The pressure on Twitter to talk publicly about how it monitors and removes spam accounts continues to mount.

Reports from CNN and The Washington Post reveal an 84-page whistleblower complaint alleging that Twitter isn’t motivated to track the true number of spam accounts and hid security vulnerabilities from federal regulators.

The complaint comes from Twitter’s former security chief, Peiter Zatko. Zatko is a well-known ethical hacker with the alias “Mudge.” He told the Post that he “felt ethically bound” to report his serious concerns to government agencies. He alleges that he was fired for pushing disinclined Twitter executives to address major security problems—which his complaint suggests “pose a threat” to Twitter “users’ personal information, to company shareholders, to national security, and to democracy.”

Zatko alleges that Twitter execs were more invested in covering up those vulnerabilities, including cherry-picking and misrepresenting data on spam accounts and security threats to regulators and Twitter’s board members. “Executives stood to win individual bonuses of as much as $10 million tied to increases in daily users, the complaint asserts, and nothing explicitly for cutting spam,” the Post reported. These security risks, CNN reported, “could allegedly open the door to foreign spying or manipulation, hacking, and disinformation campaigns.”

How US government is responding

The Federal Trade Commission is now reviewing Zatko’s complaint, which was filed in July to the FTC, the Securities and Exchange Commission, and the Department of Justice. A Senate Intelligence Committee spokesperson, Rachel Cohen, told CNN that the committee is also taking the complaint seriously and has set up a meeting to discuss Zatko’s allegations.

Zatko’s lawyer at Whistleblower Aid, John Tye, told CNN that Zatko has not been in touch with potential Twitter buyer Elon Musk. That doesn’t mean, however, that Musk won’t benefit from these reports.

The Post notes in a separate report that Zatko’s complaint may give Musk the “ammunition” the Tesla CEO needs in his legal battle over terminating his Twitter buyout. Musk’s lawsuit hinges partly on Musk’s claims that the social media company misled Musk to pay more for Twitter than it’s worth by vastly misreporting the total number of spam accounts. A chunk of Twitter’s valuation comes from advertising sales based on promised exposure to legitimate users. Therefore, the number of spam accounts matters to Musk as much as it does to regulators tracking Twitter security risks.

Twitter questioned whether Zatko’s motivations were ethical or perhaps reflected some malicious intent. “Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers, and its shareholders,” a Twitter spokesperson told CNN. “Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

Twitter, Musk, Musk’s legal team, and the DOJ did not immediately respond to Ars’ requests for comment. The FTC and SEC declined to comment to Ars.

One of Musk’s attorneys, Alex Spiro, told CNN that Musk has already issued a subpoena for Zatko, noting that Musk’s legal team found Zatko’s dismissal from Twitter earlier this year “curious” when considered “in light of what” they’ve found since filing the lawsuit.

Twitter isn’t being completely forthcoming. CNN submitted more than 50 questions to Twitter, which only answered some. Addressing the complaint overall, however, a Twitter spokesperson told CNN that Zatko’s complaint was pushing a false “narrative about our privacy and data security practices that is riddled with inconsistencies and inaccuracies, and lacks important context.”

Zatko’s legal team rejected Twitter’s characterization of the complaint.

“Mudge stands by everything in his disclosure, and his career of ethical and effective leadership speaks for itself,” Tye told Ars. “The focus should be on the facts laid out in the disclosure, not ad hominem attacks against the whistleblower.”

In total, Zatko’s disclosure spans 200 pages. The Post linked to redacted copies of the disclosure, which include Zatko’s final report to Twitter that describes all the security issues that he alleges that Twitter leadership willfully overlooks.

CNN reported that Twitter risks billions in FTC fines if discovered to be, as Zatko alleges, violating a 2010 FTC agreement to address federal regulators’ security concerns.

https://arstechnica.com/?p=1875550

One of the creators of the Botometer—a web tool Elon Musk used to estimate Twitter’s spam percentage for a court filing—has reportedly said that Musk’s calculation “doesn’t mean anything.” Kai-Cheng Yang, a Ph.D. candidate at Indiana University, “questioned the methodology used by Mr Musk’s team and told the BBC they had not approached him before using the tool,” a BBC article said today.

