The Internal Revenue Service today said that selfies collected from taxpayers will be deleted and that it has deployed a new verification option as an alternative to its controversial facial recognition system. The IRS’s use of the ID.me facial recognition service has been criticized by privacy and civil rights advocates as well as lawmakers from both the Democratic and Republican parties.

Two weeks ago, the IRS responded to the bipartisan backlash by saying it “will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts” and “quickly develop and bring online an additional authentication process that does not involve facial recognition.” Today, the IRS announced that a new option for creating accounts without facial recognition is “now available for taxpayers.”

Instead of providing a selfie, “taxpayers will have the option of verifying their identity during a live, virtual interview with agents; no biometric data—including facial recognition—will be required if taxpayers choose to authenticate their identity through a virtual interview,” the IRS said.

Creating a new IRS account still requires ID.me, so those agents are presumably ID.me employees. We ran into an error message when trying to create a new account today.

IRS: Biometric data will be “permanently deleted”

Taxpayers setting up new accounts can choose to use the ID.me selfie method that involves facial recognition technology instead. But based on today’s announcement, newly collected and previously collected images should all be deleted from ID.me’s servers.

The IRS explained:

Taxpayers will still have the option to verify their identity automatically through the use of biometric verification through ID.me’s self-assistance tool if they choose. For taxpayers who select this option, new requirements are in place to ensure images provided by taxpayers are deleted for the account being created. Any existing biometric data from taxpayers who previously created an IRS Online Account that has already been collected will also be permanently deleted over the course of the next few weeks.

The ID.me verification process used for the IRS and other agencies involves uploading a photo of an ID such as a license or passport along with a video selfie. The images are then compared against each other to verify the user’s identity. ID.me last month claimed it does not use the controversial “one-to-many” approach in which a person’s face is compared to a large database of faces, but the company later acknowledged that it uses both one-to-one and one-to-many.

“ID.me verifies identity using 1:1 face match only,” ID.me said in that clarification. “After an identity is verified, ID.me uses a specific 1:many check on selfies tied to government programs targeted by organized crime. That step is internal to ID.me and does not involve any external or government database. It occurs once during enrollment and exists to ensure a single attacker is not registering multiple identities. The 1:many step is not tied to identity verification.”

IRS will use Login.gov, eventually

The new IRS approach that lets users choose between facial recognition and a virtual interview is a “short-term solution” for this year’s tax-filing season, the agency said. Longer-term, the IRS said it “will work closely with partners across government to roll out Login.Gov as an authentication tool. The General Services Administration is currently working with the IRS to achieve the security standards and scale required of Login.Gov, with the goal of moving toward introducing this option after the 2022 filing deadline.”

ID.me uses Amazon’s Rekognition technology and says it provides identity verification services to 30 states and 10 federal agencies. Amid the recent backlash, ID.me on February 8 said it developed “a new option to verify identity without using automated facial recognition and will make this available to all public sector government partners.” That’s presumably the same option now being adopted by the IRS for this tax season.

ID.me also said it would let users “delete their selfie or photo at account.ID.me beginning on March 1.” ID.me says it has over 73 million users.

ID.me verification wasn’t required for filing tax returns, but the IRS did require it for accessing related services, such as account information, applying for payment plans online, requesting transcripts, and the Child Tax Credit Update Portal. The IRS was in the midst of a phase-in period, so ID.me verification was only required for people creating new IRS accounts. Under the original plan, people who previously created IRS accounts would have had to submit their selfies to ID.me’s facial recognition system by summer 2022.

The Electronic Frontier Foundation recently called the IRS and ID.me changes an important victory because “facial recognition is a dangerous surveillance tool. Coercing facial recognition to interact with the government is especially pernicious, as it unnecessarily forces people to give up their privacy in exchange for necessary services. Worse still, forcing people to hand their biometric data over to a third party, which is bound by fewer privacy restrictions and regulations, would have put huge swathes of the public’s personal data at risk of being misused.”

https://arstechnica.com/?p=1835733

In May 2021, grocery delivery company Zapp moved into a small garage, squashed between red brick apartment buildings on a residential street called Fagelstraat in Northwest Amsterdam. Many locals had never heard of dark stores, the mini warehouses grocery apps use to dispatch local deliveries. “We didn’t know exactly what they were doing or what type of business it was,” says local resident Alex (not his real name).

