An international law enforcement operation shut down a “notorious hacker marketplace” that sold access to infected devices and stolen account credentials, the US Department of Justice and Europol announced today. The operation targeting Genesis Market involved 17 countries, seized the platform’s infrastructure, and resulted in “119 arrests, 208 property searches, and 97 knock-and-talk measures,” Europol said.

The now-shuttered Genesis Market “advertised and sold packages of account access credentials—such as usernames and passwords for email, bank accounts, and social media—that had been stolen from malware-infected computers around the world,” the Justice Department said. The so-called “Operation Cookie Monster” seized 11 domain names pursuant to a warrant authorized by the US District Court for the Eastern District of Wisconsin.

While Genesis Market’s public website was taken down, its .onion domain was still accessible on the dark web using Tor today. Law enforcement is apparently still looking for at least some of the people behind the platform, as the domain seizure message seeks tips from anyone who’s been in contact with Genesis Market administrators. The US Treasury Department said Genesis Market “is believed to be located in Russia.”

Europol said that “unlike other criminal marketplaces, Genesis Market was accessible on the open web, although obscured from law enforcement behind an invitation-only veil. Its accessibility and cheap prices greatly lowered the barrier of entry for buyers, making it a popular resource among hackers.”

Genesis Market reportedly had about 59,000 registered users. According to Europol, the market’s “main criminal commodity was digital identities” or “what the market owners referred to as ‘bots’ that had infected victims’ devices through malware or account takeovers.”

Operation Cookie Monster was led by the FBI and Dutch National Police, with coordination by Europol.

“Custom browser” mimicked victims’ devices

Genesis Market emerged in March 2018 and since then “has offered access to data stolen from over 1.5 million compromised computers around the world containing over 80 million account access credentials,” the Justice Department said.

Upon purchasing a bot from Genesis Market, “criminals would get access to all the data harvested by it such as fingerprints, cookies, saved logins and autofill form data,” Europol said. The cheapest bots sold for less than a dollar each but others fetched hundreds of dollars and provided access to online banking accounts.

Europol said that Genesis Market shoppers were “provided with a custom browser which would mimic the one of their victim,” letting them access victims’ accounts “without triggering any of the security measures from the platform the account was on. These security measures include recognizing a different log-in location, a different browser fingerprint or a different operating system.”

A Brian Krebs report described the Genesis offering as “a custom Web browser plugin which can load a Genesis bot profile so that the browser mimics virtually every important aspect of the victim’s device, from screen size and refresh rate to the unique user agent string tied to the victim’s web browser.”

The DOJ said it accessed Genesis Market’s user database. “The database contained the purchase and activity history on all users, which the feds say helped them uncover the true identities of many users,” Krebs wrote.

Three big takedowns in the past year

The Genesis Market takedown follows similar actions against Hydra Market in April 2022 and BreachForums in March 2023. The DOJ claims it has “dismantled the darknet’s largest marketplaces” due to those three operations over the last year.

The Justice Department said victim credentials obtained during Operation Cookie Monster were provided to HaveIBeenPwned.com, which helps you check whether you’ve been involved in a data breach.

The Treasury Office of Foreign Assets Control (OFAC) said it designated Genesis Market, meaning that “all property and interests in property of the entity that are in the United States or in the possession or control of US persons must be blocked and reported to OFAC.” Additionally, anyone who “engage[s] in certain transactions with the entity designated today may themselves be exposed to sanctions.”

https://arstechnica.com/?p=1929514

After Redditors called out a Virginia-based tech firm for posting an “illegal and nauseating” job ad—which specified that only white US-born citizens would be considered—Arthur Grand Technologies has deleted the ad and shut down its website and social media presence entirely.

The deleted job ad was posted on Indeed, seeking to hire a Dallas-based business analyst for a long-term contract. The ad included a note labeled “don’t share with candidates” that said that “Only US Born Citizens [White]” would be considered, inciting outrage that not only was the job listing giving preference to white candidates but that the company intended to hide these illegal criteria from applicants.

On Reddit, commenters encouraged applicants of every race and ethnicity to apply, then file a complaint with the Office of Federal Contract Compliance to report Arthur Grand and prompt an investigation into alleged discriminatory hiring practices violating federal law.

A LinkedIn post offers the company’s official statement responding to the controversy, claiming that a former employee “took an existing posting and added discriminatory language, then reposted it through his own account.” Arthur Grand said it is now pursuing legal action against that ex-employee.

