Thousands of the most dedicated Reddit users will have a chance to snag shares when the company goes public in 2024, The Wall Street Journal reported Wednesday.

Citing people familiar with the matter, The Journal reported that 75,000 of the “most prolific” Redditors will have an opportunity to buy “an as-yet-undetermined number of shares” before trading starts.

This privilege, WSJ noted, is “normally” reserved for “big investors” who can stand to hugely profit if the share prices dramatically rise after Reddit begins listing shares on the New York Stock Exchange (NYSE), which is expected to happen this March.

Of course, Redditors could also experience the opposite and lose on their investment if the stock immediately plummets. That could further rile Redditors currently protesting changes at the company or spur Redditors to dump the stock before they can reap any benefits from buying into Reddit stock early on.

Individual investors appearing to be more prone to “selling at the first sign of weakness” is one reason banks typically prefer to sell to “big money managers,” the WSJ noted.

Many longtime Redditors who may be intrigued by this offer might be wondering what the odds are of Reddit’s initial public offering (IPO) faring better than the majority of new listings that The Journal reported are struggling to find buyers, remaining below listing prices. It’s still too early to say, but Reddit made some moves before announcing the IPO that could inspire some confidence.

Reddit announced its IPO in December 2021, nine months after Drew Vollero joined as the company’s chief financial officer. In a blog post, Reddit noted that Vollero had previously steered Snap through its IPO as a public company, which CNBC reported quenched a “long drought in the market for tech IPOs” after closing its first day of trading with share prices up 44 percent. While TechCrunch reported that Snap became a “laughing stock” of the NYSE within two years—”sinking to an all-time low” in December 2018—the company eventually bounced back after finding new ways to attract users.

Although Snap stock recently began plummeting again through earnings losses and layoffs, by the time Vollero left Snap, the company was on track to hit an all-time high for share price in September 2021, Fast Company reported.

Vollero’s track record likely appealed to Reddit as the company weighed going public in 2021. The company also seemed encouraged by positive trends on its platform, confirming that its decision to go public came after the WallStreetBets forum brought in millions of new users and advertisers, the WSJ reported.

Reddit declined Ars’ request to comment but has long made it clear that it hopes to entice users to become shareholders. From the beginning, Reddit’s blog said, the plan was to “make Reddit’s share offering more accessible to individual investors,” hinting in 2021 that users could one day own a piece of Reddit. And at a tech conference that year, Reddit CEO Steve Huffman directly said that the company wanted to make it easy for users to become shareholders.

“I want our users to be shareholders, and I want our shareholders to be users,” Huffman reportedly said.

By inviting users to become shareholders, Reddit saw an opportunity to help drive change, Huffman said, at a time when “the market is evolving to be more fair” and accessible to individual traders buying and selling stock through platforms like Robinhood.

https://arstechnica.com/?p=2004918

Apple is coming under fire from rivals Meta and Microsoft who say its plans to open up its mobile software to comply with a landmark EU law fail to go far enough, as the iPhone maker faces unprecedented regulatory challenges from Brussels over the coming month.

EU regulators, who are preparing to fine the tech giant 500 million euros in March over allegedly favoring its music-streaming app against competitors like Spotify, are also being lobbied to reject Apple’s proposals to satisfy the bloc’s Digital Markets Act.

The growing backlash against Apple comes as it is forced to make some of the biggest changes to its business model in years, following concerns over the dominance of its App Store, which forms a large share of the company’s $85 billion-a-year services business.

Apple announced last month it will make changes to its iOS mobile software in Europe, such as allowing users to download apps from other sources and access alternative payment systems.

The changes were offered ahead of the EU’s March 7 deadline for companies to declare how they will adhere to the DMA, which aims to tackle the market power of Big Tech groups.

The proposal leaves developers with a dilemma: stick with Apple’s existing ecosystem and fees, or leave permanently and face new terms.

For those who choose to also build apps in alternative stores, Apple said it would cut the highest amount paid by companies using its App Store to sell digital goods and services from 30 percent to 17 percent.

But it will add a series of new charges. These include a “core technology fee” of 50 cents on every download or update of apps with more than 1 million downloads. Apple will also charge an additional 3 percent fee to app developers that use its payment processor. The 50-cent fee will apply immediately to downloads of alternative app stores.

Critics contend that the changes could lead makers of successful apps being charged far more than they currently are, while removing any incentive for rivals to create alternative app stores.

“The initial steps [to comply with the DMA] that Apple has put forward are very prohibitive to us actually creating a meaningful alternative to the one store that’s available on the world’s largest gaming platforms, which are mobile phones,” Phil Spencer, Microsoft’s gaming chief, told the Financial Times. “So we will continue to work with regulators to open that up.”