In less than a year, that small Fagelstraat garage has become an extreme example of how dark stores can clash with local neighbors. Alex, who has lived on the street for seven years and requested anonymity to avoid further conflict with riders, says there are now 10 to 15 deliveries each day, and giant lorries regularly block the narrow road. “It’s a 24/7 business,” he says, “so riders are coming in and out late at night and early in the morning. At 2 am, I often have people standing in front of my window, smoking and talking really loudly while they are taking a break.” After a month of this, riders and residents started squaring off as tensions boiled over, Alex says. “There’s been a few instances when I almost got into a fight,” he says. “One [rider] was completely in my face. It was pretty frightening.”

In the past year, the spread of dark stores has rapidly accelerated as grocery delivery apps Gorillas, Getir, Flink, and Zapp compete to dominate the Dutch market. As of January, there were 31 dark stores in Amsterdam alone. The Netherlands appeals to these companies because the country is small, densely populated, and flat, meaning it’s easy for their couriers to operate, says Yara Wiemer, an analyst at research and consulting company Kantar. Demand is also soaring. The number of Dutch consumers using grocery delivery apps more than tripled to 700,000 between 2021 and January 2022, according to Wiemer. But as the four apps jostle for dark store space in residential areas so they can offer faster deliveries, complaints about noise, bikes blocking pavements, and increased traffic have become common across the country.

In Amsterdam, those complaints also accuse dark store staff of intimidation, sexual harassment, and starting physical fights, and the city’s residents are mobilizing to kick delivery apps out of their neighborhoods.

Fagelstraat has become the loudest example of a neighborhood mobilizing against a dark store. The street has drafted a petition and launched its own Instagram page to document the disturbance. A resident called Elisabeth says that one night last fall, when she told staff at the Fagelstraat Zapp dark store to keep the noise down, a person in a uniform—worn by both riders and warehouse staff—told her to stop complaining or he would send his friends around to her apartment. “They didn’t specify what they will do, but it’s obviously very threatening,” says Elisabeth. She describes being followed home several times late at night by people who later went inside Zapp’s dark store and says other female residents have complained about sexual harassment and catcalling.

Steve O’Hear, VP of strategy at Zapp, says the company has a zero-tolerance policy toward sexual harassment and that he was “surprised” to hear about the aggression between residents and drivers at the company’s Fagelstraat dark store. “We have met regularly with residents from the very beginning, and these conversations have largely remained cordial,” he says.

https://arstechnica.com/?p=1835312

Since filing whistleblower complaints against Facebook last year, Frances Haugen hasn’t been sitting still. A report today says the Facebook (now Meta) whistleblower has filed two new complaints with the Securities and Exchange Commission that allege the company internally acknowledged it was struggling with misinformation even while telling investors it had a handle on the problem.

Meta made “material misrepresentations and omissions in statements to investors” regarding its attempts to fight misinformation on its platforms, according to redacted complaints that a congressional staffer shared with The Washington Post and other news outlets.

“Some investors simply will not want to invest in a company that fails to adequately address such misinformation and then engages in misstatements and omissions on the topic,” one complaint says.

Haugen’s new complaints say that while Facebook/Meta executives trumpeted their efforts to tamp down misinformation about climate change and COVID in earnings calls and elsewhere, internally, the company knew it was falling short.

Recent discoveries

As recently as the first quarter of 2021, Facebook employees discovered that climate misinformation ranked high when they searched for “climate change” in the Watch tab on Facebook. The second result was “climate misinfo,” which had been viewed more than 6.6 million times, an employee wrote.

Facebook also allegedly knew that its own heavily promoted Climate Science Information Center was a flop despite a slew of press releases and money thrown at it. Even among people who had visited the page, internal documents said that awareness of it was “very low,” according to the complaint.

