Amazon, Meta, Alphabet, and Microsoft will collectively incur more than $10 billion in charges related to mass redundancies, real estate, and other cost-saving measures, as the Big Tech companies reveal the hefty price they incur to rein in spending.

The US companies that have been implementing the largest job cuts in the tech sector disclosed the high costs related to their restructuring efforts in earnings statements released this week.

The four groups had previously announced 50,000 job cuts to convince Wall Street they were heading into a “year of efficiency,” as Meta chief executive Mark Zuckerberg described it. This trend comes after more than a decade of heavy spending in a focus on aggressive top-line growth.

Despite the companies’ high upfront costs such as severance payments, investors appear encouraged by the steps taken.

Since formally announcing their cuts, the companies have together added more than $800 billion to their market capitalizations. Meta, the earliest mover among the Big Tech groups, has seen its value almost double since detailing its job cuts in November.

While savings could have been made by implementing more gradual cost reductions, tech companies were being rewarded by the markets for “ripping the Band-aid off,” said Wedbush analyst Dan Ives.

“Big Tech has been spending money like ’80s rock stars for the last four to five years,” he said. “It feels like there’s adults in the room now.”

The process to become leaner in the wake of macroeconomic pressure contrasts starkly with the pandemic-era hiring boom, with headcounts increasing rapidly at tech companies that were responding to a rise in demand in digital products and services.

Apple remains the only large tech company that has not announced any job cuts or a cost-cutting program, despite on Thursday reporting its first decline in quarterly revenues in three and a half years.

According to Layoffs.fyi, a tracker logging instances of tech redundancies, almost 250,000 employees have been let go across the sector since the start of last year.

Some of the most recent, from this past week, include software group Okta, which laid off 300 employees, data analysis company Splunk, with 325, and image-sharing social network Pinterest, which said 150 roles would go.

The deepest cuts have come from the biggest names. In November, Meta announced it would let go of 11,000 of its employees, as well as dump office space and data centers.

On Wednesday, the Facebook parent detailed charges of $4.6 billion related to restructuring. Severance costs ran to $975 million, according to a company filing, though that cost was offset by “decreases in payroll, bonus and other benefits expenses.” A further $1 billion in charges related to reducing office footprint is expected in 2023.

Amazon chief executive Andy Jassy told employees in January the company would eliminate 18,000 roles.

Speaking to investors on Thursday, Amazon’s chief financial officer, Brian Olsavsky, said $640 million had been spent on severance in the fourth quarter of 2022, as well as an additional $720 million on abandoning real estate, primarily due to pulling back on opening new physical grocery stores. The company did not share further details on charges it might incur in the current quarter and beyond.

Google parent Alphabet, which is laying off 12,000 people, said it expected to incur severance costs ranging from $1.9 billion to $2.3 billion, with most of the impact in the current quarter. At the high end of that guidance, the cost of severance will work out at approximately $191,000 per employee. Alphabet faces a further $500 million in costs relating to office space reduction in the current quarter, it said.

Despite the cuts, Alphabet Chief Financial Officer Ruth Porat told investors on Thursday the company would continue “hiring in priority areas, with a particular focus on top engineering and technical talent, as well as on the global footprint of our talent.”

Microsoft’s planned savings—which include 10,000 job cuts—has resulted in it incurring a $1.2 billion charge in the final three months of 2022, $800 million of which was from severance pay.

Salesforce, which will not report earnings until March, is expected to be another company facing significant restructuring costs, having announced a 10 percent reduction in its workforce last month. That move came as activist investor Elliott Management took a multibillion-dollar stake in the company, saying it intended to work “constructively with Salesforce to realize the value befitting a company of its stature.”

Likewise, Alphabet has drawn attention from activist Sir Christopher Hohn, of TCI Fund Management, who wrote to chief executive Sundar Pichai, saying he needed to make further headcount cuts and trim “excessive” employee compensation.

© 2023 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1914783

About SecurityWeek Cyber Insights | At the end of 2022, SecurityWeek liaised with more than 300 cybersecurity experts from over 100 different organizations to gain insight into the security issues of today – and how these issues might evolve during 2023 and beyond. The result is more than a dozen features on subjects ranging from AI, quantum encryption, and attack surface management to venture capital, regulations, and criminal gangs.

SecurityWeek Cyber Insights 2023 | Regulations – In this world, nothing is certain but death, taxes, and cyber regulations. The first is static, the second goes up and down, but the third seems only to increase. The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often in conflict with the second and third.

Transatlantic data flows

Privacy is the headline battleground going forward, and amply illustrates the conflict between voter demands and national economies. This can be seen in the unsettled but multi-year attempt to find a legal solution to the transfer of personal user data from Europe to the US. Economics demands it, but European law (GDPR) and swathes of European public opinion deny it.

At the time of writing, it is almost certainly illegal to transfer PII from Europe to the US. The Privacy Shield – the second attempt at finding a workaround to GDPR – was declared illegal in what is known as the Schrems II court ruling. The wording of that ruling almost certainly eliminates an alternative approach known as ‘standard contractual clauses’.

During 2022, the European Commission (EC) and the US Biden administration have worked on developing a replacement for Privacy Shield. The ball was obviously in the US court, and on October 7, 2022, Biden issued an Executive Order to implement the EU-US Data Privacy Framework agreement – sometimes known as Privacy Shield 2.0.

This was enthusiastically greeted by US business. IBM, for example, issued a statement, “These steps will restore certainty to the thousands of companies already self-certified under Privacy Shield. Providing predictable, free flows of data between the US and the EU will secure the mutual benefits of continued business cooperation and will create a foundation for future economic growth.”