Meta chief executive Mark Zuckerberg has also dismissed Apple’s proposal as “onerous” and “at odds” with the intent of the EU regulation, saying he would be surprised “if any developer chose to go into the alternative app stores.”

After Apple’s announcement, “it took about an hour for app developers to realize they had been screwed,” said Damien Geradin, a lawyer for developers critical of Apple. “Pretty much everyone will stick to the old terms and the DMA will effectively make no difference,” he added.

“What the European Commission is saying to people is: ‘please help us, give us examples of where it doesn’t work,’” said Geradin. The March deadline, he said, would mark the beginning of a new back and forth between the EU and Apple.

Apple said it spent “months in conversation with the European Commission” about the DMA and that its plan reflects the work of “hundreds of Apple team members who spent tens of thousands of hours” on the solution.

The growing backlash has left the European Commission, the EU’s executive arm, with the dilemma of deciding whether years of work on the new legislation aimed at digital “gatekeepers” has had its desired effect on Apple—and whether it can sanction the company for failing to comply.

The EU said the bloc can launch a non-compliance procedure against any company covered by the DMA as soon as the March deadline expires. The law allows the EU to fine companies up to 10 percent of annual turnover, rising to 20 percent in repeat cases.

Apple chief executive Tim Cook said on an earnings call this month that it was “very difficult” to quantify the impact the DMA changes would have on the company’s bottom line.

Meta and Microsoft are also hit by the DMA but spot an opportunity to grab a greater share of the around $27 billion Apple made in 2023 from App Store sales, according to data from Sensor Tower. Europe generates 7 percent of those revenues.

The companies are seeking to challenge Apple in other ways. Two years ago, Apple extended its commission fees to also take a 30 percent cut from marketers who pay to get their advert featured more prominently within apps such as Instagram.

Meta last week said it would now start passing on the 30 percent charge directly to advertisers, in effect making it more expensive to reach Apple device users.

Nicholas Rodelli at CFRA Research said Meta’s move was a “direct challenge” to Apple’s policies, with tech companies now “going on the offensive” to exploit the iPhone maker’s new regulatory vulnerabilities.

Spotify and Epic Games, longtime Apple critics, have also argued Apple’s proposed moves amount to an act of bad faith. Gary Swidler, president of Match Group, which owns Tinder, said the EU’s acceptance of Apple’s plan is “far from assured.”

Independent analyst Eric Seufert said that Apple was “feeling around for what they will be allowed to do under the DMA.”

He added: “The question is whether the European Commission accepts this—which I believe they will not.”

Additional reporting by Tim Bradshaw in London

© 2024 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=2004833

Law enforcement agencies including the FBI and the UK’s National Crime Agency have dealt a crippling blow to LockBit, one of the world’s most prolific cybercrime gangs, whose victims include Royal Mail and Boeing.

The 11 international agencies behind “Operation Cronos” said on Tuesday that the ransomware group—many of whose members are based in Russia—had been “locked out” of its own systems. Several of the group’s key members have been arrested, indicted, or identified and its core technology seized, including hacking tools and its “dark web” homepage.

Graeme Biggar, NCA director-general, said law enforcement officers had “successfully infiltrated and fundamentally disrupted LockBit.”

“LockBit has caused enormous harm and cost. No longer,” Biggar told a media conference in London, flanked by officials from the FBI, US Department of Justice, and Europol. “As of today, LockBit is effectively redundant. LockBit has been locked out.”

Over the past four years, LockBit has been involved in thousands of ransomware attacks on victims around the world, from high-profile corporate targets to hospitals and schools.

The hacking group’s technology, which locks organizations out of their own IT systems, has been used by a global network of hackers to inflict billions of dollars’ worth of damage to victims, through about $120 million in ransom payments and millions more in recovery costs, according to officials.

Five defendants have been charged in the US, officials said, including two Russian nationals. Two of the five are in custody. Another two alleged members of the gang were arrested in Ukraine and Poland on Tuesday, with law enforcement officials promising more to come.

“We will be closing in on those individuals,” said Biggar, adding that agencies had frozen about 200 cryptocurrency accounts and seized a “wealth of data” to fuel the investigation. “We’ve got a very clear understanding of the LockBit operation.”

That included seizing about 11,000 domains and servers around the world, as well as gaining access to nearly 1,000 potential decryption tools that could help more than 2,000 known victims regain access to their data.

