Patreon, a monetization platform for content creators, has asked a federal judge to deem unconstitutional a rarely invoked law that some privacy advocates consider one of the nation’s “strongest protections of consumer privacy against a specific form of data collection.” Such a ruling would end decades that the US spent carefully shielding the privacy of millions of Americans’ personal video viewing habits.

The Video Privacy Protection Act (VPPA) blocks businesses from sharing data with third parties on customers’ video purchases and rentals. At a minimum, the VPPA requires written consent each time a business wants to share this sensitive video data—including the title, description, and, in most cases, the subject matter.

The VPPA was passed in 1988 in response to backlash over a reporter sharing the video store rental history of a judge, Robert Bork, who had been nominated to the Supreme Court by Ronald Reagan. The report revealed that Bork apparently liked spy thrillers and British costume dramas and suggested that maybe the judge had a family member who dug John Hughes movies.

Although the videos that Bork rented “revealed nothing particularly salacious” about the judge, the intent of reporting the “Bork Tapes” was to confront the judge “with his own vulnerability to privacy harms” during a time when the Supreme Court nominee had “criticized the constitutional right to privacy” as “a loose canon in the law,” Harvard Law Review noted.

Even though no harm was caused by sharing the “Bork Tapes,” policymakers on both sides of the aisle agreed that First Amendment protections ought to safeguard the privacy of people’s viewing habits, or else risk chilling their speech by altering their viewing habits. The US government has not budged on this stance since, supporting a lawsuit filed in 2022 by Patreon users who claimed that while no harms were caused, damages are owed after Patreon allegedly violated the VPPA by sharing data on videos they watched on the platform with Facebook through Meta Pixel without users’ written consent.

“Restricting the ability of those who possess a consumer’s video purchase, rental, or request history to disclose such information directly advances the goal of keeping that information private and protecting consumers’ intellectual freedom,” the Department of Justice’s brief said.

The Meta Pixel is a piece of code used by companies like Patreon to better target content to users by tracking their activity and monitoring conversions on Meta platforms. “In simplest terms,” Patreon users said in an amended complaint, “the Pixel allows Meta to know what video content one of its users viewed on Patreon’s website.”

The Pixel is currently at the center of a pile of privacy lawsuits, where people have accused various platforms of using the Pixel to covertly share sensitive data without users’ consent, including health and financial data.

Several lawsuits have specifically lobbed VPPA claims, which users have argued validates the urgency of retaining the VPPA protections that Patreon now seeks to strike. The DOJ argued that “the explosion of recent VPPA cases” is proof “that the disclosures the statute seeks to prevent are a legitimate concern,” despite Patreon’s arguments that the statute does “nothing to materially or directly advance the privacy interests it supposedly was enacted to protect.”

Patreon’s attack on the VPPA

Patreon has argued in a recent court filing that the VPPA was not enacted to protect average video viewers from embarrassing and unwarranted disclosures but “for the express purpose of silencing disclosures about political figures and their video-watching, an issue of undisputed continuing public interest and concern.”

That’s one of many ways that the VPPA silences speech, Patreon argued, by allegedly preventing disclosures regarding public figures that are relevant to public interest.

Among other “fatal flaws,” Patreon alleged, the VPPA “restrains speech” while “doing little if anything to protect privacy” and never protecting privacy “by the least restrictive means.”

Patreon claimed that the VPPA is too narrow, focusing only on pre-recorded videos. It prevents video service providers from disclosing to any other person the titles of videos that someone watched, but it does not necessarily stop platforms from sharing information about “the genres, performers, directors, political views, sexual content, and every other detail of pre-recorded video that those consumers watch,” Patreon claimed.

https://arstechnica.com/?p=1998335

An anti-voting robocall that seems to use an artificially generated version of President Joe Biden’s voice is being investigated by the New Hampshire Attorney General’s office. The calls sent on Sunday told Democrats to avoid voting in the Presidential Primary on January 23.

“Although the voice in the robocall sounds like the voice of President Biden, this message appears to be artificially generated based on initial indications,” the state AG’s office said in an announcement today. The recorded message appears “to be an unlawful attempt to disrupt the New Hampshire Presidential Primary Election and to suppress New Hampshire voters,” the announcement said.

The “Biden” voice in the recording (available with this NBC News article) sounds a bit off but perhaps could fool some people into thinking it came from the president.