However, Vice noted that Arthur Grand’s LinkedIn statement had been edited, and a screenshot seemingly showed that the company had previously stated that the job posting was published by a junior employee who was subsequently fired. Confusion remains over whether any Arthur Grand employees lost their jobs because of the posting. Indeed’s terms of service indicate that any employee posting on behalf of Arthur Grand would have been verified by the company, but it’s possible that a terminated employee still had access to a linked account to post the ad.

Ars could not immediately reach Arthur Grand to clarify who posted the job and whether any employees were terminated because of the job ad.

In the LinkedIn statement, Arthur Grand called the job ad “offensive,” saying that the company is “minority-owned” and did not authorize the Indeed posting. By the end of the statement, the message gets a little garbled, saying that Arthur Grand is being “very clear” about what happened and requesting no further “assumption comments or questions” in order “to avoid further chaos.”

On an archived version of Arthur Grand’s now-deleted website, the tech firm described itself as being committed to bringing “the best talent to provide services” to its clients. Some of those clients include government agencies like the Internal Revenue Service and the Department of Veterans Affairs, as well as commercial clients like Comcast, Capital One, Citi, and Fannie Mae.

The now-deleted job posting was intended to serve Arthur Grand’s clients HTC Global Services and Berkshire Hathaway Inc. Ars could not immediately reach either company for comment.

Because Arthur Grand has seemingly stopped responding to questions to “avoid chaos,” unanswered questions remain for Redditors who wonder whether the employee who posted the ad was “an employee at the time of the post?” One commenter, quasarbar, asked, “did someone post this not-to-be-shared info on purpose to expose” Arthur Grand’s hiring practices or did they post it “accidentally because they were mindlessly copy/pasting?”

https://arstechnica.com/?p=1929436

China’s antitrust regulator “is holding back its required green light for mergers that involve American companies as a technology war with Washington intensifies,” according to a Wall Street Journal report today. China’s State Administration for Market Regulation (SAMR) has asked companies seeking merger approvals to “make available in China products they sell in other countries—an attempt to counter the US’s increased export controls targeting China,” the report said.

“Chinese regulators recently have slowed down their merger reviews of a number of proposed acquisitions by US companies, including Intel Corp.’s $5.2 billion takeover of Israel-based Tower Semiconductor Ltd. and chip maker MaxLinear Inc.’s $3.8 billion purchase of Silicon Motion Technology of Taiwan, according to people close to the process,” the WSJ wrote.

Microsoft’s $68.7 billion purchase of Activision Blizzard is “subject to Beijing’s lengthy merger scrutiny” because China last year “declined the companies’ request to file the deal under a simplified and expedited procedure,” the WSJ report said. The Microsoft/Activision deal also faces antitrust scrutiny in the UK and EU.

“We respect the thorough process of Chinese regulators in reviewing our deal,” Activision told the WSJ.

Broadcom’s $61 billion deal to buy VMware, announced in May 2022, is still waiting for a Chinese review. “Both companies in February extended the deadline to complete the deal until May 26, with further extensions likely,” the WSJ wrote. The companies now say they hope to complete the merger by the end of October.

China didn’t always have a robust merger-review system but has “consolidated all antitrust matters under SAMR and built up its staff,” the WSJ noted. “While Chinese regulators rarely reject transactions outright, they have resorted to delaying and withholding approvals until their demands—often focused on benefiting Chinese companies at the expense of their foreign competitors—are met.”

Merger review a “subtle” alternative to company ban

Chinese demands for access to certain products “could put US companies in an impossible position as Washington has enacted legislation restricting American companies’ ability to sell to China and expanding certain types of production there,” the WSJ report said.

Companies that operate internationally and want to complete a merger often need approval from authorities in multiple countries. “For multinationals, it doesn’t take much for a merger to trigger a Chinese antitrust review. For instance, if two companies in a deal have revenue of more than $117 million a year from China, the merger needs Beijing to sign off,” the WSJ noted.

The WSJ also notes that Chinese officials are said to “see merger reviews as a relatively subtle and low-cost way to pressure foreign companies and by extension, their governments.” The strategy is an alternative to banning foreign companies from selling in China, though China has blocked sales in some circumstances.

As Reuters reported in mid-February, China “put Lockheed Martin and a unit of Raytheon Technologies on an ‘unreliable entities list’ over arms sales to Taiwan, banning them from imports and exports related to China.” The Lockheed Martin and Raytheon bans were called “symbolic measures” by the White House because neither company sells defense products to China.

