A Utah high school student, Hannah Zoulek, has joined a lawsuit, fighting to block Utah’s vague social media law from taking effect on March 1.

The Social Media Regulation Act requires platforms to verify user ages and then obtain parental consent for minors under 18 to maintain accounts. Once granted access to platforms, minors must be blocked from search results, and no ads can be displayed on their account. Platforms granting access will accept liability for designing any features that the state considers to be addicting or harmful to minors. The law also imposes a curfew blocking minors from accessing platforms between 10:30 pm and 6:30 am.

Because the law “fails to define what constitutes ‘physical, mental, emotional, developmental, or material harms,’ or what degree of harm gives rise to liability,” platforms are left to “guess as to what behavior crosses the line,” the complaint said. A platform may be ruled to be causing harm if a teenager gets a headache after scrolling for too long or becomes upset after friends don’t like a selfie, the complaint said, “nobody knows.”

All of this, the lawsuit alleges, “creates a vague and virtually unlimited form of ‘addiction’ liability (where harm is presumed) that will vastly curtail the available online spaces for teens.” Many platforms might restrict minor access entirely to avoid “crushing civil penalties.” That includes a fine of $250,000 for each feature found to cause addiction, as well as up to $2,500 per minor found to be harmed.

“The vagueness means state officials (and even private plaintiffs) possess unlimited subjective discretion to decide whether a provider’s content publication practices cross the line,” the lawsuit said.

Social media law is “well-intentioned” but “misguided”

Zoulek is a queer-identifying high school student who uses social media to communicate with other members of their school’s robotics club, as well as with friends and “other communities to which they would not otherwise have access,” the complaint said. They sometimes use a cane and have consulted social media forums like Reddit in the past to answer questions about disability access when traveling to unknown places.

In a joint statement with attorneys at the Foundation for Individual Rights in Education (FIRE), Zoulek said that they’re concerned that the state is “making it harder to talk with people who have similar experiences” and that the law “just makes it even more difficult” for teens to access beneficial resources online.

Before the Social Media Regulation Act was passed, Zoulek testified before the Utah House Judiciary Committee, “citing their concerns about the law’s infringement on teens’ speech and ability to discuss important issues such as mental health.” Despite testimony from opposing stakeholders, lawmakers pushed the law through, after Utah Attorney General Sean Reyes—charged with enforcement and a defendant in the lawsuit—said that “positive aspects of social media” do not outweigh “substantial evidence” of “extremely harmful” effects of usage.

Reyes’ office declined Ars’ request to comment.

Zoulek’s lawsuit pointed out that the US surgeon general, in a 2023 advisory, said that “due to major gaps in research,” “it is impossible to generalize the effects” of minors’ social media use as either extremely positive or negative.

“Different children and adolescents are affected by social media in different ways, based on their individual strengths and vulnerabilities, and based on cultural, historical, and socio-economic factors,” the advisory concluded.

This law is “well-intentioned” but “misguided,” the complaint said. By striving to protect some minors under certain circumstances from becoming addicted to or harmed by social media, Utah risks unconstitutionally suppressing youth speech while gathering sensitive data on minors and potentially blocking access to resources and experiences shown to be beneficial to mental health.

“Some research suggests that the isolation that results from disconnecting teens from social media may be more harmful to their self-esteem and well-being than is heavy use of social media,” the complaint said.

https://arstechnica.com/?p=1996850

Lobbyists for cable companies and advertisers yesterday expressed their displeasure with a proposed “click-to-cancel” regulation that aims to make it easier for consumers to cancel services.

Federal Trade Commission Chair Lina Khan has said that changes are needed because “some businesses too often trick consumers into paying for subscriptions they no longer want or didn’t sign up for in the first place.” The FTC proposed the new set of rules in March 2023, and comments from industry groups were taken yesterday in a hearing presided over by an administrative law judge.

NCTA-The Internet & Television Association, the primary trade group for cable companies like Comcast and Charter, said the rule would make it harder to offer deals to customers who are trying to cancel.