Security researchers said earlier on Tuesday that LockBit’s website on hidden parts of the Internet—the dark web—had been taken down and replaced by a message stating it was “now under control of law enforcement.” Officials said the move was designed to humiliate and undermine the fearsome reputation of the group’s hackers, even as hundreds of its members, affiliates, and developers remained at large.

“There is a large concentration of these individuals in Russia,” said Biggar, who added that, while there was “clearly some tolerance of cyber criminality” there, the investigation had “not seen direct support from the Russian state.”

From its Russian roots, LockBit has collaborated with an international criminal syndicate through a so-called ransomware as a service model. The group rents out its malware to a loose network of hackers, who use it to paralyze a wide range of targets, from international finance groups and law firms to schools and medical facilities. LockBit typically takes a commission of as much as 20 percent of any ransom paid by victims.

LockBit’s attack in early 2023 on Royal Mail, the UK’s postal service, thrust the group into the spotlight, while its attack on the Industrial and Commercial Bank of China, the financial services arm of China’s largest bank, in November sent shockwaves through the financial world. That same month, gigabytes of data allegedly stolen from Boeing were leaked online after the aerospace group refused to pay a ransom.

The group has become so notorious that some hackers even got tattoos of its logo, part of a promotional stunt for which LockBit offered a $1,000 payment.

Chester Wisniewski, global field chief technology officer at cyber security company Sophos, said that LockBit, which is believed to have first emerged in 2019, had risen to become the “most prolific ransomware group” in the past two years.

“The frequency of their attacks, combined with having no limits to what type of infrastructure they cripple, has also made them the most destructive in recent years,” he said. “Anything that disrupts their operations and sows distrust amongst their affiliates and suppliers is a huge win for law enforcement.”

However, Wisniewski added that “much of their infrastructure is still online,” suggesting there was still work to do to bring the hackers under full control of law enforcement.

Additional reporting by Suzi Ring, Mehul Srivastava and John Paul Rathbone

© 2024 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=2004560

The day after The New York Times sued OpenAI for copyright infringement, the author and systems architect Daniel Jeffries wrote an essay-length tweet arguing that the Times “has a near zero probability of winning” its lawsuit. As we write this, it has been retweeted 288 times and received 885,000 views.

“Trying to get everyone to license training data is not going to work because that’s not what copyright is about,” Jeffries wrote. “Copyright law is about preventing people from producing exact copies or near exact copies of content and posting it for commercial gain. Period. Anyone who tells you otherwise is lying or simply does not understand how copyright works.”

This article is written by two authors. One of us is a journalist who has been on the copyright beat for nearly 20 years. The other is a law professor who has taught dozens of courses on IP and Internet law. We’re pretty sure we understand how copyright works. And we’re here to warn the AI community that it needs to take these lawsuits seriously.

In its blog post responding to the Times lawsuit, OpenAI wrote that “training AI models using publicly available Internet materials is fair use, as supported by long-standing and widely accepted precedents.”

The most important of these precedents is a 2015 decision that allowed Google to scan millions of copyrighted books to create a search engine. We expect OpenAI to argue that the Google ruling allows OpenAI to use copyrighted documents to train its generative models. Stability AI and Anthropic will undoubtedly make similar arguments as they face copyright lawsuits of their own.

These defendants could win in court—but they could lose, too. As we’ll see, AI companies are on shakier legal ground than Google was in its book search case. And the courts don’t always side with technology companies in cases where companies make copies to build their systems. The story of MP3.com illustrates the kind of legal peril AI companies could face in the coming years.

A copyright lawsuit destroyed MP3.com

Everyone knows about Napster, the music-sharing service that was destroyed by litigation in 2001. But fewer people remember MP3.com, a music startup that tried harder to color inside the lines but still got crushed in the courts.

MP3.com launched a pioneering music-streaming service in 2000. The idea was that users could build an online music library based on the CDs they already owned.

Because most users had slow dial-up modems, MP3.com took a shortcut, purchasing CDs and ripping them to MP3.com’s servers. When a customer wanted to add a CD to their collection, they would put it in their CD-ROM drive just long enough to prove they owned it. That would unlock access to copies of the same songs already stored on MP3.com servers.

“We thought about it almost like a compression algorithm,” founder Michael Robertson told us in a recent phone interview. “All we were doing was letting you listen to CDs you already had. We weren’t giving you anything you didn’t already have access to.”

According to Robertson, MP3.com also partnered with online CD retailers to enable instant listening. “As soon as you bought a CD, we’d use the digital receipt as proof” to enable streaming songs from the CD.