“What a bunch of malarkey,” the voice says. “You know the value of voting Democratic when our votes count. It’s important that you save your vote for the November election. We’ll need your help in electing Democrats up and down the ticket. Voting this Tuesday only enables the Republicans in their quest to elect Donald Trump again. Your vote makes a difference in November, not this Tuesday.”

NBC News reported that a spokesperson for the Trump campaign said it had no connection to the fake Biden call. “Not us, we have nothing to do with it,” the spokesperson said.

Spoofed Caller ID

The apparently spoofed Caller ID displayed the personal cell phone number of “a prominent New Hampshire Democrat,” NBC News wrote. Biden’s national campaign manager, Julie Chavez Rodriguez, said the “campaign is actively discussing additional actions to take immediately,” according to NBC News.

Biden isn’t officially on the ballot in New Hampshire this week because of a dispute over scheduling between New Hampshire Democrats and the Democratic National Committee. But there’s a write-in campaign supporting Biden in the Democratic primary, and a spokesperson for the write-in campaign described the robocall as “deepfake disinformation designed to harm Joe Biden, suppress votes, and damage our democracy.”

The New Hampshire AG’s office said the fake Biden call “appears to have been ‘spoofed’ to falsely show that it had been sent by the treasurer of a political committee that has been supporting the New Hampshire Democratic Presidential Primary write-in efforts for President Biden. The message’s content directed recipients who wished to be removed from a calling list to call the number belonging to this person.”

The AG’s office pointed out that no law prevents someone from voting in both January and November. “Voting in the New Hampshire Presidential Primary Election does not preclude a voter from additionally voting in the November General Election,” the AG’s office said.

https://arstechnica.com/?p=1997925

Meta will allow some Facebook and Instagram users to unlink their accounts as part of the platform’s efforts to comply with the European Union’s Digital Markets Act (DMA) ahead of enforcement starting March 1.

In a blog, Meta’s competition and regulatory director, Tim Lamb, wrote that Instagram and Facebook users in the EU, the European Economic Area, and Switzerland would be notified in the “next few weeks” about “more choices about how they can use” Meta’s services and features, including new opportunities to limit data-sharing across apps and services.

Most significantly, users can choose to either keep their accounts linked or “manage their Instagram and Facebook accounts separately so that their information is no longer used across accounts.” Up to this point, linking user accounts had provided Meta with more data to more effectively target ads to more users. The perk of accessing data on Instagram’s widening younger user base, TechCrunch noted, was arguably the $1 billion selling point explaining why Facebook acquired Instagram in 2012.

Also announced today, users protected by the DMA will soon be able to separate their Facebook Messenger, Marketplace, and Gaming accounts. However, doing so will limit some social features available in some of the standalone apps.

While Messenger users choosing to disconnect the chat service from their Facebook accounts will still “be able to use Messenger’s core service offering such as private messaging and chat, voice and video calling,” Marketplace users making that same choice will have to email sellers and buyers, rather than using Facebook’s messenger service. And unlinked Gaming app users will only be able to play single-player games, severing their access to social gaming otherwise supported by linking the Gaming service to their Facebook social networks.

While Meta may have had choices other than depriving users unlinking accounts of some features, Meta didn’t really have a choice in allowing newly announced options to unlink accounts. The DMA specifically requires that very large platforms designated as “gatekeepers” give users the “specific choice” of opting out of sharing personal data across a platform’s different core services or across any separate services that the gatekeepers manage.

Without gaining “specific” consent, gatekeepers will no longer be allowed to “combine personal data from the relevant core platform service with personal data from any further core platform services” or “cross-use personal data from the relevant core platform service in other services provided separately by the gatekeeper,” the DMA says. The “specific” requirement is designed to block platforms from securing consent at sign-up, then hoovering up as much personal data as possible as new services are added in an endless pursuit of advertising growth.

As defined under the General Data Protection Regulation, the EU requiring “specific” consent stops platforms from gaining user consent for broadly defined data processing by instead establishing “the need for granularity,” so that platforms always seek consent for each “specific” data “processing purpose.”

“This is an important ‘safeguard against the gradual widening or blurring of purposes for which data is processed, after a data subject has agreed to the initial collection of the data,’” the European Data Protection Supervisor explained in public comments describing “commercial surveillance and data security practices that harm consumers” provided at the request of the FTC in 2022.

According to Meta’s help page, once users opt out of sharing data between apps and services, Meta will “stop combining your info across these accounts” within 15 days “after you’ve removed them.” However, all “previously combined info would remain combined.”

https://arstechnica.com/?p=1997871

Google, AT&T, and Vodafone are investing $206.5 million in AST SpaceMobile, a Starlink competitor that plans to offer smartphone service from low-Earth-orbit satellites.