“The proposed simple click-to-cancel mechanism may not be so simple when such practices are involved. A consumer may easily misunderstand the consequences of canceling and it may be imperative that they learn about better options,” NCTA CEO Michael Powell said at the hearing. For example, a customer “may face difficulty and unintended consequences if they want to cancel only one service in the package,” as “canceling part of a discounted bundle may increase the price for remaining services.”

Powell said that cable company reps can usually talk customers out of canceling. “Out of millions of cancellations, complaints received by NCTA members amount to only a tiny fraction of 1 percent,” he said. “Three out of four of the cable and broadband customers who called to cancel end up retaining some or all service after speaking with an agent.”

Powell worries that retaining customers will become tougher because, he said, the FTC “proposal prevents almost any communication without first obtaining a consumer’s unambiguous, affirmative consent. That could disrupt the continuity of important services, choke off helpful information and forgo potential savings. It certainly raises First Amendment issues.”

Powell also said the cost of complying—including retraining employees and maintaining records for longer than current practice—could force cable companies to raise prices. He claimed that the FTC’s estimate of compliance costs is too low.

FTC: Sellers must take “no” for an answer

The FTC said one of its proposed rules “would require businesses to make it at least as easy to cancel a subscription as it was to start it. For example, if you can sign up online, you must be able to cancel on the same website, in the same number of steps.”

Sellers would also have to obtain customer consent before they “pitch additional offers or modifications when a consumer tries to cancel their enrollment,” the FTC said. Before making those pitches, sellers would have to “ask consumers whether they want to hear them. In other words, a seller must take ‘no’ for an answer and upon hearing ‘no’ must immediately implement the cancellation process.”

The FTC also proposes that sellers be required to “provide an annual reminder to consumers enrolled in negative option programs involving anything other than physical goods, before they are automatically renewed.”

At yesterday’s hearing, the FTC also heard from the Interactive Advertising Bureau (IAB), a lobby group for the online advertising industry. “The proposed rule would disrupt the current regime by adding specific requirements dictating what auto-renewal disclosures must say and how they must be presented,” said Lartease Tiffith, the IAB’s executive VP for public policy.

Tiffith argued that the rule will burden businesses “and restrict innovation without any corresponding benefit. And as the technology develops, these prescriptive requirements will constrain companies from being able to adapt their offerings to the needs of their customers.”

Tiffith defended auto-renewals generally, saying the practice of automatically renewing services brings “significant benefits to both businesses and consumers in the form of cost savings, convenience, and heightened value.”

https://arstechnica.com/?p=1996827

Content creators have spent the past five years developing new tactics to evade YouTube’s policies blocking monetization of videos making false claims about climate change, a report from a nonprofit advocacy group, the Center for Countering Digital Hate (CCDH), warned Tuesday.

What the CCDH found is that content creators who could no longer monetize videos spreading “old” forms of climate denial—including claims that “global warming is not happening” or “human-generated greenhouse gasses are not causing global warming”—have moved on.

Now they’re increasingly pushing other claims that contradict climate science, which YouTube has not yet banned and may not ever ban. These include harmful claims that “impacts of global warming are beneficial or harmless,” “climate solutions won’t work,” and “climate science and the climate movement are unreliable.”

The CCDH uncovered these new climate-denial tactics by using artificial intelligence to scan transcripts of 12,058 videos posted on 96 YouTube channels that the CCDH found had previously posted climate-denial content. Verified by researchers, the AI model used was judged accurate in labeling climate-denial content approximately 78 percent of the time.

According to the CCDH’s analysis, the amount of content disputing climate solutions, climate science, and impacts of climate change today comprises 70 percent of climate-denial content—a percent that doubled from 2018 to 2023. At the same time, the amount of content pushing old climate-denial claims that are harder or impossible to monetize fell from 65 percent in 2018 to 30 percent in 2023.

These “new forms of climate denial,” the CCDH warned, are designed to delay climate action by spreading disinformation.

“A new front has opened up in this battle,” Imran Ahmed, the CCDH’s chief executive, said on a call with reporters, according to Reuters. “The people that we’ve been looking at, they’ve gone from saying climate change isn’t happening to now saying, ‘Hey, climate change is happening, but there is no hope. There are no solutions.'”