When the recording industry sued, MP3.com argued all of this was allowed by copyright’s fair use doctrine. The Supreme Court had previously ruled that it was fair use to “time shift” TV shows with a VCR. And an appeals court had recently blessed “space shifting” music from a CD to an MP3 player. So why shouldn’t a company help customers “space shift” their legally purchased music across the Internet?

A New York federal judge didn’t buy it. “Defendant purchased tens of thousands of popular CDs in which plaintiffs held the copyrights, and, without authorization, copied their recordings onto its computer servers,” wrote Judge Jed Rakoff in a decision against MP3.com.

https://arstechnica.com/?p=2004168

Brussels is to impose its first-ever fine on tech giant Apple for allegedly breaking EU law over access to its music streaming services, according to five people with direct knowledge of the long-running investigation.

The fine, which is in the region of €500 million and is expected to be announced early next month, is the culmination of a European Commission antitrust probe into whether Apple has used its own platform to favor its services over those of competitors.

The probe is investigating whether Apple blocked apps from informing iPhone users of cheaper alternatives to access music subscriptions outside the App Store. It was launched after music-streaming app Spotify made a formal complaint to regulators in 2019.

The Commission will say Apple’s actions are illegal and go against the bloc’s rules that enforce competition in the single market, the people familiar with the case told the Financial Times. It will ban Apple’s practice of blocking music services from letting users outside its App Store switch to cheaper alternatives.

Brussels will accuse Apple of abusing its powerful position and imposing anti-competitive trading practices on rivals, the people said, adding that the EU would say the tech giant’s terms were “unfair trading conditions.”

It is one of the most significant financial penalties levied by the EU on Big Tech companies. A series of fines against Google levied over several years and amounting to about 8 billion euros are being contested in court.

Apple has never previously been fined for antitrust infringements by Brussels, but the company was hit in 2020 with a 1.1 billion-euro fine in France for alleged anti-competitive behavior. The penalty was revised down to 372 million euros after an appeal.

The EU’s action against Apple will reignite the war between Brussels and Big Tech at a time when companies are being forced to show how they are complying with landmark new rules aimed at opening competition and allowing small tech rivals to thrive.

Companies that are defined as gatekeepers, including Apple, Amazon, and Google, need to fully comply with these rules under the Digital Markets Act by early next month.

The act requires these tech giants to comply with more stringent rules and will force them to allow rivals to share information about their services.

There are concerns that the rules are not enabling competition as fast as some had hoped, although Brussels has insisted that changes require time.

Brussels formally charged Apple in the anti-competitive probe in 2021. The commission narrowed the scope of the investigation last year and abandoned a charge of pushing developers to use its own in-app payment system.

Apple last month announced changes to its iOS mobile software, App Store, and Safari browser in efforts to appease Brussels after long resisting such steps. But Spotify said at the time that Apple’s compliance was a “complete and total farce.”

Apple responded by saying that “the changes we’re sharing for apps in the European Union give developers choice—with new options to distribute iOS apps and process payments.”

In a separate antitrust case, Brussels is consulting with Apple’s rivals over the tech giant’s concessions to appease worries that it is blocking financial groups from its Apple Pay mobile system.

The timing of the Commission’s announcement has not yet been fixed, but it will not change the direction of the antitrust investigation, the people with knowledge of the situation said.

Apple, which can appeal to the EU courts, declined to comment on the forthcoming ruling but pointed to a statement a year ago when it said it was “pleased” the Commission had narrowed the charges and said it would address concerns while promoting competition.

It added: “The App Store has helped Spotify become the top music streaming service across Europe and we hope the European Commission will end its pursuit of a complaint that has no merit.”

The Commission—the executive body of the EU—declined to comment.

© 2024 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=2004296

Lax content moderation on X (aka Twitter) has disrupted coordinated efforts between social media companies and law enforcement to tamp down on “propaganda accounts controlled by foreign entities aiming to influence US politics,” The Washington Post reported.

Now propaganda is “flourishing” on X, The Post said, while other social media companies are stuck in endless cycles, watching some of the propaganda that they block proliferate on X, then inevitably spread back to their platforms.

Meta, Google, and then-Twitter began coordinating takedown efforts with law enforcement and disinformation researchers after Russian-backed influence campaigns manipulated their platforms in hopes of swaying the 2016 US presidential election.

The next year, all three companies promised Congress to work tirelessly to stop Russian-backed propaganda from spreading on their platforms. The companies created explicit election misinformation policies and began meeting biweekly to compare notes on propaganda networks each platform uncovered, according to The Post’s interviews with anonymous sources who participated in these meetings.

However, after Elon Musk purchased Twitter and rebranded the company as X, his company withdrew from the alliance in May 2023.