A Musk court filing on August 4 claimed a Botometer analysis of Twitter firehose data in the first week of July “shows that, during that timeframe, false or spam accounts accounted for 33 percent of visible accounts.” But as Yang pointed out, the Botometer provides scores from 0 to 5—with 5 being the most bot-like—and Musk’s court filing didn’t say where he set the cutoff between human and bot.

“In order to estimate the prevalence [of bots] you need to choose a threshold to cut the score,” Yang told the BBC. “If you change the threshold from a three to a two then you will get more bots and less human.” Because Musk’s court filing “doesn’t make the details clear,” Musk “has the freedom to do whatever he wants. So the number to me, it doesn’t mean anything,” Yang said.

“Technically, you can choose any threshold you want and to get any result you want,” Yang said in an earlier interview with Yahoo. The Botometer is a project of the Observatory on Social Media and the Network Science Institute at Indiana University.

Botometer rated Musk a likely bot

The Botometer itself once “indicated that Elon Musk’s own Twitter account was likely a bot, scoring it 4/5,” as Twitter pointed out in a court filing. Musk’s Botometer score has reportedly fluctuated between 0.5 and 4, showing the tool rates Musk as human-like on some days and as more bot-like on others.

Twitter also pointed out that Musk and his team “have not indicated what score they are applying to conclude an account constitutes spam; thus, their allegation is unverifiable.” Twitter further noted that an account could be a bot without being what the company considers a fake account or spam. Twitter gave examples such as bots “that report earthquakes as they happen or updates on the weather.”

Other types of legitimate accounts can be seen as likely bots by the Botometer. The Botometer gave my own verified Twitter account a bot score of 3 out of 5 today, and it rated the verified Ars Technica account 3.6 out of 5.

The Botometer website’s FAQ cautions against labeling every account above a certain number a bot. “It’s tempting to set some arbitrary threshold score and consider everything above that number a bot and everything below a human, but we do not recommend this approach… We believe it is more informative to look at the distribution of scores over a sample of accounts,” the FAQ says.

Yang surprised Musk didn’t create a better tool

Yang also spoke to CNN recently, expressing surprise that Musk used the Botometer instead of creating something more precise. “To be honest, you know, Elon Musk is really rich, right? I had assumed he would spend money on hiring people to build some sophisticated tool or methods by himself,” Yang told CNN.

The Botometer is best used “to complement, not to replace, your own judgment,” the tool’s FAQ says, noting that “humans and machines have different strengths when it comes to pattern recognition. Some ‘obviously’ bot/human accounts according to a human observer will fool a machine-learning algorithm. For example, Botometer sometimes categorizes ‘organizational accounts’ as bot accounts. Likewise, an algorithm may confidently classify some accounts that humans have a hard time with.”

Twitter sued Musk in Delaware Court of Chancery after he tried to get out of his commitment to buy the company for $44 billion. Musk has defended his attempt to break the merger agreement by questioning Twitter’s public disclosure that less than 5 percent of its monetizable daily active users (mDAU) are spam or fake.

Twitter defends the accuracy of its estimates, saying they are based on “multiple human reviews (in replicate) of thousands of randomly selected accounts each quarter using both public and private data.” Twitter also says Musk has no right to exit the merger agreement based on the number of spam accounts.

Musk has plans for a more thorough spam analysis, his court filing said. “Defendants’ experts are continuing their analysis even now and, in anticipation of production of additional data by Twitter (including ‘private’ data that Twitter makes available to its human reviewers and contends is necessary to verify its reported less-than-5-percent spam and false user rate), intend to conduct a more comprehensive analysis and expect to present updated estimates and findings in expert reports and at trial,” Musk’s lawyers wrote.

https://arstechnica.com/?p=1874991

In a few weeks, Ethereum is slated to undergo the most significant change in its seven-year history. Until now, the Ethereum blockchain has been secured using a method called “proof-of-work,” which consumes more electricity than the entire nation of Belgium. Next month’s switch to a new method called “proof-of-stake” is expected to cut Ethereum’s energy consumption by a factor of 1,000.