Since 2018—based on “estimates of typical ad pricing on YouTube” by social media analytics tool Social Blade—YouTube may have profited by as much as $13.4 million annually from videos flagged by the CCDH. And YouTube confirmed that some of these videos featured climate denialism that YouTube already explicitly bans.

In response to the CCDH’s report, YouTube de-monetized some videos found to be in violation of its climate change policy. But a spokesperson confirmed to Ars that the majority of videos that the CCDH found were considered compliant with YouTube’s ad policies.

The fact that most of these videos remain compliant is precisely why the CCDH is calling on YouTube to update its policies, though.

Currently, YouTube’s policy prohibits monetization of content “that contradicts well-established scientific consensus around the existence and causes of climate change.”

“Our climate change policy prohibits ads from running on content that contradicts well-established scientific consensus around the existence and causes of climate change,” YouTube’s spokesperson told Ars. “Debate or discussions of climate change topics, including around public policy or research, is allowed. However, when content crosses the line to climate change denial, we stop showing ads on those videos. We also display information panels under relevant videos to provide additional information on climate change and context from third parties.”

The CCDH worries that YouTube standing by its current policy is too short-sighted. The group recommended tweaking the policy to instead specify that YouTube prohibits content “that contradicts the authoritative scientific consensus on the causes, impacts, and solutions to climate change.”

If YouTube and other social media platforms don’t acknowledge new forms of climate denial and “urgently” update their disinformation policies in response, these new attacks on climate change science “will only increase,” the CCDH warned.

“It is vital that those advocating for action to avert climate disaster take note of this substantial shift from denial of anthropogenic climate change to undermining trust in both solutions and science itself, and shift our focus, our resources and our counternarratives accordingly,” the CCDH’s report said, adding that “demonetizing climate-denial” content “removes the economic incentives underpinning its creation and protects advertisers from bankrolling harmful content.”

https://arstechnica.com/?p=1996433

Google is updating the warning on Chrome’s Incognito mode to make it clear that Google and websites run by other companies can still collect your data in the web browser’s semi-private mode.

The change is being made as Google prepares to settle a class-action lawsuit that accuses the firm of privacy violations related to Chrome’s Incognito mode. The expanded warning was recently added to Chrome Canary, a nightly build for developers. The warning appears to directly address one of the lawsuit’s complaints, that the Incognito mode’s warning doesn’t make it clear that Google collects data from users of the private mode.

Many tech-savvy people already know that while private modes in web browsers prevent some data from being stored on your device, they don’t prevent tracking by websites or Internet service providers. But many other people may not understand exactly what Incognito mode does, so the more specific warning could help educate users.

The new warning seen in Chrome Canary when you open an incognito window says: “You’ve gone Incognito. Others who use this device won’t see your activity, so you can browse more privately. This won’t change how data is collected by websites you visit and the services they use, including Google.” The wording could be interpreted to refer to Google websites and third-party websites, including third-party websites that rely on Google ad services.

The new warning was not yet in the developer, beta, and stable branches of Chrome as of today. It also wasn’t in Chromium. The change to Canary was previously reported by MSPowerUser.

“Now you can browse privately”

Incognito mode in the stable version of Chrome still says: “You’ve gone Incognito. Now you can browse privately, and other people who use this device won’t see your activity.” Among other changes, the Canary warning replaces “browse privately” with “browse more privately.”

The stable and Canary warnings both say that your browsing activity might still be visible to “websites you visit,” “your employer or school,” or “your Internet service provider.” But only the Canary warning currently includes the caveat that Incognito mode “won’t change how data is collected by websites you visit and the services they use, including Google.”

The old and new warnings both say that Incognito mode prevents Chrome from saving your browsing history, cookies and site data, and information entered in forms, but that “downloads, bookmarks and reading list items will be saved.” Both warnings link to this page, which provides more detail on Incognito mode.