Sources told The Post that the last X meeting attendee was Irish intelligence expert Aaron Rodericks—who was allegedly disciplined for liking an X post calling Musk “a dipshit.” Rodericks was subsequently laid off when Musk dismissed the entire election integrity team last September, and after that, X apparently ditched the biweekly meeting entirely and “just kind of disappeared,” a source told The Post.

In 2023, for example, Meta flagged 150 “artificial influence accounts” identified on its platform, of which “136 were still present on X as of Thursday evening,” according to The Post’s analysis. X’s seeming oversight extends to all but eight of the 123 “deceptive China-based campaigns” connected to accounts that Meta flagged last May, August, and December, The Post reported.

The Post’s report also provided an exclusive analysis from the Stanford Internet Observatory (SIO), which found that 86 propaganda accounts that Meta flagged last November “are still active on X.”

The majority of these accounts—81—were China-based accounts posing as Americans, SIO reported. These accounts frequently ripped photos from Americans’ LinkedIn profiles, then changed the real Americans’ names while posting about both China and US politics, as well as people often trending on X, such as Musk and Joe Biden.

Meta has warned that China-based influence campaigns are “multiplying,” The Post noted, while X’s standards remain seemingly too relaxed. Even accounts linked to criminal investigations remain active on X. One “account that is accused of being run by the Chinese Ministry of Public Security,” The Post reported, remains on X despite its posts being cited by US prosecutors in a criminal complaint.

Prosecutors connected that account to “dozens” of X accounts attempting to “shape public perceptions” about the Chinese Communist Party, the Chinese government, and other world leaders. The accounts also comment on hot-button topics like the fentanyl problem or police brutality, seemingly to convey “a sense of dismay over the state of America without any clear partisan bent,” Elise Thomas, an analyst for a London nonprofit called the Institute for Strategic Dialogue, told The Post.

Some X accounts flagged by The Post had more than 1 million followers. Five have paid X for verification, suggesting that their disinformation campaigns—targeting hashtags to confound discourse on US politics—are seemingly being boosted by X.

SIO technical research manager Renée DiResta criticized X’s decision to stop coordinating with other platforms.

“The presence of these accounts reinforces the fact that state actors continue to try to influence US politics by masquerading as media and fellow Americans,” DiResta told The Post. “Ahead of the 2022 midterms, researchers and platform integrity teams were collaborating to disrupt foreign influence efforts. That collaboration seems to have ground to a halt, Twitter does not seem to be addressing even networks identified by its peers, and that’s not great.”

Musk shut down X’s election integrity team because he claimed that the team was actually “undermining” election integrity. But analysts are bracing for floods of misinformation to sway 2024 elections, as some major platforms have removed election misinformation policies just as rapid advances in AI technologies have made misinformation spread via text, images, audio, and video harder for the average person to detect.

In one prominent example, a fake robocaller relied on AI voice technology to pose as Biden to tell Democrats not to vote. That incident seemingly pushed the Federal Trade Commission on Thursday to propose penalizing AI impersonation.

It seems apparent that propaganda accounts from foreign entities on X will use every tool available to get eyes on their content, perhaps expecting Musk’s platform to be the slowest to police them. According to The Post, some of the X accounts spreading propaganda are using what appears to be AI-generated images of Biden and Donald Trump to garner tens of thousands of views on posts.

It’s possible that X will start tightening up on content moderation as elections draw closer. Yesterday, X joined Amazon, Google, Meta, OpenAI, TikTok, and other Big Tech companies in signing an agreement to fight “deceptive use of AI” during 2024 elections. Among the top goals identified in the “AI Elections accord” are identifying where propaganda originates, detecting how propaganda spreads across platforms, and “undertaking collective efforts to evaluate and learn from the experiences and outcomes of dealing” with propaganda.

https://arstechnica.com/?p=2004185

Apple is removing the ability to install home screen web apps from iPhones and iPads in Europe when iOS 17.4 comes out, saying it’s too hard to keep offering the feature under the European Union’s new Digital Markets Act (DMA). Apple is required to comply with the law by March 6.

Apple said the change is necessitated by a requirement to let developers “use alternative browser engines—other than WebKit—for dedicated browser apps and apps providing in-app browsing experiences in the EU.” Apple explained its stance in a developer Q&A under the heading, “Why don’t users in the EU have access to Home Screen web apps?” It says:

Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps. And so, to comply with the DMA’s requirements, we had to remove the Home Screen web apps feature in the EU.

It will still be possible to add website bookmarks to iPhone and iPad home screens, but those bookmarks would take the user to the web browser instead of a separate web app. The change was recently rolled out to beta versions of iOS 17.4.