The stakes are high. A botched transition could mean chaos for the many crypto projects built on top of Ethereum. A smooth transition would be the culmination of years of careful planning by Ethereum’s core developers. Over the last year, developers have repeatedly pushed back the date of “the Merge” to give themselves more time to prepare. They completed a final dress rehearsal on August 10, clearing the way to make the switch in mid-September.

The most immediate consequence of a successful Merge will be to put the world’s Ethereum miners out of work. Over the last seven years, thousands of people have bought high-end graphics cards to help maintain the Ethereum blockchain—and to earn newly created ether in the process. The new system for updating the Ethereum blockchain doesn’t require the same kind of beefy hardware—or the massive electricity bill that goes with it. So the price of used graphics cards might continue to fall as Ethereum miners exit the industry.

But the switch to proof-of-stake is much more than just an energy-saving measure—it’s a major overhaul of the Ethereum network. Ethereum founder Vitalik Buterin believes the Merge will lay the foundation for a series of future upgrades that will allow the network to handle a much larger volume of transactions in the coming years. But critics worry that the new scheme could cause the Ethereum network to become overly centralized—and hence vulnerable to government regulation.

From proof-of-work to proof-of-stake

At a high level of abstraction, here’s how any blockchain works: Someone on the network proposes a block containing a list of recent transactions. Then other network participants verify that the block follows the network’s rules. If a sufficient number of other network participants accept the block, it becomes the “official” next block in the chain. As long as most network participants are honest, users can have confidence that transactions accepted by a majority of the network won’t be removed or modified later.

The big challenge for any blockchain project is preventing a malicious party from creating many sock puppet accounts to “stuff the ballot box,” outvote the honest participants and thereby tamper with past transactions. Bitcoin’s pseudonymous founder Satoshi Nakamoto’s big insight—the one that made bitcoin possible—was that this problem could be solved using the principle of “one hash, one vote.” On the bitcoin network, whoever has the most computing power—specifically, the capacity to compute SHA-256 hashes—has the most influence over which blocks get added to the blockchain. As long as honest miners have more hash power than malicious miners, users can be confident in the integrity of the blockchain—and hence in the integrity of payments made using the bitcoin network. (Check out our in-depth bitcoin explainer for details on how this works.)

When Vitalik Buterin launched Ethereum in 2015, he used a variant of Nakamoto’s scheme. By that point, bitcoin mining was already dominated by specialized silicon optimized for computing huge numbers of SHA-256 hashes, locking ordinary bitcoiners out of the mining game. So Buterin developed a new mining algorithm designed to be “memory-hard”—and therefore difficult to accelerate with custom hardware. As a result, Ethereum mining is still largely performed using off-the-shelf graphics cards, allowing ordinary Ethereum users to participate.

But the economics of the two networks are fundamentally similar. As the values of bitcoin and ether have risen, it has become profitable for people to spend more and more money on mining hardware—and electricity—to generate new coins. While this has made the networks more secure, it has also meant that both networks consume astronomical amounts of electricity and hence drive more and more carbon emissions.

The bitcoin and Ethereum communities have responded to this issue very differently. Satoshi Nakamoto disappeared from public view in 2011. In his absence, bitcoin’s culture has become increasingly conservative. Many bitcoiners adamantly oppose changing bitcoin’s mining system, fearing that changes could open the door to centralization and ultimate government control. As a result, bitcoin is unlikely to move away from proof-of-work in the foreseeable future.

https://arstechnica.com/?p=1874521

Yesterday, the anti-vaccine group the Children’s Health Defense celebrated the spread of poliovirus in New York, mocking health officials spreading awareness that polio is vaccine-preventable. Today, CHD reports that the group was also permanently banned from Facebook and Instagram yesterday. A screenshot of Meta’s notification in its press release says that the ban is due to CHD’s practice of spreading “misinformation that could cause physical harm.”

A Meta spokesperson tells Ars that Meta “removed the Instagram and Facebook accounts in question for repeatedly violating our COVID-19 policies.”