Perhaps that’s because the company doesn’t seem to follow its own best practices when managing the page. News links are only updated every few days and are buried over halfway down the page. Plus, navigation is done through a clunky horizontal scroll instead of an infinite vertical feed like the rest of the site. The page has no “about” section or details to suggest that Facebook itself is running the page. Even the title is awkwardly stylized as the “Climate science center.” (Based on that alone, if I had stumbled across the page—and I haven’t—I would have thought it was a one-off effort by some crusading individual.) The page also doesn’t show a public follower count, and Facebook hasn’t even bothered to give it a header image.

The page was officially renamed the Climate Science Center in September 2021. At the time, it had 3.8 million followers. While almost 4 million followers would make many brands happy, for a company the size of Meta, that’s peanuts. Companies generally don’t rename products that are wildly popular.

Facebook does place labels on climate change content and reduces the distribution of content that its fact-checking partners deem false. But it typically doesn’t remove posts, as it does with COVID misinformation.

Yet despite removing some COVID-related misinformation, the whistleblower complaints allege that Facebook/Meta hasn’t lived up to its public statements there, either. An internal Facebook survey found that a third of people in the US said they saw misinformation related to COVID and voting, the complaint says, and an April 2020 spike in misinformation reports from users was traced to the topic of COVID.

Creative approach

Using whistleblower complaints to address the misinformation problem is “creative,” Nathaniel Persily, a professor at Stanford Law School and director of the Stanford Cyber Policy Center, told The Washington Post. “You cannot pass a law in the US banning disinformation,” he said. “So what can you do? You can hold the platforms accountable to promises they make. Those promises could be made to users, to the government, to shareholders.”

The strategy could work, given many investors’ appetites for focusing on environmental, social, and governance investment strategies (so-called ESG investors). 

For years, the SEC has told publicly traded companies that they need to make clear and accurate disclosures, Jane Norberg, a partner at Arnold & Porter who recently ran the SEC’s whistleblower program, told the Post. “If the company says one thing to investors but internal documents show that what they were saying is untrue, that could be something the SEC would look at,” she said.

https://arstechnica.com/?p=1835209

Tesla is facing a new headache this week. The National Highway Traffic Safety Administration has opened an investigation into a “phantom braking” problem after receiving hundreds of complaints from owners of recent Models 3 and Y. In total, the NHTSA says that about 416,000 cars are affected.

In May 2021, Tesla decided to remove the forward-looking radar sensor from the Model 3 and Model Y EVs. This sensor was used by some of the cars’ advanced driver-assistance systems, like adaptive cruise control, forward collision warning, and automatic emergency braking.

Instead, new Teslas built for the North American market rely entirely on cameras. At the time of the removal, Tesla noted that the change meant the cars’ forward collision warning and automatic emergency braking functions were no longer rated by the NHTSA but that the company expected that rating to happen “in the coming weeks.”

In December 2021, the Insurance Institute for Highway Safety tested Tesla’s camera system and came away happy enough to award the Model Y a “Top Safety Pick+” rating. The NHTSA has yet to follow suit.

The move to an entirely camera-based approach for Tesla’s ADAS suite has not been without issues. Specifically, there have been problems with the automatic emergency braking function activating due to false positives caused by things like a shadow that the car interprets as an obstacle.

In November 2021, Tesla issued a recall for a phantom braking problem with its “Full Self-Driving (FSD) Beta” driver-assistance system. The recall affected nearly 12,000 Teslas—only those whose owners had paid for the FSD feature and been accepted into the beta testing program.

But the problem of phantom braking is not limited to the controversial FSD mode. In early February, The Washington Post reported on a growing number of complaints made to the NHTSA by Tesla owners, who told the agency about situations in which their cars slammed on the brakes at inappropriate times (for example, when driving at highway speed), mistakenly believing an obstacle was ahead.

The article in the Post caused something of a snowball effect; on Thursday, the Post reported that the NHTSA has received another 250 complaints from owners over the course of two weeks. Frequently, the complaints involved a scenario in which a large truck in the distance was driving toward a Tesla.