The Digital Markets Act targets “gatekeepers” of certain technologies such as operating systems, browsers, and search engines. It requires gatekeepers to let third parties interoperate with the gatekeepers’ own services, and prohibits them from favoring their own services at the expense of competitors. As 9to5Mac notes, allowing home screen web apps with Safari but not third-party browser engines might cause Apple to violate the rules.

Apple warns of “malicious web apps”

As Apple explains, iOS “has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis.”

Apple said it won’t be able to guarantee this isolation once alternative browser engines are supported. “Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. Browsers also could install web apps on the system without a user’s awareness and consent,” Apple’s FAQ said.

Despite the change, Apple said that “EU users will be able to continue accessing websites directly from their Home Screen through a bookmark with minimal impact to their functionality.”

Apple previously announced that its DMA compliance will bring sideloading to Europe, allowing developers to offer iOS apps from stores other than Apple’s official App Store.

Browser choice, security requirements

One browser-related change will be immediately obvious to EU users once they install the new iOS version. “When users in the EU first open Safari on iOS 17.4, they’ll be prompted to choose their default browser and presented with a list of the main web browsers available in their market to select as their default browser,” Apple’s developer FAQ said.

Apple said it had to prepare carefully for the requirement to let developers use alternative browser engines because browser engines “are constantly exposed to untrusted and potentially malicious content and have visibility into sensitive user data,” making them “one of the most common attack vectors for malicious actors.”

Apple said it is requiring developers who use alternative browser engines to meet certain security standards:

To help keep users safe online, Apple will only authorize developers to implement alternative browser engines after meeting specific criteria and committing to a number of ongoing privacy and security requirements, including timely security updates to address emerging threats and vulnerabilities. Apple will provide authorized developers of dedicated browser apps access to security mitigations and capabilities to enable them to build secure browser engines, and access features like passkeys for secure user login, multiprocess system capabilities to improve security and stability, web content sandboxes that combat evolving security threats, and more.

Overall, Apple said its DMA preparations have involved “an enormous amount of engineering work to add new functionality and capabilities for developers and users in the European Union—including more than 600 new APIs and a wide range of developer tools.”

https://arstechnica.com/?p=2004114

After months of resisting, Air Canada was forced to give a partial refund to a grieving passenger who was misled by an airline chatbot inaccurately explaining the airline’s bereavement travel policy.

On the day Jake Moffatt’s grandmother died, Moffat immediately visited Air Canada’s website to book a flight from Vancouver to Toronto. Unsure of how Air Canada’s bereavement rates worked, Moffatt asked Air Canada’s chatbot to explain.

The chatbot provided inaccurate information, encouraging Moffatt to book a flight immediately and then request a refund within 90 days. In reality, Air Canada’s policy explicitly stated that the airline will not provide refunds for bereavement travel after the flight is booked. Moffatt dutifully attempted to follow the chatbot’s advice and request a refund but was shocked that the request was rejected.

Moffatt tried for months to convince Air Canada that a refund was owed, sharing a screenshot from the chatbot that clearly claimed:

If you need to travel immediately or have already travelled and would like to submit your ticket for a reduced bereavement rate, kindly do so within 90 days of the date your ticket was issued by completing our Ticket Refund Application form.

Air Canada argued that because the chatbot response elsewhere linked to a page with the actual bereavement travel policy, Moffatt should have known bereavement rates could not be requested retroactively. Instead of a refund, the best Air Canada would do was to promise to update the chatbot and offer Moffatt a $200 coupon to use on a future flight.

Unhappy with this resolution, Moffatt refused the coupon and filed a small claims complaint in Canada’s Civil Resolution Tribunal.

According to Air Canada, Moffatt never should have trusted the chatbot and the airline should not be liable for the chatbot’s misleading information because Air Canada essentially argued that “the chatbot is a separate legal entity that is responsible for its own actions,” a court order said.

Experts told the Vancouver Sun that Moffatt’s case appeared to be the first time a Canadian company tried to argue that it wasn’t liable for information provided by its chatbot.

Tribunal member Christopher Rivers, who decided the case in favor of Moffatt, called Air Canada’s defense “remarkable.”

“Air Canada argues it cannot be held liable for information provided by one of its agents, servants, or representatives—including a chatbot,” Rivers wrote. “It does not explain why it believes that is the case” or “why the webpage titled ‘Bereavement travel’ was inherently more trustworthy than its chatbot.”

Further, Rivers found that Moffatt had “no reason” to believe that one part of Air Canada’s website would be accurate and another would not.