CHD says the ban came “without warning,” cutting the anti-vax group off from hundreds of thousands of followers on both social media platforms. Denying allegations that the group spreads misinformation, CHD suggested instead the ban is connected to CHD’s lawsuit against Meta that questions the validity of how Facebook and the Centers for Disease Control and Prevention label health misinformation. The group’s legal counsel in that lawsuit, Roger Teich, suggested that the ban was improper.

“Censorship is not only unconstitutional, it’s un-American,” Teich said in the press release.

CHD founder Robert F. Kennedy Jr.—who, as AP reported, likens getting vaccines to “drinking Kool-Aid”—seemed to suggest that Meta was retaliating against CHD on behalf of the CDC: “Facebook is acting here as a surrogate for the federal government’s crusade to silence all criticism of draconian government policies,” Kennedy said in the press release.

CHD directed Ars to the press release for comments. Teich did not immediately respond to Ars’ requests to comment.

Meta’s move comes after years of tension with CHD over its content. Back in 2019, researchers identified CHD as the single leading source of anti-vax ads on Facebook. It has taken the entire pandemic to get to the point of banning the account.

Meta’s not the only social media platform that has pushed back on CHD’s misinformation. Last year, YouTube banned CHD, among other anti-vax accounts, for claiming the COVID-19 vaccine was ineffective. In 2021, Meta also made headlines when Instagram banned Kennedy’s account “for repeatedly sharing debunked claims about the coronavirus or vaccines.”

Although CHD said it had no warning, Vice reported that CHD shared in an email newsletter that this week’s permanent ban followed a temporary 30-day ban: “​​Despite not posting content on Facebook for the past 21 days due to an existing 30-day ban, and constantly self-censoring our content in an attempt to avoid continual shadow-banning and censorship, both pages were abruptly de-platformed. Removing CHD accounts is evidence of a clearly orchestrated attempt to stop the impact we have during a time of heightened criticism of our public health institutions.”

Meta tells Ars that before any ban, Meta uses “a strike system to count violations” so it can hold accountable “those who continue violating” any Meta policies. Accounts are restricted or disabled “based on the number and nature of the strikes it accrues.”

https://arstechnica.com/?p=1874691

Among the first location data brokers to publicly come under fire by the Federal Trade Commission for allegedly selling sensitive reproductive health data is Kochava, Inc. In a lawsuit filed by the adtech company this week, Kochava asked a federal court to intervene and stop the FTC from an alleged overreach.

Kochava’s complaint revealed for the first time how the FTC might act to protect consumer data from being used to support abortion prosecutions in post-Roe America. In it, Kochava described a proposed FTC complaint against Kochava that alleges that the company’s data collection practices make it possible for third parties and bad actors to track users’ sensitive location data. The FTC suggests that mobile phone users weren’t reasonably informed that they were sharing this data with Kochava, making the practice unfair or deceptive and allegedly in violation of the Federal Trade Commission Act.

In a statement to Ars, Kochava defended its data collection practices: “Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy. Nonetheless, Kochava has been threatened by the FTC with a lawsuit and a proposed settlement, the merits upon which are not accurate. This is a manipulative attempt by the FTC to give the appearance that it is protecting consumer privacy despite being based on completely false pretenses.” Suing the FTC to block its lawsuit, Kochava in its complaint noted that the FTC has up to 60 days—by mid-October—to answer a court summons.

What did Kochava allegedly do?

According to its company website, Kochava is the “largest independent data marketplace for connected devices.” Based in Idaho, Kochava’s primary business is designing app-developer tools to track, organize, and visualize marketing data, often purchasing and selling third-party mobile device data to its customers under a secondary business called Kochava Collective.

The FTC alleges that Kochava customers can “license premium data,” which it says dangerously includes the “precision location of a consumer’s mobile device,” sharing “timestamped latitude and longitude coordinates showing the location of mobile devices.” This, the FTC says, could allow bad actors, law enforcement, or anyone with access to track consumers visiting sensitive locations such as “therapists’ offices, addiction recovery centers, medical facilities, and women’s reproductive health clinics.”

The FTC has alleged that Kochava’s data collection methods are “unfair or deceptive acts or practices in or affecting commerce,” because “they cause or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid themselves.” The FTC also says that the FTC Act applies because there’s no critical or universal benefit to consumers or the competitive market from collecting sensitive data.

