for the remake, which will credit him for writing the original story and screenplay.

Instead, Hill is seeking a permanent injunction to block studios from releasing the remake without respecting his exclusive rights to the screenplay and paying appropriate licensing fees for their derivative work. He’s hoping that a jury will declare that his copyright was properly recovered last November and rule that studios are guilty of copyright infringement, owing maximum statutory damages to Hill.

“Without a newly secured license, defendants’ exploitation of the 2024 remake in the United States constitutes ongoing willful infringement of Hill’s copyright,” Hill’s complaint said.

Hill’s lawyer, Marc Toberoff, told Ars that Hill’s lawsuit seeks to defend all creators’ rights to their works when dealing with studios today.

“The asset base of all major entertainment studios is content; without it they have nothing,” Toberoff told Ars. “It is time they respect the fundamental rights and artistry of creators on whose sweat and toil their empires are based.”

Ars could not immediately reach Amazon MGM Studios for comment.

https://arstechnica.com/?p=2006660