Air Canada “does not explain why customers should have to double-check information found in one part of its website on another part of its website,” Rivers wrote.

In the end, Rivers ruled that Moffatt was entitled to a partial refund of $650.88 in Canadian dollars (CAD) off the original fare (about $482 USD), which was $1,640.36 CAD (about $1,216 USD), as well as additional damages to cover interest on the airfare and Moffatt’s tribunal fees.

Air Canada told Ars it will comply with the ruling and considers the matter closed.

Air Canada’s chatbot appears to be disabled

When Ars visited Air Canada’s website on Friday, there appeared to be no chatbot support available, suggesting that Air Canada has disabled the chatbot.

Air Canada did not respond to Ars’ request to confirm whether the chatbot is still part of the airline’s online support offerings.

Last March, Air Canada’s chief information officer Mel Crocker told the Globe and Mail that the airline had launched the chatbot as an AI “experiment.”

Initially, the chatbot was used to lighten the load on Air Canada’s call center when flights experienced unexpected delays or cancellations.

“So in the case of a snowstorm, if you have not been issued your new boarding pass yet and you just want to confirm if you have a seat available on another flight, that’s the sort of thing we can easily handle with AI,” Crocker told the Globe and Mail.

Over time, Crocker said, Air Canada hoped the chatbot would “gain the ability to resolve even more complex customer service issues,” with the airline’s ultimate goal to automate every service that did not require a “human touch.”

If Air Canada can use “technology to solve something that can be automated, we will do that,” Crocker said.

Air Canada was seemingly so invested in experimenting with AI that Crocker told the Globe and Mail that “Air Canada’s initial investment in customer service AI technology was much higher than the cost of continuing to pay workers to handle simple queries.” It was worth it, Crocker said, because “the airline believes investing in automation and machine learning technology will lower its expenses” and “fundamentally” create “a better customer experience.”

It’s now clear that for at least one person, the chatbot created a more frustrating customer experience.

Experts told the Vancouver Sun that Air Canada may have succeeded in avoiding liability in Moffatt’s case if its chatbot had warned customers that the information that the chatbot provided may not be accurate.

Because Air Canada seemingly failed to take that step, Rivers ruled that “Air Canada did not take reasonable care to ensure its chatbot was accurate.”

“It should be obvious to Air Canada that it is responsible for all the information on its website,” Rivers wrote. “It makes no difference whether the information comes from a static page or a chatbot.”

https://arstechnica.com/?p=2003992

A watchdog group’s investigation found that terrorist group Hezbollah and other US-sanctioned entities have accounts with paid checkmarks on X, the Elon Musk-owned social network that still resides at the twitter.com domain.

The Tech Transparency Project (TTP), a nonprofit that is critical of Big Tech companies, said in a report today that “X, the platform formerly known as Twitter, is providing premium, paid services to accounts for two leaders of a US-designated terrorist group and several other organizations sanctioned by the US government.”

After buying Twitter for $44 billion, Musk started charging users for checkmarks that were previously intended to verify that an account was notable and authentic. “Along with the checkmarks, which are intended to confer legitimacy, X promises various perks for premium accounts, including the ability to post longer text and videos and greater visibility for some posts,” the Tech Transparency Project report noted.

The Tech Transparency Project suggests that X may be violating US sanctions. “The accounts identified by TTP include two that apparently belong to the top leaders of Lebanon-based Hezbollah and others belonging to Iranian and Russian state-run media,” the report said. “The fact that X requires users to pay a monthly or annual fee for premium service suggests that X is engaging in financial transactions with these accounts, a potential violation of US sanctions.”

Some of the accounts were verified before Musk bought Twitter, but verification was a free service at the time. Musk’s decision to charge for checkmarks means that X is “providing a premium, paid service to sanctioned entities,” which may raise “new legal issues,” the Tech Transparency Project said.

Report details 28 checkmarked accounts

Musk’s X charges $1,000 a month for a Verified Organizations subscription and last month added a basic tier for $200 a month. For individuals, the X Premium tiers that come with checkmarks cost $8 or $16 a month.

It’s possible for US companies to receive a license from the government to engage in certain transactions with sanctioned entities, but it doesn’t seem likely that X has such a license. X’s rules explicitly prohibit users from purchasing X Premium “if you are a person with whom X is not permitted to have dealings under US and any other applicable economic sanctions and trade compliance law.”

In all, the Tech Transparency Project said it found 28 “verified” accounts tied to sanctioned individuals or entities. These include individuals and groups listed by the US Treasury Department’s Office of Foreign Assets Control (OFAC) as “Specially Designated Nationals.”