This is the first investment in AST SpaceMobile from Google and AT&T, while Vodafone had already put money into the satellite company. AST SpaceMobile announced the funding in a press release on Thursday and announced a $100 million public offering of its stock on the same day.

“Vodafone and AT&T have placed purchase orders for network equipment from AST SpaceMobile to support planned commercial service,” the satellite company said. Google has meanwhile “agreed to collaborate on product development, testing, and implementation plans for SpaceMobile network connectivity on Android and related devices.” AST, which has one very large test satellite in orbit, previously received investments from Rakuten, American Tower, and Bell Canada.

SpaceX subsidiary Starlink has deals with T-Mobile in the US and several carriers in other countries for satellite-to-smartphone service. T-Mobile is expected to offer Starlink-enabled text messaging this year, with voice and data service beginning sometime in 2025.

Though AT&T hadn’t previously invested in AST SpaceMobile, the companies were already working together. AT&T is leasing spectrum in the 700 MHz and 850 MHz bands to AST SpaceMobile. They plan “to provide mobile broadband to unserved and underserved areas covered by the Leased Spectrum,” the companies told the Federal Communications Commission in an application last year.

For hard-to-reach areas

Satellite-to-smartphone technology is generally seen as a supplement to cellular networks in hard-to-reach areas. “Because AST’s technology can focus satellite coverage in discrete portions of licensed areas, it does not need a nationwide swath of terrestrial mobile spectrum that a mobile network operator licensee has left fallow. Rather than displacing terrestrial network facilities nationwide, AST’s coverage will be complementary to AT&T’s extensive terrestrial network coverage,” the companies’ FCC filing said.

In April 2023, the companies announced that they completed the first two-way voice calls using AST SpaceMobile’s test satellite with standard mobile phones. “The first voice call was made from the Midland, Texas area to Rakuten in Japan over AT&T spectrum using a Samsung Galaxy S22 smartphone,” the announcement said.

In September 2023, AST SpaceMobile said it made “the first-ever 5G connection for voice and data between an everyday, unmodified smartphone and a satellite in space” and that it achieved a download rate of 14Mbps.

Five satellites should launch soon

AST SpaceMobile’s prototype satellite launched from a SpaceX rocket in September 2022. AST’s early plans detailed in 2020 called for 243 satellites overall, and its first five satellites for commercial operations are expected to launch by March 31, 2024. AST is manufacturing the satellites at its Texas facilities.

The prototype satellite delivers data over 5 MHz channels. “For the company’s planned operational satellites, beams are designed to support capacity of up to 40 Mhz, potentially enabling data transmission speeds of up to 120Mbps,” the company said.

An AST description of its satellite says it has “a large surface area of phased-array antennas, which work together to electronically form, steer, and shape wireless communication beams into cells of coverage,” similarly to cell towers on the ground. AST says its BlueWalker 3 test satellite is 693 square feet.

AST said it has “over 40 agreements and understandings with mobile network operators globally, who collectively service over 2 billion subscribers.” Besides Vodafone and AT&T, these “agreements and understandings” are with firms including Rakuten Mobile, Bell Canada, Orange, Telefonica, TIM, MTN, Saudi Telecom Company, Zain KSA, Etisalat, Indosat Ooredoo Hutchison, Telkomsel, Smart Communications, Globe Telecom, Millicom, Smartfren, Telecom Argentina, Telstra, Africell, and Liberty Latin America.

While Starlink already has over 5,000 satellites delivering home Internet service and plans to launch tens of thousands more, it isn’t too far ahead of AST SpaceMobile in terms of cellular-enabled satellites. SpaceX launched the first six Starlink satellites that can provide cellular transmissions to standard LTE phones a few weeks ago and demonstrated the technology with text messages sent between T-Mobile phones.

https://arstechnica.com/?p=1997827

Last Thursday, HP CEO Enrique Lores addressed the company’s controversial practice of bricking printers when users load them with third-party ink. Speaking to CNBC Television, he said, “We have seen that you can embed viruses in the cartridges. Through the cartridge, [the virus can] go to the printer, [and then] from the printer, go to the network.”

That frightening scenario could help explain why HP, which was hit this month with another lawsuit over its Dynamic Security system, insists on deploying it to printers.