The US, citing concerns about China-based companies’ ties to the Chinese government and Chinese Communist Party, has added numerous Chinese firms to the Entity List that greatly restricts access to American products and components. Targets include Chinese supercomputing companies, Huawei, ZTE, drone-maker DJI, chipmaker SMIC, memory chipmaker YMTC, and various others.

Another new US rule is that chipmakers must agree not to expand capacity in China for a decade if they receive money from a $39 billion federal fund. Internet service providers that receive Universal Service subsidies are banned from using Huawei and ZTE telecom gear in federally funded broadband projects.

And of course, there is ongoing debate in Washington about whether to ban TikTok, which is already not allowed on government devices. China already blocks online access to large web platforms such as YouTube and Wikipedia.

https://arstechnica.com/?p=1929048

A former Tesla factory worker who rejected a $15 million payout in a racial discrimination lawsuit has been awarded just $3.2 million after a new damages trial. A federal jury verdict reached yesterday gave plaintiff Owen Diaz $3 million in punitive damages and $175,000 in compensatory damages.

After the first trial, in October 2021, a jury in US District Court for the Northern District of California ruled that Tesla should pay $137 million to Diaz. In April 2022, US District Judge William Orrick reduced the award to $15 million, saying that was the highest amount supported by the evidence and law.

Diaz rejected the judge’s $15 million award and sought a new trial on damages only. The judge’s final instructions to the eight-person jury said, “It has been conclusively determined that Tesla is liable to Mr. Diaz for: (1) creating a hostile work environment based on race in violation of federal law, (2) failing to prevent racial harassment in violation of federal law, and (3) negligently retaining and supervising one or more of Mr. Diaz’s supervisors in violation of California state law.”

When Orrick decided that Tesla should pay $15 million last year, he wrote that the “evidence was disturbing. The jury heard that the Tesla factory was saturated with racism. Diaz faced frequent racial abuse, including the n-word and other slurs. Other employees harassed him. His supervisors and Tesla’s broader management structure did little or nothing to respond. And supervisors even joined in on the abuse, one going so far as to threaten Diaz and draw a racist caricature near his workstation.”

Musk: “Jury did the best they could”

Diaz, who is Black, operated a freight elevator and worked at Tesla’s Fremont, California, factory for nine months starting in June 2015. His legal team reportedly asked the jury last week to award $8 million in compensatory damages and $150 million in punitive damages.

After yesterday’s $3.2 million verdict, Diaz’s attorney Larry Organ said, “I don’t think that the truth drove the decisions here. I think it was a show whereby Mr. Diaz was attacked and his credibility was questioned,” according to a Wall Street Journal article.

Tesla CEO Elon Musk weighed in on Twitter, writing, “If we had been allowed to introduce new evidence, the verdict would’ve been zero imo. Jury did the best they could with the information they had. I respect the decision.”

Tesla last week objected to the jury being instructed that Diaz is entitled to punitive damages, arguing that the evidence didn’t prove Tesla acted purposely or with reckless disregard. “The record fails to provide legally sufficient evidence that Tesla purposely or recklessly disregarded Mr. Diaz’s complaints of racially hostile conduct by other workers,” Tesla wrote. “To the contrary, the undisputed evidence shows that Tesla supervisors responded to all of Mr. Diaz’s documented complaints of such conduct with investigations and then serious disciplinary action against the perpetrator.”

Plaintiff: Tesla misled jury

Also last week, Diaz’s lawyers filed a motion for a mistrial, alleging that during the re-trial, “Tesla repeatedly referenced and sought to introduce improper and highly prejudicial evidence in a blatant attempt to mislead and prejudice the jury regarding plaintiff Owen Diaz’s character, his mental state, and the status of this litigation.”

Tesla “asked improper questions that, without any factual basis, accuse Mr. Diaz of being a serial racial and sexual harasser,” made “entirely gratuitous and highly prejudicial references to Mr. Diaz’s previous settlement with two staffing companies in this litigation,” and “sought to elicit barred testimony about Diaz’s son’s criminal convictions,” Diaz’s side argued.

“Tesla twice attempted to elicit testimony from Mr. Diaz regarding his prior criminal convictions in violation of the Court’s April 2, 2020 order precluding Tesla from introducing such evidence at trial,” the motion said. In another incident, Tesla “displayed an exhibit not admitted to the jury so it could baselessly accuse Mr. Diaz of forging a doctor’s note,” the motion said.