Our first prediction for 2023 is that the EC will approve Biden’s Executive Order and allow ‘free flows of data between the US and the EU’. This approval is in process. The EC issued a draft adequacy determination for the EU-US data privacy framework on December 12, 2022. 

“As expected,” comments Caitlin Fennessy, VP and chief knowledge officer at the International Association of Privacy Professionals (IAPP), “the draft outlines the Commission’s reasoning in finding the framework adequate, with a focus on the new necessity and proportionality requirements for US signals intelligence and the Data Protection Review Court outlined in the recent Executive Order and Department of Justice regulations.”

But that will be just the beginning. European activists, such as Max Schrems, are likely to challenge the EC ruling in the European Court.

The basic problem remains the NSA’s requirement to only surveil non-Americans (such as Europeans) for national security purposes. Schrems’ website, noyb, has already indicated a dissatisfaction. “So-called ‘bulk surveillance’ will continue under the new Executive Order (see Section 2 (c)(ii)) and any data sent to US providers will still end up in programs like PRISM or Upstream, despite of the CJEU declaring US surveillance laws and practices as not ‘proportionate’ (under the European understanding of the word) twice.”

So, during 2023, transatlantic PII data flows will become legal under the new framework, but that framework will be challenged as unconstitutional in the European Court. The court case will take several years to come to a conclusion, but it will probably declare the data privacy framework (or whatever it becomes known as) to be illegal. The basic problem is that GDPR and NSA surveillance are incompatible, and neither is likely to change.

Federal privacy law

The US government has been seeking a federal privacy law for around a decade but is probably no closer to achieving one. Progress was made during 2022, but the midterms kicked the bill into the long grass while the lawmakers concentrated on more pressing career issues. The question is whether it can be retrieved during 2023.

Mitzi Hill, a partner at the Taylor English Duma law firm, thinks it is unlikely. “I remain doubtful,” she said. “It is a complex topic both technically and legally. It is made more complicated with every new state law, because that is a new set of factors to consider in drafting any federal legislation.”

She also notes the outcome of the 2022 midterms. “Traditionally, we would expect that a Republican House majority [as we will have in 2023] will favor marketplace (as opposed to regulatory) solutions, making it tough to get anything passed in both houses of Congress. My own view is that the states will continue to lead in this area.”

Gopi Ramamoorthy, senior director of security and GRC at Symmetry Systems points out that “Five states have already enacted privacy acts, and more are expected to follow. The increased focus on privacy has stemmed from the introduction of GDPR and Schrems II decision from the EU.”

The California Privacy Rights Act (CPRA) comes into effect on January 1, 2023, with enforcement beginning on July 1, 2023. It is an extension of the existing CCPA, which is already possibly the strongest privacy act in the US (and largely modeled on GDPR). While it is somewhat more friendly to small businesses, it gives consumers more rights, places more requirements on organizations, and establishes an enforcement agency.

The consumer demand for privacy is strong, but not absolute – and often depends on what is received in return for giving up personal information. Consider Google, widely acknowledged as one of the primary collectors and users of PII. Despite this, consumers continue to consume Google because of the ‘free’ services the company offers in exchange. The result is that it is difficult for lawmakers to know exactly what their voters really want.

“Privacy laws and regulations will continue to swing widely between completely useless – even harmful – and amazing wins for consumers. This is due to corporation lobbying and consumer [voter] demands,” comments Taylor Gulley, senior application security consultant at nVisium. “Though most consumers desire complete privacy, the growing demand for personalized content and services requires providing ever more information to companies. This increase of valuable, marketable, information gives corporations a reason to continue to lobby for their benefit.”

One area worth watching in 2023 is whether the FTC picks up the mantle of a ‘federal’ privacy regulator. Noticeably, the FTC includes failures in consumer privacy to be a potential deceptive practice – and deceptive practices are firmly within the FTC bailiwick.

“The FTC may become even bolder about privacy matters in the next couple of years,” suggests Hill. “It recently adopted an enforcement action that is targeted to a particular CEO and any future business he may join.”

She explained that his current company has multiple privacy violations and may have misstated the degree to which it addressed security issues following the first set of violations. His future companies or employers will be required to release detailed security plans. “This is unprecedented as far as I know,” she added.

Trickle-down regulated security

Although Biden does not believe in trickle-down economics, he nevertheless makes use of trickle-down cybersecurity. He cannot pass federal laws for private industry without the support of Congress – but he can (and does) issue executive orders that become mandatory instructions for federal agencies and strong trickle-down recommendations for private industry. 

If security vendors must conform to certain requirements before they can sell into the government, the size of the government market makes it a commercial if not legal requirement to conform. Furthermore, if federal agencies are required to apply certain cybersecurity methodologies, much of private industry will also take heed.

Both conditions were introduced in May 2021 with Executive Order 14208, spurring activity in zero trust, and introducing the software bill of materials (SBOM). Both are intended to counter the growing supply chain threat, and both will remain top of mind for companies during 2023.

“SBOM is going to continue to garner mainstream adoption, not just from software/firmware suppliers that are building products they are selling, but also for internal development teams that are building applications and systems for internal use,” comments Tom Pace, CEO at NetRise.

The federal government described the requirements for SBOMs in an OMB memorandum published on September 14, 2022. “This is going to cause a cascading effect in the private sector,” continued Pace, “since obviously the federal government does not manufacture all its own software and firmware – in fact very little is manufactured in house.”

There will be a bedding-in period before SBOMs achieve their end – and attackers are likely to increase their own efforts in the meantime. “Highly visible attacks on the software supply chain start with access to the weakest link. As we head into 2023, it will be important for businesses of all sizes to be engaged as new secure software development practices are defined,” warns John McClurg, SVP and CISO at BlackBerry.