The number of complaints was evidently sufficient for the agency to open an inquiry; this will be its third open investigation into Tesla. The NHTSA has also been conducting an investigation into the propensity of earlier (radar-equipped) Teslas to crash into emergency vehicles and yet another into the automaker’s now-disabled feature that allowed occupants to play video games on the car’s infotainment screen while the vehicle was in motion.

https://arstechnica.com/?p=1835194

A lawyer for Tesla and CEO Elon Musk claimed in a court filing today that the US Securities and Exchange Commission is harassing the car company and Musk to “muzzle” his criticism of the government. The three-page letter from lawyer Alex Spiro to US District Judge Alison Nathan in New York said the SEC is “weaponizing” the 2018 settlement in which Tesla and Musk agreed to pay $20 million each in penalties to resolve the SEC’s complaint that “Musk’s misleading tweets” about taking Tesla private caused the stock price to jump “and led to significant market disruption.”

The settlement also required Tesla to impose controls on Musk’s social media statements. Musk had claimed on Twitter that he had “funding secured” to take Tesla private at $420 per share, but the SEC said in a lawsuit that “Musk had not even discussed, much less confirmed, key deal terms, including price, with any potential funding source.”

Today’s letter said:

[The SEC] has been weaponizing the consent decree by using it to try to muzzle and harass Mr. Musk and Tesla, while ignoring its Court-ordered duty to remit the $40 million that it continues to hold while Tesla’s shareholders continue to wait. Worst of all, the SEC seems to be targeting Mr. Musk and Tesla for unrelenting investigation largely because Mr. Musk remains an outspoken critic of the government; the SEC’s outsized efforts seem calculated to chill his exercise of First Amendment rights rather than to enforce generally applicable laws in evenhanded fashion.

Musk, the outspoken critic

The “outspoken critic of the government” line could refer to many Musk statements. Musk has used his Twitter account to criticize the SEC, for example, calling the SEC “the Shortseller Enrichment Commission” in October 2018 and writing in February 2019 that “something is broken with SEC oversight.” A July 2020 Musk tweet read, “SEC, three letter acronym, middle word is Elon’s.”

Musk recently called vaccine mandates an “erosion of freedom,” although he says he and his children are vaccinated against COVID. He also criticized shelter-in-place orders and defied a factory shutdown order early in the pandemic. Today, Musk tweeted a meme comparing Canadian Prime Minister Justin Trudeau to Adolf Hitler and later deleted the tweet.

But it is Musk’s tweets about Tesla’s finances and business that have repeatedly drawn condemnation from the SEC. Tesla said this month in an SEC filing that in November 2021, “the SEC issued a subpoena to us seeking information on our governance processes around compliance with the SEC settlement.”

That followed several instances in which the SEC alleged that Tesla failed to control Musk’s social media pronouncements. In a May 2020 letter to Tesla, the SEC reportedly said the company failed to enforce the settlement requirements “despite repeated violations by Mr. Musk” and that “Tesla has abdicated the duties required of it by the court’s order.”

Fines weren’t distributed to shareholders

The $40 million in fines over Musk’s tweets about Tesla are supposed to be “distributed to harmed investors under a court-approved process,” as the SEC explained in 2018. In today’s letter, Tesla said that “the SEC has failed to comply with its promise to pay Tesla’s shareholders the $40 million it collected as part of the settlement in these cases and that it purports to be holding for them. Instead, it has been devoting its formidable resources to endless, unfounded investigations into Mr. Musk and Tesla.”

Tesla asked the court to “schedule a conference to address why the SEC has failed to distribute these funds to shareholders but has chosen to spend its energy and resources investigating Mr. Musk’s and Tesla’s compliance with the consent decree by issuing subpoenas unilaterally, without Court approval.”

Tesla and Musk agreed to the 2018 consent decree in part because the $40 million would be distributed to shareholders and they “understood that settling with the SEC would at last end the SEC’s harassment and, importantly, make this Court, and not the SEC alone, the monitor over any perceived compliance issues going forward. But the SEC has broken its promises,” the letter claimed.