The plaintiff’s lawyers’ “objections were not always sustained or were not sustained until after Tesla’s callous disregard for the Court’s rules had its desired effect on the jury,” the motion said.

Tesla also sued by California state agency

Tesla is separately facing a lawsuit filed by the California Department of Fair Employment and Housing (DFEH), which alleged that the Fremont-based “factory was racially segregated.”

“Defendants discriminated against Black and/or African-American workers by segregating them to undesirable work areas and/or locations, assigning them to more physically demanding jobs, lower level roles, or contract positions with lower pay and more limited growth opportunities, and affording them fewer advancement and other professional opportunities than their non-Black counterparts because of race in violation of Government Code section 12940, subdivision (a),” the state agency alleged in Alameda County Superior Court.

The state agency’s lawsuit also said that Black workers at Tesla “were routinely subjected to offensive racial harassing conduct so severe and/or pervasive that it created a hostile work environment.” Similar allegations were made in a lawsuit filed in July 2022 by 15 factory workers. Both cases are still pending.

https://arstechnica.com/?p=1928985

Dominion Voting Systems won a significant ruling against Fox News Network on Friday, with a judge finding that Fox News aired false statements about Dominion related to the 2020 presidential election and must face a jury trial in the defamation lawsuit.

“While the Court must view the record in the light most favorable to Fox, the record does not show a genuine issue of material fact as to falsity,” wrote Judge Eric Davis in a Delaware Superior Court ruling on summary judgment. Dominion provided “extensive proof” to meet its burden of showing that Fox aired false statements and Fox wasn’t able to refute those accusations, he added.

Davis used a mix of italics, capital letters, and bolded text to emphasize his conclusion that Fox published false statements:

The evidence developed in this civil proceeding demonstrates that [it] is CRYSTAL clear that none of the Statements relating to Dominion about the 2020 election are true. Therefore, the Court will grant summary judgment in favor of Dominion on the element of falsity.

Davis found that the Fox News Network statements are defamatory per se because they “claimed that Dominion committed election fraud; manipulated vote counts through its software and algorithms; is founded in Venezuela to rig elections for dictator Hugo Chavez; and paid kickbacks to government officials who used the machines in the Election… The Statements also seem to charge Dominion with the serious crime of election fraud. Accusations of criminal activity, even in the form of opinion, are not constitutionally protected.”

Davis scheduled a trial to begin on April 17. Although Davis agreed that Fox published false statements, he did not grant Dominion’s request for summary judgment on whether defendants Fox News Network and Fox Corporation acted with actual malice. That requires proving a defendant published false information about a plaintiff “with knowledge that it was false or with reckless disregard of whether it was false or not,” he noted.

If a jury decides that Fox acted with actual malice, jurors would have to calculate damages to be awarded to Dominion, which has asked for $1.6 billion. Dominion separately sued Newsmax and One America News Network. Voting machine maker Smartmatic also sued all three networks.

Fox takes “nuanced approach to falsity”

Dominion contended that Fox “intentionally provided a platform for guests that FNN’s [Fox News Network’s] hosts knew would make false and defamatory statements of fact on the air”; that Fox affirmed, endorsed, repeated, and agreed with those guests’ statements; and “republished those defamatory and false statements of fact on the air, FNN’s websites, FNN’s social media accounts, and FNN’s other digital platforms and subscription services,” Davis noted.

Davis was not impressed by Fox’s argument that it was merely reporting on former President Trump’s baseless allegations of election fraud. “Fox dedicates little to its argument on falsity,” Davis wrote. “It claims that ‘[t]he question is whether the press reported the “true” fact that the President made those allegations.'”

Fox’s “nuanced approach to falsity,” Davis wrote, “would have the Court test whether specific points stated by the FNN hosts are true. For example, Fox argues that if a FNN host notes that the next guest is Ms. [Sidney] Powell, that Ms. Powell is an attorney for former President Trump and that Ms. Powell will be stating the position of the former President, then all the statements are true and there can be no defamation.”

Davis also called it “oxymoronic” for Fox to describe the challenged statements as “opinions” while simultaneously “asserting the Statements are newsworthy allegations and/or substantially accurate reports of official proceedings.”

https://arstechnica.com/?p=1928803

Tesla CEO Elon Musk violated US labor law by threatening to take stock options away from employees who join a union, a federal appeals court ruled Friday. The appeals court said the US National Labor Relations Board can enforce its order that requires Musk to delete the tweet.