Kochava says in its complaint that the FTC is wrong and doesn’t understand their technology, claiming that it already employs “technical controls to prohibit its customers from identifying consumers or tracking” third-party users at sensitive locations. The company says the lawsuit is a waste of time, primarily because the “FTC still has yet to issue any rule or statement with legal force and effect describing the specific geolocation data practices it believes” it has the authority to prohibit or permit. Absent that specific rulemaking, the FTC makes it hard for firms to comply with the law, Kochava suggests.

Kochava also says that allowing the FTC to tie up the adtech company in a lengthy legal proceeding would inflict “irreparable and significant harm upon Kochava.”

The FTC declined Ars’ request to comment.

Is the FTC overreaching?

Kochava says in its complaint that the FTC sent its proposed complaint around July or August. Shortly after, the company announced a new policy that would seemingly address the FTC’s complaint by installing what it calls a “Privacy Block” that “removes health services location data from the Kochava Collective marketplace.” The feature is employed regardless of whether users consent to data sharing, and it also allows anyone in the health sector to register to block their location.

In a press release, Kochava Collective’s general manager, Brian Cox, suggested that Kochava was now ahead of US regulators in building a very necessary “health services location block list” that puts user privacy first by putting the power to protect all staff and patients back in the health services industry’s hands.

“We believe it’s important for the industry to be proactive and to collaborate on a unified health services location block list,” Cox wrote, noting that “there is no federal regulation or federal database which catalogs these locations to protect consumer privacy.”

A Kochava spokesperson declined to tell Ars if the “Privacy Block” feature was prompted by the FTC proposed lawsuit or already in the works.

However, because Kochava has changed its ways, the complaint urges the federal court to agree that the FTC has no authority to “seek injunctive relief for past conduct that has ceased, absent evidence that it is likely to recur.” Kochava also asked the court to consider “fundamental disagreements” on the interpretation of the FTC Act that largely forms the basis of the FTC’s proposed complaint. Kochava alleges that the FTC’s proposed lawsuit would be an improper application of the FTC Act, which it says doesn’t specify how its data collection practices are “unfair” or “deceptive.” Kochava also suggests its due process rights have been violated by a presidential overreach urging the FTC to pursue such lawsuits absent explicit legislation regulating health data collection.

https://arstechnica.com/?p=1874614

As TikTok’s popularity and earnings soar, the company has decided to crack down on political content creators—sometimes with thousands of followers—who violate the app’s policies against paid political ads. TikTok says it has been aware of the problem since 2020, but it became an issue of public concern in 2021. That’s when the Washington Post and The Mozilla Foundation uncovered TikToks from both left- and right-wing content creators that appeared to be violating FTC guidelines, which require, at a minimum, that posts must be marked with an “#ad” hashtag.

TikTok has always left it up to content creators to self-disclose when they conduct deals with business partners off-site. However, in June 2021, the company made it easier to flag posts as ads (or “branded content”) in an effort to encourage more self-disclosure. Mozilla considered this a step in the right direction, but it recommended that TikTok work harder ahead of the next elections to promptly remove undisclosed paid political ads.

This week, TikTok appears to have taken that advice, with its head of US safety, Eric Han, announcing that the company will remove any content that violates TikTok’s rules on paid political ads. To prepare creators for stricter enforcement, Han said TikTok will post an educational series in its Creator Portal and host briefings with content creators to ensure “the rules of the road are abundantly clear when it comes to paid content around elections.”

“TikTok does not allow paid political ads, and that includes content influencers are paid to create,” Han wrote. “We work to educate creators about the responsibilities they have to abide by [in] our Community Guidelines and Advertising policies as well as FTC guidelines.”

The content creator loophole

TikTok banned paid political ads on its platform in 2019, but according to Reuters, content creators became a “loophole” that campaign strategists could exploit to spread messaging on the platform. It’s not just a TikTok problem, either. The Washington Post reported in 2020 that conservative nonprofit Turning Point USA “was recruiting and paying young people” on Facebook and Twitter “to pump out false messages about voter fraud, the coronavirus, and Joe Biden in order to bolster Trump’s re-election campaign.”