Executive Orders are not the only tools the federal government can use – it also has NIST (a standards body) and CISA (a DHS agency responsible for strengthening security and infrastructure across all levels of government). While they primarily provide recommendations, this may not always be the case.

“The combined efforts of CISA and NIST in recent years,” comments Eric Hart, manager of subscription services at LogRhythm, “have led to a series of new cross-sector cybersecurity performance goals (CPGs) that organizations have already begun to implement.” 

CISA’s CPGs are designed to provide an easier route towards conforming to NIST for organizations that may not have the resources to go straight to the complexities of the NIST CSF. “While these standards are designed to strengthen organizations,” continued Hart, “the process of reaching full regulatory compliance can be tricky. The complexity, along with the growing push for federally enforced compliance, suggests we could see a flurry of activity in 2023 as more organizations seek to adopt these new security standards.”

Noticeably, CISA describes the CPGs as ‘voluntary’ and ‘not comprehensive’, adding, “The CPGs are intended to supplement the [NIST] Cybersecurity Framework (CSF) for organizations seeking assistance in prioritizing investment toward a limited number of high-impact security outcomes, whether due to gaps in expertise, resources, or capabilities or to enable focused improvements across suppliers, vendors, business partners, or customers.”

But it is also worth considering a comment from Grant Geyer, CPO at Claroty, who blogged that they may prove a jumping off point for upcoming regulations coming from the White House. “Regulators now have a CISA-approved, pre-built checklist of critical areas to focus on that address key practices such as account security, data and device integrity, supply chain and third-party risk, and response and recovery.” We may yet see CISA’s CPGs become mandated for federal agencies and join the trickle-down process of federal regulations.

Ben Johnson, CTO and co-founder of Obsidian Security, sees a great future for CISA. “CISA came into its own in 2022. This next year, we’ll see CISA drive better, more resilient security, especially in critical infrastructure — increasing the sector’s maturity as a whole.”

The regulations jungle

The trajectory for regulations is to increase, and they are increasing rapidly. These include state-level, federal level, and overseas national level that may impact US companies with operations in those countries. An example of the last could be Australia’s current plans for a new more aggressive attitude toward cybercriminals. Part of this will be to make ransom payments illegal in Australia. 

One question to be decided is how that might impact American companies with an Australian operation that gets ransomed. Will the American parent, where ransom payments are not illegal, be able to pay the ransom on behalf of the Australian operation?

Such complexities will require expert input by companies to match their infrastructure and processes against a huge number of regulations simply to understand where their compliance requirements are effectively mandatory.

Another new law, passed by Congress but targeted at federal agencies, may be introduced early in 2023: the Strengthening Agency Management and Oversight of Software Assets Act. MeriTalk reported on November 17, 2022, “The legislation would order Federal government agencies to undertake an inventory of all software used by the government – with a view toward eventually creating strategies to consolidate government software contracts, create governmentwide software licenses, and move toward adopting open-source software.”

This is not directly a cybersecurity regulation and will not be enforced on private industry. Nevertheless, if its precepts are adopted by industry, it could benefit industry groupings and separately lead to a beneficial reduction of security tool sprawl within companies.

The totality of regulations is beyond the scope of this peek into regulations in 2023. However, there is one we should consider that won’t come into effect until 2024.: PCI DSS 4.0. This will impact all organizations that store, transmit or process cardholder data and sensitive authentication data. The new standard allows organizations to customize their approach to proving compliance with each PCI DSS security requirement.

“If organizations take this direction,” warns Terry Olaes, senior technical director at Skybox Security, “there are growing opportunities for threat actors to exploit retailers who may have taken non-standard routes to achieve compliance. Additionally, the long lead time to implement these regulations gives attackers more opportunity to use those requirements as a blueprint to breach retailers before they have time to implement changes to their cybersecurity strategy.”

It is also worth noting that while regulations are becoming more numerous, they are also becoming more difficult to satisfy. “We’ll see more failed audits in regulated companies as multi-cloud, multi-cluster grows as a strategy in 2023,” warns Sitaram Iyer, senior director of cloud native solutions at Venafi. This strategy is increasingly popular among smaller but regulated organizations because it spreads risk, increases performance, and offers the control and visibility they need for compliance.

“However,” adds Iyer, “it also increases complexity because these environments are fragmented and require a huge number of machines which all need an authenticated identity to communicate securely. Due to this increased volume of machine identities in cloud native environments, compliance with regulations on machine identity management is a real challenge.”

And one to watch…

Elon Musk has completed his takeover of Twitter, and his swashbuckling management style has caused ructions even before the end of 2022. These are not relevant to us. What may be relevant, however, is his adherence to the constitutionally protected concept of free speech; and the potential for Musk’s new Twitter to operate at a lower level of moderation than the old Twitter. Noticeably, in late November 2022, Musk reinstated almost all the accounts that had previously been suspended for spreading misinformation.

As a quick aside, on November 17, 2022, a group of Democrat senators asked the FTC to investigate any possible violations by the platform of consumer-protection laws or of its data-security commitments. The FTC had already said it is “tracking recent developments at Twitter with deep concern”.

Of more direct relevance, many governments have already expressed concern over the practice of bad actors spreading misinformation, malinformation and disinformation – and giving extremist viewpoints a loudspeaker – via social media platforms such as Twitter. This is a direct challenge to democratic government, and some governments have suggested countering it by making websites legally responsible for the user-generated content they publish. There is a possibility that such suggestions will increase during 2023.

Mitzi Hill does not think this is likely in the US. Although lower moderation might lead to howls of protest, “I never bet against the First Amendment,” she said. “‘Congress shall make no law… abridging the freedom of speech’ is one of the most important tenets in American legal thinking.” 