Musk’s tweet in May 2018 is still online and said in part, “Nothing stopping Tesla team at our car plant from voting union. Could do so tmrw if they wanted. But why pay union dues & give up stock options for nothing?” Musk issued the tweet amid a union campaign at a Tesla vehicle manufacturing plant in Fremont, California. Tesla factories are still not unionized.

A federal administrative law judge ruled against Tesla and Musk in 2019, finding among other things that Musk violated labor law with the tweet. The NLRB affirmed that and most other portions of the judge’s ruling in 2021. Tesla challenged in the US Court of Appeals for the 5th Circuit, which sided with the NLRB in its ruling on Friday:

Tesla first argues that Musk’s May 20, 2018, tweet “was not threatening on its face” because the tweet started out by saying that there was “[n]othing stopping” employees from unionizing and it is a strain to characterize “give up stock options for nothing” as a threat, because, unlike the threat of plant closure, compensation is not within the employer’s unilateral control once employees unionize and the parties engage in collective bargaining.

However, because stock options are part of Tesla’s employees’ compensation, and nothing in the tweet suggested that Tesla would be forced to end stock options or that the UAW would be the cause of giving up stock options, substantial evidence supports the NLRB’s conclusion that the tweet is as [sic] an implied threat to end stock options as retaliation for unionization. Moreover, the statement in the tweet is materially similar to other statements that the NLRB and our court have found to be threats.

The 5th Circuit appeals court ruling was made unanimously by a three-judge panel and dismissed appeals submitted by both Tesla and the United Auto Workers (UAW) union. Tesla or the union could still ask for an en banc review with all the court’s judges, though the unanimous ruling suggests that would be an uphill battle.

Ruling: Tesla illegally fired pro-union worker

As the ruling notes, Tesla challenged “the NLRB’s finding that Tesla CEO Elon Musk posted an unlawful threat on Twitter” and “the NLRB’s conclusion that employee Richard Ortiz was unlawfully terminated.” The appeals court rejected both of Tesla’s arguments and granted the NLRB’s cross-application for enforcement of its order, which told Musk to delete the tweet and told Tesla to reinstate Ortiz with back pay.

The court also said the NLRB can enforce other portions of the order that weren’t challenged in court. The NLRB found Tesla committed several other violations including interfering with employee leafleting, prohibiting employees from distributing union materials without approval and threatening them with discharge, prohibiting employees from communication with the media about their employment, interrogating certain employees about union activity, and disciplining employee Jose Moran for his union activity.

On the Ortiz firing, Tesla argued that it fired him for lying during an investigation into employee misconduct. Ortiz had posted two screenshots of Tesla employee profiles from the Workday application to a private “Tesla Employees for UAW Representation” Facebook page and criticized those employees for testifying in the California Legislature against legislation supported by the union. His post on the Facebook page also accused one of the employees of “kissing ass and ratting on people.”

Ortiz later admitted that he lied when he told a Tesla investigator he didn’t remember where he got the screenshots, which he had received from Moran. The appeals court found there is substantial evidence supporting the NLRB finding “that Ortiz was fired for lying about protected union activity and not related to his job performance or Tesla’s legitimate business interests or workplace rules, and that union animus motivated—at least in part—the complaint, investigation, and decision to terminate Ortiz.”

When the screenshots were taken by Moran and shared by Ortiz, “Tesla had no policy prohibiting such use of Workday or otherwise restricting access to the program,” the court ruling noted. In one of the uncontested portions of the NLRB order, the labor agency found that Tesla violated the law by “promulgating a rule restricting Workday use in response to Ortiz and Moran’s union activity.” Tesla was ordered to rescind the rule.

https://arstechnica.com/?p=1928673

Twitter has made good on one of CEO Elon Musk’s many promises, posting on a Friday afternoon what it claims is the code for its tweet recommendation algorithm on GitHub.

The code, posted under a GNU Affero General Public License v3.0, contains numerous insights as to what factors make a tweet more or less likely to show up in users’ timelines.

In a blog post accompanying the code release, Twitter’s engineering team (under no particular byline) notes that the system for determining which “top Tweets that ultimately show up on your device’s For You timeline” is “composed of many interconnected services and jobs.” Each time a Twitter home screen is refreshed, Twitter pulls “the best 1,500 Tweets from a pool of hundreds of millions,” the post states.