Mozilla said that it has become “urgent” for popular platforms like TikTok to change how they moderate content, or they risk ongoing undetected violations by bad actors. In 2018, for example, Mozilla exposed tax filings showing that TPUSA spent millions of dollars developing services that include “influencer media programs” with hundreds of content creators. The tax documents indicated that these funds are dedicated to ensuring the organization’s “long-term vitality.” Mozilla also found a small grassroots progressive political action committee called “The 99 Problems” that it said paid creators to spread pro-Biden messaging without disclosing that the posts were sponsored.

TPUSA and The 99 Problems didn’t immediately respond to questions from Ars asking if anything has changed about how they run influencer media programs.

In a press briefing described in a Reuters report, Hans said that TikTok is adding internal teams to help spot content violations. TikTok will also continue depending on outside reports from researchers and media outlets to track the scope of the issue. Experts say TikTok should share more data to support those efforts.

This week, TikTok also announced that it would work with accredited fact-checking organizations to prevent election misinformation from spreading in both unmarked ads and other general posts. Han said that TikTok’s policy is to restrict any content that is being fact-checked from its recommended “For You” pages.

TikTok did not immediately respond to Ars’ request for comment.

https://arstechnica.com/?p=1874412

After dealing with booming demand and global shortages since the start of the pandemic, the semiconductor industry is facing a sudden downturn.

But even for an industry accustomed to frequent cyclical slumps, this one has defied easy analysis and left researchers struggling to predict how the setback will play out.

The sudden glut in memory chips, PC processors, and some other semiconductors has come at a time when manufacturers in many automotive and industrial markets still lack a reliable supply of chips.

It has also forced some of the biggest US chipmakers to slash billions of dollars from planned capital spending, at the very moment that Washington has passed a long-awaited law to subsidize a huge increase in domestic chip manufacturing capacity.

The speed of the turn, and the conflicting forces at work, had been unprecedented, said Dan Hutcheson, the veteran chief executive of VLSI Research who has analyzed chip cycles since the 1980s.

“I’ve never seen a time when we had excessive inventory and we had shortages,” he said.

The immediate cause has been a rapid build-up in inventory in the chip supply chain since early this year. Compared with February, when there were enough chips on hand to support about 1.2 months of production, global inventory levels jumped to 1.4 months in June and then 1.7 months in July, according to VLSI Research.

Tumbling PC sales and weaker smartphone demand have been the main causes, as consumers retrench. But with fears rising of an economic slowdown, manufacturers of a wide range of equipment, which had been building inventory to make themselves more resilient to supply pressures, have reversed course. Meanwhile, it is unclear how much weakening chip sales reflect supply chain problems, rather than any fall-off in demand.

The suddenness of the turn has ricocheted through the sector since late July, when Intel stunned Wall Street with the news that revenue in its latest quarter had fallen $2.6 billion, or 15 percent, short of expectations. Chief executive Pat Gelsinger blamed it on the kind of inventory adjustment that only hits once in a decade, although Intel also admitted to errors of its own.

https://arstechnica.com/?p=1874201

Twitch has faced scrutiny for how it helps streamers targeted by extreme hate campaigns. Last year, the livestreaming service started suing users conducting “hate raids” that rely on bots to spew a continual barrage of hate speech. These raids, Twitch’s lawsuit says, have been “targeting black and LGBTQIA+ streamers with racist, homophobic, sexist, and other harassing content.” Now, vulnerable users are hoping that Twitch will use its heft to stop some of the deadliest attacks affecting marginalized users on the platform: swatting that has reportedly been increasing since 2015 and that now happens multiple times a week.

These swatting attacks are conducted by anonymous persons making prank calls to police, falsely reporting emergency circumstances (like an armed potential mass shooter or a hostage situation that doesn’t exist) in order to get SWAT teams to descend, guns out, on a Twitch streamer’s location. The Washington Post reported this week that these swattings appear to be intensifying and can be traumatizing for targeted Twitch streamers. One trans Twitch streamer told the Post that police in London aimed an assault rifle at her face.