Dynamic Security stops HP printers from functioning if an ink cartridge without an HP chip or HP electronic circuitry is installed. HP has issued firmware updates that block printers with such ink cartridges from printing, leading to the above lawsuit (PDF), which is seeking class-action certification. The suit alleges that HP printer customers were not made aware that printer firmware updates issued in late 2022 and early 2023 could result in printer features not working. The lawsuit seeks monetary damages and an injunction preventing HP from issuing printer updates that block ink cartridges without an HP chip.

But are hacked ink cartridges something we should actually be concerned about?

To investigate, I turned to Ars Technica Senior Security Editor Dan Goodin. He told me that he didn’t know of any attacks actively used in the wild that are capable of using a cartridge to infect a printer.

Goodin also put the question to Mastodon, and cybersecurity professionals, many with expertise in embedded-device hacking, were decidedly skeptical.

Another commenter, going by Graham Sutherland / Polynomial on Mastodon, referred to serial presence detect (SPD) electrically erasable programmable read-only memory (EEPROM), a form of flash memory used extensively in ink cartridges, saying:

I’ve seen and done some truly wacky hardware stuff in my life, including hiding data in SPD EEPROMs on memory DIMMs (and replacing them with microcontrollers for similar shenanigans), so believe me when I say that his claim is wildly implausible even in a lab setting, let alone in the wild, and let alone at any scale that impacts businesses or individuals rather than selected political actors.

HP’s evidence

Unsurprisingly, Lores’ claim comes from HP-backed research. The company’s bug bounty program tasked researchers from Bugcrowd with determining if it’s possible to use an ink cartridge as a cyberthreat. HP argued that ink cartridge microcontroller chips, which are used to communicate with the printer, could be an entryway for attacks.

As detailed in a 2022 article from research firm Actionable Intelligence, a researcher in the program found a way to hack a printer via a third-party ink cartridge. The researcher was reportedly unable to perform the same hack with an HP cartridge.

Shivaun Albright, HP’s chief technologist of print security, said at the time:

A researcher found a vulnerability over the serial interface between the cartridge and the printer. Essentially, they found a buffer overflow. That’s where you have got an interface that you may not have tested or validated well enough, and the hacker was able to overflow into memory beyond the bounds of that particular buffer. And that gives them the ability to inject code into the device.

Albright added that the malware “remained on the printer in memory” after the cartridge was removed.

HP acknowledges that there’s no evidence of such a hack occurring in the wild. Still, because chips used in third-party ink cartridges are reprogrammable (their “code can be modified via a resetting tool right in the field,” according to Actionable Intelligence), they’re less secure, the company says. The chips are said to be programmable so that they can still work in printers after firmware updates.

HP also questions the security of third-party ink companies’ supply chains, especially compared to its own supply chain security, which is ISO/IEC-certified.

So HP did find a theoretical way for cartridges to be hacked, and it’s reasonable for the company to issue a bug bounty to identify such a risk. But its solution for this threat was announced before it showed there could be a threat. HP added ink cartridge security training to its bug bounty program in 2020, and the above research was released in 2022. HP started using Dynamic Security in 2016, ostensibly to solve the problem that it sought to prove exists years later.

Further, there’s a sense from cybersecurity professionals that Ars spoke with that even if such a threat exists, it would take a high level of resources and skills, which are usually reserved for targeting high-profile victims. Realistically, the vast majority of individual consumers and businesses shouldn’t have serious concerns about ink cartridges being used to hack their machines.

https://arstechnica.com/?p=1997422

European Union regulators intend to block Amazon’s attempt to purchase Roomba-maker iRobot, The Wall Street Journal reported yesterday.

European Commission competition officials “met Thursday with representatives from Amazon to discuss the deal,” the Journal wrote, citing people familiar with the matter. “Amazon was told during the meeting that the deal was likely to be rejected,” according to one of the Journal’s sources.

Amazon announced the $1.7 billion deal in August 2022. The EC has a February 14 deadline to reach a decision. European officials have said that Amazon could restrict the availability of Roomba rivals on the Amazon online retail store.

A move to block the iRobot purchase “would still need formal approval from the commission’s 27 top political leaders before a final decision can be issued,” the WSJ article said. “Historically, that process is unlikely to overrule a recommendation from the bloc’s competition commissioner, Margrethe Vestager.”