The largest source of those tweets are “In-Network Sources,” or users someone follows. The top tweets from that pile are ranked on the likelihood of a user’s engagement with that tweet’s author; the more likely, the more their tweets show up in For You. For the “Out-of-Network Sources,” those not followed by the user, Twitter says it considers tweets that attracted engagement from people users follow and tweets liked by those who like tweets similar to a user.

Already, those who have looked through the code have spotted considerations that raise many more questions. Many have posted them, naturally, on Twitter itself.

Ólafur Waage, a senior software developer at Norwegian software consulting service TurtleSec, noted that inside “HomeTweetTypePredicates.scala,” some of the seeming considerations for a tweet to be a candidate for the “For You” section are:

• author_is_elon
• author_is_power_user
• author_is_democrat
• author_is_republican

Elsewhere in the code, a code comment presumably left by a Twitter engineer clarifies that those identification values are “used purely for metrics collection.” The comment reads as follows:

These author ID lists are used purely for metrics collection. We track how often we are serving Tweets from these authors and how often their tweets are being impressed by users. This helps us validate in our A/B experimentation platform that we do not ship changes that negatively impacts one group over others.

The names of the objects in question such as “DDGStatsDemocratsFeature” or “DDGStatsElonFeature” seem to support this interpretation, but it may not be possible to confirm that with the available code. It’s interesting that Twitter is checking and collating these variables, however. During a Twitter Spaces audio session, a Twitter engineer noted that the Democrat and Republican labels were used for metrics. Musk, who claimed he was unaware of the labels before today, suggested they should not be there.

Other things considered about a tweet include whether it’s less than 30 minutes old, if it has pictures, and whether it’s from a “power user,” which some believe means a “legacy” verified account.

Musk tweeted alongside the company’s blog post that the recommendation algorithm, claiming that the “acid test” will be if “independent third parties” can “determine, with reasonable accuracy, what will probably be shown to users.”

Twitter’s posting of its algorithm code comes just days after the social network’s broader source code was discovered on GitHub, potentially having been there for months, according to The New York Times. Twitter then obtained a subpoena forcing GitHub to reveal the GitHub poster’s information.

A report from Platformer earlier this week suggested that Twitter utilized a secret list of 35 top Twitter users, including President Biden, LeBron James, Ben Shapiro, and Musk. Evidence of that list’s implementation, reportedly spurred partly from Musk’s dissatisfaction with his own engagement, has not been found so far in Twitter’s posted code base.

Most notably, the code arrives just hours before “legacy verified” users—those given a blue checkmark to indicate authenticity or notability before Musk’s purchase of the service—are to be un-verified in favor of paying Twitter Blue subscribers. While some users connected to governments and large organizations may apply for checkmarks of other colors, only Twitter Blue subscribers, at $8 per month, will receive “prioritized ranking in conversations,” among other features.

All of those changes happen to arrive on April 1, or April Fool’s Day.

https://arstechnica.com/?p=1928420

Like in other parts of the world, Canada is working out what the right to repair means for its people. The federal government said in its 2023 budget released Tuesday that it will bring the right to repair to Canada. At the same time, it’s considering a universal charging port mandate like the European Union (EU) is implementing with USB-C.

The Canadian federal government’s 2023 budget introduces the right to repair under the chapter “Making Life More Affordable and Supporting the Middle Class.” It says that the “government will work to implement a right to repair, with the aim of introducing a targeted framework for home appliances and electronics in 2024.” The government plans to hold consultations on the matter and claimed it will “work closely with provinces and territories” to implement the right to repair in Canada:

When it comes to broken appliances or devices, high repair fees and a lack of access to specific parts often mean Canadians are pushed to buy new products rather than repairing the ones they have. This is expensive for people and creates harmful waste.

Devices and appliances should be easy to repair, spare parts should be readily accessible, and companies should not be able to prevent repairs with complex programming or hard-to-obtain bespoke parts. By cutting down on the number of devices and appliances that are thrown out, we will be able to make life more affordable for Canadians and protect our environment.

The budget also insinuates that right-to-repair legislation can make third-party repairs cheaper than getting a phone, for example, repaired by the manufacturer, where it could cost “far more than it should.” 