Official attempts to prevent swatting

Back in 2017, a person who was an unintended target died after a swatting sent officers to the wrong address. The Twitch user who set up that swatting, Casey Viner, was sentenced to 15 months in prison, while the man whom Viner hired to place the prank call, Tyler Barriss, was sentenced to 20 years.

Since then, local and state governments have taken some steps to prevent swattings. Seattle created a police anti-swatting service to help Twitch users warn police of potential false reports. Those efforts helped lead Washington state to enact an anti-swatting law in 2020, and other states have followed that example. Kentucky passed a law earlier this year making it a Class D felony to file false reports “involving danger to life or property” if they incite police to react. That means prank callers can be heavily penalized for initiating a police response or leading officers to circulate false allegations that are likely to cause public alarm.

“Imagine having your local police department’s tactical response team surround your home in preparation of breaking down the door in what they believe is a rescue or hostage situation, only to learn that this was someone’s idea of a joke?” Phillip Pratt (R-Ky.), who sponsored the Kentucky anti-swatting bill, told me. “That’s exactly what happened in my community in March of 2021 and in other cities across the nation over the past few years. Not only is this a dangerous misuse of our first responders, but it has also led to the death of innocent people.”

Maximum penalties for prank callers under anti-swatting laws are not as extreme as Barriss’ sentence. Under the Kentucky law, victims are eligible to receive damages, including for emotional distress, and anyone sentenced risks up to five years in prison. US Senator Charles Schumer (D-N.Y.) previously sought to pass a federal law to increase that maximum sentence to eight years, but it stalled. Another attempt at passing an anti-swatting law was introduced in Congress in 2019, but so far, it has gone nowhere.

Without federal guidance, costs could prevent states from pursuing these sorts of cases. Tracking down offenders making false reports can be excessively expensive. Law enforcement who arrested Barriss estimated that it cost $100,000 to identify “just one hoax caller.” It’s difficult because, the Post notes, “harassers can use software to spoof phone numbers and IP addresses,” and this can effectively mask their identities.

However, states may realize that more resources need to be dedicated, especially since the practice appears to be targeting more users more often. The Post reported four attacks this week alone—which is a lot, considering that the Kentucky law was enacted after an estimated 10 attacks occurred within a year. Schumer’s bill was based on 21 attacks in a single New York county back in 2014. While swattings are not exclusively a Twitch problem—users on Twitter and other online platforms are vulnerable, too—Twitch is among the most visible, mainly because some SWAT raids are livestreamed to wide audiences.

https://arstechnica.com/?p=1873984

Amazon has accused the US Federal Trade Commission of harassing its top executives, including founder Jeff Bezos and chief executive Andy Jassy, as part of a probe into the ecommerce group’s Prime membership scheme.

Since March 2021, the regulator has been investigating whether Amazon uses deceptive techniques to lure customers into signing up for Prime, the subscription service that offers free delivery and other benefits at a cost of $139 a year.

The FTC is also examining whether Amazon unfairly complicates the process for customers who want to cancel their membership.

In a filing from August 5 that was made public by the regulator on Monday, Amazon said the investigation had become “unduly burdensome” on employees and executives after at least 19 were served individual subpoenas—or Civil Investigative Demands—to give evidence.

The company called for the FTC to “quash or limit” the demands, which it alleged served no other purpose other than to “harass Amazon’s highest-ranking executives and disrupt its business operations.”

Amazon said briefing Bezos and Jassy to testify on “granular” details would be a “tremendous burden on them.” At a minimum, the company said the deadline to provide the information should be extended.

The FTC did not respond to a request for comment. Amazon did not respond to requests for further comment.

Amazon said the sudden demands followed months of inactivity from the FTC and alleged the company and its executives were given just a few weeks to comply. It added that the FTC had circumvented Amazon’s legal team to serve the subpoenas directly to the individuals, creating “confusion” and “delay.”

Executives in addition to Bezos and Jassy who were served with subpoenas included Doug Herrington, Amazon’s head of retail, and Russell Grandinetti, head of international consumer.

Former executives Dave Clark, who had been head of worldwide consumer, and Greg Greeley, ex-head of Prime, were also served.

The filing accused the FTC of improperly denying at least one subpoenaed employee full access to Amazon’s legal team. It described one acrimonious investigative hearing that ended after just a “few minutes” after Amazon’s lawyer was asked to leave by FTC staff, prompting the testifying employee to follow.