Europe, however, thinks differently. The EU already has a new Digital Services Act that will kick in from January 2024. It doesn’t make platforms directly responsible for any unknown illegal content, but does require them to remove it once they are informed that it is illegal. It will also impose greater transparency on how algorithms work and are used. It is aimed at platforms that reach more than 10% of the EU population; that is, have at least 45 million EU users – that includes US big tech companies such as Twitter and Facebook. Non-compliance could lead to fines of up to 10% of annual turnover.

Finally

Martin Zinaich, CISO at the City of Tampa, once suggested to SecurityWeek, “If it ain’t required, it ain’t gonna happen.” We may have reached the point, with better organized cybercriminals and more aggressive nation states, where it must happen and therefore must be required. 

Ron Kuriscak, MD at NetSPI, certainly believes so. “Regulations need to become much more mature, stringent, and punitive. We must hold organizations more accountable for their inaction in the area of cybersecurity… Organizations will be held accountable for basic cybersecurity hygiene. If they are unable to meet the most basic standards a regulator will require a third party to take over cybersecurity program execution (they will be mandated to cover the associated costs). Similar to the FDA, we will start seeing industry-aligned compliance regulations with real penalties that will force real compliance and organizational change. The key will be enforcement and penalties.”

But don’t expect much from the federal government in 2023. “On federal government cybersecurity issues,” explains Robert DuPree, manager of government affairs at Telos Corporation, “Congress has been more active and effective but further progress in 2023 will be hampered by the fact that some longtime cyber policy advocates and experts from both parties – including Sen. Rob Portman (R-OH), Rep. Jim Langevin (D-RI) and Rep. John Katko (R-NY) – are retiring and won’t be around in 2023. Their absence will leave a tremendous void when it comes to pushing ‘good government’ cybersecurity issues through Congress.” 

Related: Do Privacy and Data Protection Regulations Create as Many Problems as They Solve?

Related: Robinhood Crypto Penalized $30M for Violating Cybersecurity Regulations

Related: Hack Prompts New Security Regulations for US Pipelines

Related: New York Imposes New Cybersecurity Regulation for Financial Services

https://www.securityweek.com/cyber-insights-2023-regulations/

Apple violated US labor laws through various workplace rules and statements made by executives, National Labor Relations Board officials determined after reviewing allegations from two former employees. An NLRB official will file a formal complaint against Apple unless the company reaches a settlement with the former employees, who filed complaints about Apple’s focus on secrecy.

An NLRB spokesperson confirmed to Ars today that the labor board’s regional office “found merit to four charges alleging that various work rules, handbook rules, and confidentiality rules at Apple violated Section 8(a)(1) of the National Labor Relations Act because they reasonably tend to interfere with, restrain, or coerce employees in the exercise of their right to protected concerted activity.”

The regional office additionally “found merit to a charge alleging statements and conduct by Apple—including high-level executives—also violated the National Labor Relations Act,” the NLRB statement said. That’s apparently a reference to an email in which Apple CEO Tim Cook warned staff not to leak confidential information.

As The New York Times wrote, the NLRB findings were in response to “five charges brought in late 2021 by two former Apple employees, Ashley Gjovik, an engineering program manager at Apple for six years, and Cher Scarlett, an engineer on the company’s security team… Both women were involved in the activist group called #AppleToo that was collecting accounts of abuse, harassment and retaliation at the company.”

The ex-employees “accused the company of trying to prevent the group from collecting wage data from employees, including through harassment,” and “said that the company’s work rules prevented them from discussing wages, hours and conditions of employment,” according to the NYT story.

Gjovik’s complaints alleged that “various Apple rules, including those relating to confidentiality and surveillance policies, deter employees from discussing issues such as pay equity and sex discrimination with each other and the media,” according to Reuters. “Gjovik also cited a 2021 email from Apple Chief Executive Tim Cook that allegedly sought to stop workers from speaking to the press and said ‘people who leak confidential information do not belong here.'”

NLRB urges parties to settle

We contacted Apple about the NLRB finding and will update this article if the company provides a response.

The regional office’s finding that the charges have merit isn’t an NLRB ruling but could lead to a formal charge against Apple. The NLRB statement said that “if the parties don’t settle, the Regional Director will issue a complaint, prosecuting this charge in a hearing with an Administrative Law Judge, who could order remedies.”

An administrative law judge’s decision could be appealed to the board, and a board decision, in turn, could be appealed to a federal appeals court.

The NLRB’s standard process calls for the agency to help the parties reach a deal. “When the NLRB investigation finds sufficient evidence to support the charge, every effort is made to facilitate a settlement between the parties. If no settlement is reached in a meritorious case, the agency issues a complaint,” an NLRB webpage explains.

https://arstechnica.com/?p=1913818

A coal-fired plant near Gillette, Wyoming, stands alone in the nation on one measure of economic viability—a positive distinction for that plant, but a damning one for coal-fired electricity in general.

Dry Fork Station, with generating capacity of 405 megawatts, is the only coal plant in the country that costs less to operate than it would take to replace the plant’s output by building new wind or solar plants in the same communities or regions, according to a new report issued today by the think tank Energy Innovation.

The report joins prior editions in 2019 and 2021 that, when viewed together, show how the economics of coal power are deteriorating. In 2019, the authors found that more than 70 percent of coal plants were more expensive to operate compared to the alternative of building new wind or solar. That share has now grown to 99 percent, with only the plant in Wyoming stopping it from being 100 percent.

The shift is due in large part to the Inflation Reduction Act, signed in August, which has several incentives that make wind and solar less expensive.