We asked Google when the warning will be added to Chrome’s stable channel and whether the change is mandated by or related to the pending settlement of the privacy class-action suit. Google didn’t provide specific answers but offered this statement: “We’re pleased to resolve this case which we’ve long disputed, and provide even more information to users about Incognito mode. Incognito mode in Chrome will continue to give people the choice to browse the Internet without their activity being saved to their browser or device.”

The litigation in US District Court for the Northern District of California began in June 2020. On December 26, 2023, Google and the plaintiffs announced that they reached a settlement that they planned to present to the court for approval within 60 days. A jury trial was previously scheduled to begin on February 5.

https://arstechnica.com/?p=1996403

For the third time in less than a year, film studios with copyright infringement complaints against a cable Internet provider are trying to force Reddit to share information about users who have discussed piracy on the site.

In 2023, film companies lost two attempts to have Reddit unmask its users. In the first instance, US Magistrate Judge Laurel Beeler ruled in the US District Court for the Northern District of California that the First Amendment right to anonymous speech meant Reddit didn’t have to disclose the names, email addresses, and other account registration information for nine Reddit users. Film companies, including Bodyguard Productions and Millennium Media, had subpoenaed Reddit in relation to a copyright infringement lawsuit against Astound Broadband-owned RCN about subscribers allegedly pirating 34 movie titles, including Hellboy (2019), Rambo V: Last Blood, and Tesla.

In the second instance, the same companies sued Astound Broadband-owned ISP Grande, again for alleged copyright infringement occurring over the ISP’s network. The studios subpoenaed Reddit for user account information, including “IP address registration and logs from 1/1/2016 to present, name, email address, and other account registration information” for six Reddit users, per a July 2023 court filing.

In August, a federal court again quashed that subpoena, citing First Amendment rights. In her ruling, Beeler noted that while the First Amendment right to anonymous speech is not absolute, the film producers had already received the names of 118 Grande subscribers. She also said the film producers had failed to prove that “the identifying information is directly or materially relevant or unavailable from another source.”

Third piracy-related subpoena

This week, as reported by TorrentFreak, film companies Voltage Holdings, which are part of the previous two subpoenas, and Screen Media Ventures, another film studio with litigation against RCN, filed a motion to compel [PDF] Reddit to respond to the subpoena in the US District Court for the Northern District of California. The studios said they’re seeking the information concerning claims they’ve made that the “ability to pirate content efficiently without any consequences is a draw for becoming a Frontier subscriber” and that Frontier Communications “does not have an effective policy for terminating repeat infringers.” The film studios are claimants against Frontier in its bankruptcy case. The studios are represented by the same lawyers used in the two aforementioned cases.

The studios are asking that the court require Reddit to provide “IP address log information from 1/1/2017 to present” for six anonymous Reddit users who talked about piracy on Reddit. Although, Reddit posts shared in the court filing only date back to 2021.

Reddit responded to the studios’ subpoena with a letter [PDF] on January 2 stating that the subpoena “does not satisfy the First Amendment standard for disclosure of identifying information regarding an anonymous speaker.” Reddit also noted the two previously quashed subpoenas and suggested that it did not have to comply with the new request because the studios could acquire equivalent or better information elsewhere.

As with the previously mentioned litigation against ISPs, Reddit is a non-party. However, since the film companies claimed that Frontier had refused to produce customer identifying information and Reddit responded with a denial to the requests, the film companies filed their motion to compel.

The studios argue that the information requests do not implicate the First Amendment and that the rulings around the two aforementioned subpoenas are not applicable because the new subpoena is only about IP address logs and not other user-identifying information.

“The Reddit users do not have a recognized privacy interest in their IP addresses,” the motion says.

https://arstechnica.com/?p=1995738

The Environmental Protection Agency (EPA) is expanding its investigation into potential risks posed by lead-covered cables installed nationwide by major telecommunications companies, The Wall Street Journal revealed in an exclusive report Thursday.

After finding “more than 100 readings with elevated lead near cables,” the EPA sent letters to AT&T and Verizon in December, requesting a meeting later this month, the Journal revealed. On the agenda, the EPA expects the companies to share internal data on their own testing of the cables, as well as details from any “technical reports related to the companies’ testing and sampling,” the WSJ reported.