Amazon declined to comment when contacted by Ars today but pointed us toward a statement by lobby group Computer & Communications Industry Association (CCIA). “If the objective is to have more competition in the home robotics sector, this makes no sense,” CCIA President Matt Schruers said. “There is no plausible risk to competition from a US retailer acquiring a struggling US vacuum maker in a sector overtaken by dynamic Chinese manufacturers. Blocking this deal may well leave consumers with fewer options, and regulators cannot sweep that fact under the rug.”

EC told Amazon deal may restrict competition

In November 2023, the EC announced that it had “informed Amazon of its preliminary view that its proposed acquisition of iRobot may restrict competition in the market for robot vacuum cleaners.” The EC sent a statement of objections, a formal step in the process that could lead to a merger being blocked.

“Amazon may have the ability and the incentive to foreclose iRobot’s rivals,” the EC’s November statement said. The regulatory body said that Amazon could punish rival sellers of robot vacuum cleaners (RVCs) on its online store.

Possible Amazon tactics cited by the EC included “delisting rival RVCs; reducing visibility of rival RVCs in both non-paid (i.e., organic) and paid results (i.e., advertisements) displayed in Amazon’s marketplace; limiting access to certain widgets (e.g. ‘other products you may like’) or certain commercially attractive product labels (e.g. ‘Amazon’s choice’ or ‘Works With Alexa’); and/or directly or indirectly raising the costs of iRobot’s rivals to advertise and sell their RVCs on Amazon’s marketplace.”

Last week, Amazon missed a deadline to offer European officials remedies to address their concerns about the deal’s impact on competition.

As of this writing, iRobot’s stock price was down about 27 percent today. Amazon’s stock price was up around 1 percent.

https://arstechnica.com/?p=1997448

Fujitsu software bugs that helped send innocent postal employees to prison in the UK were known “right from the very start of deployment,” a Fujitsu executive told a public inquiry today.

“All the bugs and errors have been known at one level or not, for many, many years. Right from the very start of deployment of the system, there were bugs and errors and defects, which were well-known to all parties,” said Paul Patterson, co-CEO of Fujitsu’s European division.

That goes back to 1999, when the Horizon software system was installed in post offices by Fujitsu subsidiary International Computers Limited. From 1999 to 2015, Fujitsu’s faulty accounting software aided in the prosecution and conviction of more than 900 sub-postmasters and postmistresses who were accused of theft or fraud when the software wrongly made it appear that money was missing from their branches.

Some innocent people went to prison, while others were forced to make payments to the UK Post Office to cover the supposed shortfalls. So far, “only 93 convictions have been overturned and thousands of people are still waiting for compensation settlements,” a BBC report said.

Post Office lawyers rewrote Fujitsu witness statements

During the prosecutions, courts hearing cases against postal employees “were not told of 29 bugs identified as early as 1999 in the system it built,” The Guardian wrote in a summary of Patterson’s testimony today. The article said:

When bugs were acknowledged, witness statements from Fujitsu staff due to be heard in court were then edited by the Post Office as it sought to maintain the line that the system was working well as it pursued innocent people through the courts.

Paul Patterson agreed that both organizations had failed the accused. “I am surprised that that detail was not included in the witness statements given by Fujitsu staff to the Post Office and I have seen some evidence of editing witness statements by others,” he said.

Asked by the lead counsel of the public inquiry, Jason Beer KC, whether he agreed that this was shameful, Patterson, who has worked at the company for 14 years, said: “That would be one word I would use. Shameful and appalling. My understanding of how our laws work in this country, is that all of the evidence should have been put in front of the subpostmasters that the Post Office was relying on to prosecute them.”

A Financial Times article said that the public inquiry “heard in December last year that the Post Office’s lawyers had rewritten Fujitsu witness statements.”

The FT article also said the Post Office, which used prosecution powers available to private corporations in the UK, obtained 700 of the 900 convictions. The other convictions came in cases brought by Scottish prosecutors. The scandal may lead to reforms of the private prosecution system that lets organizations take people to court.

Bugs were understood “way back to 1999”

Earlier this week, Patterson told UK Parliament members that “Fujitsu would like to apologize for our part in this appalling miscarriage of justice. We were involved from the very start. We did have bugs and errors in the system and we did help the Post Office in their prosecutions of the sub-postmasters. For that we are truly sorry.”

Patterson also told Parliament members that Fujitsu has “a moral obligation” to contribute to the compensation for victims.

Patterson testified today in a different setting, answering questions from lawyers representing victims. One of those lawyers, Flora Page, asked Patterson, “Did nobody historically make that pretty obvious connection between very poor code going out into operation and then very poor data coming out and through the litigation support service?”