Although the SEC appointed a tax administrator and distribution agent for the funds, the agency “has yet to announce anything like a distribution plan. As such, the SEC has taken nearly twenty times longer than its specified outer limit,” Tesla said.

https://arstechnica.com/?p=1835047

The controversial facial recognition company Clearview AI reportedly told investors that it aims to collect 100 billion photos—supposedly enough to ensure that almost every human will be in its database.

“Clearview AI is telling investors it is on track to have 100 billion facial photos in its database within a year, enough to ensure ‘almost everyone in the world will be identifiable,’ according to a financial presentation from December obtained by The Washington Post,” the Post reported today. There are an estimated 7.9 billion people on the planet.

The December presentation was part of an effort to obtain new funding from investors, so 100 billion facial images is more of a goal than a firm plan. However, the presentation said that Clearview has already racked up 10 billion images and is adding 1.5 billion images a month, the Post wrote. Clearview told investors it needs another $50 million to hit its goal of 100 billion photos, the Post reported:

The company said that its “index of faces” has grown from 3 billion images to more than 10 billion since early 2020 and that its data collection system now ingests 1.5 billion images a month.

With $50 million from investors, the company said, it could bulk up its data collection powers to 100 billion photos, build new products, expand its international sales team and pay more toward lobbying government policymakers to “develop favorable regulation.”

Clearview collects photos from Internet

As the Post noted, “Clearview has built its database by taking images from social networks and other online sources without the consent of the websites or the people who were photographed. Facebook, Google, Twitter and YouTube have demanded the company stop taking photos from their sites and delete any that were previously taken. Clearview has argued its data collection is protected by the First Amendment.”

The increase in photos could be paired with an expanded business model. Clearview “wants to expand beyond scanning faces for the police, saying in the presentation that it could monitor ‘gig economy’ workers and is researching a number of new technologies that could identify someone based on how they walk, detect their location from a photo or scan their fingerprints from afar,” the Post wrote.

We contacted Clearview about the presentation and received a short statement from Clearview founder and CEO Hoan Ton-That. “Clearview AI’s database of publicly available images is lawfully collected, just like any other search engine, including Google. It is used by law enforcement for after-the-crime investigations to assist in identifying perpetrators of crimes,” he told Ars.

Ton-That told the Post that the company has collected photos from “millions of different websites” on the public Internet. Ton-That said the company hasn’t decided whether to sell its facial recognition service to nongovernment organizations.

Clearview “principles will be updated, as needed”

Clearview’s website includes a statement of principles. “Clearview AI currently offers its solutions to only one category of customer—government agencies and their agents,” the statement says. “It limits the uses of its system to agencies engaged in lawful investigative processes directed at criminal conduct, or at preventing specific, substantial, and imminent threats to people’s lives or physical safety.”

In his statement to the Post, Ton-That argued that “every photo in the data set is a potential clue that could save a life, provide justice to an innocent victim, prevent a wrongful identification, or exonerate an innocent person.” However, the company’s approach could change along with its business model. “Our principles reflect the current uses of our technology. If those uses change, the principles will be updated, as needed,” Ton-That said.

Twitter, Facebook, and YouTube ordered Clearview AI to stop scraping their sites in early 2020. Police used Clearview technology to identify and arrest people accused of violence or destruction of property during Black Lives Matter protests later that year. After the January 6, 2021, attack on the US Capitol, Ton-That, said, “it is gratifying that Clearview AI has been used to identify the Capitol rioters who attacked our great symbol of democracy.”

Clearview lost court ruling

Clearview is facing various privacy lawsuits and lost an important ruling Monday in a case over whether the company violated the Illinois Biometric Information Privacy Act by collecting and using facial images without people’s consent. A federal judge “rejected Clearview’s First Amendment defense, denied the company’s motion to dismiss, and allowed the lawsuits to move forward,” the Electronic Frontier Foundation wrote yesterday. “This is an important victory for our privacy over Clearview’s profits.”