“The trends of coal getting more expensive, and renewables continuing to get cheaper, has definitely continued, but the IRA is, for sure, the big, big shift here,” said Michelle Solomon, a policy analyst at Energy Innovation and co-author of the report.

Even with the recent spike in inflation, which has made just about all electricity sources more expensive, the costs of wind and solar have continued to improve relative to other major sources.

But the report’s estimates do not mean that the owners of the coal plants are losing money by continuing to operate them. Indeed, many of the plants are profitable for a number of reasons, including state regulatory systems that allow the owners to pass all costs on to customers and policies from grid operators that allow the companies to “self schedule,” which means the plants run even when there are less expensive options available on the grid.

The larger point is that consumers could save billions of dollars if power plant owners would replace most of their coal plants with a mix of wind and solar power.

The IRA also includes incentives for carbon capture, which some power plant owners may use to install retrofits. The report’s authors didn’t take into account the possibility of retrofits because no plant has successfully done so other than pilot projects, and it’s not yet clear whether such modifications would work or how much they would cost.

The report doesn’t attempt to quantify the benefits to the climate and health of closing coal plants.

Coal is “struggling to stay around”

At the same time, advocates for fossil fuel industries have argued that coal and natural gas power plants have benefits that can’t completely be explained in terms of costs because the plants are capable of running around the clock, and, in the case of coal plants, they can have weeks or months of fuel stored on site. This is in contrast to wind and solar plants, which depend on wind and sun.

But the report’s authors say the potential for cost savings by closing coal plants is so huge that companies could develop wind, solar, and energy storage in a way that largely mimics the around-the-clock capabilities of coal and natural gas plants and still save money.

The authors illustrate this point by showing that most coal plants are substantially more expensive than wind and solar. About 80 percent of the coal plants in the report have operational costs that are at least one-third more than the costs of getting that electricity from new wind and solar.

https://arstechnica.com/?p=1913612

Dating apps are helping an attempted murderer evade capture in Oregon, the Grants Pass Police Department warned last week after the suspect escaped arrest.

The accused 36-year-old man, Benjamin Obadiah Foster, allegedly received assistance from a 68-year-old woman named Tina Marie Jones, who has since been arrested for hindering prosecution.

Ars could not immediately reach Grants Pass PD for comment on which dating apps Foster is known to be using. After arresting Jones, the department vaguely reported that its search revealed that Foster is “actively using online dating applications to contact unsuspecting individuals who may be lured into assisting with the suspect’s escape or potentially as additional victims.”

A spokesperson for the dating app Bumble told Ars: “Our team has been working around the clock to identify any members based on the information that is available to us at this time. As of now, we have not located any members with the name Benjamin Obadiah Foster on Bumble.”

Bumble’s spokesperson told Ars that “any time” the dating app becomes aware of reports of potentially dangerous users, the company takes “swift action against” accounts, with any profile that violates community safety guidelines “getting blocked from the app for good.”

“These are horrific crimes,” Bumble’s spokesperson told Ars. “We extend our deepest thoughts to all of the victims’ family and loved ones. We have a dedicated law enforcement team available to respond to any requests from law enforcement as needed and a law enforcement portal to facilitate access to data for investigative purposes.”

Dating apps have recently come under fire over user safety concerns. Last month, the Match Group, which owns Tinder, Match, Hinge, OKCupid, Plenty of Fish, and other dating apps, rolled out a background check feature on Tinder that could help some dating app users avoid potentially dangerous matches. Some experts told The Guardian that the background check tool might be inefficient for weeding out unsafe matches, though.

A Match Group spokesperson told Ars that the company has searched for Foster on its apps to no avail.

“At this time, we haven’t been able to locate this person on our platform,” Match Group’s spokesperson said. “We are continuing to look into this and will let you know if anything changes on our end.”

Ars could not reach any of the other popular dating apps to confirm whether Foster’s active profiles have been flagged or if dating apps are actively coordinating with police to locate the suspect.

Police report that they’re depending on citizens to help in this arrest, sharing that the blue-eyed Foster is 6 feet tall, weighs 180 pounds, and has brown hair that he frequently wears in a bun. They’ve offered a $2,500 reward for information leading to Foster’s arrest, warning not to approach the suspect because Foster is believed to be armed with a handgun and considered “extremely dangerous.” Anyone with information can call the Grants Pass Police tip line at 541-237-5607.

Grants Pass PD warns that Foster may change his hair or shave his beard to avoid detection by app users, recommending that users pay close attention to his facial structure and eyes in a photo shared by media.

“We are confident this dangerous criminal will soon be captured with the assistance of a concerned citizen,” Grants Pass PD said in a statement yesterday.

Foster is not just accused of attempted murder in Oregon but was also convicted in 2019 for kidnapping another woman for two weeks in Nevada. The other victim escaped during a shared grocery store trip, and Foster could have faced decades in prison for assault and battery, but in August 2021, he reached a plea deal and spent just 200 days in state custody, AP reported. Now, Oregon police say they’re searching “round-the-clock” to find him, coordinating with federal partners and seemingly relying on a data trail on his dating apps.

“We are using every piece of technology available to locate this man,” Grants Pass Police Chief Warren Hensman told AP.

https://arstechnica.com/?p=1913479

Charter Communications was once on the hook for over $7 billion in a case involving a former cable technician who murdered an elderly customer in her home. But Charter is now on the verge of settling the lawsuit for less than $262 million, an amount that will apparently be fully covered by the company’s insurers.

A Dallas County Court jury last year decided that Charter should pay the victim’s family and estate $7 billion in punitive damages and $337.5 million in compensatory damages. A judge lowered the total amount to over $1.1 billion.