The EPA’s investigation was prompted by a WSJ report published last July, alleging that AT&T, Verizon, and other companies were aware that thousands of miles of cables could be contaminating soils throughout the US, “where Americans live, work and play,” but did nothing to intervene despite the many public health risks associated with lead exposure.

In that report, tests showed that the telecom cables were likely the source of lead contaminated soils because “the amount measured in the soil was highest directly under or next to the cables and dropped within a few feet.” WSJ also spoke to residents and former telecom employees in areas tested who had contracted illnesses commonly linked to lead exposure.

Immediately, WSJ’s report spurred lawmakers to demand a response from USTelecom—a telecommunications trade association representing companies accused—with Senator Ed Markey (D-Mass.) suggesting that telecom giants were seemingly committing “corporate irresponsibility of the worst kind.”

Since then, the EPA has followed up and developed “its own testing data” in West Orange, New Jersey, southwest Pennsylvania, and Louisiana—the same locations flagged by the WSJ. In all locations, the EPA found lead contamination exceeding the “current recommendation for levels of lead it believes are generally safe in soil where children play,” 400-parts-per-million, the WSJ reported. In West Orange, two testing sites found lead “at 3,300 parts per million or higher.”

According to the EPA, initial testing by a national working group led to a conclusion that none of these sites poses an immediate health risk or requires an emergency response, but that finding hasn’t stopped the probe. The EPA told the WSJ that it still needs to address unanswered questions to decide “whether further actions may be required to address risks from the lead-containing cables.”

“While some locations sampled show concentrations above screening levels for long term exposures, existing data is not sufficient to determine whether lead from the cables poses a threat, or a potential threat, to human health or the environment,” the EPA said in a Reuters report.

Companies maintain that evidence from their own testing has shown lead cables do not pose public health risks requiring remediation.

USTelecom, speaking on behalf of Verizon and other telecom companies, told the WSJ that “our industry has been engaging with the EPA and our companies look forward to meeting with the EPA to discuss agency and industry testing results. We will continue to follow the science, which has not identified that lead-sheathed telecom cables are a leading cause of lead exposure or the cause of a public health issue.”

AT&T told the WSJ that it “will continue to work collaboratively with the EPA as it undertakes its review of lead-clad telecommunications cables. We look forward to the opportunity to meet with the EPA to discuss recent testing and other evidence that contradicts the Wall Street Journal’s assertions.”

An EPA spokesperson, Nick Conger, told Bloomberg that there is no date set for the meeting yet.

https://arstechnica.com/?p=1995742

eBay has agreed to pay $3 million—the maximum criminal penalty possible—after employees harassed, intimidated, and stalked a Massachusetts couple in retaliation for their critical reporting of the online marketplace in 2019.

“Today’s settlement holds eBay criminally and financially responsible for emotionally, psychologically, and physically terrorizing the publishers of an online newsletter out of fear that bad publicity would adversely impact their Fortune 500 company,” Jodi Cohen, the special agent in charge of the Federal Bureau of Investigation Boston Division, said in a Justice Department press release Thursday.

eBay’s harassment campaign against the couple, David and Ina Steiner, stretched for 18 days in August 2019 and was led by the company’s former senior director of safety and security, Jim Baugh. It started when then-CEO Devin Wenig and then-chief communications officer Steven Wymer decided to “take down” the Steiners after growing frustrated with their coverage of eBay in a newsletter called EcommerceBytes.

Executing the “take down,” Baugh and six co-conspirators “put the victims through pure hell,” acting US attorney Joshua S. Levy wrote in the DOJ’s press release.

The former eBay employees turned the Steiners’ world “upside-down through a never-ending nightmare of menacing and criminal acts,” Levy said. That included “sending anonymous and disturbing deliveries,” such as “a book on surviving the death of a spouse, a bloody pig mask, a fetal pig and a funeral wreath and live insects,” the DOJ said. The intimidation also included publishing a series of “Craigslist posts inviting the public for sexual encounters at the victims’ home.”