A Vice report yesterday quoted Ton-That as saying that Airbnb, Lyft, and Uber have “expressed interest” in using Clearview facial recognition “for the purposes of consent-based identity verification, since there are a lot of issues with crimes that happen on their platforms.” However, Ton-That said, “there are no current plans to work with” those companies, and all three companies told Vice that they have no plans to use Clearview.

https://arstechnica.com/?p=1834910

The Federal Communications Commission has voted to ban the exclusive revenue-sharing deals between landlords and Internet service providers that prevent broadband competition in apartment buildings and other multi-tenant environments. The new ban and other rule changes were adopted in a 4-0 vote announced yesterday.

Although the FCC “has long banned Internet service providers from entering into sweetheart deals with landlords that guarantee they are the only provider in the building,” evidence submitted to the commission “made it clear that our existing rules are not doing enough and that we can do more to pry open the door for providers who want to offer competitive service in apartment buildings,” FCC Chairwoman Jessica Rosenworcel said in her statement on the vote. The broadband industry has sidestepped rules that already exist with “a complex web of agreements between incumbent service providers and landlords that keep out competitors and undermine choice,” she said.

With the new rules, “we ban exclusive revenue sharing agreements, where the provider agrees with the building that only it and no other provider can give the building owner a cut of the revenue from the building. We also ban graduated revenue sharing agreements, which increase the percentage of revenue that the broadband provider directs to the landlord as the number of tenants served by the provider go up,” Rosenworcel said. Rosenworcel had circulated the proposal to commissioners in late January.

Ban invalidates existing agreements

The new prohibitions on graduated and exclusive revenue-sharing agreements apply retroactively. “The rules we adopt thus prohibit providers from (1) executing new graduated or exclusive revenue sharing agreements and (2) enforcing existing graduated or exclusive revenue sharing agreements on a going forward basis,” the FCC said.

Exclusive marketing agreements are still allowed, but the FCC is requiring broadband providers to disclose those agreements to tenants. “Such disclosure must be included on all written marketing material directed at tenants or prospective tenants of an MTE [multiple tenant environment] subject to the arrangement and must explain in clear, conspicuous, legible, and visible language that the provider has the right to exclusively market its communications services to tenants in the MTE, that such a right does not suggest that the provider is the only entity that can provide communications services to tenants in the MTE, and that service from an alternative provider may be available,” the FCC order said.

The FCC vote also closes a loophole that ISPs used to enter into exclusive wiring deals with landlords. “We clarify that sale-and-leaseback arrangements violate our existing rules that regulate cable wiring inside buildings,” Rosenworcel said. “Since the 1990s, we have had rules that allow buildings and tenants to exercise choice about how to use the wiring in the building when they are switching cable providers, but some companies have circumvented these rules by selling the wiring to the building and leasing it back on an exclusive basis. We put an end to that practice today.”

https://arstechnica.com/?p=1834774

The San Francisco Police Department’s crime lab has been checking DNA collected from sexual assault victims to determine whether any of the victims committed a crime, according to District Attorney Chesa Boudin, who called for an immediate end to the alleged practice.

“The crime lab attempts to identify crime suspects by searching a database of DNA evidence that contains DNA collected from rape and sexual assault victims,” Boudin’s office said in a press release yesterday. Boudin’s release denounced the alleged “practice of using rape and sexual assault victims’ DNA to attempt to subsequently incriminate them.”

“Boudin said his office was made aware of the purported practice last week, after a woman’s DNA collected years ago as part of a rape exam was used to link her to a recent property crime,” the San Francisco Chronicle reported yesterday. The woman “was recently arrested on suspicion of a felony property crime, with police identifying her based on the rape-kit evidence she gave as a victim, Boudin said.” That was the only example provided, and Boudin gave few details about the case to protect the woman’s privacy. But the database may include “thousands of victims’ DNA profiles, with entries over ‘many, many years,’ Boudin said,” according to the Chronicle.

“We should encourage survivors to come forward—not collect evidence to use against them in the future. This practice treats victims like evidence, not human beings. This is legally and ethically wrong,” Boudin said.

Separately, Boudin is facing a recall election in June over allegations that he hasn’t been tough enough on crime.

Police chief announces investigation

San Francisco Police Chief Bill Scott said the department will investigate and that he is “committed to ending the practice” if Boudin’s allegation is accurate. But Scott also said the suspect cited by Boudin may have been identified from a different DNA database.