Patterson answered, “Whether people made that connection or not, what is very evident… is that that connection and understanding about what was going on and where was it, was understood by certainly Fujitsu and certainly understood by Post Office way back to 1999. It’s all about what you do with that information… that is a question for this inquiry.”

Post Office Minister Kevin Hollinrake, the MP for Thirsk and Malton, told the BBC that his “number one priority” is to “try and get compensation and get answers for people.”

“You’ve had marriages fail, people commit suicide, an horrendous impact on people’s lives,” he said. “It’s perfectly reasonable that the public should demand people are held to account and that should mean criminal prosecutions wherever possible.” The UK government also has plans for a new law to “swiftly exonerate and compensate” people who were falsely convicted.

https://arstechnica.com/?p=1997397

The Supreme Court on Wednesday heard arguments for overturning the so-called Chevron doctrine, one of the most important principles guiding federal regulation for the past 40 years.

The doctrine, named for a 1984 court case involving Environmental Protection Agency air pollution rules, has been high on the agenda of right-wing groups for years. It holds that when the meaning of a law is disputed, the federal agency’s interpretation should be given deference as long as it is reasonable. Environmental groups fear that overturning the precedent will make it easier for courts to block new pollution regulations, especially those addressing climate change.

The cases heard on Wednesday, Loper Bright Enterprises v. Raimondo, and Relentless, Inc. v. Department of Commerce, take on rules put into place in 2020 that require industry-funded federal observers aboard vessels in the northern Atlantic fishing for herring.

The small school fish are key to the northern Atlantic’s food web and fishing economy. The federal rules to monitor and prevent overfishing of Atlantic herring have been bolstered in recent years, in part to address the strain on the fishery due to warming waters.

Paul Clement, a titan among conservative appellate litigators, and lawyers from the Cause of Action Institute, one of the nonprofit groups in the large libertarian advocacy network built by petrochemical billionaire Charles Koch, portrayed the fight over the Chevron doctrine in this case as a David vs. Goliath battle.

“This case well illustrates the real-world costs of Chevron, which do not fall exclusively on the Chevrons of the world, but injure small businesses and individuals,” Clement told the court. “For my clients, having to carry federal observers on board is a burden, but having to pay their salaries is a crippling blow.”

In fact, as the federal government noted in its briefs, the National Oceanic and Atmospheric Administration was able to reimburse the fishing operations for 100 percent of monitoring costs in the two years since the rules went into effect, an amount totaling about $30,000. But such details did not come up in the arguments before the high court, nor were they likely to; the justices decided last year to limit their consideration of the cases to the sole question of whether the Chevron precedent should be limited or overturned.

Potential shock to the legal system

Chevron is probably the most important, and certainly the most-cited precedent, in all of administrative law, according to scholars on both sides of this dispute. The Biden administration’s chief litigator before the Supreme Court, Solicitor General Elizabeth Prelogar, argued that Chevron should be upheld and predicted grave consequences if it is overturned.

There are “thousands of decisions that could stand to be displaced and create chaos if Chevron is overruled,” Prelogar told the court. She said it would cause “an unwarranted shock to the legal system.”

https://arstechnica.com/?p=1996932

JUST OVER A DECADE AGO, Bitcoin appeared to many of its adherents to be the crypto-anarchist holy grail: truly private digital cash for the Internet.

Satoshi Nakamoto, the cryptocurrency’s mysterious and unidentifiable inventor, had stated in an email introducing Bitcoin that “participants can be anonymous.” And the Silk Road dark-web drug market seemed like living proof of that potential, enabling the sale of hundreds of millions of dollars in illegal drugs and other contraband for bitcoin while flaunting its impunity from law enforcement.

This is the story of the revelation in late 2013 that Bitcoin was, in fact, the opposite of untraceable—that its blockchain would actually allow researchers, tech companies, and law enforcement to trace and identify users with even more transparency than the existing financial system. That discovery would upend the world of cybercrime. Bitcoin tracing would, over the next few years, solve the mystery of the theft of a half-billion dollar stash of bitcoins from the world’s first crypto exchange, help enable the biggest dark-web drug market takedown in history, lead to the arrest of hundreds of pedophiles around the world in the bust of the dark web’s largest child sexual abuse video site, and result in the first-, second-, and third-biggest law enforcement monetary seizures in the history of the US Justice Department.