But the intimidation did not stop there. After sending tweets and DMs threatening to visit the couple’s home, former eBay employees escalated the criminal activity by traveling to Massachusetts and installing a GPS tracker on the Steiners’ car. Spotting their stalkers, the Steiners called local police, who coordinated with the FBI to investigate what Levy called an “unprecedented stalking campaign” fueled by eBay’s toxic corporate culture.

Once police got involved, the former eBay employees tried to cover their tracks. Baugh and his team falsified records and deleted evidence to throw the cops “off the trail,” the DOJ said. Baugh was also caught making false statements to police and internal investigators and subsequently became the first eBay employee involved who was imprisoned in 2022 for “terrorizing innocent people,” Levy said.

In a press release, eBay confirmed that the company admitted to all the relevant facts that law enforcement uncovered in the case.

“The company’s conduct in 2019 was wrong and reprehensible,” said Jamie Iannone, eBay’s CEO. “From the moment eBay first learned of the 2019 events, eBay cooperated fully and extensively with law enforcement authorities. We continue to extend our deepest apologies to the Steiners for what they endured.”

Cohen acknowledged that the settlement “cannot erase the significant distress this couple suffered” but said that the DOJ hopes slapping eBay with the maximum fine “will deter others from engaging in similar conduct.”

“No one should ever feel unsafe in their own home,” Cohen said.

Ars could not immediately reach the Steiners’ lawyer for comment on the settlement.

Under eBay’s agreement with the DOJ, eBay must “retain an independent corporate compliance monitor” to ensure the company’s corporate culture never pushes employees to engage in such criminal conduct again.

All seven former eBay employees have been convicted on felony charges, the DOJ said. As the “ringleader,” Baugh was sentenced to 57 months in federal prison. Others have received prison sentences between 12 and 24 months. Two former employees were sentenced to a year of home confinement. One co-conspirator has pleaded guilty and is still awaiting sentencing.

In the end, the DOJ said that “eBay was charged criminally with two counts of stalking through interstate travel, two counts of stalking through electronic communications services, one count of witness tampering, and one count of obstruction of justice, and has entered into a deferred prosecution agreement.”

Through the deferred prosecution agreement, eBay must remain compliant and fully cooperate with the DOJ’s terms for three years. If that process is successful, the US attorney will “dismiss the criminal information against eBay.”

The DOJ announced criminal penalties during Stalking Awareness Month, when advocates work to raise awareness that stalking is a serious crime.

After taking responsibility for the misconduct of its former employee, eBay seems ready to put the harassment campaign in its past.

“Since these events occurred, new leaders have joined the company and eBay has strengthened its policies, procedures, controls and training,” eBay said. “eBay remains committed to upholding high standards of conduct and ethics and to making things right with the Steiners.”

https://arstechnica.com/?p=1995639

For those who trade in child sexual exploitation images and videos in the darkest recesses of the Internet, cryptocurrency has been both a powerful tool and a treacherous one. Bitcoin, for instance, has allowed denizens of that criminal underground to buy and sell their wares with no involvement from a bank or payment processor that might reveal their activities to law enforcement. But the public and surprisingly traceable transactions recorded in Bitcoin’s blockchain have sometimes led financial investigators directly to pedophiles’ doorsteps.

Now, after years of evolution in that grim cat-and-mouse game, new evidence suggests that online vendors of what was once commonly called “child porn” are learning to use cryptocurrency with significantly more skill and stealth—and that it’s helping them survive longer in the Internet’s most abusive industry.

Today, as part of an annual crime report, cryptocurrency tracing firm Chainalysis revealed new research that analyzed blockchains to measure the changing scale and sophistication of the cryptocurrency-based sale of child sexual abuse materials, or CSAM, over the past four years. Total revenue from CSAM sold for cryptocurrency has actually gone down since 2021, Chainalysis found, along with the number of new CSAM sellers accepting crypto. But the sophistication of crypto-based CSAM sales has been increasing. More and more, Chainalysis discovered, sellers of CSAM are using privacy tools like “mixers” and “privacy coins” that obfuscate their money trails across blockchains.