The budget’s release comes in the same month as the European Commission’s adoption of a proposal requiring tech makers to provide repairs for up to 10 years after purchase, depending on the product category. The European Parliament and Council must approve the proposal before it’s law.

A broader look at right-to-repair discussions around the globe shows the difficulties in creating a system that appeases consumer advocates and tech companies. The strength of EU’s right-to-repair legislation has been criticized for things like failing to cover specific types of electronics and not ensuring that necessary aspects, like spare parts, tools, and manuals, are affordably priced.

But some, like tech trade group DigitalEurope’s director-general, Cecilia Bonefeld-Dahl, think such legislation should be built around “manufacturer-led repair networks.”

At the (very) end of 2022, New York became the first state to implement an electronics right-to-repair law, but significant changes made to the Digital Fair Repair Act have been heavily detailed.

Meanwhile, self-repair initiatives by tech giants like Samsung and Apple have been scrutinized for lack of supported products and, in the case of Apple, requiring remote OEM authorization for repairs.

India announced that it was setting up a committee to hammer out a right-to-repair framework in July, and its legislation may cover four categories: electronics, automobiles, farming equipment, and consumer durables. 

Universal charging port also under consideration

Canada’s 2023 budget also revealed the government’s interest in introducing a standard charging port for electronics. The budget says the government “will work with international partners and other stakeholders to explore implementing a standard charging port in Canada.” It says a universal charging port could help residents save money and e-waste.

“Every time Canadians purchase new devices, they need to buy new chargers to go along with them, which drives up costs and increases electronic waste,” the budget says.

The EU famously made universal charging port mandates a reality, requiring that smartphones, tablets, and other consumer gadgets with wired charging have a USB-C port by December 28, 2024. Laptops will be required to do the same by April 2026. The landmark legislation has pushed Apple to reluctantly work on a USB-C iPhone.

The incoming EU requirements also started a trickle-down effect around the world, where numerous countries are now considering some type of universal charging port rules of their own. India is considering such a mandate to take place by March 2025 and potentially excluding wearables, hearables, and feature phones, due to associated costs. Brazil also had a public consultation about a USB-C charging smartphone requirement that ended in August. And although the US hasn’t seen much visible movement around such a law, some politicians have asked the Secretary of Commerce for a strategy.

As governments, tech makers, and consumer advocates seek to define legislation that impacts how consumers use and buy electronics and create e-waste, debate around the right to repair and charging standards abound. This has brought the issues greater attention, including among consumers, some of which are demanding repairability and e-waste consideration in their products, legally mandated or not. Framework, which makes modular laptops, continuing to expand its portfolio is one indicator of consumer interest in repairability and choice. Regardless of how different geographies’ governments decide to handle things, these types of discussions have, rightfully so, become impossible to ignore.

https://arstechnica.com/?p=1928301

Today an Italian regulator, the Guarantor for the Protection of Personal Data (referred to by its Italian acronym, GPDP), announced a temporary ban on ChatGPT in Italy. The ban is effective immediately and will remain in place while the regulator investigates its concerns that OpenAI—the developer of ChatGPT—is unlawfully collecting Italian Internet users’ personal data to train the conversational AI software and has no age verification system in place to prevent kids from accessing the tool.

The Italian ban comes after a ChatGPT data breach on March 20, exposing “user conversations and information relating to the payment of subscribers to the paid service,” GPDP said in its press release. OpenAI notified users impacted by the breach and said it was “committed to protecting our users’ privacy and keeping their data safe,” apologizing for falling “short of that commitment, and of our users’ expectations.”

Ars could not immediately reach OpenAI to comment. The company has 20 days to respond with proposed measures that could address GPDP’s concerns or face fines of up to 20 million euro or 4 percent of OpenAI’s gross revenue.

Potential mitigation efforts to lift the ban could include notifying users about how OpenAI collects their data and implementing an age verification system to stop young kids from using ChatGPT.

GPDP is also concerned that ChatGPT’s answers to text prompts can manipulate data and potentially mislead users by inaccurately processing data and ultimately sharing misinformation.

Currently, GPDP said there is no legal basis for OpenAI to collect and store personal data to train its AI model, which ChatGPT uses to simulate and process convincingly real conversations. There is also no age verification system to prevent minors from being exposed to answers to text prompts that are “absolutely unsuitable” to younger users’ “degree of development and self-awareness.”

Ars could not immediately reach GPDP to comment on the next steps in its investigation.

Because OpenAI is not currently based in the European Union, the company has up to 60 days to appeal the ban, according to a GPDP document.