That 180-degree flip in the world’s understanding of cryptocurrency’s privacy properties, and the epic game of cat-and-mouse that followed, is the larger saga that unfolds in the book Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency, out this week in paperback.

All of it began with the work of a young, puzzle-loving mathematician named Sarah Meiklejohn, the first researcher to pull out traceable patterns in the apparent noise of Bitcoin’s blockchain. This excerpt from Tracers in the Dark reveals how Meiklejohn came to the discoveries that would launch that new era of crypto criminal justice.

IN EARLY 2013, the shelves of a windowless storage room in a building of the University of California, San Diego, began to fill up with strange, seemingly random objects. A Casio calculator. A pair of alpaca wool socks. A small stack of Magic: The Gathering cards. A Super Mario Bros. 3 cartridge for the original Nintendo. A plastic Guy Fawkes mask of the kind popularized by the hacker group Anonymous. An album by the classic rock band Boston on CD.

Periodically, the door would open, the light would turn on, and a petite, dark-haired graduate student named Sarah Meiklejohn would enter the room and add to the growing piles of miscellaneous artifacts. Then Meiklejohn would walk back out the door, down the hall, up the stairs, and into an office she shared with other graduate students at the UC San Diego computer science department. One wall of the room was almost entirely glass, and it looked out onto the sunbaked vista of Sorrento Valley and the rolling hills beyond. But Meiklejohn’s desk faced away from that expanse. She was wholly focused on the screen of her laptop, where she was quickly becoming one of the strangest, most hyperactive Bitcoin users in the world.

Meiklejohn had personally purchased every one of the dozens of items in the bizarre, growing collection in the UCSD closet using bitcoin, buying each one almost at random from a different vendor who accepted the cryptocurrency. And between those ecommerce orders and trips to the storage room, she was performing practically every other task that a person could carry out with bitcoin, all at once, like a kind of cryptocurrency fanatic having a manic episode.

She moved money into and out of 10 different bitcoin wallet services and converted dollars to bitcoins on more than two dozen exchanges such as Bitstamp, Mt. Gox, and Coinbase. She wagered those coins on 13 different online gambling services, with names like Satoshi Dice and Bitcoin Kamikaze. She contributed her computer’s mining power to 11 different mining “pools,” groups that collected users’ computing power for mining bitcoins and then paid them a share of the profits. And, again and again, she moved bitcoins into and then out of accounts on the Silk Road, the first-ever dark-web drug market, without ever actually buying any drugs.

In all, Meiklejohn carried out 344 cryptocurrency transactions over the course of a few weeks. With each one, she carefully noted on a spreadsheet the amount, the Bitcoin address she had used for it, and then, after digging up the transaction on the Bitcoin blockchain and examining the public record of the payment, the address of the recipient or sender.

Meiklejohn’s hundreds of purchases, bets, and seemingly meaningless movements of money were not, in fact, signs of a psychotic break. Each was a tiny experiment, adding up to a study of a kind that had never been attempted before. After years of claims about Bitcoin’s anonymity—or lack thereof—made by its users, its developers, and even its creator, Meiklejohn was finally putting its privacy properties to the test.

All of her meticulous, manual transactions were time-consuming and tedious. But Meiklejohn had time to kill: As she was carrying them out and recording the results, her computer was simultaneously running queries on a massive database stored on a server that she and her fellow UCSD researchers had set up, algorithms that sometimes took as long as 12 hours to spit out results. The database represented the entire Bitcoin blockchain, the roughly 16 million transactions that had occurred across the entire Bitcoin economy since its creation four years earlier. For weeks on end, Meiklejohn combed through those transactions while simultaneously tagging the vendors, services, markets, and other recipients on the other end of her hundreds of test transactions.

When she had started that process of probing the Bitcoin ecosystem, Meiklejohn had seen her work almost as anthropology: What were people doing with bitcoin? How many of them were saving the cryptocurrency versus spending it? But as her initial findings began to unfold, she had started to develop a much more specific goal, one that ran exactly counter to crypto-anarchists’ idealized notion of bitcoin as the ultimate privacy-preserving currency of the dark web: She aimed to prove, beyond any doubt, that bitcoin transactions could very often be traced. Even when the people involved thought they were anonymous.

https://arstechnica.com/?p=1996584

A chapter in the ongoing Epic v. Apple court case closed yesterday when the US Supreme Court declined to hear further arguments from either company. This decision leaves the case where it was after the 9th Circuit Court of Appeals ruled on it in April 2023.