Perhaps because of that increased savvy, the company found that CSAM vendors active in 2023 persisted online—and evaded law enforcement—for a longer time than in any previous year, and about 57 percent longer than even in 2022. “Growing sophistication makes identification harder. It makes tracing harder, it makes prosecution harder, and it makes rescuing victims harder,” says Eric Jardine, the researcher who led the Chainalysis study. “So that sophistication dimension is probably the worst one you could see increasing over time.”

Better stealth, longer criminal lifespans

Scouring blockchains, Chainalysis researchers analyzed around 400 cryptocurrency wallets of CSAM sellers and more than 10,000 buyers who sent funds to them over the past four years. Their most disturbing finding in that broad economic study was that crypto-based CSAM sellers seem to have a longer lifespan online than ever, suggesting a kind of relative impunity. On average, CSAM vendors who were active in 2023 remained online for 884 days, compared with 560 days for those active in 2022 and just 112 days in 2020.

To explain that new longevity for some of the most harmful actors on the Internet, Chainalysis points to how CSAM vendors are increasingly laundering their proceeds with cryptocurrency mixers—services that blend users’ funds to make tracing more difficult—such as ChipMixer and Sinbad. (US and German law enforcement shut down ChipMixer in March 2023, but Sinbad remains online despite facing US sanctions for money laundering.) In 2023, Chainalysis found that about 46 percent of CSAM vendors used mixers, up from around 22 percent in 2020.

Chainalysis also found that CSAM vendors are increasingly using “instant exchanger” services that often collect little or no identifying information on traders and allow them to swap bitcoin for cryptocurrencies like Monero and Zcash—”privacy coins” designed to obfuscate or encrypt their blockchains to make tracing their cash-outs of profits far more difficult. Chainalysis’ Jardine says that Monero in particular seems to be gaining popularity among CSAM purveyors. In the company’s investigations, Chainalysis has seen it used repeatedly by CSAM sellers laundering funds through instant exchangers, and in multiple cases it has also seen CSAM forums post Monero addresses to solicit donations. While the instant exchangers did offer other cryptocurrencies, including the privacy coin Zcash, Chainalysis’ report states that “we believe Monero to be the currency of choice for laundering via instant exchangers.”

https://arstechnica.com/?p=1995594

Popular search engines like Google and Bing are making it easy to surface nonconsensual deepfake pornography by placing it at the top of search results, NBC News reported Thursday.

These controversial deepfakes superimpose faces of real women, often celebrities, onto the bodies of adult entertainers to make them appear to be engaging in real sex. Thanks in part to advances in generative AI, there is now a burgeoning black market for deepfake porn that could be discovered through a Google search, NBC News previously reported.

NBC News uncovered the problem by turning off safe search, then combining the names of 36 female celebrities with obvious search terms like “deepfakes,” “deepfake porn,” and “fake nudes.” Bing generated links to deepfake videos in top results 35 times, while Google did so 34 times. Bing also surfaced “fake nude photos of former teen Disney Channel female actors” using images where actors appear to be underaged.

A Google spokesperson told NBC that the tech giant understands “how distressing this content can be for people affected by it” and is “actively working to bring more protections to Search.”

According to Google’s spokesperson, this controversial content sometimes appears because “Google indexes content that exists on the web,” just “like any search engine.” But while searches using terms like “deepfake” may generate results consistently, Google “actively” designs “ranking systems to avoid shocking people with unexpected harmful or explicit content that they aren’t looking for,” the spokesperson said.

Currently, the only way to remove nonconsensual deepfake porn from Google search results is for the victim to submit a form personally or through an “authorized representative.” That form requires victims to meet three requirements: showing that they’re “identifiably depicted” in the deepfake; the “imagery in question is fake and falsely depicts” them as “nude or in a sexually explicit situation”; and the imagery was distributed without their consent.

While this gives victims some course of action to remove content, experts are concerned that search engines need to do more to effectively reduce the prevalence of deepfake pornography available online—which right now is rising at a rapid rate.

This emerging issue increasingly affects average people and even children, not just celebrities. Last June, child safety experts discovered thousands of realistic but fake AI child sex images being traded online, around the same time that the FBI warned that the use of AI-generated deepfakes in sextortion schemes was increasing.