Should governments be restricting AI tools?

ChatGPT is just one of many AI tools spurring a lively ethics debate, with some critics urging regulators to slow down AI technology development until the risks of mass adoption are fully understood. However, according to Reuters, ChatGPT is the fastest-growing consumer application in history—reaching 100 monthly active users within a couple of months of its launch—which is likely why it has become one of the first popular AI tools to face a government ban.

The heightened scrutiny of OpenAI’s products in particular has seemingly just begun. Earlier this week, a nonprofit AI research group submitted a complaint to the US Federal Trade Commission about OpenAI’s product GPT-4, claiming it was “biased, deceptive,” and poses “a risk to privacy and public safety.” GPT-4 is trained on a massive amount of online data and is already available to ChatGPT Plus subscribers and powers Microsoft’s Bing.

https://arstechnica.com/?p=1928298

Twitter owner Elon Musk requested a meeting with Federal Trade Commission Chair Lina Khan late last year, but he was rebuffed and told to stop dragging his heels on providing documents and depositions needed for the FTC investigation into Twitter’s privacy and data practices, a New York Times report said yesterday.

“In a Jan. 27 letter declining the meeting, Ms. Khan told a Twitter lawyer to focus on complying with investigators’ demands for information before she would consider meeting with Mr. Musk,” the NYT wrote.

Twitter has to comply with conditions in a May 2022 settlement in which it agreed to pay a $150 million penalty for targeting ads at users with phone numbers and email addresses collected from those users when they enabled two-factor authentication. Last year’s settlement was reached after the FTC said Twitter violated the terms of a 2011 settlement that prohibited the company from misrepresenting its privacy and security practices.

Khan’s January 27 letter to Twitter reportedly said she was “troubled by Twitter’s delays and the obstacles that these delays are creating for the FTC’s investigation.” Khan’s letter criticized Twitter for dragging its heels in providing documents and delaying depositions with witnesses, including Musk, according to the NYT.

“I recommend that Twitter appropriately prioritize its legal obligations to provide the requested information,” she wrote to Twitter. “Once Twitter has fully complied with all FTC requests, I will be happy to consider scheduling a meeting with Mr. Musk.”

FTC concerned about Twitter staff shortage

An internal FTC email described by The New York Times report said Khan consulted with the FTC Consumer Protection Bureau’s enforcement division about Musk’s request for a meeting. “Acting on the enforcement team’s advice, Ms. Khan declined to meet with Mr. Musk at that time,” the article said.

The FTC declined to comment when contacted by Ars. We contacted Twitter, but the company’s press email now auto-replies to every message with a poop emoji.

The 2022 settlement requires assessments of risks to privacy, security, and confidentiality before Twitter launches new or modified products and services. In November 2022, shortly after Musk bought Twitter, some of the company’s top privacy and security executives resigned amid worries that Musk’s rapid changes would cause violations of the deal with the FTC.

The FTC’s ongoing investigation is focused on whether Twitter “has adequate resources to protect its users’ privacy” after laying off thousands of employees, the NYT wrote. “The agency has separately sought to interview Mr. Musk for the investigation; the interview has not occurred, a person with knowledge of the matter said.”

Musk request shows seriousness of probe

The NYT quoted former FTC Chair William Kovacic as saying that a CEO requesting a meeting indicates that the company is taking the investigation seriously. “If you thought you could simply brush it aside, and it was not a matter of great concern, you’d just ignore it… If you think it’s important, that would be a reason to seek out a meeting,” Kovacic said.

While it’s rare for a CEO to seek a meeting with the FTC chair or commissioners during an investigation, “such meetings sometimes occur when the executives hope to convince the agency’s top officials that they are committed to abiding by their promises to the FTC,” the NYT wrote.

Musk did speak last month with Christine Wilson, the only Republican commissioner at the FTC. Wilson recently said she plans to resign from the FTC and accused Khan of abusing her power. “My fundamental concern with her leadership of the commission pertains to her willful disregard of congressionally imposed limits on agency jurisdiction, her defiance of legal precedent, and her abuse of power to achieve desired outcomes,” Wilson wrote in a Wall Street Journal op-ed.

According to an FTC staffer’s email paraphrased in the NYT article, Wilson “asked for copies of the agency’s letters to Twitter demanding information and documents related to its compliance with the privacy settlement.”

https://arstechnica.com/?p=1928251