“We will immediately begin reviewing our DNA collection practices and policies… Although I am informed of the possibility that the suspect in this case may have been identified through a DNA hit in a non-victim DNA database, I think the questions raised by our district attorney today are sufficiently concerning that I have asked my assistant chief for operations to work with our Investigations Bureau to thoroughly review the matter and report back to me and to our DA’s office partners,” Scott said in a statement published by KRON 4.

Scott also said, “I am informed that our existing DNA collection policies have been legally vetted and conform with state and national forensic standards,” but he noted that “there are many important principles for which the San Francisco Police Department stands that go beyond state and national standards.”

“We must never create disincentives for crime victims to cooperate with police, and if it’s true that DNA collected from a rape or sexual assault victim has been used by SFPD to identify and apprehend that person as a suspect in another crime, I’m committed to ending the practice,” Scott said.

Local lawmakers plan legislation

During examinations of people reporting sexual assaults, “biological evidence from bodily fluids, fingernail scrapings, and bite and scratch marks is collected from the victim’s body,” Boudin’s announcement explained. “The victim submits their own DNA sample in order to exclude DNA that comes from the victim, as opposed to the suspect.”

State Senator Scott Wiener (D-San Francisco) and District 9 Supervisor Hillary Ronen are planning legislation at both the state and city level to stop the alleged misuse of DNA and are both quoted in Boudin’s announcement. Wiener said that “if survivors believe their DNA may end up being used against them in the future, they’ll have one more reason not to participate in the rape kit process. That’s why I’m working with the DA’s office to address this problem through state legislation, if needed.”

Despite the plan for legislation, Boudin said the crime lab’s alleged practice may already be illegal. “If DNA from a rape kit was used without consent for purposes other than investigating the underlying rape case, it may be a violation of constitutional protections against unreasonable searches and seizures as well as California’s Victims’ Bill of Rights, Boudin said,” according to the San Francisco Chronicle article.

Women’s groups slam use of DNA

Women’s groups spoke out against the alleged use of victims’ DNA. Rape exams should not be “used to self-incriminate past survivors of sexual assault and rape,” Pamela Tate, co-executive director of Black Women Revolt Against Domestic Violence, said in Boudin’s press release. “Rape survivors do not give law enforcement a blanket waiver of their rights to not self-incriminate. This type of misrepresentation will have a chilling effect to Black women and women of color in reporting crimes of sexual assault.”

Orchid Pusey, executive director of the Asian Women’s Shelter, said, “It can be especially frightening for crime survivors who are immigrants or non-native English speakers to come forward to report a crime like domestic violence or sexual assault.”

“Using DNA evidence from a survivor’s most vulnerable moments to investigate her years later abuses trust and discourages future survivors’ reporting and participation,” she said.

https://arstechnica.com/?p=1834500

A former high-level IBM executive wrote an internal message calling older workers “dinobabies” who should go “extinct,” according to a plaintiff’s filing in an age-discrimination lawsuit against IBM.

“In arbitration, Plaintiff’s counsel have obtained evidence showing high level executive communications demonstrating highly incriminating animus against older workers by” two former IBM executives who left the company in 2020, said the court filing submitted on Friday. The executives’ names and their positions were redacted. In one communication, an executive “applauds the use of the disparaging term ‘dinobabies’ to describe the older IBM employees” and described a “plan to oust them from IBM‟s workforce,” the court filing said.

In the message, “he describes his plan to ‘accelerate change by inviting the “dinobabies” (new species) to leave’ and make them an ‘Extinct species,'” the filing said. “In another email, [name redacted] describes IBM’s ‘dated maternal workforce—this is what must change. They really don’t understand social or engagement. Not digital natives. A real threat for us,'” the filing said.

“In one email, [name redacted] warns her team: ‘I’m sure you all know this but as a reminder, keep data on age very limited and when in doubt check with legal,'” the filing said.