And nonconsensual deepfake porn isn’t just being traded in black markets online. In November, New Jersey police launched a probe after high school teens used AI image generators to create and share fake nude photos of female classmates.

With tech companies seemingly slow to stop the rise in deepfakes, some states have passed laws criminalizing deepfake porn distribution. Last July, Virginia amended its existing law criminalizing revenge porn to include any “falsely created videographic or still image.” In October, New York passed a law specifically focused on banning deepfake porn, imposing a $1,000 fine and up to a year of jail time on violators. Congress has also introduced legislation that creates criminal penalties for spreading deepfake porn.

Although Google told NBC News that its search features “don’t allow manipulated media or sexually explicit content,” the outlet’s investigation seemingly found otherwise. NBC News also noted that Google’s Play app store hosts an app that was previously marketed for creating deepfake porn, despite prohibiting “apps determined to promote or perpetuate demonstrably misleading or deceptive imagery, videos and/or text.” This suggests that Google’s remediation efforts blocking deceptive imagery may be inconsistent.

Google told Ars that it will soon be strengthening its policies against apps featuring AI-generated restricted content in the Play Store. A generative AI policy taking effect on January 31 will require all apps to comply with developer policies that ban AI-generated restricted content, including deceptive content and content that facilitates the exploitation or abuse of children.

Experts told NBC News that “Google’s lack of proactive patrolling for abuse has made it and other search engines useful platforms for people looking to engage in deepfake harassment campaigns.”

Google is currently “in the process of building more expansive safeguards, with a particular focus on removing the need for known victims to request content removals one by one,” Google’s spokesperson told NBC News.

Microsoft’s spokesperson told Ars that they were looking into our request to comment. We will update this report with any new information that Microsoft shares.

In the past, Microsoft President Brad Smith has said that among all dangers that AI poses, deepfakes worry him most, but deepfakes fueling “foreign cyber influence operations” seemingly concern him more than deepfake porn.

This story was updated on January 11 to include information on Google’s AI-generated content policy.

https://arstechnica.com/?p=1995499

SpaceX is showing off the first text messages sent between T-Mobile phones via one of Starlink’s low Earth orbit satellites. “On Monday, January 8, the Starlink team successfully sent and received our first text messages using T-Mobile network spectrum through one of our new Direct to Cell satellites launched six days prior,” a Starlink update said.

SpaceX last week launched the first six Starlink satellites that can provide cellular transmissions to standard LTE phones. The service from what Starlink calls “cellphone towers in space” is expected to provide text messaging sometime this year for customers of T-Mobile in the US and carriers in other countries, with voice and data service beginning sometime in 2025.

SpaceX posted a photo of the two iPhones that exchanged the texts, which included messages such as “Such signal” and “Much wow.” The process that allowed those texts to be sent was pretty complicated, Starlink said.

“Connecting cell phones to satellites has several major challenges to overcome,” Starlink said. “For example, in terrestrial networks cell towers are stationary, but in a satellite network they move at tens of thousands of miles per hour relative to users on Earth. This requires seamless handoffs between satellites and accommodations for factors like Doppler shift and timing delays that challenge phone to space communications.”

Mobile phones have “low antenna gain and transmit power,” making it “incredibly difficult” to communicate with satellites hundreds of kilometers away, the company said. But Starlink’s new satellites “are equipped with innovative new custom silicon, phased array antennas, and advanced software algorithms that overcome these challenges and provide standard LTE service to cell phones on the ground.”

The satellite-to-phone service should work just about anywhere on the planet, but there would be no point in using it when you can connect to a ground-based cellular tower. As SpaceX CEO Elon Musk pointed out, the limited bandwidth means that “it is not meaningfully competitive with existing terrestrial cellular networks.”

T-Mobile said last week that field testing of Starlink satellites with the T-Mobile network will begin soon but did not announce a start date for actual service. T-Mobile said the Starlink connectivity will be useful in areas of the US where it has no coverage “due to terrain limitations, land-use restrictions,” and other factors.

https://arstechnica.com/?p=1995454