“Of the 28 X accounts identified by TTP, 18 show they got verified after April 1, 2023, when X began requiring accounts to subscribe to paid plans to get a checkmark. The other 10 were legacy verified accounts, which are required to pay for a subscription to retain their checkmarks,” the group wrote, adding that it “found advertising in the replies to posts in 19 of the 28 accounts.”

We contacted X today and will update this article if we get a comment. Our email to press@x.com triggered the standard auto-reply from press+noreply@twitter.com that says, “Busy now, please check back later.”

Update at 4:28pm ET: After this article was published, X issued the following statement: “X has a robust and secure approach in place for our monetization features, adhering to legal obligations, along with independent screening by our payments providers. Several of the accounts listed in the Tech Transparency Report are not directly named on sanction lists, while some others may have visible account check marks without receiving any services that would be subject to sanctions. Our teams have reviewed the report and will take action if necessary. We’re always committed to ensuring that we maintain a safe, secure and compliant platform.”

https://arstechnica.com/?p=2003423

The European Court of Human Rights (ECHR) has ruled that weakening end-to-end encryption disproportionately risks undermining human rights. The international court’s decision could potentially disrupt the European Commission’s proposed plans to require email and messaging service providers to create backdoors that would allow law enforcement to easily decrypt users’ messages.

This ruling came after Russia’s intelligence agency, the Federal Security Service (FSS), began requiring Telegram to share users’ encrypted messages to deter “terrorism-related activities” in 2017, ECHR’s ruling said. A Russian Telegram user alleged that FSS’s requirement violated his rights to a private life and private communications, as well as all Telegram users’ rights.

The Telegram user was apparently disturbed, moving to block required disclosures after Telegram refused to comply with an FSS order to decrypt messages on six users suspected of terrorism. According to Telegram, “it was technically impossible to provide the authorities with encryption keys associated with specific users,” and therefore, “any disclosure of encryption keys” would affect the “privacy of the correspondence of all Telegram users,” the ECHR’s ruling said.

For refusing to comply, Telegram was fined, and one court even ordered the app to be blocked in Russia, while dozens of Telegram users rallied to continue challenging the order to maintain Telegram services in Russia. Ultimately, users’ multiple court challenges failed, sending the case before the ECHR while Telegram services seemingly tenuously remained available in Russia.

The Russian government told the ECHR that “allegations that the security services had access to the communications of all users” were “unsubstantiated” because their request only concerned six Telegram users.

They further argued that Telegram providing encryption keys to FSB “did not mean that the information necessary to decrypt encrypted electronic communications would become available to its entire staff.” Essentially, the government believed that FSB staff’s “duty of discretion” would prevent any intrusion on private life for Telegram users as described in the ECHR complaint.

Seemingly most critically, the government told the ECHR that any intrusion on private lives resulting from decrypting messages was “necessary” to combat terrorism in a democratic society. To back up this claim, the government pointed to a 2017 terrorist attack that was “coordinated from abroad through secret chats via Telegram.” The government claimed that a second terrorist attack that year was prevented after the government discovered it was being coordinated through Telegram chats.

However, privacy advocates backed up Telegram’s claims that the messaging services couldn’t technically build a backdoor for governments without impacting all its users. They also argued that the threat of mass surveillance could be enough to infringe on human rights. The European Information Society Institute (EISI) and Privacy International told the ECHR that even if governments never used required disclosures to mass surveil citizens, it could have a chilling effect on users’ speech or prompt service providers to issue radical software updates weakening encryption for all users.

In the end, the ECHR concluded that the Telegram user’s rights had been violated, partly due to privacy advocates and international reports that corroborated Telegram’s position that complying with the FSB’s disclosure order would force changes impacting all its users.

The “confidentiality of communications is an essential element of the right to respect for private life and correspondence,” the ECHR’s ruling said. Thus, requiring messages to be decrypted by law enforcement “cannot be regarded as necessary in a democratic society.”

The ruling “strikes a blow to authoritarian measures that seek to undermine fundamental rights protections in the digital age,” Ioannis Kouvakas, senior legal officer for Privacy International, told Ars. “By finding that Russia’s efforts to circumvent encryption of online messaging services violated the European Convention on Human Rights, the Court sends a clear message to other governments currently toying with similar ideas: risking the privacy and security of each and every user is certainly not the way to go.”

Martin Husovec, a law professor who helped to draft EISI’s testimony, told Ars that EISI is “obviously pleased that the Court has recognized the value of encryption and agreed with us that state-imposed weakening of encryption is a form of indiscriminate surveillance because it affects everyone’s privacy.”

https://arstechnica.com/?p=2003350