The Prime program has been heralded as a linchpin of Amazon’s success, with members typically spending more money than non-members. Revenue directly from subscription fees was $8.7 billion in the second quarter, about 7 percent of Amazon’s total revenue for the period.

The FTC under the leadership of chair Lina Khan has pledged to crack down on the power of Big Tech groups. The regulator has in particular identified dealing with deceptive tactics online, so-called dark patterns, as a priority, and released a new set of guidelines in October.

The FTC’s investigation has been extended to four other Amazon subscription services including its ebook service Kindle Unlimited and music streaming platform Amazon Music.

Amazon’s requests will be subject to a vote by the FTC’s commissioners, which include three Democratic and two Republican appointees.

Details of the filing were first reported by Business Insider.

© 2022 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1873893

To help combat caste-based discrimination, the Indian government saves spots at the best Indian universities for lower-caste students, who often take that opportunity and turn it into a tech job in Silicon Valley. In the US, discrimination laws don’t specifically protect citizens based on caste, though that is changing. Reuters reports that, out of all the Big Tech companies relying on India’s skilled workers, Apple has been most explicit about preventing discrimination by caste among its US employees.

Reported this week for the first time publicly, Apple updated its employee conduct policy in 2020 to “explicitly prohibit discrimination on the basis of caste,” the same way it prohibits discrimination on the basis of race, gender, age, and ancestry.

The decision came after “the first US employment lawsuit about alleged casteism” was filed in June 2020 by a California employment regulator defending a low-caste engineer working at Cisco Systems. The engineer alleged that two of his Cisco bosses were higher-caste and impeded his advancement opportunities at the tech company.

Although Cisco has denied any wrongdoing and claims that it’s protected because California law does not prohibit discrimination by caste, the company will have to raise those defenses publicly in court. An appeals panel declined Cisco’s request for private arbitration. Cisco did not immediately provide Ars with a comment on the lawsuit or the company’s internal policies. (Update: A Cisco spokesperson declined to comment on ongoing litigation.)

Historically, caste was decided by family lineage, with the lowest castes assigned the worst jobs and the highest castes getting the better-paid work. Over time, research found that the caste system led higher-caste workers to become less likely to cooperate with people associated with lower castes. Though today lower-caste Indians can compete for better jobs, some higher-caste employees at tech companies may still view promoting lower-caste members as an insult to their ancestry.

Reuters interviewed “about two dozen” lower-caste US tech workers who claimed that they were overlooked for “hiring, promotions, and social activities” based on “caste cues.” Those cues could be based on their names, where they were born, or even what foods they ate for lunch.

Until US labor laws update the definition of discrimination to include casteism as on par with racism and sexism, each tech company is left to devise their own solutions to alleged discrimination. Reuters reviewed US industries employing “hundreds of thousands of workers from India” and found “patchy results” on the issue of casteism.

Apple told Reuters that the company “updated language a couple of years ago” in its equal employment opportunity and anti-harassment policies to reinforce that the company prohibits “discrimination or harassment based on caste.” It did not immediately respond to Ars’ request for comment.

IBM is another tech company that addresses casteism in its global policies.

But Reuters’ review of internal policy documents from companies like Meta, Microsoft, Google, and Amazon show that they do not explicitly prohibit casteism. All of these companies told Reuters that they “have zero tolerance for caste prejudice,” however, and some claimed that “such bias would fall under existing bans on discrimination by categories such as ancestry and national origin.” Those reassurances were not enough to stop more than 1,600 Google employees from signing a petition asking the company to add casteism to its global employee code of conduct as a form of prohibited discrimination.

Apple hasn’t said whether any complaints about casteism have been filed since updating its policies, but it’s clear from the Google petition that at least some US workers hope more tech giants follow in Apple’s footsteps. Google did not immediately respond to Ars’ request for comment.

It’s possible that the outcome of the Cisco discrimination case—which could come early next year—will prompt further changes to both US discrimination laws and the tech companies who set their policies based on federal and state guidance.

https://arstechnica.com/?p=1873825