Charter said it planned to appeal the $1.1 billion judgment, and the sides held settlement talks. The family apparently opted to take a smaller amount instead of risking an appeal that would drag out the case longer and potentially result in lower damages or an overturned verdict.

Charter described the results of settlement talks in a Securities and Exchange Commission filing on Friday. Charter said that plaintiffs’ monetary demands steadily decreased in the months after the verdict and that Charter’s insurers pressured the cable company to strike a deal. There’s now a tentative settlement between the plaintiffs and a Charter subsidiary referred to as Charter Communications, LLC (CC, LLC):

On January 11, 2023, and after issuing a series of decreasing settlement demands over several months, the plaintiffs issued a new, lower settlement demand to CC, LLC and its insurers, and then on January 18, 2023, plaintiffs also filed a notice of remittitur with the court to further reduce the judgment to $262 million, comprised of $87 million in actual damages, and $175 million in punitive damages. On January 24, 2023 and upon the insistence and demand of its insurers, CC, LLC reached a tentative settlement of this lawsuit at an amount substantially less than the reduced judgment and within CC, LLC’s insurance coverage.

“In the event the settlement is not ultimately finalized, CC, LLC will continue to vigorously defend this lawsuit including pursuing all available appeals,” Charter’s filing also said. Charter said it previously “posted a $25 million bond to stay the judgment pending appeals.”

A Light Reading article about the Charter filing quoted a New Street Research analyst as writing that the settlement amount is “within Charter’s insurance coverage and shouldn’t cost Charter anything… This settlement should reduce any overhang there might have been on the stock due to the lawsuit.” Charter is the second biggest cable company in the US and reported revenue of $54 billion and net income of $5.1 billion in 2022.

Jury found Charter committed forgery and gross negligence

Former Charter Spectrum technician Roy Holden pleaded guilty to the 2019 murder of 83-year-old customer Betty Thomas and was sentenced to life in prison in April 2021. Charter was accused of hiring Holden without verifying his employment history and ignoring a series of red flags about his behavior, which included stealing credit cards and checks from elderly female customers.

While Judge Juan Renteria lowered the awarded damages, he ruled in favor of the plaintiffs and did not dispute the jury’s conclusions—that “Mrs. Thomas’s death was caused by Charter’s gross negligence” and that “Charter knowingly or intentionally committed forgery with the intent to defraud or harm Plaintiffs.”

“This was a shocking breach of faith by a company that sends workers inside millions of homes every year,” one of the family’s lawyers said after the jury verdict. The family’s law firm said that when Thomas caught Holden stealing her credit cards from her purse, he “brutally stabbed the 83-year-old customer with a utility knife supplied by Charter Spectrum and went on a spending spree with her credit cards.”

After the family sued, “Charter Spectrum attorneys used a forged document to try to force the lawsuit into a closed-door arbitration where the results would have been secret and damages for the murder would have been limited to the amount of Ms. Thomas’s final bill,” the law firm said.

Charter said in a statement to media that the “crime was not foreseeable” and that Holden’s pre-employment criminal background check “showed no arrests, convictions, or other criminal behavior.” Charter also said Holden had “more than 1,000 completed service calls with zero customer complaints about his behavior.”

Disclosure: The Advance/Newhouse Partnership, which owns 12.4 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica.

https://arstechnica.com/?p=1913433

A major independent flight tracking platform, which has made enemies of the Saudi royal family and Elon Musk, has been sold to a subsidiary of a private equity firm. And its users are furious.

ADS-B Exchange has made headlines in recent months for, as AFP put it, irking “billionaires and baddies.” But in a Wednesday morning press release, aviation intelligence firm Jetnet announced it had acquired the scrappy open source operation for an undisclosed sum.

Jetnet mostly provides intelligence for the aviation industry and was itself acquired by private equity firm Silversmith Capital Partners last year. According to a company press release, “the acquisition is the second of what the company anticipates will be several future acquisitions as Jetnet expands its data-driven product offerings for the aviation industry.”

The deal wasn’t exactly welcomed by the user base that makes up ADBS-B Exchange. “I don’t see a long future for ADSBx under a PE [private equity] firm,” one user wrote on ADS-B Exchange’s Discord server. “And definitely not the information-for-all we-show-all-the-data service it is today. The paycheck was bigger than the vision.”

“Wouldn’t surprise me if it becomes censored because it’s owned by a PE,” another user chimed in.

ADS-B Exchange, like bigger competitors FlightRadar24 and FlightAware, allows users armed with the aircraft registration details to follow planes’ flight paths and access historical travel data. That data, as WIRED reported last month, is enormously helpful for plane spotters, open source investigators, and aviation regulators.

What separates ADS-B Exchange from the other, more established operations is where it sources its data. FlightAware and FlightRadar24 have a dedicated team of volunteer and amateur data collectors, or feeders, but they also rely heavily on government feeds, including from the US Federal Aviation Authority (FAA).

ADS-B Exchange, on the other hand, is entirely user-supported. Across the globe, volunteers set up receivers—which can be built, or bought for relatively cheap—designed to receive real-time data from planes in mid-flight. They, in turn, feed that data into ADS-B Exchange’s software, which compiles the thousands of inputs and displays a real-time map of all the world’s in-transit flights.

The standard the exchange relies on, Automatic Dependent Surveillance-Broadcast (ADS-B), is becoming increasingly ubiquitous and is mandated by the FAA. It’s that standard that has made ADS-B Exchange so reviled by Musk and the Saudis. Plane owners who wish to hide their flight paths from the general public can submit a request to the FAA, which can require that downstream users of their feeds, like FlightRadar24 and FlightAware, suppress that information. Because ADS-B is transmitted without encryption, directly from the planes themselves, that kind of censorship isn’t possible.