The main issue at hand—to summarize days of arguments and multiple lengthy, technical court rulings in a couple of sentences—was whether Apple could continue to collect the 15–30 percent cut that it takes of all App Store purchases on its platforms and in-app purchases and subscriptions bought inside of those apps. The rulings, largely seen as victories for Apple, didn’t open iOS or iPadOS up to third-party app stores or app sideloading as Epic had originally sought. However, the rulings established that Apple’s so-called “anti-steering” rules—language prohibiting developers from mentioning cheaper or alternative purchasing options that might be available outside of an app—were anticompetitive.

Apple has updated its App Store rules to allow developers to provide external links to other payment options, technically circumventing its normal fee structure. But they come with many extra conditions that developers have to meet. And instead of paying Apple a 15 or 30 percent cut, Apple will collect a 12–27 percent commission. After factoring in the fees from whatever non-Apple payment processor these developers decide to use, the revenue they give up will remain essentially unchanged.

Apple is still taking a cut

The new rules, which apply only to the US App Store, cover something Apple calls a StoreKit External Purchase Link Entitlement. This entitlement comes with a long list of additional requirements, which Apple says are “designed to help protect people’s privacy and security, prevent scams and fraudulent activity, and maintain the overall quality of the user experience.”

Most notably, external links must adhere to Apple’s “design and language requirements,” cannot “mimic Apple’s in-app purchase system,” and can only be displayed in one place in your app. Developers still can’t include language about going directly to their websites for a discounted rate. And whenever users click the external purchase link in your app, they’ll be shown a full-page warning screen explaining that Apple is not responsible for the site’s privacy or security and that you won’t be able to use your Apple account to manage purchases or subscriptions.

Developers who don’t get approval from Apple won’t be able to use this link entitlement and will be subject to the same rules and restrictions around external purchasing links as before. Developers who offer external purchasing links will also be required to offer standard in-app purchasing through Apple, and developers “may not discourage end-users from making in-app purchases.”

The new commission reporting requirements may be even more onerous, particularly for small developers. In short, devs who would have owed Apple 15 percent of any in-app purchases will owe Apple a 12 percent commission on any in-app purchases made using a third-party site. Developers who would have owed Apple a 30 percent cut will owe a 27 percent commission instead. Apple says that these commissions “account for the substantial value Apple provides developers, including in facilitating linked transactions.”

To put these rates in context, payment processors generally take a small percentage of all online transactions, plus a small fixed fee. Square and Stripe, to pick two prominent examples, take 2.9 percent of every sale plus an additional 30 cents (NerdWallet has a good comparative list).

Depending on what a developer is charging for in-app purchases, this could work out to a little under 3 percent or substantially more than 3 percent. Regardless, most developers would struggle to take home more money than they do by using Apple’s built-in payment system, especially once you factor in overhead for complying with Apple’s filing requirements. Developers will be required to file monthly transaction reports with Apple, and they will be invoiced based on those reports. Apple will charge interest on late payments, and if the company ever “develops an API to facilitate reporting,” developers will be required to add support in their apps within 30 days.

Developers who attempt to circumvent any of Apple’s requirements can have their apps removed and developer accounts suspended at Apple’s discretion.

The way Apple has structured this link entitlement is similar to a hypothetical suggested by Judge Yvonne Gonzalez Rogers in the original Epic v. Apple ruling.

“Even in the absence of [in-app purchases,] Apple could still charge a commission on developers. It would simply be more difficult for Apple to collect that commission,” Rodriguez writes, before continuing in a footnote. “In such a hypothetical world, developers could potentially avoid the commission while benefitting from Apple’s innovation and intellectual property free of charge. The Court presumes that in such circumstances that Apple may rely on imposing and utilizing a contractual right to audit developers’ annual accounting to ensure compliance with its commissions, among other methods. Of course, any alternatives to IAP (including the foregoing) would seemingly impose both increased monetary and time costs to both Apple and the developers.”

Regardless of Apple’s intent, it seems clear that most developers will continue on the path of least resistance: use Apple’s first-party in-app payment system, which rolls Apple’s commission fees and payment processing fees up into a flat 15–30 percent payment, doesn’t come with the same restrictions or warnings as Apple’s External Purchase Link Entitlement system, and doesn’t require the same amount of administrative overhead.

And the new rules may open up another chapter in the Epic v. Apple saga. Epic CEO Tim Sweeney called the new rules a “bad-faith compliance plan” and vowed to contest them in district court.

https://arstechnica.com/?p=1996686