“Age animus from IBM’s highest ranks”

The new filing was made to support a motion for summary judgment by plaintiff Denise Lohnn, who filed the lawsuit against IBM in July 2021 in US District Court for the Southern District of New York. Denise Lohnn is executor of the estate of her deceased husband, Jorgen Lohnn, who committed suicide after being laid off by IBM.

Evidence from the internal communications “reflects age animus from IBM’s highest ranks,” Lohnn’s filing alleged. Ginni Rometty was IBM’s CEO during the time period discussed in the filing. Rometty retired at the end of 2020 and was replaced by Arvind Krishna.

IBM: Dinobabies comment “does not reflect company practices”

IBM provided a statement to Ars that said, “Some language in emails between former IBM executives that has been reported is not consistent with the respect IBM has for its employees and as the facts clearly show, it does not reflect company practices or policies.” A New York Times article about the “dinobabies” email quotes an IBM spokesperson as saying that “employees were separated because of shifts in business conditions and demand for certain skills, not because of their age.”

IBM also defended its hiring practices in a memo yesterday to all employees from Chief Human Resources Officer Nickle LaMoreaux.

“The facts are clear: between 2010 and 2020, IBM exited whole lines of business and reinvented itself for an entirely new era of technology and the skills it requires. Amidst those significant changes, IBM never engaged in systemic age discrimination,” the memo said.

Between 2010 and 2020, according to yesterday’s memo, “37 percent of all US hires at IBM were over the age of 40” and “IBM hired more than 10,000 people in the US over the age of 50 and 1,500 over the age of 60.” In 2020, “26 percent of IBM’s US workforce had been with the company for 20 years or more,” and the “median age of IBM’s US workforce was 48, precisely where it was in 2010 and six years older than the 2020 median age of all US workers,” IBM said.

https://arstechnica.com/?p=1834269

A Cole County prosecutor has rebuffed Missouri Gov. Mike Parson’s request to file criminal charges against a St. Louis Post-Dispatch reporter who identified a major security flaw in a government website by viewing publicly available HTML code.

Post-Dispatch reporter Josh Renaud had been facing the threat of prosecution since his discovery that the state website’s HTML source code exposed the full Social Security numbers of teachers and other school employees in unencrypted form. Renaud merely viewed the website’s HTML and converted the Social Security numbers into plain text, and he gave the state time to close the gaping security hole before publishing his findings. Despite Renaud helping the state improve its security, Parson called the journalist a “hacker,” sought criminal charges, and threatened a civil suit.

On Friday, Cole County Prosecutor Locke Thompson issued a statement saying he has closed the investigation without charges:

There is an argument to be made that there was a violation of law. However, upon a review of the case file, the issues at the heart of the investigation have been resolved through non-legal means. As such, it is not in the best interest of Cole County citizens to utilize the significant resources and taxpayer dollars that would be necessary to pursue misdemeanor criminal charges in this case. The investigation is now closed, and the Cole County Prosecutor’s Office will have no further comment on the matter.

As the county’s prosecuting attorney, Thompson is an elected official. Thompson and Parson are both Republicans.

Governor still insists reporter committed crime

Gov. Parson’s office continues to insist that the journalist committed a crime. “The hacking of Missouri teachers’ personally identifiable information is a clear violation of Section 569.095, which the state takes seriously. The state did its part by investigating and presenting its findings to the Cole County Prosecutor, who has elected not to press charges, as is his prerogative,” the governor’s office said in a statement to Missourinet.

Normally, an organization notified of a security flaw would thank the person who reported it. Missouri state government officials did in fact plan to publicly thank Renaud in a press release, according to internal emails published by the Post-Dispatch in December.

But that draft of the press release was scrapped as the governor insisted on calling Renaud a hacker and demanding a criminal investigation. “It is unlawful to access encoded data and systems in order to examine other people’s personal information, and we are coordinating state resources to respond and utilize all legal methods available,” Parson said in October. In addition to announcing that his “administration notified the Cole County prosecutor of this matter,” Parson said that state law “allows us to bring a civil suit to recover damages against all those involved.” No civil suit has been filed.

Thompson’s decision to close the investigation came about seven weeks after the Missouri Highway Patrol finished its report on the incident.

https://arstechnica.com/?p=1834032