ADS-B Exchange’s administrators pride themselves on never hiding flight data. James Stanford, one of ADS-B Exchange’s senior administrators, told WIRED their website has been used to track gold smugglers and kidnappers, and it has been threatened by billionaires and warlords who aren’t keen on having their private jets tracked.

https://arstechnica.com/?p=1913176

For years, the cryptocurrency economy has been rife with black market sales, theft, ransomware, and money laundering—despite the strange fact that in that economy, practically every transaction is written into a blockchain’s permanent, unchangeable ledger. But new evidence suggests that years of advancements in blockchain tracing and crackdowns on that illicit underworld may be having an effect—if not reducing the overall volume of crime, then at least cutting down on the number of laundering outlets, leaving the crypto black market with fewer options to cash out its proceeds than it’s had in a decade.

In a portion of its annual crime report focused on money laundering that was published today, cryptocurrency-tracing firm Chainalysis points to a new consolidation in crypto criminal cash-out services over the past year. It counted just 915 of those services used in 2022, the fewest it’s seen since 2012 and the latest sign of a steady drop-off in the number of those services since 2018. Chainalysis says an even smaller number of exchanges now enable the money-laundering trade of cryptocurrency for actual dollars, euros, and yen: It found that just five cryptocurrency exchanges now handle nearly 68 percent of all black market cash-outs.

In fact, Chainalysis saw just 542 cryptocurrency deposit addresses receive more than half of the $6.3 billion in total illicit funds it tracked to those cash-out services in 2022, and just four addresses received $1.1 billion of those funds.

That intense narrowing of so-called “off-ramps” for crypto crime is a result of an ongoing government crackdown on crypto money laundering and a sign of additional enforcement on the way, says Kim Grauer, Chainalysis’ director of research. “It’s shocking to see some of these deposit addresses moving more than a hundred million dollars in illicit funds and still operating when it’s something that’s extremely transparent and easy to see with blockchain analytics,” Grauer says. “So it does seem like a good chokepoint, where we can shut down and profile and—to some degree—eradicate this activity.”

Whether the overall amount of crypto crime rose or fell in 2022, meanwhile, is far from clear: By some measures, Chainalysis’ data has shown that criminal use of cryptocurrency increased last year despite the steep decline in cryptocurrency exchange rates. But those numbers include a huge spike in illegal transactions at sanctioned cryptocurrency exchanges—which may have less to do with a rise in crime than with the US Treasury’s Office of Foreign Asset Control (OFAC) increasingly imposing those sanctions on major players in the crypto underground. In April of last year, for instance, OFAC sanctioned Garantex, an exchange based in Russia that it says laundered over $100 million in criminal proceeds, including ransomware payments. The year before, it sanctioned two other Russian exchanges, Chatex and Suex, which have since gone out of business. And just last week, OFAC sanctioned another exchange, Bitzlato, and the Justice Department indicted its Russian founder, Anatoly Legkodymov, and tore his operation offline.

https://arstechnica.com/?p=1913170

Paul Hansmeier, who is serving a 14-year prison sentence for filing sham copyright infringement lawsuits and extorting money from victims, has lost an attempt to enforce copyrights from prison. In a ruling Monday, a federal judge rejected Hansmeier’s request to prevent the government from enforcing mail-wire fraud and money laundering laws against him. Hansmeier wanted an injunction so that he could file copyright lawsuits without facing new charges.

Hansmeier, who is also appealing his conviction despite having pleaded guilty, will be familiar to Ars readers as one of the principals behind the notorious “copyright troll” firm Prenda Law. He was sentenced in June 2019 “for an elaborate fraud scheme that involved uploading pornographic videos to file-sharing networks and then threatening to sue people who downloaded them,” as our reporting at the time said. Prenda Law’s strategy involved seeking settlements of a few thousand dollars from each victim.

Prenda Law founder John Steele pleaded guilty in 2017 to charges of conspiracy to commit mail fraud and wire fraud and conspiracy to commit money laundering and cooperated in the investigation into Hansmeier. Hansmeier ultimately pleaded guilty to the same charges in August 2018. Steele was sentenced to five years in prison in July 2019.

Hansmeier and Steele obtained subscriber information from Internet service providers and “threaten[ed] victims with enormous financial penalties and public embarrassment unless they agreed to pay a $3,000 settlement fee,” the US Department of Justice said in a press release at the time of Hansmeier’s sentencing. They obtained a total of $3 million “from extortion victims to settle sham copyright infringement lawsuits,” the DOJ said.

Hansmeier claimed his “litigation will be socially valuable”

Last week, Hansmeier filed a motion in US District Court for the District of Minnesota saying he wants to “hire an undercover investigator to protect his copyrights against Internet piracy and bring claims under the Copyright Act and the Computer Fraud and Abuse Act against people who trespass on his computers to infringe his works.”

The motion sought an injunction preventing “the government from enforcing the mail-wire fraud conspiracy (18 U.S.C. 1349) and money laundering conspiracy (18 U.S.C. 1956(h)) statutes against [Hansmeier] on account of this copyright enforcement activity.” US District Judge Joan Ericksen denied the request for a preliminary injunction in a brief order. TorrentFreak covered the ruling in an article on Wednesday.

Hansmeier’s now-rejected motion for an injunction said his proposed “litigation will be socially valuable. Internet piracy is a cancer eating away at the markets for creative expression.” Hansmeier’s motion claimed his new lawsuits would “avoid association with pornography” and enforce copyrights “in less socially stigmatizing material, like poetry.”

Hansmeier also told the court he would “sue fewer people; instead of suing thousands of people at a time, he will bring more significant cases against a considerably smaller number of people.” But his motion said he “is chilled from engaging in this petitioning activity by the credible threat of criminal prosecution” due to “Hansmeier’s current imprisonment based on his participation in copyright enforcement activity similar to that which he wants to participate in now.”

Ericksen’s order noted that Hansmeier is “subject to a filing restriction.” The restriction was imposed in March 2022 by US District Judge John Tunheim in a ruling that said Hansmeier “has filed at least sixteen actions in this district alone challenging the constitutionality of the federal mail fraud, wire fraud, and extortion statutes.”

Hansmeier’s challenges filed from prison “allege that the statutes are unconstitutional because they either prevent him from pursuing copyright enforcement or prevent him from assisting unidentified individuals pursuing Americans with Disabilities Act (ADA) enforcement claims,” Tunheim wrote. Tunheim’s ruling prohibited Hansmeier from filing new lawsuits or pleadings on those topics in the District of Minnesota against the US attorney general and other federal officials “unless he obtains prior written approval” from the court.

https://arstechnica.com/?p=1913090

Like any social media platform, Truth Social relies on advertising to drive revenue, but as Twitter’s highly publicized struggle to retain advertisers has shown, it’s hard to attract major brands when a company’s content moderation capabilities appear undependable. That’s likely why Truth Social—which prides itself on sparking an “open, free, and honest global conversation” by largely avoiding content moderation altogether—has seemingly attracted no major advertisers.

A New York Times analysis of hundreds of Truth Social ads showed that the social media platform’s strategy for scraping by is taking ads from just about anyone. Currently, the platform, which was founded by former president Donald Trump, is attracting ad dollars from “hucksters and fringe marketers” who are peddling products like Trump tchotchkes, gun accessories, and diet pills, the Times reported.

In addition to Truth Social’s apparently struggling ad business, SFGate reported in November that Truth Social’s user base also seems to be dwindling. According to The Righting, a group monitoring conservative media, Truth Social traffic peaked last August at 4 million unique visitors but dropped to 2.8 million by October.

Failing to attract ad dollars, losing a huge chunk of traffic, and potentially seeing Trump pivot back to major platforms (he has recently regained access to Twitter and Facebook) could put Truth Social in a dire financial situation. William Wilkinson, a former executive at Trump Media & Technology Group, Truth Social’s parent company, told the Times that the social platform fueled by a $37 million donation is “burning through about $1.7 million each month.”

Trump Media & Technology Group did not immediately respond to Ars’ request for comment.

What’s scaring off major brands?

In August, when Truth Social traffic was at its peak, the platform boasted about its novel ad strategy, hoping to attract more advertisers with its “rapidly growing, highly engaged audience.” Partnering with Rumble Ads—which said in the same press release that it created an “ecosystem” for advertisers seeking to push back against “cancel culture”—Truth Social CEO Devin Nunes predicted that Truth Social would “displace” Big Tech platforms as a preferred advertising space.

That prediction has seemingly not panned out. New York Times reporter Stuart A. Thompson spent several months running a program collecting and analyzing Truth Social ads, concluding that amid Truth Social’s dwindling finances, “ads from major brands are nonexistent on the site.”

Ad experts told the Times that Truth Social major brands are put off because of users posting conspiracy theories and hyperpartisan statements. But the brands could also be avoiding Truth Social simply because there aren’t as many users there to reach compared to Facebook’s billions of users or Twitter’s hundreds of millions. Perhaps most significantly, Truth Social wasn’t attracting enough young audiences for brands to funnel ad spends that way.

Rumble Ad’s advertiser tools could also be partly to blame, the Times reported. The tools make it harder to track an ad’s performance compared to major platforms and seem to limit advertiser abilities to target specific demographics. Rumble did not immediately respond to Ars’ request for comment.

Among the samples the Times collected were ads for “vaccination exemption” cards, kids’ guides to “resisting socialism,” and plenty of gold-plated and “diamond-dusted” Trump trinkets. While there was nothing misleading about some of these ads, like those pushing Trump hats or bobbleheads, other ads sold fake merchandise. Some clearly fabricated information to make sales, like creating a fake tweet from Joe Biden to push a $2 bill with Trump’s face on it. Others relied on disturbing imagery to sell “miracle cures” like “nature’s oxycontin” or alternative medicines for common ailments like toe fungus, vision impairment, and wrinkles.

Brand safety will always be major brands’ top priority, and it seems that most brands see advertising on Truth Social as playing with fire. Even for the advertisers on Truth Social, the platform may not be doing enough to keep them in business.

The Times pointed to a YouTube video posted by online marketer Maxwell Finn, who claimed to be one of Truth Social’s top advertisers. Finn said in the video that he has spent over $150,000 on Truth Social and has invested in other right-wing-centric platforms. He confirmed that he was frustrated that he had to track his own ad performance on Truth Social—otherwise, he wouldn’t know if his ads were generating any sales at all.

“They’ve gotten incredibly bare-bones, and this is really strange and kind of frustrating because they’re all struggling to make money,” Finn said of conservative platforms like Truth Social and Gab.

Ars could not immediately reach Finn for comment, but he potentially represents Truth Social’s ideal advertiser: someone who wants to target a niche user base to sell Trump gear. But Finn suggests that Truth Social isn’t doing enough to build basic advertiser tools that would keep marketers on the platform. Not investing in better ad tools could lead to more financial trouble for Truth Social, as major brands remain shy and Trump eyes spending more time on other platforms ahead of his next presidential bid.

“You have a decent user base, and you have advertisers that want to spend money in your platform, that want to diversify. They want to get off of Facebook, they want to get off of TikTok, they want to get off of YouTube,” Finn said. “That continues to be my biggest gripe.”

https://arstechnica.com/?p=1913042